]>
Commit | Line | Data |
---|---|---|
ab198edb PK |
1 | diff -urNp linux-3.0.3/arch/alpha/include/asm/elf.h linux-3.0.3/arch/alpha/include/asm/elf.h |
2 | --- linux-3.0.3/arch/alpha/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
3 | +++ linux-3.0.3/arch/alpha/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
4 | @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N | |
5 | ||
6 | #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000) | |
7 | ||
8 | +#ifdef CONFIG_PAX_ASLR | |
9 | +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL) | |
10 | + | |
11 | +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28) | |
12 | +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19) | |
13 | +#endif | |
14 | + | |
15 | /* $0 is set by ld.so to a pointer to a function which might be | |
16 | registered using atexit. This provides a mean for the dynamic | |
17 | linker to call DT_FINI functions for shared libraries that have | |
18 | diff -urNp linux-3.0.3/arch/alpha/include/asm/pgtable.h linux-3.0.3/arch/alpha/include/asm/pgtable.h | |
19 | --- linux-3.0.3/arch/alpha/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
20 | +++ linux-3.0.3/arch/alpha/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400 | |
21 | @@ -101,6 +101,17 @@ struct vm_area_struct; | |
22 | #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS) | |
23 | #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW) | |
24 | #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW) | |
25 | + | |
26 | +#ifdef CONFIG_PAX_PAGEEXEC | |
27 | +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE) | |
28 | +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE) | |
29 | +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE) | |
30 | +#else | |
31 | +# define PAGE_SHARED_NOEXEC PAGE_SHARED | |
32 | +# define PAGE_COPY_NOEXEC PAGE_COPY | |
33 | +# define PAGE_READONLY_NOEXEC PAGE_READONLY | |
34 | +#endif | |
35 | + | |
36 | #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE) | |
37 | ||
38 | #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x)) | |
39 | diff -urNp linux-3.0.3/arch/alpha/kernel/module.c linux-3.0.3/arch/alpha/kernel/module.c | |
40 | --- linux-3.0.3/arch/alpha/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
41 | +++ linux-3.0.3/arch/alpha/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
42 | @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, | |
43 | ||
44 | /* The small sections were sorted to the end of the segment. | |
45 | The following should definitely cover them. */ | |
46 | - gp = (u64)me->module_core + me->core_size - 0x8000; | |
47 | + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000; | |
48 | got = sechdrs[me->arch.gotsecindex].sh_addr; | |
49 | ||
50 | for (i = 0; i < n; i++) { | |
51 | diff -urNp linux-3.0.3/arch/alpha/kernel/osf_sys.c linux-3.0.3/arch/alpha/kernel/osf_sys.c | |
52 | --- linux-3.0.3/arch/alpha/kernel/osf_sys.c 2011-07-21 22:17:23.000000000 -0400 | |
53 | +++ linux-3.0.3/arch/alpha/kernel/osf_sys.c 2011-08-23 21:47:55.000000000 -0400 | |
54 | @@ -1145,7 +1145,7 @@ arch_get_unmapped_area_1(unsigned long a | |
55 | /* At this point: (!vma || addr < vma->vm_end). */ | |
56 | if (limit - len < addr) | |
57 | return -ENOMEM; | |
58 | - if (!vma || addr + len <= vma->vm_start) | |
59 | + if (check_heap_stack_gap(vma, addr, len)) | |
60 | return addr; | |
61 | addr = vma->vm_end; | |
62 | vma = vma->vm_next; | |
63 | @@ -1181,6 +1181,10 @@ arch_get_unmapped_area(struct file *filp | |
64 | merely specific addresses, but regions of memory -- perhaps | |
65 | this feature should be incorporated into all ports? */ | |
66 | ||
67 | +#ifdef CONFIG_PAX_RANDMMAP | |
68 | + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP)) | |
69 | +#endif | |
70 | + | |
71 | if (addr) { | |
72 | addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit); | |
73 | if (addr != (unsigned long) -ENOMEM) | |
74 | @@ -1188,8 +1192,8 @@ arch_get_unmapped_area(struct file *filp | |
75 | } | |
76 | ||
77 | /* Next, try allocating at TASK_UNMAPPED_BASE. */ | |
78 | - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE), | |
79 | - len, limit); | |
80 | + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit); | |
81 | + | |
82 | if (addr != (unsigned long) -ENOMEM) | |
83 | return addr; | |
84 | ||
85 | diff -urNp linux-3.0.3/arch/alpha/mm/fault.c linux-3.0.3/arch/alpha/mm/fault.c | |
86 | --- linux-3.0.3/arch/alpha/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
87 | +++ linux-3.0.3/arch/alpha/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
88 | @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct * | |
89 | __reload_thread(pcb); | |
90 | } | |
91 | ||
92 | +#ifdef CONFIG_PAX_PAGEEXEC | |
93 | +/* | |
94 | + * PaX: decide what to do with offenders (regs->pc = fault address) | |
95 | + * | |
96 | + * returns 1 when task should be killed | |
97 | + * 2 when patched PLT trampoline was detected | |
98 | + * 3 when unpatched PLT trampoline was detected | |
99 | + */ | |
100 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
101 | +{ | |
102 | + | |
103 | +#ifdef CONFIG_PAX_EMUPLT | |
104 | + int err; | |
105 | + | |
106 | + do { /* PaX: patched PLT emulation #1 */ | |
107 | + unsigned int ldah, ldq, jmp; | |
108 | + | |
109 | + err = get_user(ldah, (unsigned int *)regs->pc); | |
110 | + err |= get_user(ldq, (unsigned int *)(regs->pc+4)); | |
111 | + err |= get_user(jmp, (unsigned int *)(regs->pc+8)); | |
112 | + | |
113 | + if (err) | |
114 | + break; | |
115 | + | |
116 | + if ((ldah & 0xFFFF0000U) == 0x277B0000U && | |
117 | + (ldq & 0xFFFF0000U) == 0xA77B0000U && | |
118 | + jmp == 0x6BFB0000U) | |
119 | + { | |
120 | + unsigned long r27, addr; | |
121 | + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16; | |
122 | + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL; | |
123 | + | |
124 | + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL); | |
125 | + err = get_user(r27, (unsigned long *)addr); | |
126 | + if (err) | |
127 | + break; | |
128 | + | |
129 | + regs->r27 = r27; | |
130 | + regs->pc = r27; | |
131 | + return 2; | |
132 | + } | |
133 | + } while (0); | |
134 | + | |
135 | + do { /* PaX: patched PLT emulation #2 */ | |
136 | + unsigned int ldah, lda, br; | |
137 | + | |
138 | + err = get_user(ldah, (unsigned int *)regs->pc); | |
139 | + err |= get_user(lda, (unsigned int *)(regs->pc+4)); | |
140 | + err |= get_user(br, (unsigned int *)(regs->pc+8)); | |
141 | + | |
142 | + if (err) | |
143 | + break; | |
144 | + | |
145 | + if ((ldah & 0xFFFF0000U) == 0x277B0000U && | |
146 | + (lda & 0xFFFF0000U) == 0xA77B0000U && | |
147 | + (br & 0xFFE00000U) == 0xC3E00000U) | |
148 | + { | |
149 | + unsigned long addr = br | 0xFFFFFFFFFFE00000UL; | |
150 | + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16; | |
151 | + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL; | |
152 | + | |
153 | + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL); | |
154 | + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2); | |
155 | + return 2; | |
156 | + } | |
157 | + } while (0); | |
158 | + | |
159 | + do { /* PaX: unpatched PLT emulation */ | |
160 | + unsigned int br; | |
161 | + | |
162 | + err = get_user(br, (unsigned int *)regs->pc); | |
163 | + | |
164 | + if (!err && (br & 0xFFE00000U) == 0xC3800000U) { | |
165 | + unsigned int br2, ldq, nop, jmp; | |
166 | + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver; | |
167 | + | |
168 | + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2); | |
169 | + err = get_user(br2, (unsigned int *)addr); | |
170 | + err |= get_user(ldq, (unsigned int *)(addr+4)); | |
171 | + err |= get_user(nop, (unsigned int *)(addr+8)); | |
172 | + err |= get_user(jmp, (unsigned int *)(addr+12)); | |
173 | + err |= get_user(resolver, (unsigned long *)(addr+16)); | |
174 | + | |
175 | + if (err) | |
176 | + break; | |
177 | + | |
178 | + if (br2 == 0xC3600000U && | |
179 | + ldq == 0xA77B000CU && | |
180 | + nop == 0x47FF041FU && | |
181 | + jmp == 0x6B7B0000U) | |
182 | + { | |
183 | + regs->r28 = regs->pc+4; | |
184 | + regs->r27 = addr+16; | |
185 | + regs->pc = resolver; | |
186 | + return 3; | |
187 | + } | |
188 | + } | |
189 | + } while (0); | |
190 | +#endif | |
191 | + | |
192 | + return 1; | |
193 | +} | |
194 | + | |
195 | +void pax_report_insns(void *pc, void *sp) | |
196 | +{ | |
197 | + unsigned long i; | |
198 | + | |
199 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
200 | + for (i = 0; i < 5; i++) { | |
201 | + unsigned int c; | |
202 | + if (get_user(c, (unsigned int *)pc+i)) | |
203 | + printk(KERN_CONT "???????? "); | |
204 | + else | |
205 | + printk(KERN_CONT "%08x ", c); | |
206 | + } | |
207 | + printk("\n"); | |
208 | +} | |
209 | +#endif | |
210 | ||
211 | /* | |
212 | * This routine handles page faults. It determines the address, | |
213 | @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns | |
214 | good_area: | |
215 | si_code = SEGV_ACCERR; | |
216 | if (cause < 0) { | |
217 | - if (!(vma->vm_flags & VM_EXEC)) | |
218 | + if (!(vma->vm_flags & VM_EXEC)) { | |
219 | + | |
220 | +#ifdef CONFIG_PAX_PAGEEXEC | |
221 | + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc) | |
222 | + goto bad_area; | |
223 | + | |
224 | + up_read(&mm->mmap_sem); | |
225 | + switch (pax_handle_fetch_fault(regs)) { | |
226 | + | |
227 | +#ifdef CONFIG_PAX_EMUPLT | |
228 | + case 2: | |
229 | + case 3: | |
230 | + return; | |
231 | +#endif | |
232 | + | |
233 | + } | |
234 | + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp()); | |
235 | + do_group_exit(SIGKILL); | |
236 | +#else | |
237 | goto bad_area; | |
238 | +#endif | |
239 | + | |
240 | + } | |
241 | } else if (!cause) { | |
242 | /* Allow reads even for write-only mappings */ | |
243 | if (!(vma->vm_flags & (VM_READ | VM_WRITE))) | |
244 | diff -urNp linux-3.0.3/arch/arm/include/asm/elf.h linux-3.0.3/arch/arm/include/asm/elf.h | |
245 | --- linux-3.0.3/arch/arm/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
246 | +++ linux-3.0.3/arch/arm/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
247 | @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t | |
248 | the loader. We need to make sure that it is out of the way of the program | |
249 | that it will "exec", and that there is sufficient room for the brk. */ | |
250 | ||
251 | -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) | |
252 | +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) | |
253 | + | |
254 | +#ifdef CONFIG_PAX_ASLR | |
255 | +#define PAX_ELF_ET_DYN_BASE 0x00008000UL | |
256 | + | |
257 | +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10) | |
258 | +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10) | |
259 | +#endif | |
260 | ||
261 | /* When the program starts, a1 contains a pointer to a function to be | |
262 | registered with atexit, as per the SVR4 ABI. A value of 0 means we | |
263 | @@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t | |
264 | extern void elf_set_personality(const struct elf32_hdr *); | |
265 | #define SET_PERSONALITY(ex) elf_set_personality(&(ex)) | |
266 | ||
267 | -struct mm_struct; | |
268 | -extern unsigned long arch_randomize_brk(struct mm_struct *mm); | |
269 | -#define arch_randomize_brk arch_randomize_brk | |
270 | - | |
271 | extern int vectors_user_mapping(void); | |
272 | #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping() | |
273 | #define ARCH_HAS_SETUP_ADDITIONAL_PAGES | |
274 | diff -urNp linux-3.0.3/arch/arm/include/asm/kmap_types.h linux-3.0.3/arch/arm/include/asm/kmap_types.h | |
275 | --- linux-3.0.3/arch/arm/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
276 | +++ linux-3.0.3/arch/arm/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400 | |
277 | @@ -21,6 +21,7 @@ enum km_type { | |
278 | KM_L1_CACHE, | |
279 | KM_L2_CACHE, | |
280 | KM_KDB, | |
281 | + KM_CLEARPAGE, | |
282 | KM_TYPE_NR | |
283 | }; | |
284 | ||
285 | diff -urNp linux-3.0.3/arch/arm/include/asm/uaccess.h linux-3.0.3/arch/arm/include/asm/uaccess.h | |
286 | --- linux-3.0.3/arch/arm/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
287 | +++ linux-3.0.3/arch/arm/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
288 | @@ -22,6 +22,8 @@ | |
289 | #define VERIFY_READ 0 | |
290 | #define VERIFY_WRITE 1 | |
291 | ||
292 | +extern void check_object_size(const void *ptr, unsigned long n, bool to); | |
293 | + | |
294 | /* | |
295 | * The exception table consists of pairs of addresses: the first is the | |
296 | * address of an instruction that is allowed to fault, and the second is | |
297 | @@ -387,8 +389,23 @@ do { \ | |
298 | ||
299 | ||
300 | #ifdef CONFIG_MMU | |
301 | -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n); | |
302 | -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n); | |
303 | +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n); | |
304 | +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n); | |
305 | + | |
306 | +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n) | |
307 | +{ | |
308 | + if (!__builtin_constant_p(n)) | |
309 | + check_object_size(to, n, false); | |
310 | + return ___copy_from_user(to, from, n); | |
311 | +} | |
312 | + | |
313 | +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n) | |
314 | +{ | |
315 | + if (!__builtin_constant_p(n)) | |
316 | + check_object_size(from, n, true); | |
317 | + return ___copy_to_user(to, from, n); | |
318 | +} | |
319 | + | |
320 | extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n); | |
321 | extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n); | |
322 | extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n); | |
323 | @@ -403,6 +420,9 @@ extern unsigned long __must_check __strn | |
324 | ||
325 | static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) | |
326 | { | |
327 | + if ((long)n < 0) | |
328 | + return n; | |
329 | + | |
330 | if (access_ok(VERIFY_READ, from, n)) | |
331 | n = __copy_from_user(to, from, n); | |
332 | else /* security hole - plug it */ | |
333 | @@ -412,6 +432,9 @@ static inline unsigned long __must_check | |
334 | ||
335 | static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) | |
336 | { | |
337 | + if ((long)n < 0) | |
338 | + return n; | |
339 | + | |
340 | if (access_ok(VERIFY_WRITE, to, n)) | |
341 | n = __copy_to_user(to, from, n); | |
342 | return n; | |
343 | diff -urNp linux-3.0.3/arch/arm/kernel/armksyms.c linux-3.0.3/arch/arm/kernel/armksyms.c | |
344 | --- linux-3.0.3/arch/arm/kernel/armksyms.c 2011-07-21 22:17:23.000000000 -0400 | |
345 | +++ linux-3.0.3/arch/arm/kernel/armksyms.c 2011-08-23 21:47:55.000000000 -0400 | |
346 | @@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user); | |
347 | #ifdef CONFIG_MMU | |
348 | EXPORT_SYMBOL(copy_page); | |
349 | ||
350 | -EXPORT_SYMBOL(__copy_from_user); | |
351 | -EXPORT_SYMBOL(__copy_to_user); | |
352 | +EXPORT_SYMBOL(___copy_from_user); | |
353 | +EXPORT_SYMBOL(___copy_to_user); | |
354 | EXPORT_SYMBOL(__clear_user); | |
355 | ||
356 | EXPORT_SYMBOL(__get_user_1); | |
357 | diff -urNp linux-3.0.3/arch/arm/kernel/process.c linux-3.0.3/arch/arm/kernel/process.c | |
358 | --- linux-3.0.3/arch/arm/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
359 | +++ linux-3.0.3/arch/arm/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
360 | @@ -28,7 +28,6 @@ | |
361 | #include <linux/tick.h> | |
362 | #include <linux/utsname.h> | |
363 | #include <linux/uaccess.h> | |
364 | -#include <linux/random.h> | |
365 | #include <linux/hw_breakpoint.h> | |
366 | ||
367 | #include <asm/cacheflush.h> | |
368 | @@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru | |
369 | return 0; | |
370 | } | |
371 | ||
372 | -unsigned long arch_randomize_brk(struct mm_struct *mm) | |
373 | -{ | |
374 | - unsigned long range_end = mm->brk + 0x02000000; | |
375 | - return randomize_range(mm->brk, range_end, 0) ? : mm->brk; | |
376 | -} | |
377 | - | |
378 | #ifdef CONFIG_MMU | |
379 | /* | |
380 | * The vectors page is always readable from user space for the | |
381 | diff -urNp linux-3.0.3/arch/arm/kernel/traps.c linux-3.0.3/arch/arm/kernel/traps.c | |
382 | --- linux-3.0.3/arch/arm/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400 | |
383 | +++ linux-3.0.3/arch/arm/kernel/traps.c 2011-08-23 21:48:14.000000000 -0400 | |
384 | @@ -257,6 +257,8 @@ static int __die(const char *str, int er | |
385 | ||
386 | static DEFINE_SPINLOCK(die_lock); | |
387 | ||
388 | +extern void gr_handle_kernel_exploit(void); | |
389 | + | |
390 | /* | |
391 | * This function is protected against re-entrancy. | |
392 | */ | |
393 | @@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs | |
394 | panic("Fatal exception in interrupt"); | |
395 | if (panic_on_oops) | |
396 | panic("Fatal exception"); | |
397 | + | |
398 | + gr_handle_kernel_exploit(); | |
399 | + | |
400 | if (ret != NOTIFY_STOP) | |
401 | do_exit(SIGSEGV); | |
402 | } | |
403 | diff -urNp linux-3.0.3/arch/arm/lib/copy_from_user.S linux-3.0.3/arch/arm/lib/copy_from_user.S | |
404 | --- linux-3.0.3/arch/arm/lib/copy_from_user.S 2011-07-21 22:17:23.000000000 -0400 | |
405 | +++ linux-3.0.3/arch/arm/lib/copy_from_user.S 2011-08-23 21:47:55.000000000 -0400 | |
406 | @@ -16,7 +16,7 @@ | |
407 | /* | |
408 | * Prototype: | |
409 | * | |
410 | - * size_t __copy_from_user(void *to, const void *from, size_t n) | |
411 | + * size_t ___copy_from_user(void *to, const void *from, size_t n) | |
412 | * | |
413 | * Purpose: | |
414 | * | |
415 | @@ -84,11 +84,11 @@ | |
416 | ||
417 | .text | |
418 | ||
419 | -ENTRY(__copy_from_user) | |
420 | +ENTRY(___copy_from_user) | |
421 | ||
422 | #include "copy_template.S" | |
423 | ||
424 | -ENDPROC(__copy_from_user) | |
425 | +ENDPROC(___copy_from_user) | |
426 | ||
427 | .pushsection .fixup,"ax" | |
428 | .align 0 | |
429 | diff -urNp linux-3.0.3/arch/arm/lib/copy_to_user.S linux-3.0.3/arch/arm/lib/copy_to_user.S | |
430 | --- linux-3.0.3/arch/arm/lib/copy_to_user.S 2011-07-21 22:17:23.000000000 -0400 | |
431 | +++ linux-3.0.3/arch/arm/lib/copy_to_user.S 2011-08-23 21:47:55.000000000 -0400 | |
432 | @@ -16,7 +16,7 @@ | |
433 | /* | |
434 | * Prototype: | |
435 | * | |
436 | - * size_t __copy_to_user(void *to, const void *from, size_t n) | |
437 | + * size_t ___copy_to_user(void *to, const void *from, size_t n) | |
438 | * | |
439 | * Purpose: | |
440 | * | |
441 | @@ -88,11 +88,11 @@ | |
442 | .text | |
443 | ||
444 | ENTRY(__copy_to_user_std) | |
445 | -WEAK(__copy_to_user) | |
446 | +WEAK(___copy_to_user) | |
447 | ||
448 | #include "copy_template.S" | |
449 | ||
450 | -ENDPROC(__copy_to_user) | |
451 | +ENDPROC(___copy_to_user) | |
452 | ENDPROC(__copy_to_user_std) | |
453 | ||
454 | .pushsection .fixup,"ax" | |
455 | diff -urNp linux-3.0.3/arch/arm/lib/uaccess.S linux-3.0.3/arch/arm/lib/uaccess.S | |
456 | --- linux-3.0.3/arch/arm/lib/uaccess.S 2011-07-21 22:17:23.000000000 -0400 | |
457 | +++ linux-3.0.3/arch/arm/lib/uaccess.S 2011-08-23 21:47:55.000000000 -0400 | |
458 | @@ -20,7 +20,7 @@ | |
459 | ||
460 | #define PAGE_SHIFT 12 | |
461 | ||
462 | -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n) | |
463 | +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n) | |
464 | * Purpose : copy a block to user memory from kernel memory | |
465 | * Params : to - user memory | |
466 | * : from - kernel memory | |
467 | @@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May f | |
468 | sub r2, r2, ip | |
469 | b .Lc2u_dest_aligned | |
470 | ||
471 | -ENTRY(__copy_to_user) | |
472 | +ENTRY(___copy_to_user) | |
473 | stmfd sp!, {r2, r4 - r7, lr} | |
474 | cmp r2, #4 | |
475 | blt .Lc2u_not_enough | |
476 | @@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May f | |
477 | ldrgtb r3, [r1], #0 | |
478 | USER( T(strgtb) r3, [r0], #1) @ May fault | |
479 | b .Lc2u_finished | |
480 | -ENDPROC(__copy_to_user) | |
481 | +ENDPROC(___copy_to_user) | |
482 | ||
483 | .pushsection .fixup,"ax" | |
484 | .align 0 | |
485 | 9001: ldmfd sp!, {r0, r4 - r7, pc} | |
486 | .popsection | |
487 | ||
488 | -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n); | |
489 | +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n); | |
490 | * Purpose : copy a block from user memory to kernel memory | |
491 | * Params : to - kernel memory | |
492 | * : from - user memory | |
493 | @@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May f | |
494 | sub r2, r2, ip | |
495 | b .Lcfu_dest_aligned | |
496 | ||
497 | -ENTRY(__copy_from_user) | |
498 | +ENTRY(___copy_from_user) | |
499 | stmfd sp!, {r0, r2, r4 - r7, lr} | |
500 | cmp r2, #4 | |
501 | blt .Lcfu_not_enough | |
502 | @@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May f | |
503 | USER( T(ldrgtb) r3, [r1], #1) @ May fault | |
504 | strgtb r3, [r0], #1 | |
505 | b .Lcfu_finished | |
506 | -ENDPROC(__copy_from_user) | |
507 | +ENDPROC(___copy_from_user) | |
508 | ||
509 | .pushsection .fixup,"ax" | |
510 | .align 0 | |
511 | diff -urNp linux-3.0.3/arch/arm/lib/uaccess_with_memcpy.c linux-3.0.3/arch/arm/lib/uaccess_with_memcpy.c | |
512 | --- linux-3.0.3/arch/arm/lib/uaccess_with_memcpy.c 2011-07-21 22:17:23.000000000 -0400 | |
513 | +++ linux-3.0.3/arch/arm/lib/uaccess_with_memcpy.c 2011-08-23 21:47:55.000000000 -0400 | |
514 | @@ -103,7 +103,7 @@ out: | |
515 | } | |
516 | ||
517 | unsigned long | |
518 | -__copy_to_user(void __user *to, const void *from, unsigned long n) | |
519 | +___copy_to_user(void __user *to, const void *from, unsigned long n) | |
520 | { | |
521 | /* | |
522 | * This test is stubbed out of the main function above to keep | |
523 | diff -urNp linux-3.0.3/arch/arm/mach-ux500/mbox-db5500.c linux-3.0.3/arch/arm/mach-ux500/mbox-db5500.c | |
524 | --- linux-3.0.3/arch/arm/mach-ux500/mbox-db5500.c 2011-07-21 22:17:23.000000000 -0400 | |
525 | +++ linux-3.0.3/arch/arm/mach-ux500/mbox-db5500.c 2011-08-23 21:48:14.000000000 -0400 | |
526 | @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev | |
527 | return sprintf(buf, "0x%X\n", mbox_value); | |
528 | } | |
529 | ||
530 | -static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo); | |
531 | +static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo); | |
532 | ||
533 | static int mbox_show(struct seq_file *s, void *data) | |
534 | { | |
535 | diff -urNp linux-3.0.3/arch/arm/mm/fault.c linux-3.0.3/arch/arm/mm/fault.c | |
536 | --- linux-3.0.3/arch/arm/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
537 | +++ linux-3.0.3/arch/arm/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
538 | @@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk, | |
539 | } | |
540 | #endif | |
541 | ||
542 | +#ifdef CONFIG_PAX_PAGEEXEC | |
543 | + if (fsr & FSR_LNX_PF) { | |
544 | + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp); | |
545 | + do_group_exit(SIGKILL); | |
546 | + } | |
547 | +#endif | |
548 | + | |
549 | tsk->thread.address = addr; | |
550 | tsk->thread.error_code = fsr; | |
551 | tsk->thread.trap_no = 14; | |
552 | @@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign | |
553 | } | |
554 | #endif /* CONFIG_MMU */ | |
555 | ||
556 | +#ifdef CONFIG_PAX_PAGEEXEC | |
557 | +void pax_report_insns(void *pc, void *sp) | |
558 | +{ | |
559 | + long i; | |
560 | + | |
561 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
562 | + for (i = 0; i < 20; i++) { | |
563 | + unsigned char c; | |
564 | + if (get_user(c, (__force unsigned char __user *)pc+i)) | |
565 | + printk(KERN_CONT "?? "); | |
566 | + else | |
567 | + printk(KERN_CONT "%02x ", c); | |
568 | + } | |
569 | + printk("\n"); | |
570 | + | |
571 | + printk(KERN_ERR "PAX: bytes at SP-4: "); | |
572 | + for (i = -1; i < 20; i++) { | |
573 | + unsigned long c; | |
574 | + if (get_user(c, (__force unsigned long __user *)sp+i)) | |
575 | + printk(KERN_CONT "???????? "); | |
576 | + else | |
577 | + printk(KERN_CONT "%08lx ", c); | |
578 | + } | |
579 | + printk("\n"); | |
580 | +} | |
581 | +#endif | |
582 | + | |
583 | /* | |
584 | * First Level Translation Fault Handler | |
585 | * | |
586 | diff -urNp linux-3.0.3/arch/arm/mm/mmap.c linux-3.0.3/arch/arm/mm/mmap.c | |
587 | --- linux-3.0.3/arch/arm/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
588 | +++ linux-3.0.3/arch/arm/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400 | |
589 | @@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp | |
590 | if (len > TASK_SIZE) | |
591 | return -ENOMEM; | |
592 | ||
593 | +#ifdef CONFIG_PAX_RANDMMAP | |
594 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
595 | +#endif | |
596 | + | |
597 | if (addr) { | |
598 | if (do_align) | |
599 | addr = COLOUR_ALIGN(addr, pgoff); | |
600 | @@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp | |
601 | addr = PAGE_ALIGN(addr); | |
602 | ||
603 | vma = find_vma(mm, addr); | |
604 | - if (TASK_SIZE - len >= addr && | |
605 | - (!vma || addr + len <= vma->vm_start)) | |
606 | + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
607 | return addr; | |
608 | } | |
609 | if (len > mm->cached_hole_size) { | |
610 | - start_addr = addr = mm->free_area_cache; | |
611 | + start_addr = addr = mm->free_area_cache; | |
612 | } else { | |
613 | - start_addr = addr = TASK_UNMAPPED_BASE; | |
614 | - mm->cached_hole_size = 0; | |
615 | + start_addr = addr = mm->mmap_base; | |
616 | + mm->cached_hole_size = 0; | |
617 | } | |
618 | /* 8 bits of randomness in 20 address space bits */ | |
619 | if ((current->flags & PF_RANDOMIZE) && | |
620 | @@ -100,14 +103,14 @@ full_search: | |
621 | * Start a new search - just in case we missed | |
622 | * some holes. | |
623 | */ | |
624 | - if (start_addr != TASK_UNMAPPED_BASE) { | |
625 | - start_addr = addr = TASK_UNMAPPED_BASE; | |
626 | + if (start_addr != mm->mmap_base) { | |
627 | + start_addr = addr = mm->mmap_base; | |
628 | mm->cached_hole_size = 0; | |
629 | goto full_search; | |
630 | } | |
631 | return -ENOMEM; | |
632 | } | |
633 | - if (!vma || addr + len <= vma->vm_start) { | |
634 | + if (check_heap_stack_gap(vma, addr, len)) { | |
635 | /* | |
636 | * Remember the place where we stopped the search: | |
637 | */ | |
638 | diff -urNp linux-3.0.3/arch/avr32/include/asm/elf.h linux-3.0.3/arch/avr32/include/asm/elf.h | |
639 | --- linux-3.0.3/arch/avr32/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
640 | +++ linux-3.0.3/arch/avr32/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
641 | @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg | |
642 | the loader. We need to make sure that it is out of the way of the program | |
643 | that it will "exec", and that there is sufficient room for the brk. */ | |
644 | ||
645 | -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) | |
646 | +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) | |
647 | ||
648 | +#ifdef CONFIG_PAX_ASLR | |
649 | +#define PAX_ELF_ET_DYN_BASE 0x00001000UL | |
650 | + | |
651 | +#define PAX_DELTA_MMAP_LEN 15 | |
652 | +#define PAX_DELTA_STACK_LEN 15 | |
653 | +#endif | |
654 | ||
655 | /* This yields a mask that user programs can use to figure out what | |
656 | instruction set this CPU supports. This could be done in user space, | |
657 | diff -urNp linux-3.0.3/arch/avr32/include/asm/kmap_types.h linux-3.0.3/arch/avr32/include/asm/kmap_types.h | |
658 | --- linux-3.0.3/arch/avr32/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
659 | +++ linux-3.0.3/arch/avr32/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400 | |
660 | @@ -22,7 +22,8 @@ D(10) KM_IRQ0, | |
661 | D(11) KM_IRQ1, | |
662 | D(12) KM_SOFTIRQ0, | |
663 | D(13) KM_SOFTIRQ1, | |
664 | -D(14) KM_TYPE_NR | |
665 | +D(14) KM_CLEARPAGE, | |
666 | +D(15) KM_TYPE_NR | |
667 | }; | |
668 | ||
669 | #undef D | |
670 | diff -urNp linux-3.0.3/arch/avr32/mm/fault.c linux-3.0.3/arch/avr32/mm/fault.c | |
671 | --- linux-3.0.3/arch/avr32/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
672 | +++ linux-3.0.3/arch/avr32/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
673 | @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru | |
674 | ||
675 | int exception_trace = 1; | |
676 | ||
677 | +#ifdef CONFIG_PAX_PAGEEXEC | |
678 | +void pax_report_insns(void *pc, void *sp) | |
679 | +{ | |
680 | + unsigned long i; | |
681 | + | |
682 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
683 | + for (i = 0; i < 20; i++) { | |
684 | + unsigned char c; | |
685 | + if (get_user(c, (unsigned char *)pc+i)) | |
686 | + printk(KERN_CONT "???????? "); | |
687 | + else | |
688 | + printk(KERN_CONT "%02x ", c); | |
689 | + } | |
690 | + printk("\n"); | |
691 | +} | |
692 | +#endif | |
693 | + | |
694 | /* | |
695 | * This routine handles page faults. It determines the address and the | |
696 | * problem, and then passes it off to one of the appropriate routines. | |
697 | @@ -156,6 +173,16 @@ bad_area: | |
698 | up_read(&mm->mmap_sem); | |
699 | ||
700 | if (user_mode(regs)) { | |
701 | + | |
702 | +#ifdef CONFIG_PAX_PAGEEXEC | |
703 | + if (mm->pax_flags & MF_PAX_PAGEEXEC) { | |
704 | + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) { | |
705 | + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp); | |
706 | + do_group_exit(SIGKILL); | |
707 | + } | |
708 | + } | |
709 | +#endif | |
710 | + | |
711 | if (exception_trace && printk_ratelimit()) | |
712 | printk("%s%s[%d]: segfault at %08lx pc %08lx " | |
713 | "sp %08lx ecr %lu\n", | |
714 | diff -urNp linux-3.0.3/arch/frv/include/asm/kmap_types.h linux-3.0.3/arch/frv/include/asm/kmap_types.h | |
715 | --- linux-3.0.3/arch/frv/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
716 | +++ linux-3.0.3/arch/frv/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400 | |
717 | @@ -23,6 +23,7 @@ enum km_type { | |
718 | KM_IRQ1, | |
719 | KM_SOFTIRQ0, | |
720 | KM_SOFTIRQ1, | |
721 | + KM_CLEARPAGE, | |
722 | KM_TYPE_NR | |
723 | }; | |
724 | ||
725 | diff -urNp linux-3.0.3/arch/frv/mm/elf-fdpic.c linux-3.0.3/arch/frv/mm/elf-fdpic.c | |
726 | --- linux-3.0.3/arch/frv/mm/elf-fdpic.c 2011-07-21 22:17:23.000000000 -0400 | |
727 | +++ linux-3.0.3/arch/frv/mm/elf-fdpic.c 2011-08-23 21:47:55.000000000 -0400 | |
728 | @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str | |
729 | if (addr) { | |
730 | addr = PAGE_ALIGN(addr); | |
731 | vma = find_vma(current->mm, addr); | |
732 | - if (TASK_SIZE - len >= addr && | |
733 | - (!vma || addr + len <= vma->vm_start)) | |
734 | + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
735 | goto success; | |
736 | } | |
737 | ||
738 | @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str | |
739 | for (; vma; vma = vma->vm_next) { | |
740 | if (addr > limit) | |
741 | break; | |
742 | - if (addr + len <= vma->vm_start) | |
743 | + if (check_heap_stack_gap(vma, addr, len)) | |
744 | goto success; | |
745 | addr = vma->vm_end; | |
746 | } | |
747 | @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str | |
748 | for (; vma; vma = vma->vm_next) { | |
749 | if (addr > limit) | |
750 | break; | |
751 | - if (addr + len <= vma->vm_start) | |
752 | + if (check_heap_stack_gap(vma, addr, len)) | |
753 | goto success; | |
754 | addr = vma->vm_end; | |
755 | } | |
756 | diff -urNp linux-3.0.3/arch/ia64/include/asm/elf.h linux-3.0.3/arch/ia64/include/asm/elf.h | |
757 | --- linux-3.0.3/arch/ia64/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
758 | +++ linux-3.0.3/arch/ia64/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
759 | @@ -42,6 +42,13 @@ | |
760 | */ | |
761 | #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL) | |
762 | ||
763 | +#ifdef CONFIG_PAX_ASLR | |
764 | +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL) | |
765 | + | |
766 | +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13) | |
767 | +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13) | |
768 | +#endif | |
769 | + | |
770 | #define PT_IA_64_UNWIND 0x70000001 | |
771 | ||
772 | /* IA-64 relocations: */ | |
773 | diff -urNp linux-3.0.3/arch/ia64/include/asm/pgtable.h linux-3.0.3/arch/ia64/include/asm/pgtable.h | |
774 | --- linux-3.0.3/arch/ia64/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
775 | +++ linux-3.0.3/arch/ia64/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400 | |
776 | @@ -12,7 +12,7 @@ | |
777 | * David Mosberger-Tang <davidm@hpl.hp.com> | |
778 | */ | |
779 | ||
780 | - | |
781 | +#include <linux/const.h> | |
782 | #include <asm/mman.h> | |
783 | #include <asm/page.h> | |
784 | #include <asm/processor.h> | |
785 | @@ -143,6 +143,17 @@ | |
786 | #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R) | |
787 | #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R) | |
788 | #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX) | |
789 | + | |
790 | +#ifdef CONFIG_PAX_PAGEEXEC | |
791 | +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW) | |
792 | +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R) | |
793 | +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R) | |
794 | +#else | |
795 | +# define PAGE_SHARED_NOEXEC PAGE_SHARED | |
796 | +# define PAGE_READONLY_NOEXEC PAGE_READONLY | |
797 | +# define PAGE_COPY_NOEXEC PAGE_COPY | |
798 | +#endif | |
799 | + | |
800 | #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX) | |
801 | #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX) | |
802 | #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX) | |
803 | diff -urNp linux-3.0.3/arch/ia64/include/asm/spinlock.h linux-3.0.3/arch/ia64/include/asm/spinlock.h | |
804 | --- linux-3.0.3/arch/ia64/include/asm/spinlock.h 2011-07-21 22:17:23.000000000 -0400 | |
805 | +++ linux-3.0.3/arch/ia64/include/asm/spinlock.h 2011-08-23 21:47:55.000000000 -0400 | |
806 | @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi | |
807 | unsigned short *p = (unsigned short *)&lock->lock + 1, tmp; | |
808 | ||
809 | asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p)); | |
810 | - ACCESS_ONCE(*p) = (tmp + 2) & ~1; | |
811 | + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1; | |
812 | } | |
813 | ||
814 | static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock) | |
815 | diff -urNp linux-3.0.3/arch/ia64/include/asm/uaccess.h linux-3.0.3/arch/ia64/include/asm/uaccess.h | |
816 | --- linux-3.0.3/arch/ia64/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
817 | +++ linux-3.0.3/arch/ia64/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
818 | @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _ | |
819 | const void *__cu_from = (from); \ | |
820 | long __cu_len = (n); \ | |
821 | \ | |
822 | - if (__access_ok(__cu_to, __cu_len, get_fs())) \ | |
823 | + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \ | |
824 | __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \ | |
825 | __cu_len; \ | |
826 | }) | |
827 | @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _ | |
828 | long __cu_len = (n); \ | |
829 | \ | |
830 | __chk_user_ptr(__cu_from); \ | |
831 | - if (__access_ok(__cu_from, __cu_len, get_fs())) \ | |
832 | + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \ | |
833 | __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \ | |
834 | __cu_len; \ | |
835 | }) | |
836 | diff -urNp linux-3.0.3/arch/ia64/kernel/module.c linux-3.0.3/arch/ia64/kernel/module.c | |
837 | --- linux-3.0.3/arch/ia64/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
838 | +++ linux-3.0.3/arch/ia64/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
839 | @@ -315,8 +315,7 @@ module_alloc (unsigned long size) | |
840 | void | |
841 | module_free (struct module *mod, void *module_region) | |
842 | { | |
843 | - if (mod && mod->arch.init_unw_table && | |
844 | - module_region == mod->module_init) { | |
845 | + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) { | |
846 | unw_remove_unwind_table(mod->arch.init_unw_table); | |
847 | mod->arch.init_unw_table = NULL; | |
848 | } | |
849 | @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd | |
850 | } | |
851 | ||
852 | static inline int | |
853 | +in_init_rx (const struct module *mod, uint64_t addr) | |
854 | +{ | |
855 | + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx; | |
856 | +} | |
857 | + | |
858 | +static inline int | |
859 | +in_init_rw (const struct module *mod, uint64_t addr) | |
860 | +{ | |
861 | + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw; | |
862 | +} | |
863 | + | |
864 | +static inline int | |
865 | in_init (const struct module *mod, uint64_t addr) | |
866 | { | |
867 | - return addr - (uint64_t) mod->module_init < mod->init_size; | |
868 | + return in_init_rx(mod, addr) || in_init_rw(mod, addr); | |
869 | +} | |
870 | + | |
871 | +static inline int | |
872 | +in_core_rx (const struct module *mod, uint64_t addr) | |
873 | +{ | |
874 | + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx; | |
875 | +} | |
876 | + | |
877 | +static inline int | |
878 | +in_core_rw (const struct module *mod, uint64_t addr) | |
879 | +{ | |
880 | + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw; | |
881 | } | |
882 | ||
883 | static inline int | |
884 | in_core (const struct module *mod, uint64_t addr) | |
885 | { | |
886 | - return addr - (uint64_t) mod->module_core < mod->core_size; | |
887 | + return in_core_rx(mod, addr) || in_core_rw(mod, addr); | |
888 | } | |
889 | ||
890 | static inline int | |
891 | @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_ | |
892 | break; | |
893 | ||
894 | case RV_BDREL: | |
895 | - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core); | |
896 | + if (in_init_rx(mod, val)) | |
897 | + val -= (uint64_t) mod->module_init_rx; | |
898 | + else if (in_init_rw(mod, val)) | |
899 | + val -= (uint64_t) mod->module_init_rw; | |
900 | + else if (in_core_rx(mod, val)) | |
901 | + val -= (uint64_t) mod->module_core_rx; | |
902 | + else if (in_core_rw(mod, val)) | |
903 | + val -= (uint64_t) mod->module_core_rw; | |
904 | break; | |
905 | ||
906 | case RV_LTV: | |
907 | @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, | |
908 | * addresses have been selected... | |
909 | */ | |
910 | uint64_t gp; | |
911 | - if (mod->core_size > MAX_LTOFF) | |
912 | + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF) | |
913 | /* | |
914 | * This takes advantage of fact that SHF_ARCH_SMALL gets allocated | |
915 | * at the end of the module. | |
916 | */ | |
917 | - gp = mod->core_size - MAX_LTOFF / 2; | |
918 | + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2; | |
919 | else | |
920 | - gp = mod->core_size / 2; | |
921 | - gp = (uint64_t) mod->module_core + ((gp + 7) & -8); | |
922 | + gp = (mod->core_size_rx + mod->core_size_rw) / 2; | |
923 | + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8); | |
924 | mod->arch.gp = gp; | |
925 | DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp); | |
926 | } | |
927 | diff -urNp linux-3.0.3/arch/ia64/kernel/sys_ia64.c linux-3.0.3/arch/ia64/kernel/sys_ia64.c | |
928 | --- linux-3.0.3/arch/ia64/kernel/sys_ia64.c 2011-07-21 22:17:23.000000000 -0400 | |
929 | +++ linux-3.0.3/arch/ia64/kernel/sys_ia64.c 2011-08-23 21:47:55.000000000 -0400 | |
930 | @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil | |
931 | if (REGION_NUMBER(addr) == RGN_HPAGE) | |
932 | addr = 0; | |
933 | #endif | |
934 | + | |
935 | +#ifdef CONFIG_PAX_RANDMMAP | |
936 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
937 | + addr = mm->free_area_cache; | |
938 | + else | |
939 | +#endif | |
940 | + | |
941 | if (!addr) | |
942 | addr = mm->free_area_cache; | |
943 | ||
944 | @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil | |
945 | for (vma = find_vma(mm, addr); ; vma = vma->vm_next) { | |
946 | /* At this point: (!vma || addr < vma->vm_end). */ | |
947 | if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) { | |
948 | - if (start_addr != TASK_UNMAPPED_BASE) { | |
949 | + if (start_addr != mm->mmap_base) { | |
950 | /* Start a new search --- just in case we missed some holes. */ | |
951 | - addr = TASK_UNMAPPED_BASE; | |
952 | + addr = mm->mmap_base; | |
953 | goto full_search; | |
954 | } | |
955 | return -ENOMEM; | |
956 | } | |
957 | - if (!vma || addr + len <= vma->vm_start) { | |
958 | + if (check_heap_stack_gap(vma, addr, len)) { | |
959 | /* Remember the address where we stopped this search: */ | |
960 | mm->free_area_cache = addr + len; | |
961 | return addr; | |
962 | diff -urNp linux-3.0.3/arch/ia64/kernel/vmlinux.lds.S linux-3.0.3/arch/ia64/kernel/vmlinux.lds.S | |
963 | --- linux-3.0.3/arch/ia64/kernel/vmlinux.lds.S 2011-07-21 22:17:23.000000000 -0400 | |
964 | +++ linux-3.0.3/arch/ia64/kernel/vmlinux.lds.S 2011-08-23 21:47:55.000000000 -0400 | |
965 | @@ -199,7 +199,7 @@ SECTIONS { | |
966 | /* Per-cpu data: */ | |
967 | . = ALIGN(PERCPU_PAGE_SIZE); | |
968 | PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu) | |
969 | - __phys_per_cpu_start = __per_cpu_load; | |
970 | + __phys_per_cpu_start = per_cpu_load; | |
971 | /* | |
972 | * ensure percpu data fits | |
973 | * into percpu page size | |
974 | diff -urNp linux-3.0.3/arch/ia64/mm/fault.c linux-3.0.3/arch/ia64/mm/fault.c | |
975 | --- linux-3.0.3/arch/ia64/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
976 | +++ linux-3.0.3/arch/ia64/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
977 | @@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned | |
978 | return pte_present(pte); | |
979 | } | |
980 | ||
981 | +#ifdef CONFIG_PAX_PAGEEXEC | |
982 | +void pax_report_insns(void *pc, void *sp) | |
983 | +{ | |
984 | + unsigned long i; | |
985 | + | |
986 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
987 | + for (i = 0; i < 8; i++) { | |
988 | + unsigned int c; | |
989 | + if (get_user(c, (unsigned int *)pc+i)) | |
990 | + printk(KERN_CONT "???????? "); | |
991 | + else | |
992 | + printk(KERN_CONT "%08x ", c); | |
993 | + } | |
994 | + printk("\n"); | |
995 | +} | |
996 | +#endif | |
997 | + | |
998 | void __kprobes | |
999 | ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs) | |
1000 | { | |
1001 | @@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long addres | |
1002 | mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT) | |
1003 | | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT)); | |
1004 | ||
1005 | - if ((vma->vm_flags & mask) != mask) | |
1006 | + if ((vma->vm_flags & mask) != mask) { | |
1007 | + | |
1008 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1009 | + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) { | |
1010 | + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip) | |
1011 | + goto bad_area; | |
1012 | + | |
1013 | + up_read(&mm->mmap_sem); | |
1014 | + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12); | |
1015 | + do_group_exit(SIGKILL); | |
1016 | + } | |
1017 | +#endif | |
1018 | + | |
1019 | goto bad_area; | |
1020 | ||
1021 | + } | |
1022 | + | |
1023 | /* | |
1024 | * If for any reason at all we couldn't handle the fault, make | |
1025 | * sure we exit gracefully rather than endlessly redo the | |
1026 | diff -urNp linux-3.0.3/arch/ia64/mm/hugetlbpage.c linux-3.0.3/arch/ia64/mm/hugetlbpage.c | |
1027 | --- linux-3.0.3/arch/ia64/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400 | |
1028 | +++ linux-3.0.3/arch/ia64/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400 | |
1029 | @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area( | |
1030 | /* At this point: (!vmm || addr < vmm->vm_end). */ | |
1031 | if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT) | |
1032 | return -ENOMEM; | |
1033 | - if (!vmm || (addr + len) <= vmm->vm_start) | |
1034 | + if (check_heap_stack_gap(vmm, addr, len)) | |
1035 | return addr; | |
1036 | addr = ALIGN(vmm->vm_end, HPAGE_SIZE); | |
1037 | } | |
1038 | diff -urNp linux-3.0.3/arch/ia64/mm/init.c linux-3.0.3/arch/ia64/mm/init.c | |
1039 | --- linux-3.0.3/arch/ia64/mm/init.c 2011-07-21 22:17:23.000000000 -0400 | |
1040 | +++ linux-3.0.3/arch/ia64/mm/init.c 2011-08-23 21:47:55.000000000 -0400 | |
1041 | @@ -120,6 +120,19 @@ ia64_init_addr_space (void) | |
1042 | vma->vm_start = current->thread.rbs_bot & PAGE_MASK; | |
1043 | vma->vm_end = vma->vm_start + PAGE_SIZE; | |
1044 | vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT; | |
1045 | + | |
1046 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1047 | + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) { | |
1048 | + vma->vm_flags &= ~VM_EXEC; | |
1049 | + | |
1050 | +#ifdef CONFIG_PAX_MPROTECT | |
1051 | + if (current->mm->pax_flags & MF_PAX_MPROTECT) | |
1052 | + vma->vm_flags &= ~VM_MAYEXEC; | |
1053 | +#endif | |
1054 | + | |
1055 | + } | |
1056 | +#endif | |
1057 | + | |
1058 | vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
1059 | down_write(¤t->mm->mmap_sem); | |
1060 | if (insert_vm_struct(current->mm, vma)) { | |
1061 | diff -urNp linux-3.0.3/arch/m32r/lib/usercopy.c linux-3.0.3/arch/m32r/lib/usercopy.c | |
1062 | --- linux-3.0.3/arch/m32r/lib/usercopy.c 2011-07-21 22:17:23.000000000 -0400 | |
1063 | +++ linux-3.0.3/arch/m32r/lib/usercopy.c 2011-08-23 21:47:55.000000000 -0400 | |
1064 | @@ -14,6 +14,9 @@ | |
1065 | unsigned long | |
1066 | __generic_copy_to_user(void __user *to, const void *from, unsigned long n) | |
1067 | { | |
1068 | + if ((long)n < 0) | |
1069 | + return n; | |
1070 | + | |
1071 | prefetch(from); | |
1072 | if (access_ok(VERIFY_WRITE, to, n)) | |
1073 | __copy_user(to,from,n); | |
1074 | @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, | |
1075 | unsigned long | |
1076 | __generic_copy_from_user(void *to, const void __user *from, unsigned long n) | |
1077 | { | |
1078 | + if ((long)n < 0) | |
1079 | + return n; | |
1080 | + | |
1081 | prefetchw(to); | |
1082 | if (access_ok(VERIFY_READ, from, n)) | |
1083 | __copy_user_zeroing(to,from,n); | |
1084 | diff -urNp linux-3.0.3/arch/mips/include/asm/elf.h linux-3.0.3/arch/mips/include/asm/elf.h | |
1085 | --- linux-3.0.3/arch/mips/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
1086 | +++ linux-3.0.3/arch/mips/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
1087 | @@ -372,13 +372,16 @@ extern const char *__elf_platform; | |
1088 | #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) | |
1089 | #endif | |
1090 | ||
1091 | +#ifdef CONFIG_PAX_ASLR | |
1092 | +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL) | |
1093 | + | |
1094 | +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1095 | +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1096 | +#endif | |
1097 | + | |
1098 | #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1 | |
1099 | struct linux_binprm; | |
1100 | extern int arch_setup_additional_pages(struct linux_binprm *bprm, | |
1101 | int uses_interp); | |
1102 | ||
1103 | -struct mm_struct; | |
1104 | -extern unsigned long arch_randomize_brk(struct mm_struct *mm); | |
1105 | -#define arch_randomize_brk arch_randomize_brk | |
1106 | - | |
1107 | #endif /* _ASM_ELF_H */ | |
1108 | diff -urNp linux-3.0.3/arch/mips/include/asm/page.h linux-3.0.3/arch/mips/include/asm/page.h | |
1109 | --- linux-3.0.3/arch/mips/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400 | |
1110 | +++ linux-3.0.3/arch/mips/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400 | |
1111 | @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa | |
1112 | #ifdef CONFIG_CPU_MIPS32 | |
1113 | typedef struct { unsigned long pte_low, pte_high; } pte_t; | |
1114 | #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32)) | |
1115 | - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; }) | |
1116 | + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; }) | |
1117 | #else | |
1118 | typedef struct { unsigned long long pte; } pte_t; | |
1119 | #define pte_val(x) ((x).pte) | |
1120 | diff -urNp linux-3.0.3/arch/mips/include/asm/system.h linux-3.0.3/arch/mips/include/asm/system.h | |
1121 | --- linux-3.0.3/arch/mips/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 | |
1122 | +++ linux-3.0.3/arch/mips/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 | |
1123 | @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void); | |
1124 | */ | |
1125 | #define __ARCH_WANT_UNLOCKED_CTXSW | |
1126 | ||
1127 | -extern unsigned long arch_align_stack(unsigned long sp); | |
1128 | +#define arch_align_stack(x) ((x) & ~0xfUL) | |
1129 | ||
1130 | #endif /* _ASM_SYSTEM_H */ | |
1131 | diff -urNp linux-3.0.3/arch/mips/kernel/binfmt_elfn32.c linux-3.0.3/arch/mips/kernel/binfmt_elfn32.c | |
1132 | --- linux-3.0.3/arch/mips/kernel/binfmt_elfn32.c 2011-07-21 22:17:23.000000000 -0400 | |
1133 | +++ linux-3.0.3/arch/mips/kernel/binfmt_elfn32.c 2011-08-23 21:47:55.000000000 -0400 | |
1134 | @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N | |
1135 | #undef ELF_ET_DYN_BASE | |
1136 | #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2) | |
1137 | ||
1138 | +#ifdef CONFIG_PAX_ASLR | |
1139 | +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL) | |
1140 | + | |
1141 | +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1142 | +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1143 | +#endif | |
1144 | + | |
1145 | #include <asm/processor.h> | |
1146 | #include <linux/module.h> | |
1147 | #include <linux/elfcore.h> | |
1148 | diff -urNp linux-3.0.3/arch/mips/kernel/binfmt_elfo32.c linux-3.0.3/arch/mips/kernel/binfmt_elfo32.c | |
1149 | --- linux-3.0.3/arch/mips/kernel/binfmt_elfo32.c 2011-07-21 22:17:23.000000000 -0400 | |
1150 | +++ linux-3.0.3/arch/mips/kernel/binfmt_elfo32.c 2011-08-23 21:47:55.000000000 -0400 | |
1151 | @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N | |
1152 | #undef ELF_ET_DYN_BASE | |
1153 | #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2) | |
1154 | ||
1155 | +#ifdef CONFIG_PAX_ASLR | |
1156 | +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL) | |
1157 | + | |
1158 | +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1159 | +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT) | |
1160 | +#endif | |
1161 | + | |
1162 | #include <asm/processor.h> | |
1163 | ||
1164 | /* | |
1165 | diff -urNp linux-3.0.3/arch/mips/kernel/process.c linux-3.0.3/arch/mips/kernel/process.c | |
1166 | --- linux-3.0.3/arch/mips/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
1167 | +++ linux-3.0.3/arch/mips/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
1168 | @@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru | |
1169 | out: | |
1170 | return pc; | |
1171 | } | |
1172 | - | |
1173 | -/* | |
1174 | - * Don't forget that the stack pointer must be aligned on a 8 bytes | |
1175 | - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI. | |
1176 | - */ | |
1177 | -unsigned long arch_align_stack(unsigned long sp) | |
1178 | -{ | |
1179 | - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) | |
1180 | - sp -= get_random_int() & ~PAGE_MASK; | |
1181 | - | |
1182 | - return sp & ALMASK; | |
1183 | -} | |
1184 | diff -urNp linux-3.0.3/arch/mips/mm/fault.c linux-3.0.3/arch/mips/mm/fault.c | |
1185 | --- linux-3.0.3/arch/mips/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
1186 | +++ linux-3.0.3/arch/mips/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
1187 | @@ -28,6 +28,23 @@ | |
1188 | #include <asm/highmem.h> /* For VMALLOC_END */ | |
1189 | #include <linux/kdebug.h> | |
1190 | ||
1191 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1192 | +void pax_report_insns(void *pc, void *sp) | |
1193 | +{ | |
1194 | + unsigned long i; | |
1195 | + | |
1196 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
1197 | + for (i = 0; i < 5; i++) { | |
1198 | + unsigned int c; | |
1199 | + if (get_user(c, (unsigned int *)pc+i)) | |
1200 | + printk(KERN_CONT "???????? "); | |
1201 | + else | |
1202 | + printk(KERN_CONT "%08x ", c); | |
1203 | + } | |
1204 | + printk("\n"); | |
1205 | +} | |
1206 | +#endif | |
1207 | + | |
1208 | /* | |
1209 | * This routine handles page faults. It determines the address, | |
1210 | * and the problem, and then passes it off to one of the appropriate | |
1211 | diff -urNp linux-3.0.3/arch/mips/mm/mmap.c linux-3.0.3/arch/mips/mm/mmap.c | |
1212 | --- linux-3.0.3/arch/mips/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
1213 | +++ linux-3.0.3/arch/mips/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400 | |
1214 | @@ -48,14 +48,18 @@ unsigned long arch_get_unmapped_area(str | |
1215 | do_color_align = 0; | |
1216 | if (filp || (flags & MAP_SHARED)) | |
1217 | do_color_align = 1; | |
1218 | + | |
1219 | +#ifdef CONFIG_PAX_RANDMMAP | |
1220 | + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP)) | |
1221 | +#endif | |
1222 | + | |
1223 | if (addr) { | |
1224 | if (do_color_align) | |
1225 | addr = COLOUR_ALIGN(addr, pgoff); | |
1226 | else | |
1227 | addr = PAGE_ALIGN(addr); | |
1228 | vmm = find_vma(current->mm, addr); | |
1229 | - if (TASK_SIZE - len >= addr && | |
1230 | - (!vmm || addr + len <= vmm->vm_start)) | |
1231 | + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len)) | |
1232 | return addr; | |
1233 | } | |
1234 | addr = current->mm->mmap_base; | |
1235 | @@ -68,7 +72,7 @@ unsigned long arch_get_unmapped_area(str | |
1236 | /* At this point: (!vmm || addr < vmm->vm_end). */ | |
1237 | if (TASK_SIZE - len < addr) | |
1238 | return -ENOMEM; | |
1239 | - if (!vmm || addr + len <= vmm->vm_start) | |
1240 | + if (check_heap_stack_gap(vmm, addr, len)) | |
1241 | return addr; | |
1242 | addr = vmm->vm_end; | |
1243 | if (do_color_align) | |
1244 | @@ -93,30 +97,3 @@ void arch_pick_mmap_layout(struct mm_str | |
1245 | mm->get_unmapped_area = arch_get_unmapped_area; | |
1246 | mm->unmap_area = arch_unmap_area; | |
1247 | } | |
1248 | - | |
1249 | -static inline unsigned long brk_rnd(void) | |
1250 | -{ | |
1251 | - unsigned long rnd = get_random_int(); | |
1252 | - | |
1253 | - rnd = rnd << PAGE_SHIFT; | |
1254 | - /* 8MB for 32bit, 256MB for 64bit */ | |
1255 | - if (TASK_IS_32BIT_ADDR) | |
1256 | - rnd = rnd & 0x7ffffful; | |
1257 | - else | |
1258 | - rnd = rnd & 0xffffffful; | |
1259 | - | |
1260 | - return rnd; | |
1261 | -} | |
1262 | - | |
1263 | -unsigned long arch_randomize_brk(struct mm_struct *mm) | |
1264 | -{ | |
1265 | - unsigned long base = mm->brk; | |
1266 | - unsigned long ret; | |
1267 | - | |
1268 | - ret = PAGE_ALIGN(base + brk_rnd()); | |
1269 | - | |
1270 | - if (ret < mm->brk) | |
1271 | - return mm->brk; | |
1272 | - | |
1273 | - return ret; | |
1274 | -} | |
1275 | diff -urNp linux-3.0.3/arch/parisc/include/asm/elf.h linux-3.0.3/arch/parisc/include/asm/elf.h | |
1276 | --- linux-3.0.3/arch/parisc/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
1277 | +++ linux-3.0.3/arch/parisc/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
1278 | @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration.. | |
1279 | ||
1280 | #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000) | |
1281 | ||
1282 | +#ifdef CONFIG_PAX_ASLR | |
1283 | +#define PAX_ELF_ET_DYN_BASE 0x10000UL | |
1284 | + | |
1285 | +#define PAX_DELTA_MMAP_LEN 16 | |
1286 | +#define PAX_DELTA_STACK_LEN 16 | |
1287 | +#endif | |
1288 | + | |
1289 | /* This yields a mask that user programs can use to figure out what | |
1290 | instruction set this CPU supports. This could be done in user space, | |
1291 | but it's not easy, and we've already done it here. */ | |
1292 | diff -urNp linux-3.0.3/arch/parisc/include/asm/pgtable.h linux-3.0.3/arch/parisc/include/asm/pgtable.h | |
1293 | --- linux-3.0.3/arch/parisc/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
1294 | +++ linux-3.0.3/arch/parisc/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400 | |
1295 | @@ -210,6 +210,17 @@ struct vm_area_struct; | |
1296 | #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED) | |
1297 | #define PAGE_COPY PAGE_EXECREAD | |
1298 | #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED) | |
1299 | + | |
1300 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1301 | +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED) | |
1302 | +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED) | |
1303 | +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED) | |
1304 | +#else | |
1305 | +# define PAGE_SHARED_NOEXEC PAGE_SHARED | |
1306 | +# define PAGE_COPY_NOEXEC PAGE_COPY | |
1307 | +# define PAGE_READONLY_NOEXEC PAGE_READONLY | |
1308 | +#endif | |
1309 | + | |
1310 | #define PAGE_KERNEL __pgprot(_PAGE_KERNEL) | |
1311 | #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC) | |
1312 | #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX) | |
1313 | diff -urNp linux-3.0.3/arch/parisc/kernel/module.c linux-3.0.3/arch/parisc/kernel/module.c | |
1314 | --- linux-3.0.3/arch/parisc/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
1315 | +++ linux-3.0.3/arch/parisc/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
1316 | @@ -98,16 +98,38 @@ | |
1317 | ||
1318 | /* three functions to determine where in the module core | |
1319 | * or init pieces the location is */ | |
1320 | +static inline int in_init_rx(struct module *me, void *loc) | |
1321 | +{ | |
1322 | + return (loc >= me->module_init_rx && | |
1323 | + loc < (me->module_init_rx + me->init_size_rx)); | |
1324 | +} | |
1325 | + | |
1326 | +static inline int in_init_rw(struct module *me, void *loc) | |
1327 | +{ | |
1328 | + return (loc >= me->module_init_rw && | |
1329 | + loc < (me->module_init_rw + me->init_size_rw)); | |
1330 | +} | |
1331 | + | |
1332 | static inline int in_init(struct module *me, void *loc) | |
1333 | { | |
1334 | - return (loc >= me->module_init && | |
1335 | - loc <= (me->module_init + me->init_size)); | |
1336 | + return in_init_rx(me, loc) || in_init_rw(me, loc); | |
1337 | +} | |
1338 | + | |
1339 | +static inline int in_core_rx(struct module *me, void *loc) | |
1340 | +{ | |
1341 | + return (loc >= me->module_core_rx && | |
1342 | + loc < (me->module_core_rx + me->core_size_rx)); | |
1343 | +} | |
1344 | + | |
1345 | +static inline int in_core_rw(struct module *me, void *loc) | |
1346 | +{ | |
1347 | + return (loc >= me->module_core_rw && | |
1348 | + loc < (me->module_core_rw + me->core_size_rw)); | |
1349 | } | |
1350 | ||
1351 | static inline int in_core(struct module *me, void *loc) | |
1352 | { | |
1353 | - return (loc >= me->module_core && | |
1354 | - loc <= (me->module_core + me->core_size)); | |
1355 | + return in_core_rx(me, loc) || in_core_rw(me, loc); | |
1356 | } | |
1357 | ||
1358 | static inline int in_local(struct module *me, void *loc) | |
1359 | @@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_ | |
1360 | } | |
1361 | ||
1362 | /* align things a bit */ | |
1363 | - me->core_size = ALIGN(me->core_size, 16); | |
1364 | - me->arch.got_offset = me->core_size; | |
1365 | - me->core_size += gots * sizeof(struct got_entry); | |
1366 | - | |
1367 | - me->core_size = ALIGN(me->core_size, 16); | |
1368 | - me->arch.fdesc_offset = me->core_size; | |
1369 | - me->core_size += fdescs * sizeof(Elf_Fdesc); | |
1370 | + me->core_size_rw = ALIGN(me->core_size_rw, 16); | |
1371 | + me->arch.got_offset = me->core_size_rw; | |
1372 | + me->core_size_rw += gots * sizeof(struct got_entry); | |
1373 | + | |
1374 | + me->core_size_rw = ALIGN(me->core_size_rw, 16); | |
1375 | + me->arch.fdesc_offset = me->core_size_rw; | |
1376 | + me->core_size_rw += fdescs * sizeof(Elf_Fdesc); | |
1377 | ||
1378 | me->arch.got_max = gots; | |
1379 | me->arch.fdesc_max = fdescs; | |
1380 | @@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module | |
1381 | ||
1382 | BUG_ON(value == 0); | |
1383 | ||
1384 | - got = me->module_core + me->arch.got_offset; | |
1385 | + got = me->module_core_rw + me->arch.got_offset; | |
1386 | for (i = 0; got[i].addr; i++) | |
1387 | if (got[i].addr == value) | |
1388 | goto out; | |
1389 | @@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module | |
1390 | #ifdef CONFIG_64BIT | |
1391 | static Elf_Addr get_fdesc(struct module *me, unsigned long value) | |
1392 | { | |
1393 | - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset; | |
1394 | + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset; | |
1395 | ||
1396 | if (!value) { | |
1397 | printk(KERN_ERR "%s: zero OPD requested!\n", me->name); | |
1398 | @@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module | |
1399 | ||
1400 | /* Create new one */ | |
1401 | fdesc->addr = value; | |
1402 | - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset; | |
1403 | + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset; | |
1404 | return (Elf_Addr)fdesc; | |
1405 | } | |
1406 | #endif /* CONFIG_64BIT */ | |
1407 | @@ -857,7 +879,7 @@ register_unwind_table(struct module *me, | |
1408 | ||
1409 | table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr; | |
1410 | end = table + sechdrs[me->arch.unwind_section].sh_size; | |
1411 | - gp = (Elf_Addr)me->module_core + me->arch.got_offset; | |
1412 | + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset; | |
1413 | ||
1414 | DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n", | |
1415 | me->arch.unwind_section, table, end, gp); | |
1416 | diff -urNp linux-3.0.3/arch/parisc/kernel/sys_parisc.c linux-3.0.3/arch/parisc/kernel/sys_parisc.c | |
1417 | --- linux-3.0.3/arch/parisc/kernel/sys_parisc.c 2011-07-21 22:17:23.000000000 -0400 | |
1418 | +++ linux-3.0.3/arch/parisc/kernel/sys_parisc.c 2011-08-23 21:47:55.000000000 -0400 | |
1419 | @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u | |
1420 | /* At this point: (!vma || addr < vma->vm_end). */ | |
1421 | if (TASK_SIZE - len < addr) | |
1422 | return -ENOMEM; | |
1423 | - if (!vma || addr + len <= vma->vm_start) | |
1424 | + if (check_heap_stack_gap(vma, addr, len)) | |
1425 | return addr; | |
1426 | addr = vma->vm_end; | |
1427 | } | |
1428 | @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str | |
1429 | /* At this point: (!vma || addr < vma->vm_end). */ | |
1430 | if (TASK_SIZE - len < addr) | |
1431 | return -ENOMEM; | |
1432 | - if (!vma || addr + len <= vma->vm_start) | |
1433 | + if (check_heap_stack_gap(vma, addr, len)) | |
1434 | return addr; | |
1435 | addr = DCACHE_ALIGN(vma->vm_end - offset) + offset; | |
1436 | if (addr < vma->vm_end) /* handle wraparound */ | |
1437 | @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str | |
1438 | if (flags & MAP_FIXED) | |
1439 | return addr; | |
1440 | if (!addr) | |
1441 | - addr = TASK_UNMAPPED_BASE; | |
1442 | + addr = current->mm->mmap_base; | |
1443 | ||
1444 | if (filp) { | |
1445 | addr = get_shared_area(filp->f_mapping, addr, len, pgoff); | |
1446 | diff -urNp linux-3.0.3/arch/parisc/kernel/traps.c linux-3.0.3/arch/parisc/kernel/traps.c | |
1447 | --- linux-3.0.3/arch/parisc/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400 | |
1448 | +++ linux-3.0.3/arch/parisc/kernel/traps.c 2011-08-23 21:47:55.000000000 -0400 | |
1449 | @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod | |
1450 | ||
1451 | down_read(¤t->mm->mmap_sem); | |
1452 | vma = find_vma(current->mm,regs->iaoq[0]); | |
1453 | - if (vma && (regs->iaoq[0] >= vma->vm_start) | |
1454 | - && (vma->vm_flags & VM_EXEC)) { | |
1455 | - | |
1456 | + if (vma && (regs->iaoq[0] >= vma->vm_start)) { | |
1457 | fault_address = regs->iaoq[0]; | |
1458 | fault_space = regs->iasq[0]; | |
1459 | ||
1460 | diff -urNp linux-3.0.3/arch/parisc/mm/fault.c linux-3.0.3/arch/parisc/mm/fault.c | |
1461 | --- linux-3.0.3/arch/parisc/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
1462 | +++ linux-3.0.3/arch/parisc/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
1463 | @@ -15,6 +15,7 @@ | |
1464 | #include <linux/sched.h> | |
1465 | #include <linux/interrupt.h> | |
1466 | #include <linux/module.h> | |
1467 | +#include <linux/unistd.h> | |
1468 | ||
1469 | #include <asm/uaccess.h> | |
1470 | #include <asm/traps.h> | |
1471 | @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex | |
1472 | static unsigned long | |
1473 | parisc_acctyp(unsigned long code, unsigned int inst) | |
1474 | { | |
1475 | - if (code == 6 || code == 16) | |
1476 | + if (code == 6 || code == 7 || code == 16) | |
1477 | return VM_EXEC; | |
1478 | ||
1479 | switch (inst & 0xf0000000) { | |
1480 | @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign | |
1481 | } | |
1482 | #endif | |
1483 | ||
1484 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1485 | +/* | |
1486 | + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address) | |
1487 | + * | |
1488 | + * returns 1 when task should be killed | |
1489 | + * 2 when rt_sigreturn trampoline was detected | |
1490 | + * 3 when unpatched PLT trampoline was detected | |
1491 | + */ | |
1492 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
1493 | +{ | |
1494 | + | |
1495 | +#ifdef CONFIG_PAX_EMUPLT | |
1496 | + int err; | |
1497 | + | |
1498 | + do { /* PaX: unpatched PLT emulation */ | |
1499 | + unsigned int bl, depwi; | |
1500 | + | |
1501 | + err = get_user(bl, (unsigned int *)instruction_pointer(regs)); | |
1502 | + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4)); | |
1503 | + | |
1504 | + if (err) | |
1505 | + break; | |
1506 | + | |
1507 | + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) { | |
1508 | + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12; | |
1509 | + | |
1510 | + err = get_user(ldw, (unsigned int *)addr); | |
1511 | + err |= get_user(bv, (unsigned int *)(addr+4)); | |
1512 | + err |= get_user(ldw2, (unsigned int *)(addr+8)); | |
1513 | + | |
1514 | + if (err) | |
1515 | + break; | |
1516 | + | |
1517 | + if (ldw == 0x0E801096U && | |
1518 | + bv == 0xEAC0C000U && | |
1519 | + ldw2 == 0x0E881095U) | |
1520 | + { | |
1521 | + unsigned int resolver, map; | |
1522 | + | |
1523 | + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8)); | |
1524 | + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12)); | |
1525 | + if (err) | |
1526 | + break; | |
1527 | + | |
1528 | + regs->gr[20] = instruction_pointer(regs)+8; | |
1529 | + regs->gr[21] = map; | |
1530 | + regs->gr[22] = resolver; | |
1531 | + regs->iaoq[0] = resolver | 3UL; | |
1532 | + regs->iaoq[1] = regs->iaoq[0] + 4; | |
1533 | + return 3; | |
1534 | + } | |
1535 | + } | |
1536 | + } while (0); | |
1537 | +#endif | |
1538 | + | |
1539 | +#ifdef CONFIG_PAX_EMUTRAMP | |
1540 | + | |
1541 | +#ifndef CONFIG_PAX_EMUSIGRT | |
1542 | + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP)) | |
1543 | + return 1; | |
1544 | +#endif | |
1545 | + | |
1546 | + do { /* PaX: rt_sigreturn emulation */ | |
1547 | + unsigned int ldi1, ldi2, bel, nop; | |
1548 | + | |
1549 | + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs)); | |
1550 | + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4)); | |
1551 | + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8)); | |
1552 | + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12)); | |
1553 | + | |
1554 | + if (err) | |
1555 | + break; | |
1556 | + | |
1557 | + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) && | |
1558 | + ldi2 == 0x3414015AU && | |
1559 | + bel == 0xE4008200U && | |
1560 | + nop == 0x08000240U) | |
1561 | + { | |
1562 | + regs->gr[25] = (ldi1 & 2) >> 1; | |
1563 | + regs->gr[20] = __NR_rt_sigreturn; | |
1564 | + regs->gr[31] = regs->iaoq[1] + 16; | |
1565 | + regs->sr[0] = regs->iasq[1]; | |
1566 | + regs->iaoq[0] = 0x100UL; | |
1567 | + regs->iaoq[1] = regs->iaoq[0] + 4; | |
1568 | + regs->iasq[0] = regs->sr[2]; | |
1569 | + regs->iasq[1] = regs->sr[2]; | |
1570 | + return 2; | |
1571 | + } | |
1572 | + } while (0); | |
1573 | +#endif | |
1574 | + | |
1575 | + return 1; | |
1576 | +} | |
1577 | + | |
1578 | +void pax_report_insns(void *pc, void *sp) | |
1579 | +{ | |
1580 | + unsigned long i; | |
1581 | + | |
1582 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
1583 | + for (i = 0; i < 5; i++) { | |
1584 | + unsigned int c; | |
1585 | + if (get_user(c, (unsigned int *)pc+i)) | |
1586 | + printk(KERN_CONT "???????? "); | |
1587 | + else | |
1588 | + printk(KERN_CONT "%08x ", c); | |
1589 | + } | |
1590 | + printk("\n"); | |
1591 | +} | |
1592 | +#endif | |
1593 | + | |
1594 | int fixup_exception(struct pt_regs *regs) | |
1595 | { | |
1596 | const struct exception_table_entry *fix; | |
1597 | @@ -192,8 +303,33 @@ good_area: | |
1598 | ||
1599 | acc_type = parisc_acctyp(code,regs->iir); | |
1600 | ||
1601 | - if ((vma->vm_flags & acc_type) != acc_type) | |
1602 | + if ((vma->vm_flags & acc_type) != acc_type) { | |
1603 | + | |
1604 | +#ifdef CONFIG_PAX_PAGEEXEC | |
1605 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) && | |
1606 | + (address & ~3UL) == instruction_pointer(regs)) | |
1607 | + { | |
1608 | + up_read(&mm->mmap_sem); | |
1609 | + switch (pax_handle_fetch_fault(regs)) { | |
1610 | + | |
1611 | +#ifdef CONFIG_PAX_EMUPLT | |
1612 | + case 3: | |
1613 | + return; | |
1614 | +#endif | |
1615 | + | |
1616 | +#ifdef CONFIG_PAX_EMUTRAMP | |
1617 | + case 2: | |
1618 | + return; | |
1619 | +#endif | |
1620 | + | |
1621 | + } | |
1622 | + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]); | |
1623 | + do_group_exit(SIGKILL); | |
1624 | + } | |
1625 | +#endif | |
1626 | + | |
1627 | goto bad_area; | |
1628 | + } | |
1629 | ||
1630 | /* | |
1631 | * If for any reason at all we couldn't handle the fault, make | |
1632 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/elf.h linux-3.0.3/arch/powerpc/include/asm/elf.h | |
1633 | --- linux-3.0.3/arch/powerpc/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
1634 | +++ linux-3.0.3/arch/powerpc/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
1635 | @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E | |
1636 | the loader. We need to make sure that it is out of the way of the program | |
1637 | that it will "exec", and that there is sufficient room for the brk. */ | |
1638 | ||
1639 | -extern unsigned long randomize_et_dyn(unsigned long base); | |
1640 | -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000)) | |
1641 | +#define ELF_ET_DYN_BASE (0x20000000) | |
1642 | + | |
1643 | +#ifdef CONFIG_PAX_ASLR | |
1644 | +#define PAX_ELF_ET_DYN_BASE (0x10000000UL) | |
1645 | + | |
1646 | +#ifdef __powerpc64__ | |
1647 | +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28) | |
1648 | +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28) | |
1649 | +#else | |
1650 | +#define PAX_DELTA_MMAP_LEN 15 | |
1651 | +#define PAX_DELTA_STACK_LEN 15 | |
1652 | +#endif | |
1653 | +#endif | |
1654 | ||
1655 | /* | |
1656 | * Our registers are always unsigned longs, whether we're a 32 bit | |
1657 | @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s | |
1658 | (0x7ff >> (PAGE_SHIFT - 12)) : \ | |
1659 | (0x3ffff >> (PAGE_SHIFT - 12))) | |
1660 | ||
1661 | -extern unsigned long arch_randomize_brk(struct mm_struct *mm); | |
1662 | -#define arch_randomize_brk arch_randomize_brk | |
1663 | - | |
1664 | #endif /* __KERNEL__ */ | |
1665 | ||
1666 | /* | |
1667 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/kmap_types.h linux-3.0.3/arch/powerpc/include/asm/kmap_types.h | |
1668 | --- linux-3.0.3/arch/powerpc/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
1669 | +++ linux-3.0.3/arch/powerpc/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400 | |
1670 | @@ -27,6 +27,7 @@ enum km_type { | |
1671 | KM_PPC_SYNC_PAGE, | |
1672 | KM_PPC_SYNC_ICACHE, | |
1673 | KM_KDB, | |
1674 | + KM_CLEARPAGE, | |
1675 | KM_TYPE_NR | |
1676 | }; | |
1677 | ||
1678 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/mman.h linux-3.0.3/arch/powerpc/include/asm/mman.h | |
1679 | --- linux-3.0.3/arch/powerpc/include/asm/mman.h 2011-07-21 22:17:23.000000000 -0400 | |
1680 | +++ linux-3.0.3/arch/powerpc/include/asm/mman.h 2011-08-23 21:47:55.000000000 -0400 | |
1681 | @@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm | |
1682 | } | |
1683 | #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot) | |
1684 | ||
1685 | -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags) | |
1686 | +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags) | |
1687 | { | |
1688 | return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0); | |
1689 | } | |
1690 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/page_64.h linux-3.0.3/arch/powerpc/include/asm/page_64.h | |
1691 | --- linux-3.0.3/arch/powerpc/include/asm/page_64.h 2011-07-21 22:17:23.000000000 -0400 | |
1692 | +++ linux-3.0.3/arch/powerpc/include/asm/page_64.h 2011-08-23 21:47:55.000000000 -0400 | |
1693 | @@ -155,15 +155,18 @@ do { \ | |
1694 | * stack by default, so in the absence of a PT_GNU_STACK program header | |
1695 | * we turn execute permission off. | |
1696 | */ | |
1697 | -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \ | |
1698 | - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1699 | +#define VM_STACK_DEFAULT_FLAGS32 \ | |
1700 | + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \ | |
1701 | + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1702 | ||
1703 | #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \ | |
1704 | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1705 | ||
1706 | +#ifndef CONFIG_PAX_PAGEEXEC | |
1707 | #define VM_STACK_DEFAULT_FLAGS \ | |
1708 | (is_32bit_task() ? \ | |
1709 | VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64) | |
1710 | +#endif | |
1711 | ||
1712 | #include <asm-generic/getorder.h> | |
1713 | ||
1714 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/page.h linux-3.0.3/arch/powerpc/include/asm/page.h | |
1715 | --- linux-3.0.3/arch/powerpc/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400 | |
1716 | +++ linux-3.0.3/arch/powerpc/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400 | |
1717 | @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr; | |
1718 | * and needs to be executable. This means the whole heap ends | |
1719 | * up being executable. | |
1720 | */ | |
1721 | -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \ | |
1722 | - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1723 | +#define VM_DATA_DEFAULT_FLAGS32 \ | |
1724 | + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \ | |
1725 | + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1726 | ||
1727 | #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \ | |
1728 | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) | |
1729 | @@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr; | |
1730 | #define is_kernel_addr(x) ((x) >= PAGE_OFFSET) | |
1731 | #endif | |
1732 | ||
1733 | +#define ktla_ktva(addr) (addr) | |
1734 | +#define ktva_ktla(addr) (addr) | |
1735 | + | |
1736 | #ifndef __ASSEMBLY__ | |
1737 | ||
1738 | #undef STRICT_MM_TYPECHECKS | |
1739 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/pgtable.h linux-3.0.3/arch/powerpc/include/asm/pgtable.h | |
1740 | --- linux-3.0.3/arch/powerpc/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
1741 | +++ linux-3.0.3/arch/powerpc/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400 | |
1742 | @@ -2,6 +2,7 @@ | |
1743 | #define _ASM_POWERPC_PGTABLE_H | |
1744 | #ifdef __KERNEL__ | |
1745 | ||
1746 | +#include <linux/const.h> | |
1747 | #ifndef __ASSEMBLY__ | |
1748 | #include <asm/processor.h> /* For TASK_SIZE */ | |
1749 | #include <asm/mmu.h> | |
1750 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/pte-hash32.h linux-3.0.3/arch/powerpc/include/asm/pte-hash32.h | |
1751 | --- linux-3.0.3/arch/powerpc/include/asm/pte-hash32.h 2011-07-21 22:17:23.000000000 -0400 | |
1752 | +++ linux-3.0.3/arch/powerpc/include/asm/pte-hash32.h 2011-08-23 21:47:55.000000000 -0400 | |
1753 | @@ -21,6 +21,7 @@ | |
1754 | #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */ | |
1755 | #define _PAGE_USER 0x004 /* usermode access allowed */ | |
1756 | #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */ | |
1757 | +#define _PAGE_EXEC _PAGE_GUARDED | |
1758 | #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */ | |
1759 | #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */ | |
1760 | #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */ | |
1761 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/reg.h linux-3.0.3/arch/powerpc/include/asm/reg.h | |
1762 | --- linux-3.0.3/arch/powerpc/include/asm/reg.h 2011-07-21 22:17:23.000000000 -0400 | |
1763 | +++ linux-3.0.3/arch/powerpc/include/asm/reg.h 2011-08-23 21:47:55.000000000 -0400 | |
1764 | @@ -209,6 +209,7 @@ | |
1765 | #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */ | |
1766 | #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */ | |
1767 | #define DSISR_NOHPTE 0x40000000 /* no translation found */ | |
1768 | +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */ | |
1769 | #define DSISR_PROTFAULT 0x08000000 /* protection fault */ | |
1770 | #define DSISR_ISSTORE 0x02000000 /* access was a store */ | |
1771 | #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */ | |
1772 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/system.h linux-3.0.3/arch/powerpc/include/asm/system.h | |
1773 | --- linux-3.0.3/arch/powerpc/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 | |
1774 | +++ linux-3.0.3/arch/powerpc/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 | |
1775 | @@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi | |
1776 | #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n)) | |
1777 | #endif | |
1778 | ||
1779 | -extern unsigned long arch_align_stack(unsigned long sp); | |
1780 | +#define arch_align_stack(x) ((x) & ~0xfUL) | |
1781 | ||
1782 | /* Used in very early kernel initialization. */ | |
1783 | extern unsigned long reloc_offset(void); | |
1784 | diff -urNp linux-3.0.3/arch/powerpc/include/asm/uaccess.h linux-3.0.3/arch/powerpc/include/asm/uaccess.h | |
1785 | --- linux-3.0.3/arch/powerpc/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
1786 | +++ linux-3.0.3/arch/powerpc/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
1787 | @@ -13,6 +13,8 @@ | |
1788 | #define VERIFY_READ 0 | |
1789 | #define VERIFY_WRITE 1 | |
1790 | ||
1791 | +extern void check_object_size(const void *ptr, unsigned long n, bool to); | |
1792 | + | |
1793 | /* | |
1794 | * The fs value determines whether argument validity checking should be | |
1795 | * performed or not. If get_fs() == USER_DS, checking is performed, with | |
1796 | @@ -327,52 +329,6 @@ do { \ | |
1797 | extern unsigned long __copy_tofrom_user(void __user *to, | |
1798 | const void __user *from, unsigned long size); | |
1799 | ||
1800 | -#ifndef __powerpc64__ | |
1801 | - | |
1802 | -static inline unsigned long copy_from_user(void *to, | |
1803 | - const void __user *from, unsigned long n) | |
1804 | -{ | |
1805 | - unsigned long over; | |
1806 | - | |
1807 | - if (access_ok(VERIFY_READ, from, n)) | |
1808 | - return __copy_tofrom_user((__force void __user *)to, from, n); | |
1809 | - if ((unsigned long)from < TASK_SIZE) { | |
1810 | - over = (unsigned long)from + n - TASK_SIZE; | |
1811 | - return __copy_tofrom_user((__force void __user *)to, from, | |
1812 | - n - over) + over; | |
1813 | - } | |
1814 | - return n; | |
1815 | -} | |
1816 | - | |
1817 | -static inline unsigned long copy_to_user(void __user *to, | |
1818 | - const void *from, unsigned long n) | |
1819 | -{ | |
1820 | - unsigned long over; | |
1821 | - | |
1822 | - if (access_ok(VERIFY_WRITE, to, n)) | |
1823 | - return __copy_tofrom_user(to, (__force void __user *)from, n); | |
1824 | - if ((unsigned long)to < TASK_SIZE) { | |
1825 | - over = (unsigned long)to + n - TASK_SIZE; | |
1826 | - return __copy_tofrom_user(to, (__force void __user *)from, | |
1827 | - n - over) + over; | |
1828 | - } | |
1829 | - return n; | |
1830 | -} | |
1831 | - | |
1832 | -#else /* __powerpc64__ */ | |
1833 | - | |
1834 | -#define __copy_in_user(to, from, size) \ | |
1835 | - __copy_tofrom_user((to), (from), (size)) | |
1836 | - | |
1837 | -extern unsigned long copy_from_user(void *to, const void __user *from, | |
1838 | - unsigned long n); | |
1839 | -extern unsigned long copy_to_user(void __user *to, const void *from, | |
1840 | - unsigned long n); | |
1841 | -extern unsigned long copy_in_user(void __user *to, const void __user *from, | |
1842 | - unsigned long n); | |
1843 | - | |
1844 | -#endif /* __powerpc64__ */ | |
1845 | - | |
1846 | static inline unsigned long __copy_from_user_inatomic(void *to, | |
1847 | const void __user *from, unsigned long n) | |
1848 | { | |
1849 | @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_ | |
1850 | if (ret == 0) | |
1851 | return 0; | |
1852 | } | |
1853 | + | |
1854 | + if (!__builtin_constant_p(n)) | |
1855 | + check_object_size(to, n, false); | |
1856 | + | |
1857 | return __copy_tofrom_user((__force void __user *)to, from, n); | |
1858 | } | |
1859 | ||
1860 | @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us | |
1861 | if (ret == 0) | |
1862 | return 0; | |
1863 | } | |
1864 | + | |
1865 | + if (!__builtin_constant_p(n)) | |
1866 | + check_object_size(from, n, true); | |
1867 | + | |
1868 | return __copy_tofrom_user(to, (__force const void __user *)from, n); | |
1869 | } | |
1870 | ||
1871 | @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us | |
1872 | return __copy_to_user_inatomic(to, from, size); | |
1873 | } | |
1874 | ||
1875 | +#ifndef __powerpc64__ | |
1876 | + | |
1877 | +static inline unsigned long __must_check copy_from_user(void *to, | |
1878 | + const void __user *from, unsigned long n) | |
1879 | +{ | |
1880 | + unsigned long over; | |
1881 | + | |
1882 | + if ((long)n < 0) | |
1883 | + return n; | |
1884 | + | |
1885 | + if (access_ok(VERIFY_READ, from, n)) { | |
1886 | + if (!__builtin_constant_p(n)) | |
1887 | + check_object_size(to, n, false); | |
1888 | + return __copy_tofrom_user((__force void __user *)to, from, n); | |
1889 | + } | |
1890 | + if ((unsigned long)from < TASK_SIZE) { | |
1891 | + over = (unsigned long)from + n - TASK_SIZE; | |
1892 | + if (!__builtin_constant_p(n - over)) | |
1893 | + check_object_size(to, n - over, false); | |
1894 | + return __copy_tofrom_user((__force void __user *)to, from, | |
1895 | + n - over) + over; | |
1896 | + } | |
1897 | + return n; | |
1898 | +} | |
1899 | + | |
1900 | +static inline unsigned long __must_check copy_to_user(void __user *to, | |
1901 | + const void *from, unsigned long n) | |
1902 | +{ | |
1903 | + unsigned long over; | |
1904 | + | |
1905 | + if ((long)n < 0) | |
1906 | + return n; | |
1907 | + | |
1908 | + if (access_ok(VERIFY_WRITE, to, n)) { | |
1909 | + if (!__builtin_constant_p(n)) | |
1910 | + check_object_size(from, n, true); | |
1911 | + return __copy_tofrom_user(to, (__force void __user *)from, n); | |
1912 | + } | |
1913 | + if ((unsigned long)to < TASK_SIZE) { | |
1914 | + over = (unsigned long)to + n - TASK_SIZE; | |
1915 | + if (!__builtin_constant_p(n)) | |
1916 | + check_object_size(from, n - over, true); | |
1917 | + return __copy_tofrom_user(to, (__force void __user *)from, | |
1918 | + n - over) + over; | |
1919 | + } | |
1920 | + return n; | |
1921 | +} | |
1922 | + | |
1923 | +#else /* __powerpc64__ */ | |
1924 | + | |
1925 | +#define __copy_in_user(to, from, size) \ | |
1926 | + __copy_tofrom_user((to), (from), (size)) | |
1927 | + | |
1928 | +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) | |
1929 | +{ | |
1930 | + if ((long)n < 0 || n > INT_MAX) | |
1931 | + return n; | |
1932 | + | |
1933 | + if (!__builtin_constant_p(n)) | |
1934 | + check_object_size(to, n, false); | |
1935 | + | |
1936 | + if (likely(access_ok(VERIFY_READ, from, n))) | |
1937 | + n = __copy_from_user(to, from, n); | |
1938 | + else | |
1939 | + memset(to, 0, n); | |
1940 | + return n; | |
1941 | +} | |
1942 | + | |
1943 | +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) | |
1944 | +{ | |
1945 | + if ((long)n < 0 || n > INT_MAX) | |
1946 | + return n; | |
1947 | + | |
1948 | + if (likely(access_ok(VERIFY_WRITE, to, n))) { | |
1949 | + if (!__builtin_constant_p(n)) | |
1950 | + check_object_size(from, n, true); | |
1951 | + n = __copy_to_user(to, from, n); | |
1952 | + } | |
1953 | + return n; | |
1954 | +} | |
1955 | + | |
1956 | +extern unsigned long copy_in_user(void __user *to, const void __user *from, | |
1957 | + unsigned long n); | |
1958 | + | |
1959 | +#endif /* __powerpc64__ */ | |
1960 | + | |
1961 | extern unsigned long __clear_user(void __user *addr, unsigned long size); | |
1962 | ||
1963 | static inline unsigned long clear_user(void __user *addr, unsigned long size) | |
1964 | diff -urNp linux-3.0.3/arch/powerpc/kernel/exceptions-64e.S linux-3.0.3/arch/powerpc/kernel/exceptions-64e.S | |
1965 | --- linux-3.0.3/arch/powerpc/kernel/exceptions-64e.S 2011-07-21 22:17:23.000000000 -0400 | |
1966 | +++ linux-3.0.3/arch/powerpc/kernel/exceptions-64e.S 2011-08-23 21:47:55.000000000 -0400 | |
1967 | @@ -567,6 +567,7 @@ storage_fault_common: | |
1968 | std r14,_DAR(r1) | |
1969 | std r15,_DSISR(r1) | |
1970 | addi r3,r1,STACK_FRAME_OVERHEAD | |
1971 | + bl .save_nvgprs | |
1972 | mr r4,r14 | |
1973 | mr r5,r15 | |
1974 | ld r14,PACA_EXGEN+EX_R14(r13) | |
1975 | @@ -576,8 +577,7 @@ storage_fault_common: | |
1976 | cmpdi r3,0 | |
1977 | bne- 1f | |
1978 | b .ret_from_except_lite | |
1979 | -1: bl .save_nvgprs | |
1980 | - mr r5,r3 | |
1981 | +1: mr r5,r3 | |
1982 | addi r3,r1,STACK_FRAME_OVERHEAD | |
1983 | ld r4,_DAR(r1) | |
1984 | bl .bad_page_fault | |
1985 | diff -urNp linux-3.0.3/arch/powerpc/kernel/exceptions-64s.S linux-3.0.3/arch/powerpc/kernel/exceptions-64s.S | |
1986 | --- linux-3.0.3/arch/powerpc/kernel/exceptions-64s.S 2011-07-21 22:17:23.000000000 -0400 | |
1987 | +++ linux-3.0.3/arch/powerpc/kernel/exceptions-64s.S 2011-08-23 21:47:55.000000000 -0400 | |
1988 | @@ -956,10 +956,10 @@ handle_page_fault: | |
1989 | 11: ld r4,_DAR(r1) | |
1990 | ld r5,_DSISR(r1) | |
1991 | addi r3,r1,STACK_FRAME_OVERHEAD | |
1992 | + bl .save_nvgprs | |
1993 | bl .do_page_fault | |
1994 | cmpdi r3,0 | |
1995 | beq+ 13f | |
1996 | - bl .save_nvgprs | |
1997 | mr r5,r3 | |
1998 | addi r3,r1,STACK_FRAME_OVERHEAD | |
1999 | lwz r4,_DAR(r1) | |
2000 | diff -urNp linux-3.0.3/arch/powerpc/kernel/module_32.c linux-3.0.3/arch/powerpc/kernel/module_32.c | |
2001 | --- linux-3.0.3/arch/powerpc/kernel/module_32.c 2011-07-21 22:17:23.000000000 -0400 | |
2002 | +++ linux-3.0.3/arch/powerpc/kernel/module_32.c 2011-08-23 21:47:55.000000000 -0400 | |
2003 | @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr | |
2004 | me->arch.core_plt_section = i; | |
2005 | } | |
2006 | if (!me->arch.core_plt_section || !me->arch.init_plt_section) { | |
2007 | - printk("Module doesn't contain .plt or .init.plt sections.\n"); | |
2008 | + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name); | |
2009 | return -ENOEXEC; | |
2010 | } | |
2011 | ||
2012 | @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati | |
2013 | ||
2014 | DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location); | |
2015 | /* Init, or core PLT? */ | |
2016 | - if (location >= mod->module_core | |
2017 | - && location < mod->module_core + mod->core_size) | |
2018 | + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) || | |
2019 | + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw)) | |
2020 | entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr; | |
2021 | - else | |
2022 | + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) || | |
2023 | + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw)) | |
2024 | entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr; | |
2025 | + else { | |
2026 | + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name); | |
2027 | + return ~0UL; | |
2028 | + } | |
2029 | ||
2030 | /* Find this entry, or if that fails, the next avail. entry */ | |
2031 | while (entry->jump[0]) { | |
2032 | diff -urNp linux-3.0.3/arch/powerpc/kernel/module.c linux-3.0.3/arch/powerpc/kernel/module.c | |
2033 | --- linux-3.0.3/arch/powerpc/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
2034 | +++ linux-3.0.3/arch/powerpc/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
2035 | @@ -31,11 +31,24 @@ | |
2036 | ||
2037 | LIST_HEAD(module_bug_list); | |
2038 | ||
2039 | +#ifdef CONFIG_PAX_KERNEXEC | |
2040 | void *module_alloc(unsigned long size) | |
2041 | { | |
2042 | if (size == 0) | |
2043 | return NULL; | |
2044 | ||
2045 | + return vmalloc(size); | |
2046 | +} | |
2047 | + | |
2048 | +void *module_alloc_exec(unsigned long size) | |
2049 | +#else | |
2050 | +void *module_alloc(unsigned long size) | |
2051 | +#endif | |
2052 | + | |
2053 | +{ | |
2054 | + if (size == 0) | |
2055 | + return NULL; | |
2056 | + | |
2057 | return vmalloc_exec(size); | |
2058 | } | |
2059 | ||
2060 | @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi | |
2061 | vfree(module_region); | |
2062 | } | |
2063 | ||
2064 | +#ifdef CONFIG_PAX_KERNEXEC | |
2065 | +void module_free_exec(struct module *mod, void *module_region) | |
2066 | +{ | |
2067 | + module_free(mod, module_region); | |
2068 | +} | |
2069 | +#endif | |
2070 | + | |
2071 | static const Elf_Shdr *find_section(const Elf_Ehdr *hdr, | |
2072 | const Elf_Shdr *sechdrs, | |
2073 | const char *name) | |
2074 | diff -urNp linux-3.0.3/arch/powerpc/kernel/process.c linux-3.0.3/arch/powerpc/kernel/process.c | |
2075 | --- linux-3.0.3/arch/powerpc/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
2076 | +++ linux-3.0.3/arch/powerpc/kernel/process.c 2011-08-23 21:48:14.000000000 -0400 | |
2077 | @@ -676,8 +676,8 @@ void show_regs(struct pt_regs * regs) | |
2078 | * Lookup NIP late so we have the best change of getting the | |
2079 | * above info out without failing | |
2080 | */ | |
2081 | - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip); | |
2082 | - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link); | |
2083 | + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip); | |
2084 | + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link); | |
2085 | #endif | |
2086 | show_stack(current, (unsigned long *) regs->gpr[1]); | |
2087 | if (!user_mode(regs)) | |
2088 | @@ -1183,10 +1183,10 @@ void show_stack(struct task_struct *tsk, | |
2089 | newsp = stack[0]; | |
2090 | ip = stack[STACK_FRAME_LR_SAVE]; | |
2091 | if (!firstframe || ip != lr) { | |
2092 | - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip); | |
2093 | + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip); | |
2094 | #ifdef CONFIG_FUNCTION_GRAPH_TRACER | |
2095 | if ((ip == rth || ip == mrth) && curr_frame >= 0) { | |
2096 | - printk(" (%pS)", | |
2097 | + printk(" (%pA)", | |
2098 | (void *)current->ret_stack[curr_frame].ret); | |
2099 | curr_frame--; | |
2100 | } | |
2101 | @@ -1206,7 +1206,7 @@ void show_stack(struct task_struct *tsk, | |
2102 | struct pt_regs *regs = (struct pt_regs *) | |
2103 | (sp + STACK_FRAME_OVERHEAD); | |
2104 | lr = regs->link; | |
2105 | - printk("--- Exception: %lx at %pS\n LR = %pS\n", | |
2106 | + printk("--- Exception: %lx at %pA\n LR = %pA\n", | |
2107 | regs->trap, (void *)regs->nip, (void *)lr); | |
2108 | firstframe = 1; | |
2109 | } | |
2110 | @@ -1281,58 +1281,3 @@ void thread_info_cache_init(void) | |
2111 | } | |
2112 | ||
2113 | #endif /* THREAD_SHIFT < PAGE_SHIFT */ | |
2114 | - | |
2115 | -unsigned long arch_align_stack(unsigned long sp) | |
2116 | -{ | |
2117 | - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) | |
2118 | - sp -= get_random_int() & ~PAGE_MASK; | |
2119 | - return sp & ~0xf; | |
2120 | -} | |
2121 | - | |
2122 | -static inline unsigned long brk_rnd(void) | |
2123 | -{ | |
2124 | - unsigned long rnd = 0; | |
2125 | - | |
2126 | - /* 8MB for 32bit, 1GB for 64bit */ | |
2127 | - if (is_32bit_task()) | |
2128 | - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT))); | |
2129 | - else | |
2130 | - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT))); | |
2131 | - | |
2132 | - return rnd << PAGE_SHIFT; | |
2133 | -} | |
2134 | - | |
2135 | -unsigned long arch_randomize_brk(struct mm_struct *mm) | |
2136 | -{ | |
2137 | - unsigned long base = mm->brk; | |
2138 | - unsigned long ret; | |
2139 | - | |
2140 | -#ifdef CONFIG_PPC_STD_MMU_64 | |
2141 | - /* | |
2142 | - * If we are using 1TB segments and we are allowed to randomise | |
2143 | - * the heap, we can put it above 1TB so it is backed by a 1TB | |
2144 | - * segment. Otherwise the heap will be in the bottom 1TB | |
2145 | - * which always uses 256MB segments and this may result in a | |
2146 | - * performance penalty. | |
2147 | - */ | |
2148 | - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T)) | |
2149 | - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T); | |
2150 | -#endif | |
2151 | - | |
2152 | - ret = PAGE_ALIGN(base + brk_rnd()); | |
2153 | - | |
2154 | - if (ret < mm->brk) | |
2155 | - return mm->brk; | |
2156 | - | |
2157 | - return ret; | |
2158 | -} | |
2159 | - | |
2160 | -unsigned long randomize_et_dyn(unsigned long base) | |
2161 | -{ | |
2162 | - unsigned long ret = PAGE_ALIGN(base + brk_rnd()); | |
2163 | - | |
2164 | - if (ret < base) | |
2165 | - return base; | |
2166 | - | |
2167 | - return ret; | |
2168 | -} | |
2169 | diff -urNp linux-3.0.3/arch/powerpc/kernel/signal_32.c linux-3.0.3/arch/powerpc/kernel/signal_32.c | |
2170 | --- linux-3.0.3/arch/powerpc/kernel/signal_32.c 2011-07-21 22:17:23.000000000 -0400 | |
2171 | +++ linux-3.0.3/arch/powerpc/kernel/signal_32.c 2011-08-23 21:47:55.000000000 -0400 | |
2172 | @@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig | |
2173 | /* Save user registers on the stack */ | |
2174 | frame = &rt_sf->uc.uc_mcontext; | |
2175 | addr = frame; | |
2176 | - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) { | |
2177 | + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) { | |
2178 | if (save_user_regs(regs, frame, 0, 1)) | |
2179 | goto badframe; | |
2180 | regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp; | |
2181 | diff -urNp linux-3.0.3/arch/powerpc/kernel/signal_64.c linux-3.0.3/arch/powerpc/kernel/signal_64.c | |
2182 | --- linux-3.0.3/arch/powerpc/kernel/signal_64.c 2011-07-21 22:17:23.000000000 -0400 | |
2183 | +++ linux-3.0.3/arch/powerpc/kernel/signal_64.c 2011-08-23 21:47:55.000000000 -0400 | |
2184 | @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct | |
2185 | current->thread.fpscr.val = 0; | |
2186 | ||
2187 | /* Set up to return from userspace. */ | |
2188 | - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) { | |
2189 | + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) { | |
2190 | regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp; | |
2191 | } else { | |
2192 | err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]); | |
2193 | diff -urNp linux-3.0.3/arch/powerpc/kernel/traps.c linux-3.0.3/arch/powerpc/kernel/traps.c | |
2194 | --- linux-3.0.3/arch/powerpc/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400 | |
2195 | +++ linux-3.0.3/arch/powerpc/kernel/traps.c 2011-08-23 21:48:14.000000000 -0400 | |
2196 | @@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void) | |
2197 | static inline void pmac_backlight_unblank(void) { } | |
2198 | #endif | |
2199 | ||
2200 | +extern void gr_handle_kernel_exploit(void); | |
2201 | + | |
2202 | int die(const char *str, struct pt_regs *regs, long err) | |
2203 | { | |
2204 | static struct { | |
2205 | @@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs | |
2206 | if (panic_on_oops) | |
2207 | panic("Fatal exception"); | |
2208 | ||
2209 | + gr_handle_kernel_exploit(); | |
2210 | + | |
2211 | oops_exit(); | |
2212 | do_exit(err); | |
2213 | ||
2214 | diff -urNp linux-3.0.3/arch/powerpc/kernel/vdso.c linux-3.0.3/arch/powerpc/kernel/vdso.c | |
2215 | --- linux-3.0.3/arch/powerpc/kernel/vdso.c 2011-07-21 22:17:23.000000000 -0400 | |
2216 | +++ linux-3.0.3/arch/powerpc/kernel/vdso.c 2011-08-23 21:47:55.000000000 -0400 | |
2217 | @@ -36,6 +36,7 @@ | |
2218 | #include <asm/firmware.h> | |
2219 | #include <asm/vdso.h> | |
2220 | #include <asm/vdso_datapage.h> | |
2221 | +#include <asm/mman.h> | |
2222 | ||
2223 | #include "setup.h" | |
2224 | ||
2225 | @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l | |
2226 | vdso_base = VDSO32_MBASE; | |
2227 | #endif | |
2228 | ||
2229 | - current->mm->context.vdso_base = 0; | |
2230 | + current->mm->context.vdso_base = ~0UL; | |
2231 | ||
2232 | /* vDSO has a problem and was disabled, just don't "enable" it for the | |
2233 | * process | |
2234 | @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l | |
2235 | vdso_base = get_unmapped_area(NULL, vdso_base, | |
2236 | (vdso_pages << PAGE_SHIFT) + | |
2237 | ((VDSO_ALIGNMENT - 1) & PAGE_MASK), | |
2238 | - 0, 0); | |
2239 | + 0, MAP_PRIVATE | MAP_EXECUTABLE); | |
2240 | if (IS_ERR_VALUE(vdso_base)) { | |
2241 | rc = vdso_base; | |
2242 | goto fail_mmapsem; | |
2243 | diff -urNp linux-3.0.3/arch/powerpc/lib/usercopy_64.c linux-3.0.3/arch/powerpc/lib/usercopy_64.c | |
2244 | --- linux-3.0.3/arch/powerpc/lib/usercopy_64.c 2011-07-21 22:17:23.000000000 -0400 | |
2245 | +++ linux-3.0.3/arch/powerpc/lib/usercopy_64.c 2011-08-23 21:47:55.000000000 -0400 | |
2246 | @@ -9,22 +9,6 @@ | |
2247 | #include <linux/module.h> | |
2248 | #include <asm/uaccess.h> | |
2249 | ||
2250 | -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n) | |
2251 | -{ | |
2252 | - if (likely(access_ok(VERIFY_READ, from, n))) | |
2253 | - n = __copy_from_user(to, from, n); | |
2254 | - else | |
2255 | - memset(to, 0, n); | |
2256 | - return n; | |
2257 | -} | |
2258 | - | |
2259 | -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) | |
2260 | -{ | |
2261 | - if (likely(access_ok(VERIFY_WRITE, to, n))) | |
2262 | - n = __copy_to_user(to, from, n); | |
2263 | - return n; | |
2264 | -} | |
2265 | - | |
2266 | unsigned long copy_in_user(void __user *to, const void __user *from, | |
2267 | unsigned long n) | |
2268 | { | |
2269 | @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user * | |
2270 | return n; | |
2271 | } | |
2272 | ||
2273 | -EXPORT_SYMBOL(copy_from_user); | |
2274 | -EXPORT_SYMBOL(copy_to_user); | |
2275 | EXPORT_SYMBOL(copy_in_user); | |
2276 | ||
2277 | diff -urNp linux-3.0.3/arch/powerpc/mm/fault.c linux-3.0.3/arch/powerpc/mm/fault.c | |
2278 | --- linux-3.0.3/arch/powerpc/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
2279 | +++ linux-3.0.3/arch/powerpc/mm/fault.c 2011-08-23 21:47:55.000000000 -0400 | |
2280 | @@ -32,6 +32,10 @@ | |
2281 | #include <linux/perf_event.h> | |
2282 | #include <linux/magic.h> | |
2283 | #include <linux/ratelimit.h> | |
2284 | +#include <linux/slab.h> | |
2285 | +#include <linux/pagemap.h> | |
2286 | +#include <linux/compiler.h> | |
2287 | +#include <linux/unistd.h> | |
2288 | ||
2289 | #include <asm/firmware.h> | |
2290 | #include <asm/page.h> | |
2291 | @@ -43,6 +47,7 @@ | |
2292 | #include <asm/tlbflush.h> | |
2293 | #include <asm/siginfo.h> | |
2294 | #include <mm/mmu_decl.h> | |
2295 | +#include <asm/ptrace.h> | |
2296 | ||
2297 | #ifdef CONFIG_KPROBES | |
2298 | static inline int notify_page_fault(struct pt_regs *regs) | |
2299 | @@ -66,6 +71,33 @@ static inline int notify_page_fault(stru | |
2300 | } | |
2301 | #endif | |
2302 | ||
2303 | +#ifdef CONFIG_PAX_PAGEEXEC | |
2304 | +/* | |
2305 | + * PaX: decide what to do with offenders (regs->nip = fault address) | |
2306 | + * | |
2307 | + * returns 1 when task should be killed | |
2308 | + */ | |
2309 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
2310 | +{ | |
2311 | + return 1; | |
2312 | +} | |
2313 | + | |
2314 | +void pax_report_insns(void *pc, void *sp) | |
2315 | +{ | |
2316 | + unsigned long i; | |
2317 | + | |
2318 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
2319 | + for (i = 0; i < 5; i++) { | |
2320 | + unsigned int c; | |
2321 | + if (get_user(c, (unsigned int __user *)pc+i)) | |
2322 | + printk(KERN_CONT "???????? "); | |
2323 | + else | |
2324 | + printk(KERN_CONT "%08x ", c); | |
2325 | + } | |
2326 | + printk("\n"); | |
2327 | +} | |
2328 | +#endif | |
2329 | + | |
2330 | /* | |
2331 | * Check whether the instruction at regs->nip is a store using | |
2332 | * an update addressing form which will update r1. | |
2333 | @@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_re | |
2334 | * indicate errors in DSISR but can validly be set in SRR1. | |
2335 | */ | |
2336 | if (trap == 0x400) | |
2337 | - error_code &= 0x48200000; | |
2338 | + error_code &= 0x58200000; | |
2339 | else | |
2340 | is_write = error_code & DSISR_ISSTORE; | |
2341 | #else | |
2342 | @@ -259,7 +291,7 @@ good_area: | |
2343 | * "undefined". Of those that can be set, this is the only | |
2344 | * one which seems bad. | |
2345 | */ | |
2346 | - if (error_code & 0x10000000) | |
2347 | + if (error_code & DSISR_GUARDED) | |
2348 | /* Guarded storage error. */ | |
2349 | goto bad_area; | |
2350 | #endif /* CONFIG_8xx */ | |
2351 | @@ -274,7 +306,7 @@ good_area: | |
2352 | * processors use the same I/D cache coherency mechanism | |
2353 | * as embedded. | |
2354 | */ | |
2355 | - if (error_code & DSISR_PROTFAULT) | |
2356 | + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED)) | |
2357 | goto bad_area; | |
2358 | #endif /* CONFIG_PPC_STD_MMU */ | |
2359 | ||
2360 | @@ -343,6 +375,23 @@ bad_area: | |
2361 | bad_area_nosemaphore: | |
2362 | /* User mode accesses cause a SIGSEGV */ | |
2363 | if (user_mode(regs)) { | |
2364 | + | |
2365 | +#ifdef CONFIG_PAX_PAGEEXEC | |
2366 | + if (mm->pax_flags & MF_PAX_PAGEEXEC) { | |
2367 | +#ifdef CONFIG_PPC_STD_MMU | |
2368 | + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) { | |
2369 | +#else | |
2370 | + if (is_exec && regs->nip == address) { | |
2371 | +#endif | |
2372 | + switch (pax_handle_fetch_fault(regs)) { | |
2373 | + } | |
2374 | + | |
2375 | + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]); | |
2376 | + do_group_exit(SIGKILL); | |
2377 | + } | |
2378 | + } | |
2379 | +#endif | |
2380 | + | |
2381 | _exception(SIGSEGV, regs, code, address); | |
2382 | return 0; | |
2383 | } | |
2384 | diff -urNp linux-3.0.3/arch/powerpc/mm/mmap_64.c linux-3.0.3/arch/powerpc/mm/mmap_64.c | |
2385 | --- linux-3.0.3/arch/powerpc/mm/mmap_64.c 2011-07-21 22:17:23.000000000 -0400 | |
2386 | +++ linux-3.0.3/arch/powerpc/mm/mmap_64.c 2011-08-23 21:47:55.000000000 -0400 | |
2387 | @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str | |
2388 | */ | |
2389 | if (mmap_is_legacy()) { | |
2390 | mm->mmap_base = TASK_UNMAPPED_BASE; | |
2391 | + | |
2392 | +#ifdef CONFIG_PAX_RANDMMAP | |
2393 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2394 | + mm->mmap_base += mm->delta_mmap; | |
2395 | +#endif | |
2396 | + | |
2397 | mm->get_unmapped_area = arch_get_unmapped_area; | |
2398 | mm->unmap_area = arch_unmap_area; | |
2399 | } else { | |
2400 | mm->mmap_base = mmap_base(); | |
2401 | + | |
2402 | +#ifdef CONFIG_PAX_RANDMMAP | |
2403 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2404 | + mm->mmap_base -= mm->delta_mmap + mm->delta_stack; | |
2405 | +#endif | |
2406 | + | |
2407 | mm->get_unmapped_area = arch_get_unmapped_area_topdown; | |
2408 | mm->unmap_area = arch_unmap_area_topdown; | |
2409 | } | |
2410 | diff -urNp linux-3.0.3/arch/powerpc/mm/slice.c linux-3.0.3/arch/powerpc/mm/slice.c | |
2411 | --- linux-3.0.3/arch/powerpc/mm/slice.c 2011-07-21 22:17:23.000000000 -0400 | |
2412 | +++ linux-3.0.3/arch/powerpc/mm/slice.c 2011-08-23 21:47:55.000000000 -0400 | |
2413 | @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_ | |
2414 | if ((mm->task_size - len) < addr) | |
2415 | return 0; | |
2416 | vma = find_vma(mm, addr); | |
2417 | - return (!vma || (addr + len) <= vma->vm_start); | |
2418 | + return check_heap_stack_gap(vma, addr, len); | |
2419 | } | |
2420 | ||
2421 | static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice) | |
2422 | @@ -256,7 +256,7 @@ full_search: | |
2423 | addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT); | |
2424 | continue; | |
2425 | } | |
2426 | - if (!vma || addr + len <= vma->vm_start) { | |
2427 | + if (check_heap_stack_gap(vma, addr, len)) { | |
2428 | /* | |
2429 | * Remember the place where we stopped the search: | |
2430 | */ | |
2431 | @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top | |
2432 | } | |
2433 | } | |
2434 | ||
2435 | - addr = mm->mmap_base; | |
2436 | - while (addr > len) { | |
2437 | + if (mm->mmap_base < len) | |
2438 | + addr = -ENOMEM; | |
2439 | + else | |
2440 | + addr = mm->mmap_base - len; | |
2441 | + | |
2442 | + while (!IS_ERR_VALUE(addr)) { | |
2443 | /* Go down by chunk size */ | |
2444 | - addr = _ALIGN_DOWN(addr - len, 1ul << pshift); | |
2445 | + addr = _ALIGN_DOWN(addr, 1ul << pshift); | |
2446 | ||
2447 | /* Check for hit with different page size */ | |
2448 | mask = slice_range_to_mask(addr, len); | |
2449 | @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top | |
2450 | * return with success: | |
2451 | */ | |
2452 | vma = find_vma(mm, addr); | |
2453 | - if (!vma || (addr + len) <= vma->vm_start) { | |
2454 | + if (check_heap_stack_gap(vma, addr, len)) { | |
2455 | /* remember the address as a hint for next time */ | |
2456 | if (use_cache) | |
2457 | mm->free_area_cache = addr; | |
2458 | @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top | |
2459 | mm->cached_hole_size = vma->vm_start - addr; | |
2460 | ||
2461 | /* try just below the current vma->vm_start */ | |
2462 | - addr = vma->vm_start; | |
2463 | + addr = skip_heap_stack_gap(vma, len); | |
2464 | } | |
2465 | ||
2466 | /* | |
2467 | @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un | |
2468 | if (fixed && addr > (mm->task_size - len)) | |
2469 | return -EINVAL; | |
2470 | ||
2471 | +#ifdef CONFIG_PAX_RANDMMAP | |
2472 | + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP)) | |
2473 | + addr = 0; | |
2474 | +#endif | |
2475 | + | |
2476 | /* If hint, make sure it matches our alignment restrictions */ | |
2477 | if (!fixed && addr) { | |
2478 | addr = _ALIGN_UP(addr, 1ul << pshift); | |
2479 | diff -urNp linux-3.0.3/arch/s390/include/asm/elf.h linux-3.0.3/arch/s390/include/asm/elf.h | |
2480 | --- linux-3.0.3/arch/s390/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
2481 | +++ linux-3.0.3/arch/s390/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
2482 | @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled; | |
2483 | the loader. We need to make sure that it is out of the way of the program | |
2484 | that it will "exec", and that there is sufficient room for the brk. */ | |
2485 | ||
2486 | -extern unsigned long randomize_et_dyn(unsigned long base); | |
2487 | -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2)) | |
2488 | +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2) | |
2489 | + | |
2490 | +#ifdef CONFIG_PAX_ASLR | |
2491 | +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL) | |
2492 | + | |
2493 | +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 ) | |
2494 | +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 ) | |
2495 | +#endif | |
2496 | ||
2497 | /* This yields a mask that user programs can use to figure out what | |
2498 | instruction set this CPU supports. */ | |
2499 | @@ -210,7 +216,4 @@ struct linux_binprm; | |
2500 | #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1 | |
2501 | int arch_setup_additional_pages(struct linux_binprm *, int); | |
2502 | ||
2503 | -extern unsigned long arch_randomize_brk(struct mm_struct *mm); | |
2504 | -#define arch_randomize_brk arch_randomize_brk | |
2505 | - | |
2506 | #endif | |
2507 | diff -urNp linux-3.0.3/arch/s390/include/asm/system.h linux-3.0.3/arch/s390/include/asm/system.h | |
2508 | --- linux-3.0.3/arch/s390/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 | |
2509 | +++ linux-3.0.3/arch/s390/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 | |
2510 | @@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co | |
2511 | extern void (*_machine_halt)(void); | |
2512 | extern void (*_machine_power_off)(void); | |
2513 | ||
2514 | -extern unsigned long arch_align_stack(unsigned long sp); | |
2515 | +#define arch_align_stack(x) ((x) & ~0xfUL) | |
2516 | ||
2517 | static inline int tprot(unsigned long addr) | |
2518 | { | |
2519 | diff -urNp linux-3.0.3/arch/s390/include/asm/uaccess.h linux-3.0.3/arch/s390/include/asm/uaccess.h | |
2520 | --- linux-3.0.3/arch/s390/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
2521 | +++ linux-3.0.3/arch/s390/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
2522 | @@ -235,6 +235,10 @@ static inline unsigned long __must_check | |
2523 | copy_to_user(void __user *to, const void *from, unsigned long n) | |
2524 | { | |
2525 | might_fault(); | |
2526 | + | |
2527 | + if ((long)n < 0) | |
2528 | + return n; | |
2529 | + | |
2530 | if (access_ok(VERIFY_WRITE, to, n)) | |
2531 | n = __copy_to_user(to, from, n); | |
2532 | return n; | |
2533 | @@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void | |
2534 | static inline unsigned long __must_check | |
2535 | __copy_from_user(void *to, const void __user *from, unsigned long n) | |
2536 | { | |
2537 | + if ((long)n < 0) | |
2538 | + return n; | |
2539 | + | |
2540 | if (__builtin_constant_p(n) && (n <= 256)) | |
2541 | return uaccess.copy_from_user_small(n, from, to); | |
2542 | else | |
2543 | @@ -294,6 +301,10 @@ copy_from_user(void *to, const void __us | |
2544 | unsigned int sz = __compiletime_object_size(to); | |
2545 | ||
2546 | might_fault(); | |
2547 | + | |
2548 | + if ((long)n < 0) | |
2549 | + return n; | |
2550 | + | |
2551 | if (unlikely(sz != -1 && sz < n)) { | |
2552 | copy_from_user_overflow(); | |
2553 | return n; | |
2554 | diff -urNp linux-3.0.3/arch/s390/kernel/module.c linux-3.0.3/arch/s390/kernel/module.c | |
2555 | --- linux-3.0.3/arch/s390/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
2556 | +++ linux-3.0.3/arch/s390/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
2557 | @@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, | |
2558 | ||
2559 | /* Increase core size by size of got & plt and set start | |
2560 | offsets for got and plt. */ | |
2561 | - me->core_size = ALIGN(me->core_size, 4); | |
2562 | - me->arch.got_offset = me->core_size; | |
2563 | - me->core_size += me->arch.got_size; | |
2564 | - me->arch.plt_offset = me->core_size; | |
2565 | - me->core_size += me->arch.plt_size; | |
2566 | + me->core_size_rw = ALIGN(me->core_size_rw, 4); | |
2567 | + me->arch.got_offset = me->core_size_rw; | |
2568 | + me->core_size_rw += me->arch.got_size; | |
2569 | + me->arch.plt_offset = me->core_size_rx; | |
2570 | + me->core_size_rx += me->arch.plt_size; | |
2571 | return 0; | |
2572 | } | |
2573 | ||
2574 | @@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2575 | if (info->got_initialized == 0) { | |
2576 | Elf_Addr *gotent; | |
2577 | ||
2578 | - gotent = me->module_core + me->arch.got_offset + | |
2579 | + gotent = me->module_core_rw + me->arch.got_offset + | |
2580 | info->got_offset; | |
2581 | *gotent = val; | |
2582 | info->got_initialized = 1; | |
2583 | @@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2584 | else if (r_type == R_390_GOTENT || | |
2585 | r_type == R_390_GOTPLTENT) | |
2586 | *(unsigned int *) loc = | |
2587 | - (val + (Elf_Addr) me->module_core - loc) >> 1; | |
2588 | + (val + (Elf_Addr) me->module_core_rw - loc) >> 1; | |
2589 | else if (r_type == R_390_GOT64 || | |
2590 | r_type == R_390_GOTPLT64) | |
2591 | *(unsigned long *) loc = val; | |
2592 | @@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2593 | case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ | |
2594 | if (info->plt_initialized == 0) { | |
2595 | unsigned int *ip; | |
2596 | - ip = me->module_core + me->arch.plt_offset + | |
2597 | + ip = me->module_core_rx + me->arch.plt_offset + | |
2598 | info->plt_offset; | |
2599 | #ifndef CONFIG_64BIT | |
2600 | ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */ | |
2601 | @@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2602 | val - loc + 0xffffUL < 0x1ffffeUL) || | |
2603 | (r_type == R_390_PLT32DBL && | |
2604 | val - loc + 0xffffffffULL < 0x1fffffffeULL))) | |
2605 | - val = (Elf_Addr) me->module_core + | |
2606 | + val = (Elf_Addr) me->module_core_rx + | |
2607 | me->arch.plt_offset + | |
2608 | info->plt_offset; | |
2609 | val += rela->r_addend - loc; | |
2610 | @@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2611 | case R_390_GOTOFF32: /* 32 bit offset to GOT. */ | |
2612 | case R_390_GOTOFF64: /* 64 bit offset to GOT. */ | |
2613 | val = val + rela->r_addend - | |
2614 | - ((Elf_Addr) me->module_core + me->arch.got_offset); | |
2615 | + ((Elf_Addr) me->module_core_rw + me->arch.got_offset); | |
2616 | if (r_type == R_390_GOTOFF16) | |
2617 | *(unsigned short *) loc = val; | |
2618 | else if (r_type == R_390_GOTOFF32) | |
2619 | @@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base | |
2620 | break; | |
2621 | case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */ | |
2622 | case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */ | |
2623 | - val = (Elf_Addr) me->module_core + me->arch.got_offset + | |
2624 | + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset + | |
2625 | rela->r_addend - loc; | |
2626 | if (r_type == R_390_GOTPC) | |
2627 | *(unsigned int *) loc = val; | |
2628 | diff -urNp linux-3.0.3/arch/s390/kernel/process.c linux-3.0.3/arch/s390/kernel/process.c | |
2629 | --- linux-3.0.3/arch/s390/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
2630 | +++ linux-3.0.3/arch/s390/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
2631 | @@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_stru | |
2632 | } | |
2633 | return 0; | |
2634 | } | |
2635 | - | |
2636 | -unsigned long arch_align_stack(unsigned long sp) | |
2637 | -{ | |
2638 | - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) | |
2639 | - sp -= get_random_int() & ~PAGE_MASK; | |
2640 | - return sp & ~0xf; | |
2641 | -} | |
2642 | - | |
2643 | -static inline unsigned long brk_rnd(void) | |
2644 | -{ | |
2645 | - /* 8MB for 32bit, 1GB for 64bit */ | |
2646 | - if (is_32bit_task()) | |
2647 | - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT; | |
2648 | - else | |
2649 | - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT; | |
2650 | -} | |
2651 | - | |
2652 | -unsigned long arch_randomize_brk(struct mm_struct *mm) | |
2653 | -{ | |
2654 | - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd()); | |
2655 | - | |
2656 | - if (ret < mm->brk) | |
2657 | - return mm->brk; | |
2658 | - return ret; | |
2659 | -} | |
2660 | - | |
2661 | -unsigned long randomize_et_dyn(unsigned long base) | |
2662 | -{ | |
2663 | - unsigned long ret = PAGE_ALIGN(base + brk_rnd()); | |
2664 | - | |
2665 | - if (!(current->flags & PF_RANDOMIZE)) | |
2666 | - return base; | |
2667 | - if (ret < base) | |
2668 | - return base; | |
2669 | - return ret; | |
2670 | -} | |
2671 | diff -urNp linux-3.0.3/arch/s390/kernel/setup.c linux-3.0.3/arch/s390/kernel/setup.c | |
2672 | --- linux-3.0.3/arch/s390/kernel/setup.c 2011-07-21 22:17:23.000000000 -0400 | |
2673 | +++ linux-3.0.3/arch/s390/kernel/setup.c 2011-08-23 21:47:55.000000000 -0400 | |
2674 | @@ -271,7 +271,7 @@ static int __init early_parse_mem(char * | |
2675 | } | |
2676 | early_param("mem", early_parse_mem); | |
2677 | ||
2678 | -unsigned int user_mode = HOME_SPACE_MODE; | |
2679 | +unsigned int user_mode = SECONDARY_SPACE_MODE; | |
2680 | EXPORT_SYMBOL_GPL(user_mode); | |
2681 | ||
2682 | static int set_amode_and_uaccess(unsigned long user_amode, | |
2683 | diff -urNp linux-3.0.3/arch/s390/mm/mmap.c linux-3.0.3/arch/s390/mm/mmap.c | |
2684 | --- linux-3.0.3/arch/s390/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
2685 | +++ linux-3.0.3/arch/s390/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400 | |
2686 | @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str | |
2687 | */ | |
2688 | if (mmap_is_legacy()) { | |
2689 | mm->mmap_base = TASK_UNMAPPED_BASE; | |
2690 | + | |
2691 | +#ifdef CONFIG_PAX_RANDMMAP | |
2692 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2693 | + mm->mmap_base += mm->delta_mmap; | |
2694 | +#endif | |
2695 | + | |
2696 | mm->get_unmapped_area = arch_get_unmapped_area; | |
2697 | mm->unmap_area = arch_unmap_area; | |
2698 | } else { | |
2699 | mm->mmap_base = mmap_base(); | |
2700 | + | |
2701 | +#ifdef CONFIG_PAX_RANDMMAP | |
2702 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2703 | + mm->mmap_base -= mm->delta_mmap + mm->delta_stack; | |
2704 | +#endif | |
2705 | + | |
2706 | mm->get_unmapped_area = arch_get_unmapped_area_topdown; | |
2707 | mm->unmap_area = arch_unmap_area_topdown; | |
2708 | } | |
2709 | @@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str | |
2710 | */ | |
2711 | if (mmap_is_legacy()) { | |
2712 | mm->mmap_base = TASK_UNMAPPED_BASE; | |
2713 | + | |
2714 | +#ifdef CONFIG_PAX_RANDMMAP | |
2715 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2716 | + mm->mmap_base += mm->delta_mmap; | |
2717 | +#endif | |
2718 | + | |
2719 | mm->get_unmapped_area = s390_get_unmapped_area; | |
2720 | mm->unmap_area = arch_unmap_area; | |
2721 | } else { | |
2722 | mm->mmap_base = mmap_base(); | |
2723 | + | |
2724 | +#ifdef CONFIG_PAX_RANDMMAP | |
2725 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
2726 | + mm->mmap_base -= mm->delta_mmap + mm->delta_stack; | |
2727 | +#endif | |
2728 | + | |
2729 | mm->get_unmapped_area = s390_get_unmapped_area_topdown; | |
2730 | mm->unmap_area = arch_unmap_area_topdown; | |
2731 | } | |
2732 | diff -urNp linux-3.0.3/arch/score/include/asm/system.h linux-3.0.3/arch/score/include/asm/system.h | |
2733 | --- linux-3.0.3/arch/score/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 | |
2734 | +++ linux-3.0.3/arch/score/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 | |
2735 | @@ -17,7 +17,7 @@ do { \ | |
2736 | #define finish_arch_switch(prev) do {} while (0) | |
2737 | ||
2738 | typedef void (*vi_handler_t)(void); | |
2739 | -extern unsigned long arch_align_stack(unsigned long sp); | |
2740 | +#define arch_align_stack(x) (x) | |
2741 | ||
2742 | #define mb() barrier() | |
2743 | #define rmb() barrier() | |
2744 | diff -urNp linux-3.0.3/arch/score/kernel/process.c linux-3.0.3/arch/score/kernel/process.c | |
2745 | --- linux-3.0.3/arch/score/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
2746 | +++ linux-3.0.3/arch/score/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
2747 | @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru | |
2748 | ||
2749 | return task_pt_regs(task)->cp0_epc; | |
2750 | } | |
2751 | - | |
2752 | -unsigned long arch_align_stack(unsigned long sp) | |
2753 | -{ | |
2754 | - return sp; | |
2755 | -} | |
2756 | diff -urNp linux-3.0.3/arch/sh/mm/mmap.c linux-3.0.3/arch/sh/mm/mmap.c | |
2757 | --- linux-3.0.3/arch/sh/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
2758 | +++ linux-3.0.3/arch/sh/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400 | |
2759 | @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str | |
2760 | addr = PAGE_ALIGN(addr); | |
2761 | ||
2762 | vma = find_vma(mm, addr); | |
2763 | - if (TASK_SIZE - len >= addr && | |
2764 | - (!vma || addr + len <= vma->vm_start)) | |
2765 | + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
2766 | return addr; | |
2767 | } | |
2768 | ||
2769 | @@ -106,7 +105,7 @@ full_search: | |
2770 | } | |
2771 | return -ENOMEM; | |
2772 | } | |
2773 | - if (likely(!vma || addr + len <= vma->vm_start)) { | |
2774 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
2775 | /* | |
2776 | * Remember the place where we stopped the search: | |
2777 | */ | |
2778 | @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi | |
2779 | addr = PAGE_ALIGN(addr); | |
2780 | ||
2781 | vma = find_vma(mm, addr); | |
2782 | - if (TASK_SIZE - len >= addr && | |
2783 | - (!vma || addr + len <= vma->vm_start)) | |
2784 | + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
2785 | return addr; | |
2786 | } | |
2787 | ||
2788 | @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi | |
2789 | /* make sure it can fit in the remaining address space */ | |
2790 | if (likely(addr > len)) { | |
2791 | vma = find_vma(mm, addr-len); | |
2792 | - if (!vma || addr <= vma->vm_start) { | |
2793 | + if (check_heap_stack_gap(vma, addr - len, len)) { | |
2794 | /* remember the address as a hint for next time */ | |
2795 | return (mm->free_area_cache = addr-len); | |
2796 | } | |
2797 | @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi | |
2798 | if (unlikely(mm->mmap_base < len)) | |
2799 | goto bottomup; | |
2800 | ||
2801 | - addr = mm->mmap_base-len; | |
2802 | - if (do_colour_align) | |
2803 | - addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
2804 | + addr = mm->mmap_base - len; | |
2805 | ||
2806 | do { | |
2807 | + if (do_colour_align) | |
2808 | + addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
2809 | /* | |
2810 | * Lookup failure means no vma is above this address, | |
2811 | * else if new region fits below vma->vm_start, | |
2812 | * return with success: | |
2813 | */ | |
2814 | vma = find_vma(mm, addr); | |
2815 | - if (likely(!vma || addr+len <= vma->vm_start)) { | |
2816 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
2817 | /* remember the address as a hint for next time */ | |
2818 | return (mm->free_area_cache = addr); | |
2819 | } | |
2820 | @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi | |
2821 | mm->cached_hole_size = vma->vm_start - addr; | |
2822 | ||
2823 | /* try just below the current vma->vm_start */ | |
2824 | - addr = vma->vm_start-len; | |
2825 | - if (do_colour_align) | |
2826 | - addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
2827 | - } while (likely(len < vma->vm_start)); | |
2828 | + addr = skip_heap_stack_gap(vma, len); | |
2829 | + } while (!IS_ERR_VALUE(addr)); | |
2830 | ||
2831 | bottomup: | |
2832 | /* | |
2833 | diff -urNp linux-3.0.3/arch/sparc/include/asm/atomic_64.h linux-3.0.3/arch/sparc/include/asm/atomic_64.h | |
2834 | --- linux-3.0.3/arch/sparc/include/asm/atomic_64.h 2011-07-21 22:17:23.000000000 -0400 | |
2835 | +++ linux-3.0.3/arch/sparc/include/asm/atomic_64.h 2011-08-23 21:48:14.000000000 -0400 | |
2836 | @@ -14,18 +14,40 @@ | |
2837 | #define ATOMIC64_INIT(i) { (i) } | |
2838 | ||
2839 | #define atomic_read(v) (*(volatile int *)&(v)->counter) | |
2840 | +static inline int atomic_read_unchecked(const atomic_unchecked_t *v) | |
2841 | +{ | |
2842 | + return v->counter; | |
2843 | +} | |
2844 | #define atomic64_read(v) (*(volatile long *)&(v)->counter) | |
2845 | +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v) | |
2846 | +{ | |
2847 | + return v->counter; | |
2848 | +} | |
2849 | ||
2850 | #define atomic_set(v, i) (((v)->counter) = i) | |
2851 | +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i) | |
2852 | +{ | |
2853 | + v->counter = i; | |
2854 | +} | |
2855 | #define atomic64_set(v, i) (((v)->counter) = i) | |
2856 | +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i) | |
2857 | +{ | |
2858 | + v->counter = i; | |
2859 | +} | |
2860 | ||
2861 | extern void atomic_add(int, atomic_t *); | |
2862 | +extern void atomic_add_unchecked(int, atomic_unchecked_t *); | |
2863 | extern void atomic64_add(long, atomic64_t *); | |
2864 | +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *); | |
2865 | extern void atomic_sub(int, atomic_t *); | |
2866 | +extern void atomic_sub_unchecked(int, atomic_unchecked_t *); | |
2867 | extern void atomic64_sub(long, atomic64_t *); | |
2868 | +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *); | |
2869 | ||
2870 | extern int atomic_add_ret(int, atomic_t *); | |
2871 | +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *); | |
2872 | extern long atomic64_add_ret(long, atomic64_t *); | |
2873 | +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *); | |
2874 | extern int atomic_sub_ret(int, atomic_t *); | |
2875 | extern long atomic64_sub_ret(long, atomic64_t *); | |
2876 | ||
2877 | @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi | |
2878 | #define atomic64_dec_return(v) atomic64_sub_ret(1, v) | |
2879 | ||
2880 | #define atomic_inc_return(v) atomic_add_ret(1, v) | |
2881 | +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v) | |
2882 | +{ | |
2883 | + return atomic_add_ret_unchecked(1, v); | |
2884 | +} | |
2885 | #define atomic64_inc_return(v) atomic64_add_ret(1, v) | |
2886 | +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v) | |
2887 | +{ | |
2888 | + return atomic64_add_ret_unchecked(1, v); | |
2889 | +} | |
2890 | ||
2891 | #define atomic_sub_return(i, v) atomic_sub_ret(i, v) | |
2892 | #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v) | |
2893 | ||
2894 | #define atomic_add_return(i, v) atomic_add_ret(i, v) | |
2895 | +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v) | |
2896 | +{ | |
2897 | + return atomic_add_ret_unchecked(i, v); | |
2898 | +} | |
2899 | #define atomic64_add_return(i, v) atomic64_add_ret(i, v) | |
2900 | +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v) | |
2901 | +{ | |
2902 | + return atomic64_add_ret_unchecked(i, v); | |
2903 | +} | |
2904 | ||
2905 | /* | |
2906 | * atomic_inc_and_test - increment and test | |
2907 | @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi | |
2908 | * other cases. | |
2909 | */ | |
2910 | #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0) | |
2911 | +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v) | |
2912 | +{ | |
2913 | + return atomic_inc_return_unchecked(v) == 0; | |
2914 | +} | |
2915 | #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0) | |
2916 | ||
2917 | #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0) | |
2918 | @@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi | |
2919 | #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0) | |
2920 | ||
2921 | #define atomic_inc(v) atomic_add(1, v) | |
2922 | +static inline void atomic_inc_unchecked(atomic_unchecked_t *v) | |
2923 | +{ | |
2924 | + atomic_add_unchecked(1, v); | |
2925 | +} | |
2926 | #define atomic64_inc(v) atomic64_add(1, v) | |
2927 | +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v) | |
2928 | +{ | |
2929 | + atomic64_add_unchecked(1, v); | |
2930 | +} | |
2931 | ||
2932 | #define atomic_dec(v) atomic_sub(1, v) | |
2933 | +static inline void atomic_dec_unchecked(atomic_unchecked_t *v) | |
2934 | +{ | |
2935 | + atomic_sub_unchecked(1, v); | |
2936 | +} | |
2937 | #define atomic64_dec(v) atomic64_sub(1, v) | |
2938 | +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v) | |
2939 | +{ | |
2940 | + atomic64_sub_unchecked(1, v); | |
2941 | +} | |
2942 | ||
2943 | #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0) | |
2944 | #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0) | |
2945 | ||
2946 | #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n))) | |
2947 | +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new) | |
2948 | +{ | |
2949 | + return cmpxchg(&v->counter, old, new); | |
2950 | +} | |
2951 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new)) | |
2952 | +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new) | |
2953 | +{ | |
2954 | + return xchg(&v->counter, new); | |
2955 | +} | |
2956 | ||
2957 | static inline int atomic_add_unless(atomic_t *v, int a, int u) | |
2958 | { | |
2959 | - int c, old; | |
2960 | + int c, old, new; | |
2961 | c = atomic_read(v); | |
2962 | for (;;) { | |
2963 | - if (unlikely(c == (u))) | |
2964 | + if (unlikely(c == u)) | |
2965 | break; | |
2966 | - old = atomic_cmpxchg((v), c, c + (a)); | |
2967 | + | |
2968 | + asm volatile("addcc %2, %0, %0\n" | |
2969 | + | |
2970 | +#ifdef CONFIG_PAX_REFCOUNT | |
2971 | + "tvs %%icc, 6\n" | |
2972 | +#endif | |
2973 | + | |
2974 | + : "=r" (new) | |
2975 | + : "0" (c), "ir" (a) | |
2976 | + : "cc"); | |
2977 | + | |
2978 | + old = atomic_cmpxchg(v, c, new); | |
2979 | if (likely(old == c)) | |
2980 | break; | |
2981 | c = old; | |
2982 | } | |
2983 | - return c != (u); | |
2984 | + return c != u; | |
2985 | } | |
2986 | ||
2987 | #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0) | |
2988 | @@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom | |
2989 | #define atomic64_cmpxchg(v, o, n) \ | |
2990 | ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n))) | |
2991 | #define atomic64_xchg(v, new) (xchg(&((v)->counter), new)) | |
2992 | +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new) | |
2993 | +{ | |
2994 | + return xchg(&v->counter, new); | |
2995 | +} | |
2996 | ||
2997 | static inline long atomic64_add_unless(atomic64_t *v, long a, long u) | |
2998 | { | |
2999 | - long c, old; | |
3000 | + long c, old, new; | |
3001 | c = atomic64_read(v); | |
3002 | for (;;) { | |
3003 | - if (unlikely(c == (u))) | |
3004 | + if (unlikely(c == u)) | |
3005 | break; | |
3006 | - old = atomic64_cmpxchg((v), c, c + (a)); | |
3007 | + | |
3008 | + asm volatile("addcc %2, %0, %0\n" | |
3009 | + | |
3010 | +#ifdef CONFIG_PAX_REFCOUNT | |
3011 | + "tvs %%xcc, 6\n" | |
3012 | +#endif | |
3013 | + | |
3014 | + : "=r" (new) | |
3015 | + : "0" (c), "ir" (a) | |
3016 | + : "cc"); | |
3017 | + | |
3018 | + old = atomic64_cmpxchg(v, c, new); | |
3019 | if (likely(old == c)) | |
3020 | break; | |
3021 | c = old; | |
3022 | } | |
3023 | - return c != (u); | |
3024 | + return c != u; | |
3025 | } | |
3026 | ||
3027 | #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0) | |
3028 | diff -urNp linux-3.0.3/arch/sparc/include/asm/cache.h linux-3.0.3/arch/sparc/include/asm/cache.h | |
3029 | --- linux-3.0.3/arch/sparc/include/asm/cache.h 2011-07-21 22:17:23.000000000 -0400 | |
3030 | +++ linux-3.0.3/arch/sparc/include/asm/cache.h 2011-08-23 21:47:55.000000000 -0400 | |
3031 | @@ -10,7 +10,7 @@ | |
3032 | #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long) | |
3033 | ||
3034 | #define L1_CACHE_SHIFT 5 | |
3035 | -#define L1_CACHE_BYTES 32 | |
3036 | +#define L1_CACHE_BYTES 32UL | |
3037 | ||
3038 | #ifdef CONFIG_SPARC32 | |
3039 | #define SMP_CACHE_BYTES_SHIFT 5 | |
3040 | diff -urNp linux-3.0.3/arch/sparc/include/asm/elf_32.h linux-3.0.3/arch/sparc/include/asm/elf_32.h | |
3041 | --- linux-3.0.3/arch/sparc/include/asm/elf_32.h 2011-07-21 22:17:23.000000000 -0400 | |
3042 | +++ linux-3.0.3/arch/sparc/include/asm/elf_32.h 2011-08-23 21:47:55.000000000 -0400 | |
3043 | @@ -114,6 +114,13 @@ typedef struct { | |
3044 | ||
3045 | #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE) | |
3046 | ||
3047 | +#ifdef CONFIG_PAX_ASLR | |
3048 | +#define PAX_ELF_ET_DYN_BASE 0x10000UL | |
3049 | + | |
3050 | +#define PAX_DELTA_MMAP_LEN 16 | |
3051 | +#define PAX_DELTA_STACK_LEN 16 | |
3052 | +#endif | |
3053 | + | |
3054 | /* This yields a mask that user programs can use to figure out what | |
3055 | instruction set this cpu supports. This can NOT be done in userspace | |
3056 | on Sparc. */ | |
3057 | diff -urNp linux-3.0.3/arch/sparc/include/asm/elf_64.h linux-3.0.3/arch/sparc/include/asm/elf_64.h | |
3058 | --- linux-3.0.3/arch/sparc/include/asm/elf_64.h 2011-08-23 21:44:40.000000000 -0400 | |
3059 | +++ linux-3.0.3/arch/sparc/include/asm/elf_64.h 2011-08-23 21:47:55.000000000 -0400 | |
3060 | @@ -180,6 +180,13 @@ typedef struct { | |
3061 | #define ELF_ET_DYN_BASE 0x0000010000000000UL | |
3062 | #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL | |
3063 | ||
3064 | +#ifdef CONFIG_PAX_ASLR | |
3065 | +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL) | |
3066 | + | |
3067 | +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28) | |
3068 | +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29) | |
3069 | +#endif | |
3070 | + | |
3071 | extern unsigned long sparc64_elf_hwcap; | |
3072 | #define ELF_HWCAP sparc64_elf_hwcap | |
3073 | ||
3074 | diff -urNp linux-3.0.3/arch/sparc/include/asm/pgtable_32.h linux-3.0.3/arch/sparc/include/asm/pgtable_32.h | |
3075 | --- linux-3.0.3/arch/sparc/include/asm/pgtable_32.h 2011-07-21 22:17:23.000000000 -0400 | |
3076 | +++ linux-3.0.3/arch/sparc/include/asm/pgtable_32.h 2011-08-23 21:47:55.000000000 -0400 | |
3077 | @@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd) | |
3078 | BTFIXUPDEF_INT(page_none) | |
3079 | BTFIXUPDEF_INT(page_copy) | |
3080 | BTFIXUPDEF_INT(page_readonly) | |
3081 | + | |
3082 | +#ifdef CONFIG_PAX_PAGEEXEC | |
3083 | +BTFIXUPDEF_INT(page_shared_noexec) | |
3084 | +BTFIXUPDEF_INT(page_copy_noexec) | |
3085 | +BTFIXUPDEF_INT(page_readonly_noexec) | |
3086 | +#endif | |
3087 | + | |
3088 | BTFIXUPDEF_INT(page_kernel) | |
3089 | ||
3090 | #define PMD_SHIFT SUN4C_PMD_SHIFT | |
3091 | @@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED; | |
3092 | #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy)) | |
3093 | #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly)) | |
3094 | ||
3095 | +#ifdef CONFIG_PAX_PAGEEXEC | |
3096 | +extern pgprot_t PAGE_SHARED_NOEXEC; | |
3097 | +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec)) | |
3098 | +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec)) | |
3099 | +#else | |
3100 | +# define PAGE_SHARED_NOEXEC PAGE_SHARED | |
3101 | +# define PAGE_COPY_NOEXEC PAGE_COPY | |
3102 | +# define PAGE_READONLY_NOEXEC PAGE_READONLY | |
3103 | +#endif | |
3104 | + | |
3105 | extern unsigned long page_kernel; | |
3106 | ||
3107 | #ifdef MODULE | |
3108 | diff -urNp linux-3.0.3/arch/sparc/include/asm/pgtsrmmu.h linux-3.0.3/arch/sparc/include/asm/pgtsrmmu.h | |
3109 | --- linux-3.0.3/arch/sparc/include/asm/pgtsrmmu.h 2011-07-21 22:17:23.000000000 -0400 | |
3110 | +++ linux-3.0.3/arch/sparc/include/asm/pgtsrmmu.h 2011-08-23 21:47:55.000000000 -0400 | |
3111 | @@ -115,6 +115,13 @@ | |
3112 | SRMMU_EXEC | SRMMU_REF) | |
3113 | #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \ | |
3114 | SRMMU_EXEC | SRMMU_REF) | |
3115 | + | |
3116 | +#ifdef CONFIG_PAX_PAGEEXEC | |
3117 | +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF) | |
3118 | +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF) | |
3119 | +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF) | |
3120 | +#endif | |
3121 | + | |
3122 | #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \ | |
3123 | SRMMU_DIRTY | SRMMU_REF) | |
3124 | ||
3125 | diff -urNp linux-3.0.3/arch/sparc/include/asm/spinlock_64.h linux-3.0.3/arch/sparc/include/asm/spinlock_64.h | |
3126 | --- linux-3.0.3/arch/sparc/include/asm/spinlock_64.h 2011-07-21 22:17:23.000000000 -0400 | |
3127 | +++ linux-3.0.3/arch/sparc/include/asm/spinlock_64.h 2011-08-23 21:47:55.000000000 -0400 | |
3128 | @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags( | |
3129 | ||
3130 | /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */ | |
3131 | ||
3132 | -static void inline arch_read_lock(arch_rwlock_t *lock) | |
3133 | +static inline void arch_read_lock(arch_rwlock_t *lock) | |
3134 | { | |
3135 | unsigned long tmp1, tmp2; | |
3136 | ||
3137 | __asm__ __volatile__ ( | |
3138 | "1: ldsw [%2], %0\n" | |
3139 | " brlz,pn %0, 2f\n" | |
3140 | -"4: add %0, 1, %1\n" | |
3141 | +"4: addcc %0, 1, %1\n" | |
3142 | + | |
3143 | +#ifdef CONFIG_PAX_REFCOUNT | |
3144 | +" tvs %%icc, 6\n" | |
3145 | +#endif | |
3146 | + | |
3147 | " cas [%2], %0, %1\n" | |
3148 | " cmp %0, %1\n" | |
3149 | " bne,pn %%icc, 1b\n" | |
3150 | @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r | |
3151 | " .previous" | |
3152 | : "=&r" (tmp1), "=&r" (tmp2) | |
3153 | : "r" (lock) | |
3154 | - : "memory"); | |
3155 | + : "memory", "cc"); | |
3156 | } | |
3157 | ||
3158 | -static int inline arch_read_trylock(arch_rwlock_t *lock) | |
3159 | +static inline int arch_read_trylock(arch_rwlock_t *lock) | |
3160 | { | |
3161 | int tmp1, tmp2; | |
3162 | ||
3163 | @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch | |
3164 | "1: ldsw [%2], %0\n" | |
3165 | " brlz,a,pn %0, 2f\n" | |
3166 | " mov 0, %0\n" | |
3167 | -" add %0, 1, %1\n" | |
3168 | +" addcc %0, 1, %1\n" | |
3169 | + | |
3170 | +#ifdef CONFIG_PAX_REFCOUNT | |
3171 | +" tvs %%icc, 6\n" | |
3172 | +#endif | |
3173 | + | |
3174 | " cas [%2], %0, %1\n" | |
3175 | " cmp %0, %1\n" | |
3176 | " bne,pn %%icc, 1b\n" | |
3177 | @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch | |
3178 | return tmp1; | |
3179 | } | |
3180 | ||
3181 | -static void inline arch_read_unlock(arch_rwlock_t *lock) | |
3182 | +static inline void arch_read_unlock(arch_rwlock_t *lock) | |
3183 | { | |
3184 | unsigned long tmp1, tmp2; | |
3185 | ||
3186 | __asm__ __volatile__( | |
3187 | "1: lduw [%2], %0\n" | |
3188 | -" sub %0, 1, %1\n" | |
3189 | +" subcc %0, 1, %1\n" | |
3190 | + | |
3191 | +#ifdef CONFIG_PAX_REFCOUNT | |
3192 | +" tvs %%icc, 6\n" | |
3193 | +#endif | |
3194 | + | |
3195 | " cas [%2], %0, %1\n" | |
3196 | " cmp %0, %1\n" | |
3197 | " bne,pn %%xcc, 1b\n" | |
3198 | @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch | |
3199 | : "memory"); | |
3200 | } | |
3201 | ||
3202 | -static void inline arch_write_lock(arch_rwlock_t *lock) | |
3203 | +static inline void arch_write_lock(arch_rwlock_t *lock) | |
3204 | { | |
3205 | unsigned long mask, tmp1, tmp2; | |
3206 | ||
3207 | @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_ | |
3208 | : "memory"); | |
3209 | } | |
3210 | ||
3211 | -static void inline arch_write_unlock(arch_rwlock_t *lock) | |
3212 | +static inline void arch_write_unlock(arch_rwlock_t *lock) | |
3213 | { | |
3214 | __asm__ __volatile__( | |
3215 | " stw %%g0, [%0]" | |
3216 | @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc | |
3217 | : "memory"); | |
3218 | } | |
3219 | ||
3220 | -static int inline arch_write_trylock(arch_rwlock_t *lock) | |
3221 | +static inline int arch_write_trylock(arch_rwlock_t *lock) | |
3222 | { | |
3223 | unsigned long mask, tmp1, tmp2, result; | |
3224 | ||
3225 | diff -urNp linux-3.0.3/arch/sparc/include/asm/thread_info_32.h linux-3.0.3/arch/sparc/include/asm/thread_info_32.h | |
3226 | --- linux-3.0.3/arch/sparc/include/asm/thread_info_32.h 2011-07-21 22:17:23.000000000 -0400 | |
3227 | +++ linux-3.0.3/arch/sparc/include/asm/thread_info_32.h 2011-08-23 21:47:55.000000000 -0400 | |
3228 | @@ -50,6 +50,8 @@ struct thread_info { | |
3229 | unsigned long w_saved; | |
3230 | ||
3231 | struct restart_block restart_block; | |
3232 | + | |
3233 | + unsigned long lowest_stack; | |
3234 | }; | |
3235 | ||
3236 | /* | |
3237 | diff -urNp linux-3.0.3/arch/sparc/include/asm/thread_info_64.h linux-3.0.3/arch/sparc/include/asm/thread_info_64.h | |
3238 | --- linux-3.0.3/arch/sparc/include/asm/thread_info_64.h 2011-07-21 22:17:23.000000000 -0400 | |
3239 | +++ linux-3.0.3/arch/sparc/include/asm/thread_info_64.h 2011-08-23 21:47:55.000000000 -0400 | |
3240 | @@ -63,6 +63,8 @@ struct thread_info { | |
3241 | struct pt_regs *kern_una_regs; | |
3242 | unsigned int kern_una_insn; | |
3243 | ||
3244 | + unsigned long lowest_stack; | |
3245 | + | |
3246 | unsigned long fpregs[0] __attribute__ ((aligned(64))); | |
3247 | }; | |
3248 | ||
3249 | diff -urNp linux-3.0.3/arch/sparc/include/asm/uaccess_32.h linux-3.0.3/arch/sparc/include/asm/uaccess_32.h | |
3250 | --- linux-3.0.3/arch/sparc/include/asm/uaccess_32.h 2011-07-21 22:17:23.000000000 -0400 | |
3251 | +++ linux-3.0.3/arch/sparc/include/asm/uaccess_32.h 2011-08-23 21:47:55.000000000 -0400 | |
3252 | @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __ | |
3253 | ||
3254 | static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) | |
3255 | { | |
3256 | - if (n && __access_ok((unsigned long) to, n)) | |
3257 | + if ((long)n < 0) | |
3258 | + return n; | |
3259 | + | |
3260 | + if (n && __access_ok((unsigned long) to, n)) { | |
3261 | + if (!__builtin_constant_p(n)) | |
3262 | + check_object_size(from, n, true); | |
3263 | return __copy_user(to, (__force void __user *) from, n); | |
3264 | - else | |
3265 | + } else | |
3266 | return n; | |
3267 | } | |
3268 | ||
3269 | static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n) | |
3270 | { | |
3271 | + if ((long)n < 0) | |
3272 | + return n; | |
3273 | + | |
3274 | + if (!__builtin_constant_p(n)) | |
3275 | + check_object_size(from, n, true); | |
3276 | + | |
3277 | return __copy_user(to, (__force void __user *) from, n); | |
3278 | } | |
3279 | ||
3280 | static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n) | |
3281 | { | |
3282 | - if (n && __access_ok((unsigned long) from, n)) | |
3283 | + if ((long)n < 0) | |
3284 | + return n; | |
3285 | + | |
3286 | + if (n && __access_ok((unsigned long) from, n)) { | |
3287 | + if (!__builtin_constant_p(n)) | |
3288 | + check_object_size(to, n, false); | |
3289 | return __copy_user((__force void __user *) to, from, n); | |
3290 | - else | |
3291 | + } else | |
3292 | return n; | |
3293 | } | |
3294 | ||
3295 | static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n) | |
3296 | { | |
3297 | + if ((long)n < 0) | |
3298 | + return n; | |
3299 | + | |
3300 | return __copy_user((__force void __user *) to, from, n); | |
3301 | } | |
3302 | ||
3303 | diff -urNp linux-3.0.3/arch/sparc/include/asm/uaccess_64.h linux-3.0.3/arch/sparc/include/asm/uaccess_64.h | |
3304 | --- linux-3.0.3/arch/sparc/include/asm/uaccess_64.h 2011-07-21 22:17:23.000000000 -0400 | |
3305 | +++ linux-3.0.3/arch/sparc/include/asm/uaccess_64.h 2011-08-23 21:47:55.000000000 -0400 | |
3306 | @@ -10,6 +10,7 @@ | |
3307 | #include <linux/compiler.h> | |
3308 | #include <linux/string.h> | |
3309 | #include <linux/thread_info.h> | |
3310 | +#include <linux/kernel.h> | |
3311 | #include <asm/asi.h> | |
3312 | #include <asm/system.h> | |
3313 | #include <asm/spitfire.h> | |
3314 | @@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu | |
3315 | static inline unsigned long __must_check | |
3316 | copy_from_user(void *to, const void __user *from, unsigned long size) | |
3317 | { | |
3318 | - unsigned long ret = ___copy_from_user(to, from, size); | |
3319 | + unsigned long ret; | |
3320 | ||
3321 | + if ((long)size < 0 || size > INT_MAX) | |
3322 | + return size; | |
3323 | + | |
3324 | + if (!__builtin_constant_p(size)) | |
3325 | + check_object_size(to, size, false); | |
3326 | + | |
3327 | + ret = ___copy_from_user(to, from, size); | |
3328 | if (unlikely(ret)) | |
3329 | ret = copy_from_user_fixup(to, from, size); | |
3330 | ||
3331 | @@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup( | |
3332 | static inline unsigned long __must_check | |
3333 | copy_to_user(void __user *to, const void *from, unsigned long size) | |
3334 | { | |
3335 | - unsigned long ret = ___copy_to_user(to, from, size); | |
3336 | + unsigned long ret; | |
3337 | + | |
3338 | + if ((long)size < 0 || size > INT_MAX) | |
3339 | + return size; | |
3340 | + | |
3341 | + if (!__builtin_constant_p(size)) | |
3342 | + check_object_size(from, size, true); | |
3343 | ||
3344 | + ret = ___copy_to_user(to, from, size); | |
3345 | if (unlikely(ret)) | |
3346 | ret = copy_to_user_fixup(to, from, size); | |
3347 | return ret; | |
3348 | diff -urNp linux-3.0.3/arch/sparc/include/asm/uaccess.h linux-3.0.3/arch/sparc/include/asm/uaccess.h | |
3349 | --- linux-3.0.3/arch/sparc/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
3350 | +++ linux-3.0.3/arch/sparc/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
3351 | @@ -1,5 +1,13 @@ | |
3352 | #ifndef ___ASM_SPARC_UACCESS_H | |
3353 | #define ___ASM_SPARC_UACCESS_H | |
3354 | + | |
3355 | +#ifdef __KERNEL__ | |
3356 | +#ifndef __ASSEMBLY__ | |
3357 | +#include <linux/types.h> | |
3358 | +extern void check_object_size(const void *ptr, unsigned long n, bool to); | |
3359 | +#endif | |
3360 | +#endif | |
3361 | + | |
3362 | #if defined(__sparc__) && defined(__arch64__) | |
3363 | #include <asm/uaccess_64.h> | |
3364 | #else | |
3365 | diff -urNp linux-3.0.3/arch/sparc/kernel/Makefile linux-3.0.3/arch/sparc/kernel/Makefile | |
3366 | --- linux-3.0.3/arch/sparc/kernel/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
3367 | +++ linux-3.0.3/arch/sparc/kernel/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
3368 | @@ -3,7 +3,7 @@ | |
3369 | # | |
3370 | ||
3371 | asflags-y := -ansi | |
3372 | -ccflags-y := -Werror | |
3373 | +#ccflags-y := -Werror | |
3374 | ||
3375 | extra-y := head_$(BITS).o | |
3376 | extra-y += init_task.o | |
3377 | diff -urNp linux-3.0.3/arch/sparc/kernel/process_32.c linux-3.0.3/arch/sparc/kernel/process_32.c | |
3378 | --- linux-3.0.3/arch/sparc/kernel/process_32.c 2011-07-21 22:17:23.000000000 -0400 | |
3379 | +++ linux-3.0.3/arch/sparc/kernel/process_32.c 2011-08-23 21:48:14.000000000 -0400 | |
3380 | @@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp) | |
3381 | rw->ins[4], rw->ins[5], | |
3382 | rw->ins[6], | |
3383 | rw->ins[7]); | |
3384 | - printk("%pS\n", (void *) rw->ins[7]); | |
3385 | + printk("%pA\n", (void *) rw->ins[7]); | |
3386 | rw = (struct reg_window32 *) rw->ins[6]; | |
3387 | } | |
3388 | spin_unlock_irqrestore(&sparc_backtrace_lock, flags); | |
3389 | @@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r) | |
3390 | ||
3391 | printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n", | |
3392 | r->psr, r->pc, r->npc, r->y, print_tainted()); | |
3393 | - printk("PC: <%pS>\n", (void *) r->pc); | |
3394 | + printk("PC: <%pA>\n", (void *) r->pc); | |
3395 | printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n", | |
3396 | r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3], | |
3397 | r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]); | |
3398 | printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n", | |
3399 | r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11], | |
3400 | r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]); | |
3401 | - printk("RPC: <%pS>\n", (void *) r->u_regs[15]); | |
3402 | + printk("RPC: <%pA>\n", (void *) r->u_regs[15]); | |
3403 | ||
3404 | printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n", | |
3405 | rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3], | |
3406 | @@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk, | |
3407 | rw = (struct reg_window32 *) fp; | |
3408 | pc = rw->ins[7]; | |
3409 | printk("[%08lx : ", pc); | |
3410 | - printk("%pS ] ", (void *) pc); | |
3411 | + printk("%pA ] ", (void *) pc); | |
3412 | fp = rw->ins[6]; | |
3413 | } while (++count < 16); | |
3414 | printk("\n"); | |
3415 | diff -urNp linux-3.0.3/arch/sparc/kernel/process_64.c linux-3.0.3/arch/sparc/kernel/process_64.c | |
3416 | --- linux-3.0.3/arch/sparc/kernel/process_64.c 2011-07-21 22:17:23.000000000 -0400 | |
3417 | +++ linux-3.0.3/arch/sparc/kernel/process_64.c 2011-08-23 21:48:14.000000000 -0400 | |
3418 | @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg | |
3419 | printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n", | |
3420 | rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]); | |
3421 | if (regs->tstate & TSTATE_PRIV) | |
3422 | - printk("I7: <%pS>\n", (void *) rwk->ins[7]); | |
3423 | + printk("I7: <%pA>\n", (void *) rwk->ins[7]); | |
3424 | } | |
3425 | ||
3426 | void show_regs(struct pt_regs *regs) | |
3427 | { | |
3428 | printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate, | |
3429 | regs->tpc, regs->tnpc, regs->y, print_tainted()); | |
3430 | - printk("TPC: <%pS>\n", (void *) regs->tpc); | |
3431 | + printk("TPC: <%pA>\n", (void *) regs->tpc); | |
3432 | printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n", | |
3433 | regs->u_regs[0], regs->u_regs[1], regs->u_regs[2], | |
3434 | regs->u_regs[3]); | |
3435 | @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs) | |
3436 | printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n", | |
3437 | regs->u_regs[12], regs->u_regs[13], regs->u_regs[14], | |
3438 | regs->u_regs[15]); | |
3439 | - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]); | |
3440 | + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]); | |
3441 | show_regwindow(regs); | |
3442 | show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]); | |
3443 | } | |
3444 | @@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void | |
3445 | ((tp && tp->task) ? tp->task->pid : -1)); | |
3446 | ||
3447 | if (gp->tstate & TSTATE_PRIV) { | |
3448 | - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n", | |
3449 | + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n", | |
3450 | (void *) gp->tpc, | |
3451 | (void *) gp->o7, | |
3452 | (void *) gp->i7, | |
3453 | diff -urNp linux-3.0.3/arch/sparc/kernel/sys_sparc_32.c linux-3.0.3/arch/sparc/kernel/sys_sparc_32.c | |
3454 | --- linux-3.0.3/arch/sparc/kernel/sys_sparc_32.c 2011-07-21 22:17:23.000000000 -0400 | |
3455 | +++ linux-3.0.3/arch/sparc/kernel/sys_sparc_32.c 2011-08-23 21:47:55.000000000 -0400 | |
3456 | @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str | |
3457 | if (ARCH_SUN4C && len > 0x20000000) | |
3458 | return -ENOMEM; | |
3459 | if (!addr) | |
3460 | - addr = TASK_UNMAPPED_BASE; | |
3461 | + addr = current->mm->mmap_base; | |
3462 | ||
3463 | if (flags & MAP_SHARED) | |
3464 | addr = COLOUR_ALIGN(addr); | |
3465 | @@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str | |
3466 | } | |
3467 | if (TASK_SIZE - PAGE_SIZE - len < addr) | |
3468 | return -ENOMEM; | |
3469 | - if (!vmm || addr + len <= vmm->vm_start) | |
3470 | + if (check_heap_stack_gap(vmm, addr, len)) | |
3471 | return addr; | |
3472 | addr = vmm->vm_end; | |
3473 | if (flags & MAP_SHARED) | |
3474 | diff -urNp linux-3.0.3/arch/sparc/kernel/sys_sparc_64.c linux-3.0.3/arch/sparc/kernel/sys_sparc_64.c | |
3475 | --- linux-3.0.3/arch/sparc/kernel/sys_sparc_64.c 2011-07-21 22:17:23.000000000 -0400 | |
3476 | +++ linux-3.0.3/arch/sparc/kernel/sys_sparc_64.c 2011-08-23 21:47:55.000000000 -0400 | |
3477 | @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str | |
3478 | /* We do not accept a shared mapping if it would violate | |
3479 | * cache aliasing constraints. | |
3480 | */ | |
3481 | - if ((flags & MAP_SHARED) && | |
3482 | + if ((filp || (flags & MAP_SHARED)) && | |
3483 | ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1))) | |
3484 | return -EINVAL; | |
3485 | return addr; | |
3486 | @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str | |
3487 | if (filp || (flags & MAP_SHARED)) | |
3488 | do_color_align = 1; | |
3489 | ||
3490 | +#ifdef CONFIG_PAX_RANDMMAP | |
3491 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
3492 | +#endif | |
3493 | + | |
3494 | if (addr) { | |
3495 | if (do_color_align) | |
3496 | addr = COLOUR_ALIGN(addr, pgoff); | |
3497 | @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str | |
3498 | addr = PAGE_ALIGN(addr); | |
3499 | ||
3500 | vma = find_vma(mm, addr); | |
3501 | - if (task_size - len >= addr && | |
3502 | - (!vma || addr + len <= vma->vm_start)) | |
3503 | + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
3504 | return addr; | |
3505 | } | |
3506 | ||
3507 | if (len > mm->cached_hole_size) { | |
3508 | - start_addr = addr = mm->free_area_cache; | |
3509 | + start_addr = addr = mm->free_area_cache; | |
3510 | } else { | |
3511 | - start_addr = addr = TASK_UNMAPPED_BASE; | |
3512 | + start_addr = addr = mm->mmap_base; | |
3513 | mm->cached_hole_size = 0; | |
3514 | } | |
3515 | ||
3516 | @@ -174,14 +177,14 @@ full_search: | |
3517 | vma = find_vma(mm, VA_EXCLUDE_END); | |
3518 | } | |
3519 | if (unlikely(task_size < addr)) { | |
3520 | - if (start_addr != TASK_UNMAPPED_BASE) { | |
3521 | - start_addr = addr = TASK_UNMAPPED_BASE; | |
3522 | + if (start_addr != mm->mmap_base) { | |
3523 | + start_addr = addr = mm->mmap_base; | |
3524 | mm->cached_hole_size = 0; | |
3525 | goto full_search; | |
3526 | } | |
3527 | return -ENOMEM; | |
3528 | } | |
3529 | - if (likely(!vma || addr + len <= vma->vm_start)) { | |
3530 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
3531 | /* | |
3532 | * Remember the place where we stopped the search: | |
3533 | */ | |
3534 | @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi | |
3535 | /* We do not accept a shared mapping if it would violate | |
3536 | * cache aliasing constraints. | |
3537 | */ | |
3538 | - if ((flags & MAP_SHARED) && | |
3539 | + if ((filp || (flags & MAP_SHARED)) && | |
3540 | ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1))) | |
3541 | return -EINVAL; | |
3542 | return addr; | |
3543 | @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi | |
3544 | addr = PAGE_ALIGN(addr); | |
3545 | ||
3546 | vma = find_vma(mm, addr); | |
3547 | - if (task_size - len >= addr && | |
3548 | - (!vma || addr + len <= vma->vm_start)) | |
3549 | + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
3550 | return addr; | |
3551 | } | |
3552 | ||
3553 | @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi | |
3554 | /* make sure it can fit in the remaining address space */ | |
3555 | if (likely(addr > len)) { | |
3556 | vma = find_vma(mm, addr-len); | |
3557 | - if (!vma || addr <= vma->vm_start) { | |
3558 | + if (check_heap_stack_gap(vma, addr - len, len)) { | |
3559 | /* remember the address as a hint for next time */ | |
3560 | return (mm->free_area_cache = addr-len); | |
3561 | } | |
3562 | @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi | |
3563 | if (unlikely(mm->mmap_base < len)) | |
3564 | goto bottomup; | |
3565 | ||
3566 | - addr = mm->mmap_base-len; | |
3567 | - if (do_color_align) | |
3568 | - addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
3569 | + addr = mm->mmap_base - len; | |
3570 | ||
3571 | do { | |
3572 | + if (do_color_align) | |
3573 | + addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
3574 | /* | |
3575 | * Lookup failure means no vma is above this address, | |
3576 | * else if new region fits below vma->vm_start, | |
3577 | * return with success: | |
3578 | */ | |
3579 | vma = find_vma(mm, addr); | |
3580 | - if (likely(!vma || addr+len <= vma->vm_start)) { | |
3581 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
3582 | /* remember the address as a hint for next time */ | |
3583 | return (mm->free_area_cache = addr); | |
3584 | } | |
3585 | @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi | |
3586 | mm->cached_hole_size = vma->vm_start - addr; | |
3587 | ||
3588 | /* try just below the current vma->vm_start */ | |
3589 | - addr = vma->vm_start-len; | |
3590 | - if (do_color_align) | |
3591 | - addr = COLOUR_ALIGN_DOWN(addr, pgoff); | |
3592 | - } while (likely(len < vma->vm_start)); | |
3593 | + addr = skip_heap_stack_gap(vma, len); | |
3594 | + } while (!IS_ERR_VALUE(addr)); | |
3595 | ||
3596 | bottomup: | |
3597 | /* | |
3598 | @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str | |
3599 | gap == RLIM_INFINITY || | |
3600 | sysctl_legacy_va_layout) { | |
3601 | mm->mmap_base = TASK_UNMAPPED_BASE + random_factor; | |
3602 | + | |
3603 | +#ifdef CONFIG_PAX_RANDMMAP | |
3604 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
3605 | + mm->mmap_base += mm->delta_mmap; | |
3606 | +#endif | |
3607 | + | |
3608 | mm->get_unmapped_area = arch_get_unmapped_area; | |
3609 | mm->unmap_area = arch_unmap_area; | |
3610 | } else { | |
3611 | @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str | |
3612 | gap = (task_size / 6 * 5); | |
3613 | ||
3614 | mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor); | |
3615 | + | |
3616 | +#ifdef CONFIG_PAX_RANDMMAP | |
3617 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
3618 | + mm->mmap_base -= mm->delta_mmap + mm->delta_stack; | |
3619 | +#endif | |
3620 | + | |
3621 | mm->get_unmapped_area = arch_get_unmapped_area_topdown; | |
3622 | mm->unmap_area = arch_unmap_area_topdown; | |
3623 | } | |
3624 | diff -urNp linux-3.0.3/arch/sparc/kernel/traps_32.c linux-3.0.3/arch/sparc/kernel/traps_32.c | |
3625 | --- linux-3.0.3/arch/sparc/kernel/traps_32.c 2011-07-21 22:17:23.000000000 -0400 | |
3626 | +++ linux-3.0.3/arch/sparc/kernel/traps_32.c 2011-08-23 21:48:14.000000000 -0400 | |
3627 | @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo | |
3628 | #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t") | |
3629 | #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t") | |
3630 | ||
3631 | +extern void gr_handle_kernel_exploit(void); | |
3632 | + | |
3633 | void die_if_kernel(char *str, struct pt_regs *regs) | |
3634 | { | |
3635 | static int die_counter; | |
3636 | @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_ | |
3637 | count++ < 30 && | |
3638 | (((unsigned long) rw) >= PAGE_OFFSET) && | |
3639 | !(((unsigned long) rw) & 0x7)) { | |
3640 | - printk("Caller[%08lx]: %pS\n", rw->ins[7], | |
3641 | + printk("Caller[%08lx]: %pA\n", rw->ins[7], | |
3642 | (void *) rw->ins[7]); | |
3643 | rw = (struct reg_window32 *)rw->ins[6]; | |
3644 | } | |
3645 | } | |
3646 | printk("Instruction DUMP:"); | |
3647 | instruction_dump ((unsigned long *) regs->pc); | |
3648 | - if(regs->psr & PSR_PS) | |
3649 | + if(regs->psr & PSR_PS) { | |
3650 | + gr_handle_kernel_exploit(); | |
3651 | do_exit(SIGKILL); | |
3652 | + } | |
3653 | do_exit(SIGSEGV); | |
3654 | } | |
3655 | ||
3656 | diff -urNp linux-3.0.3/arch/sparc/kernel/traps_64.c linux-3.0.3/arch/sparc/kernel/traps_64.c | |
3657 | --- linux-3.0.3/arch/sparc/kernel/traps_64.c 2011-07-21 22:17:23.000000000 -0400 | |
3658 | +++ linux-3.0.3/arch/sparc/kernel/traps_64.c 2011-08-23 21:48:14.000000000 -0400 | |
3659 | @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_ | |
3660 | i + 1, | |
3661 | p->trapstack[i].tstate, p->trapstack[i].tpc, | |
3662 | p->trapstack[i].tnpc, p->trapstack[i].tt); | |
3663 | - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc); | |
3664 | + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc); | |
3665 | } | |
3666 | } | |
3667 | ||
3668 | @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long | |
3669 | ||
3670 | lvl -= 0x100; | |
3671 | if (regs->tstate & TSTATE_PRIV) { | |
3672 | + | |
3673 | +#ifdef CONFIG_PAX_REFCOUNT | |
3674 | + if (lvl == 6) | |
3675 | + pax_report_refcount_overflow(regs); | |
3676 | +#endif | |
3677 | + | |
3678 | sprintf(buffer, "Kernel bad sw trap %lx", lvl); | |
3679 | die_if_kernel(buffer, regs); | |
3680 | } | |
3681 | @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long | |
3682 | void bad_trap_tl1(struct pt_regs *regs, long lvl) | |
3683 | { | |
3684 | char buffer[32]; | |
3685 | - | |
3686 | + | |
3687 | if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs, | |
3688 | 0, lvl, SIGTRAP) == NOTIFY_STOP) | |
3689 | return; | |
3690 | ||
3691 | +#ifdef CONFIG_PAX_REFCOUNT | |
3692 | + if (lvl == 6) | |
3693 | + pax_report_refcount_overflow(regs); | |
3694 | +#endif | |
3695 | + | |
3696 | dump_tl1_traplog((struct tl1_traplog *)(regs + 1)); | |
3697 | ||
3698 | sprintf (buffer, "Bad trap %lx at tl>0", lvl); | |
3699 | @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt | |
3700 | regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate); | |
3701 | printk("%s" "ERROR(%d): ", | |
3702 | (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id()); | |
3703 | - printk("TPC<%pS>\n", (void *) regs->tpc); | |
3704 | + printk("TPC<%pA>\n", (void *) regs->tpc); | |
3705 | printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n", | |
3706 | (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(), | |
3707 | (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT, | |
3708 | @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, | |
3709 | smp_processor_id(), | |
3710 | (type & 0x1) ? 'I' : 'D', | |
3711 | regs->tpc); | |
3712 | - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc); | |
3713 | + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc); | |
3714 | panic("Irrecoverable Cheetah+ parity error."); | |
3715 | } | |
3716 | ||
3717 | @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, | |
3718 | smp_processor_id(), | |
3719 | (type & 0x1) ? 'I' : 'D', | |
3720 | regs->tpc); | |
3721 | - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc); | |
3722 | + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc); | |
3723 | } | |
3724 | ||
3725 | struct sun4v_error_entry { | |
3726 | @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r | |
3727 | ||
3728 | printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n", | |
3729 | regs->tpc, tl); | |
3730 | - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc); | |
3731 | + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc); | |
3732 | printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]); | |
3733 | - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n", | |
3734 | + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n", | |
3735 | (void *) regs->u_regs[UREG_I7]); | |
3736 | printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] " | |
3737 | "pte[%lx] error[%lx]\n", | |
3738 | @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r | |
3739 | ||
3740 | printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n", | |
3741 | regs->tpc, tl); | |
3742 | - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc); | |
3743 | + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc); | |
3744 | printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]); | |
3745 | - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n", | |
3746 | + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n", | |
3747 | (void *) regs->u_regs[UREG_I7]); | |
3748 | printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] " | |
3749 | "pte[%lx] error[%lx]\n", | |
3750 | @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, | |
3751 | fp = (unsigned long)sf->fp + STACK_BIAS; | |
3752 | } | |
3753 | ||
3754 | - printk(" [%016lx] %pS\n", pc, (void *) pc); | |
3755 | + printk(" [%016lx] %pA\n", pc, (void *) pc); | |
3756 | #ifdef CONFIG_FUNCTION_GRAPH_TRACER | |
3757 | if ((pc + 8UL) == (unsigned long) &return_to_handler) { | |
3758 | int index = tsk->curr_ret_stack; | |
3759 | if (tsk->ret_stack && index >= graph) { | |
3760 | pc = tsk->ret_stack[index - graph].ret; | |
3761 | - printk(" [%016lx] %pS\n", pc, (void *) pc); | |
3762 | + printk(" [%016lx] %pA\n", pc, (void *) pc); | |
3763 | graph++; | |
3764 | } | |
3765 | } | |
3766 | @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_ | |
3767 | return (struct reg_window *) (fp + STACK_BIAS); | |
3768 | } | |
3769 | ||
3770 | +extern void gr_handle_kernel_exploit(void); | |
3771 | + | |
3772 | void die_if_kernel(char *str, struct pt_regs *regs) | |
3773 | { | |
3774 | static int die_counter; | |
3775 | @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_ | |
3776 | while (rw && | |
3777 | count++ < 30 && | |
3778 | kstack_valid(tp, (unsigned long) rw)) { | |
3779 | - printk("Caller[%016lx]: %pS\n", rw->ins[7], | |
3780 | + printk("Caller[%016lx]: %pA\n", rw->ins[7], | |
3781 | (void *) rw->ins[7]); | |
3782 | ||
3783 | rw = kernel_stack_up(rw); | |
3784 | @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_ | |
3785 | } | |
3786 | user_instruction_dump ((unsigned int __user *) regs->tpc); | |
3787 | } | |
3788 | - if (regs->tstate & TSTATE_PRIV) | |
3789 | + if (regs->tstate & TSTATE_PRIV) { | |
3790 | + gr_handle_kernel_exploit(); | |
3791 | do_exit(SIGKILL); | |
3792 | + } | |
3793 | do_exit(SIGSEGV); | |
3794 | } | |
3795 | EXPORT_SYMBOL(die_if_kernel); | |
3796 | diff -urNp linux-3.0.3/arch/sparc/kernel/unaligned_64.c linux-3.0.3/arch/sparc/kernel/unaligned_64.c | |
3797 | --- linux-3.0.3/arch/sparc/kernel/unaligned_64.c 2011-08-23 21:44:40.000000000 -0400 | |
3798 | +++ linux-3.0.3/arch/sparc/kernel/unaligned_64.c 2011-08-23 21:48:14.000000000 -0400 | |
3799 | @@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs | |
3800 | static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); | |
3801 | ||
3802 | if (__ratelimit(&ratelimit)) { | |
3803 | - printk("Kernel unaligned access at TPC[%lx] %pS\n", | |
3804 | + printk("Kernel unaligned access at TPC[%lx] %pA\n", | |
3805 | regs->tpc, (void *) regs->tpc); | |
3806 | } | |
3807 | } | |
3808 | diff -urNp linux-3.0.3/arch/sparc/lib/atomic_64.S linux-3.0.3/arch/sparc/lib/atomic_64.S | |
3809 | --- linux-3.0.3/arch/sparc/lib/atomic_64.S 2011-07-21 22:17:23.000000000 -0400 | |
3810 | +++ linux-3.0.3/arch/sparc/lib/atomic_64.S 2011-08-23 21:47:55.000000000 -0400 | |
3811 | @@ -18,7 +18,12 @@ | |
3812 | atomic_add: /* %o0 = increment, %o1 = atomic_ptr */ | |
3813 | BACKOFF_SETUP(%o2) | |
3814 | 1: lduw [%o1], %g1 | |
3815 | - add %g1, %o0, %g7 | |
3816 | + addcc %g1, %o0, %g7 | |
3817 | + | |
3818 | +#ifdef CONFIG_PAX_REFCOUNT | |
3819 | + tvs %icc, 6 | |
3820 | +#endif | |
3821 | + | |
3822 | cas [%o1], %g1, %g7 | |
3823 | cmp %g1, %g7 | |
3824 | bne,pn %icc, BACKOFF_LABEL(2f, 1b) | |
3825 | @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at | |
3826 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3827 | .size atomic_add, .-atomic_add | |
3828 | ||
3829 | + .globl atomic_add_unchecked | |
3830 | + .type atomic_add_unchecked,#function | |
3831 | +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ | |
3832 | + BACKOFF_SETUP(%o2) | |
3833 | +1: lduw [%o1], %g1 | |
3834 | + add %g1, %o0, %g7 | |
3835 | + cas [%o1], %g1, %g7 | |
3836 | + cmp %g1, %g7 | |
3837 | + bne,pn %icc, 2f | |
3838 | + nop | |
3839 | + retl | |
3840 | + nop | |
3841 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3842 | + .size atomic_add_unchecked, .-atomic_add_unchecked | |
3843 | + | |
3844 | .globl atomic_sub | |
3845 | .type atomic_sub,#function | |
3846 | atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */ | |
3847 | BACKOFF_SETUP(%o2) | |
3848 | 1: lduw [%o1], %g1 | |
3849 | - sub %g1, %o0, %g7 | |
3850 | + subcc %g1, %o0, %g7 | |
3851 | + | |
3852 | +#ifdef CONFIG_PAX_REFCOUNT | |
3853 | + tvs %icc, 6 | |
3854 | +#endif | |
3855 | + | |
3856 | cas [%o1], %g1, %g7 | |
3857 | cmp %g1, %g7 | |
3858 | bne,pn %icc, BACKOFF_LABEL(2f, 1b) | |
3859 | @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at | |
3860 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3861 | .size atomic_sub, .-atomic_sub | |
3862 | ||
3863 | + .globl atomic_sub_unchecked | |
3864 | + .type atomic_sub_unchecked,#function | |
3865 | +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */ | |
3866 | + BACKOFF_SETUP(%o2) | |
3867 | +1: lduw [%o1], %g1 | |
3868 | + sub %g1, %o0, %g7 | |
3869 | + cas [%o1], %g1, %g7 | |
3870 | + cmp %g1, %g7 | |
3871 | + bne,pn %icc, 2f | |
3872 | + nop | |
3873 | + retl | |
3874 | + nop | |
3875 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3876 | + .size atomic_sub_unchecked, .-atomic_sub_unchecked | |
3877 | + | |
3878 | .globl atomic_add_ret | |
3879 | .type atomic_add_ret,#function | |
3880 | atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ | |
3881 | BACKOFF_SETUP(%o2) | |
3882 | 1: lduw [%o1], %g1 | |
3883 | - add %g1, %o0, %g7 | |
3884 | + addcc %g1, %o0, %g7 | |
3885 | + | |
3886 | +#ifdef CONFIG_PAX_REFCOUNT | |
3887 | + tvs %icc, 6 | |
3888 | +#endif | |
3889 | + | |
3890 | cas [%o1], %g1, %g7 | |
3891 | cmp %g1, %g7 | |
3892 | bne,pn %icc, BACKOFF_LABEL(2f, 1b) | |
3893 | @@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 | |
3894 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3895 | .size atomic_add_ret, .-atomic_add_ret | |
3896 | ||
3897 | + .globl atomic_add_ret_unchecked | |
3898 | + .type atomic_add_ret_unchecked,#function | |
3899 | +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ | |
3900 | + BACKOFF_SETUP(%o2) | |
3901 | +1: lduw [%o1], %g1 | |
3902 | + addcc %g1, %o0, %g7 | |
3903 | + cas [%o1], %g1, %g7 | |
3904 | + cmp %g1, %g7 | |
3905 | + bne,pn %icc, 2f | |
3906 | + add %g7, %o0, %g7 | |
3907 | + sra %g7, 0, %o0 | |
3908 | + retl | |
3909 | + nop | |
3910 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3911 | + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked | |
3912 | + | |
3913 | .globl atomic_sub_ret | |
3914 | .type atomic_sub_ret,#function | |
3915 | atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */ | |
3916 | BACKOFF_SETUP(%o2) | |
3917 | 1: lduw [%o1], %g1 | |
3918 | - sub %g1, %o0, %g7 | |
3919 | + subcc %g1, %o0, %g7 | |
3920 | + | |
3921 | +#ifdef CONFIG_PAX_REFCOUNT | |
3922 | + tvs %icc, 6 | |
3923 | +#endif | |
3924 | + | |
3925 | cas [%o1], %g1, %g7 | |
3926 | cmp %g1, %g7 | |
3927 | bne,pn %icc, BACKOFF_LABEL(2f, 1b) | |
3928 | @@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 | |
3929 | atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */ | |
3930 | BACKOFF_SETUP(%o2) | |
3931 | 1: ldx [%o1], %g1 | |
3932 | - add %g1, %o0, %g7 | |
3933 | + addcc %g1, %o0, %g7 | |
3934 | + | |
3935 | +#ifdef CONFIG_PAX_REFCOUNT | |
3936 | + tvs %xcc, 6 | |
3937 | +#endif | |
3938 | + | |
3939 | casx [%o1], %g1, %g7 | |
3940 | cmp %g1, %g7 | |
3941 | bne,pn %xcc, BACKOFF_LABEL(2f, 1b) | |
3942 | @@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = | |
3943 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3944 | .size atomic64_add, .-atomic64_add | |
3945 | ||
3946 | + .globl atomic64_add_unchecked | |
3947 | + .type atomic64_add_unchecked,#function | |
3948 | +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ | |
3949 | + BACKOFF_SETUP(%o2) | |
3950 | +1: ldx [%o1], %g1 | |
3951 | + addcc %g1, %o0, %g7 | |
3952 | + casx [%o1], %g1, %g7 | |
3953 | + cmp %g1, %g7 | |
3954 | + bne,pn %xcc, 2f | |
3955 | + nop | |
3956 | + retl | |
3957 | + nop | |
3958 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3959 | + .size atomic64_add_unchecked, .-atomic64_add_unchecked | |
3960 | + | |
3961 | .globl atomic64_sub | |
3962 | .type atomic64_sub,#function | |
3963 | atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */ | |
3964 | BACKOFF_SETUP(%o2) | |
3965 | 1: ldx [%o1], %g1 | |
3966 | - sub %g1, %o0, %g7 | |
3967 | + subcc %g1, %o0, %g7 | |
3968 | + | |
3969 | +#ifdef CONFIG_PAX_REFCOUNT | |
3970 | + tvs %xcc, 6 | |
3971 | +#endif | |
3972 | + | |
3973 | casx [%o1], %g1, %g7 | |
3974 | cmp %g1, %g7 | |
3975 | bne,pn %xcc, BACKOFF_LABEL(2f, 1b) | |
3976 | @@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = | |
3977 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3978 | .size atomic64_sub, .-atomic64_sub | |
3979 | ||
3980 | + .globl atomic64_sub_unchecked | |
3981 | + .type atomic64_sub_unchecked,#function | |
3982 | +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */ | |
3983 | + BACKOFF_SETUP(%o2) | |
3984 | +1: ldx [%o1], %g1 | |
3985 | + subcc %g1, %o0, %g7 | |
3986 | + casx [%o1], %g1, %g7 | |
3987 | + cmp %g1, %g7 | |
3988 | + bne,pn %xcc, 2f | |
3989 | + nop | |
3990 | + retl | |
3991 | + nop | |
3992 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
3993 | + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked | |
3994 | + | |
3995 | .globl atomic64_add_ret | |
3996 | .type atomic64_add_ret,#function | |
3997 | atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ | |
3998 | BACKOFF_SETUP(%o2) | |
3999 | 1: ldx [%o1], %g1 | |
4000 | - add %g1, %o0, %g7 | |
4001 | + addcc %g1, %o0, %g7 | |
4002 | + | |
4003 | +#ifdef CONFIG_PAX_REFCOUNT | |
4004 | + tvs %xcc, 6 | |
4005 | +#endif | |
4006 | + | |
4007 | casx [%o1], %g1, %g7 | |
4008 | cmp %g1, %g7 | |
4009 | bne,pn %xcc, BACKOFF_LABEL(2f, 1b) | |
4010 | @@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o | |
4011 | 2: BACKOFF_SPIN(%o2, %o3, 1b) | |
4012 | .size atomic64_add_ret, .-atomic64_add_ret | |
4013 | ||
4014 | + .globl atomic64_add_ret_unchecked | |
4015 | + .type atomic64_add_ret_unchecked,#function | |
4016 | +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ | |
4017 | + BACKOFF_SETUP(%o2) | |
4018 | +1: ldx [%o1], %g1 | |
4019 | + addcc %g1, %o0, %g7 | |
4020 | + casx [%o1], %g1, %g7 | |
4021 | + cmp %g1, %g7 | |
4022 | + bne,pn %xcc, 2f | |
4023 | + add %g7, %o0, %g7 | |
4024 | + mov %g7, %o0 | |
4025 | + retl | |
4026 | + nop | |
4027 | +2: BACKOFF_SPIN(%o2, %o3, 1b) | |
4028 | + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked | |
4029 | + | |
4030 | .globl atomic64_sub_ret | |
4031 | .type atomic64_sub_ret,#function | |
4032 | atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */ | |
4033 | BACKOFF_SETUP(%o2) | |
4034 | 1: ldx [%o1], %g1 | |
4035 | - sub %g1, %o0, %g7 | |
4036 | + subcc %g1, %o0, %g7 | |
4037 | + | |
4038 | +#ifdef CONFIG_PAX_REFCOUNT | |
4039 | + tvs %xcc, 6 | |
4040 | +#endif | |
4041 | + | |
4042 | casx [%o1], %g1, %g7 | |
4043 | cmp %g1, %g7 | |
4044 | bne,pn %xcc, BACKOFF_LABEL(2f, 1b) | |
4045 | diff -urNp linux-3.0.3/arch/sparc/lib/ksyms.c linux-3.0.3/arch/sparc/lib/ksyms.c | |
4046 | --- linux-3.0.3/arch/sparc/lib/ksyms.c 2011-07-21 22:17:23.000000000 -0400 | |
4047 | +++ linux-3.0.3/arch/sparc/lib/ksyms.c 2011-08-23 21:48:14.000000000 -0400 | |
4048 | @@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write); | |
4049 | ||
4050 | /* Atomic counter implementation. */ | |
4051 | EXPORT_SYMBOL(atomic_add); | |
4052 | +EXPORT_SYMBOL(atomic_add_unchecked); | |
4053 | EXPORT_SYMBOL(atomic_add_ret); | |
4054 | +EXPORT_SYMBOL(atomic_add_ret_unchecked); | |
4055 | EXPORT_SYMBOL(atomic_sub); | |
4056 | +EXPORT_SYMBOL(atomic_sub_unchecked); | |
4057 | EXPORT_SYMBOL(atomic_sub_ret); | |
4058 | EXPORT_SYMBOL(atomic64_add); | |
4059 | +EXPORT_SYMBOL(atomic64_add_unchecked); | |
4060 | EXPORT_SYMBOL(atomic64_add_ret); | |
4061 | +EXPORT_SYMBOL(atomic64_add_ret_unchecked); | |
4062 | EXPORT_SYMBOL(atomic64_sub); | |
4063 | +EXPORT_SYMBOL(atomic64_sub_unchecked); | |
4064 | EXPORT_SYMBOL(atomic64_sub_ret); | |
4065 | ||
4066 | /* Atomic bit operations. */ | |
4067 | diff -urNp linux-3.0.3/arch/sparc/lib/Makefile linux-3.0.3/arch/sparc/lib/Makefile | |
4068 | --- linux-3.0.3/arch/sparc/lib/Makefile 2011-08-23 21:44:40.000000000 -0400 | |
4069 | +++ linux-3.0.3/arch/sparc/lib/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
4070 | @@ -2,7 +2,7 @@ | |
4071 | # | |
4072 | ||
4073 | asflags-y := -ansi -DST_DIV0=0x02 | |
4074 | -ccflags-y := -Werror | |
4075 | +#ccflags-y := -Werror | |
4076 | ||
4077 | lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o | |
4078 | lib-$(CONFIG_SPARC32) += memcpy.o memset.o | |
4079 | diff -urNp linux-3.0.3/arch/sparc/Makefile linux-3.0.3/arch/sparc/Makefile | |
4080 | --- linux-3.0.3/arch/sparc/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
4081 | +++ linux-3.0.3/arch/sparc/Makefile 2011-08-23 21:48:14.000000000 -0400 | |
4082 | @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc | |
4083 | # Export what is needed by arch/sparc/boot/Makefile | |
4084 | export VMLINUX_INIT VMLINUX_MAIN | |
4085 | VMLINUX_INIT := $(head-y) $(init-y) | |
4086 | -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ | |
4087 | +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/ | |
4088 | VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y) | |
4089 | VMLINUX_MAIN += $(drivers-y) $(net-y) | |
4090 | ||
4091 | diff -urNp linux-3.0.3/arch/sparc/mm/fault_32.c linux-3.0.3/arch/sparc/mm/fault_32.c | |
4092 | --- linux-3.0.3/arch/sparc/mm/fault_32.c 2011-07-21 22:17:23.000000000 -0400 | |
4093 | +++ linux-3.0.3/arch/sparc/mm/fault_32.c 2011-08-23 21:47:55.000000000 -0400 | |
4094 | @@ -22,6 +22,9 @@ | |
4095 | #include <linux/interrupt.h> | |
4096 | #include <linux/module.h> | |
4097 | #include <linux/kdebug.h> | |
4098 | +#include <linux/slab.h> | |
4099 | +#include <linux/pagemap.h> | |
4100 | +#include <linux/compiler.h> | |
4101 | ||
4102 | #include <asm/system.h> | |
4103 | #include <asm/page.h> | |
4104 | @@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str | |
4105 | return safe_compute_effective_address(regs, insn); | |
4106 | } | |
4107 | ||
4108 | +#ifdef CONFIG_PAX_PAGEEXEC | |
4109 | +#ifdef CONFIG_PAX_DLRESOLVE | |
4110 | +static void pax_emuplt_close(struct vm_area_struct *vma) | |
4111 | +{ | |
4112 | + vma->vm_mm->call_dl_resolve = 0UL; | |
4113 | +} | |
4114 | + | |
4115 | +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf) | |
4116 | +{ | |
4117 | + unsigned int *kaddr; | |
4118 | + | |
4119 | + vmf->page = alloc_page(GFP_HIGHUSER); | |
4120 | + if (!vmf->page) | |
4121 | + return VM_FAULT_OOM; | |
4122 | + | |
4123 | + kaddr = kmap(vmf->page); | |
4124 | + memset(kaddr, 0, PAGE_SIZE); | |
4125 | + kaddr[0] = 0x9DE3BFA8U; /* save */ | |
4126 | + flush_dcache_page(vmf->page); | |
4127 | + kunmap(vmf->page); | |
4128 | + return VM_FAULT_MAJOR; | |
4129 | +} | |
4130 | + | |
4131 | +static const struct vm_operations_struct pax_vm_ops = { | |
4132 | + .close = pax_emuplt_close, | |
4133 | + .fault = pax_emuplt_fault | |
4134 | +}; | |
4135 | + | |
4136 | +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr) | |
4137 | +{ | |
4138 | + int ret; | |
4139 | + | |
4140 | + INIT_LIST_HEAD(&vma->anon_vma_chain); | |
4141 | + vma->vm_mm = current->mm; | |
4142 | + vma->vm_start = addr; | |
4143 | + vma->vm_end = addr + PAGE_SIZE; | |
4144 | + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC; | |
4145 | + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
4146 | + vma->vm_ops = &pax_vm_ops; | |
4147 | + | |
4148 | + ret = insert_vm_struct(current->mm, vma); | |
4149 | + if (ret) | |
4150 | + return ret; | |
4151 | + | |
4152 | + ++current->mm->total_vm; | |
4153 | + return 0; | |
4154 | +} | |
4155 | +#endif | |
4156 | + | |
4157 | +/* | |
4158 | + * PaX: decide what to do with offenders (regs->pc = fault address) | |
4159 | + * | |
4160 | + * returns 1 when task should be killed | |
4161 | + * 2 when patched PLT trampoline was detected | |
4162 | + * 3 when unpatched PLT trampoline was detected | |
4163 | + */ | |
4164 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
4165 | +{ | |
4166 | + | |
4167 | +#ifdef CONFIG_PAX_EMUPLT | |
4168 | + int err; | |
4169 | + | |
4170 | + do { /* PaX: patched PLT emulation #1 */ | |
4171 | + unsigned int sethi1, sethi2, jmpl; | |
4172 | + | |
4173 | + err = get_user(sethi1, (unsigned int *)regs->pc); | |
4174 | + err |= get_user(sethi2, (unsigned int *)(regs->pc+4)); | |
4175 | + err |= get_user(jmpl, (unsigned int *)(regs->pc+8)); | |
4176 | + | |
4177 | + if (err) | |
4178 | + break; | |
4179 | + | |
4180 | + if ((sethi1 & 0xFFC00000U) == 0x03000000U && | |
4181 | + (sethi2 & 0xFFC00000U) == 0x03000000U && | |
4182 | + (jmpl & 0xFFFFE000U) == 0x81C06000U) | |
4183 | + { | |
4184 | + unsigned int addr; | |
4185 | + | |
4186 | + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10; | |
4187 | + addr = regs->u_regs[UREG_G1]; | |
4188 | + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U); | |
4189 | + regs->pc = addr; | |
4190 | + regs->npc = addr+4; | |
4191 | + return 2; | |
4192 | + } | |
4193 | + } while (0); | |
4194 | + | |
4195 | + { /* PaX: patched PLT emulation #2 */ | |
4196 | + unsigned int ba; | |
4197 | + | |
4198 | + err = get_user(ba, (unsigned int *)regs->pc); | |
4199 | + | |
4200 | + if (!err && (ba & 0xFFC00000U) == 0x30800000U) { | |
4201 | + unsigned int addr; | |
4202 | + | |
4203 | + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2); | |
4204 | + regs->pc = addr; | |
4205 | + regs->npc = addr+4; | |
4206 | + return 2; | |
4207 | + } | |
4208 | + } | |
4209 | + | |
4210 | + do { /* PaX: patched PLT emulation #3 */ | |
4211 | + unsigned int sethi, jmpl, nop; | |
4212 | + | |
4213 | + err = get_user(sethi, (unsigned int *)regs->pc); | |
4214 | + err |= get_user(jmpl, (unsigned int *)(regs->pc+4)); | |
4215 | + err |= get_user(nop, (unsigned int *)(regs->pc+8)); | |
4216 | + | |
4217 | + if (err) | |
4218 | + break; | |
4219 | + | |
4220 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4221 | + (jmpl & 0xFFFFE000U) == 0x81C06000U && | |
4222 | + nop == 0x01000000U) | |
4223 | + { | |
4224 | + unsigned int addr; | |
4225 | + | |
4226 | + addr = (sethi & 0x003FFFFFU) << 10; | |
4227 | + regs->u_regs[UREG_G1] = addr; | |
4228 | + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U); | |
4229 | + regs->pc = addr; | |
4230 | + regs->npc = addr+4; | |
4231 | + return 2; | |
4232 | + } | |
4233 | + } while (0); | |
4234 | + | |
4235 | + do { /* PaX: unpatched PLT emulation step 1 */ | |
4236 | + unsigned int sethi, ba, nop; | |
4237 | + | |
4238 | + err = get_user(sethi, (unsigned int *)regs->pc); | |
4239 | + err |= get_user(ba, (unsigned int *)(regs->pc+4)); | |
4240 | + err |= get_user(nop, (unsigned int *)(regs->pc+8)); | |
4241 | + | |
4242 | + if (err) | |
4243 | + break; | |
4244 | + | |
4245 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4246 | + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) && | |
4247 | + nop == 0x01000000U) | |
4248 | + { | |
4249 | + unsigned int addr, save, call; | |
4250 | + | |
4251 | + if ((ba & 0xFFC00000U) == 0x30800000U) | |
4252 | + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2); | |
4253 | + else | |
4254 | + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2); | |
4255 | + | |
4256 | + err = get_user(save, (unsigned int *)addr); | |
4257 | + err |= get_user(call, (unsigned int *)(addr+4)); | |
4258 | + err |= get_user(nop, (unsigned int *)(addr+8)); | |
4259 | + if (err) | |
4260 | + break; | |
4261 | + | |
4262 | +#ifdef CONFIG_PAX_DLRESOLVE | |
4263 | + if (save == 0x9DE3BFA8U && | |
4264 | + (call & 0xC0000000U) == 0x40000000U && | |
4265 | + nop == 0x01000000U) | |
4266 | + { | |
4267 | + struct vm_area_struct *vma; | |
4268 | + unsigned long call_dl_resolve; | |
4269 | + | |
4270 | + down_read(¤t->mm->mmap_sem); | |
4271 | + call_dl_resolve = current->mm->call_dl_resolve; | |
4272 | + up_read(¤t->mm->mmap_sem); | |
4273 | + if (likely(call_dl_resolve)) | |
4274 | + goto emulate; | |
4275 | + | |
4276 | + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
4277 | + | |
4278 | + down_write(¤t->mm->mmap_sem); | |
4279 | + if (current->mm->call_dl_resolve) { | |
4280 | + call_dl_resolve = current->mm->call_dl_resolve; | |
4281 | + up_write(¤t->mm->mmap_sem); | |
4282 | + if (vma) | |
4283 | + kmem_cache_free(vm_area_cachep, vma); | |
4284 | + goto emulate; | |
4285 | + } | |
4286 | + | |
4287 | + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE); | |
4288 | + if (!vma || (call_dl_resolve & ~PAGE_MASK)) { | |
4289 | + up_write(¤t->mm->mmap_sem); | |
4290 | + if (vma) | |
4291 | + kmem_cache_free(vm_area_cachep, vma); | |
4292 | + return 1; | |
4293 | + } | |
4294 | + | |
4295 | + if (pax_insert_vma(vma, call_dl_resolve)) { | |
4296 | + up_write(¤t->mm->mmap_sem); | |
4297 | + kmem_cache_free(vm_area_cachep, vma); | |
4298 | + return 1; | |
4299 | + } | |
4300 | + | |
4301 | + current->mm->call_dl_resolve = call_dl_resolve; | |
4302 | + up_write(¤t->mm->mmap_sem); | |
4303 | + | |
4304 | +emulate: | |
4305 | + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10; | |
4306 | + regs->pc = call_dl_resolve; | |
4307 | + regs->npc = addr+4; | |
4308 | + return 3; | |
4309 | + } | |
4310 | +#endif | |
4311 | + | |
4312 | + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */ | |
4313 | + if ((save & 0xFFC00000U) == 0x05000000U && | |
4314 | + (call & 0xFFFFE000U) == 0x85C0A000U && | |
4315 | + nop == 0x01000000U) | |
4316 | + { | |
4317 | + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10; | |
4318 | + regs->u_regs[UREG_G2] = addr + 4; | |
4319 | + addr = (save & 0x003FFFFFU) << 10; | |
4320 | + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U); | |
4321 | + regs->pc = addr; | |
4322 | + regs->npc = addr+4; | |
4323 | + return 3; | |
4324 | + } | |
4325 | + } | |
4326 | + } while (0); | |
4327 | + | |
4328 | + do { /* PaX: unpatched PLT emulation step 2 */ | |
4329 | + unsigned int save, call, nop; | |
4330 | + | |
4331 | + err = get_user(save, (unsigned int *)(regs->pc-4)); | |
4332 | + err |= get_user(call, (unsigned int *)regs->pc); | |
4333 | + err |= get_user(nop, (unsigned int *)(regs->pc+4)); | |
4334 | + if (err) | |
4335 | + break; | |
4336 | + | |
4337 | + if (save == 0x9DE3BFA8U && | |
4338 | + (call & 0xC0000000U) == 0x40000000U && | |
4339 | + nop == 0x01000000U) | |
4340 | + { | |
4341 | + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2); | |
4342 | + | |
4343 | + regs->u_regs[UREG_RETPC] = regs->pc; | |
4344 | + regs->pc = dl_resolve; | |
4345 | + regs->npc = dl_resolve+4; | |
4346 | + return 3; | |
4347 | + } | |
4348 | + } while (0); | |
4349 | +#endif | |
4350 | + | |
4351 | + return 1; | |
4352 | +} | |
4353 | + | |
4354 | +void pax_report_insns(void *pc, void *sp) | |
4355 | +{ | |
4356 | + unsigned long i; | |
4357 | + | |
4358 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
4359 | + for (i = 0; i < 8; i++) { | |
4360 | + unsigned int c; | |
4361 | + if (get_user(c, (unsigned int *)pc+i)) | |
4362 | + printk(KERN_CONT "???????? "); | |
4363 | + else | |
4364 | + printk(KERN_CONT "%08x ", c); | |
4365 | + } | |
4366 | + printk("\n"); | |
4367 | +} | |
4368 | +#endif | |
4369 | + | |
4370 | static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs, | |
4371 | int text_fault) | |
4372 | { | |
4373 | @@ -281,6 +546,24 @@ good_area: | |
4374 | if(!(vma->vm_flags & VM_WRITE)) | |
4375 | goto bad_area; | |
4376 | } else { | |
4377 | + | |
4378 | +#ifdef CONFIG_PAX_PAGEEXEC | |
4379 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) { | |
4380 | + up_read(&mm->mmap_sem); | |
4381 | + switch (pax_handle_fetch_fault(regs)) { | |
4382 | + | |
4383 | +#ifdef CONFIG_PAX_EMUPLT | |
4384 | + case 2: | |
4385 | + case 3: | |
4386 | + return; | |
4387 | +#endif | |
4388 | + | |
4389 | + } | |
4390 | + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]); | |
4391 | + do_group_exit(SIGKILL); | |
4392 | + } | |
4393 | +#endif | |
4394 | + | |
4395 | /* Allow reads even for write-only mappings */ | |
4396 | if(!(vma->vm_flags & (VM_READ | VM_EXEC))) | |
4397 | goto bad_area; | |
4398 | diff -urNp linux-3.0.3/arch/sparc/mm/fault_64.c linux-3.0.3/arch/sparc/mm/fault_64.c | |
4399 | --- linux-3.0.3/arch/sparc/mm/fault_64.c 2011-07-21 22:17:23.000000000 -0400 | |
4400 | +++ linux-3.0.3/arch/sparc/mm/fault_64.c 2011-08-23 21:48:14.000000000 -0400 | |
4401 | @@ -21,6 +21,9 @@ | |
4402 | #include <linux/kprobes.h> | |
4403 | #include <linux/kdebug.h> | |
4404 | #include <linux/percpu.h> | |
4405 | +#include <linux/slab.h> | |
4406 | +#include <linux/pagemap.h> | |
4407 | +#include <linux/compiler.h> | |
4408 | ||
4409 | #include <asm/page.h> | |
4410 | #include <asm/pgtable.h> | |
4411 | @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru | |
4412 | printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n", | |
4413 | regs->tpc); | |
4414 | printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]); | |
4415 | - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]); | |
4416 | + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]); | |
4417 | printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr); | |
4418 | dump_stack(); | |
4419 | unhandled_fault(regs->tpc, current, regs); | |
4420 | @@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b | |
4421 | show_regs(regs); | |
4422 | } | |
4423 | ||
4424 | +#ifdef CONFIG_PAX_PAGEEXEC | |
4425 | +#ifdef CONFIG_PAX_DLRESOLVE | |
4426 | +static void pax_emuplt_close(struct vm_area_struct *vma) | |
4427 | +{ | |
4428 | + vma->vm_mm->call_dl_resolve = 0UL; | |
4429 | +} | |
4430 | + | |
4431 | +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf) | |
4432 | +{ | |
4433 | + unsigned int *kaddr; | |
4434 | + | |
4435 | + vmf->page = alloc_page(GFP_HIGHUSER); | |
4436 | + if (!vmf->page) | |
4437 | + return VM_FAULT_OOM; | |
4438 | + | |
4439 | + kaddr = kmap(vmf->page); | |
4440 | + memset(kaddr, 0, PAGE_SIZE); | |
4441 | + kaddr[0] = 0x9DE3BFA8U; /* save */ | |
4442 | + flush_dcache_page(vmf->page); | |
4443 | + kunmap(vmf->page); | |
4444 | + return VM_FAULT_MAJOR; | |
4445 | +} | |
4446 | + | |
4447 | +static const struct vm_operations_struct pax_vm_ops = { | |
4448 | + .close = pax_emuplt_close, | |
4449 | + .fault = pax_emuplt_fault | |
4450 | +}; | |
4451 | + | |
4452 | +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr) | |
4453 | +{ | |
4454 | + int ret; | |
4455 | + | |
4456 | + INIT_LIST_HEAD(&vma->anon_vma_chain); | |
4457 | + vma->vm_mm = current->mm; | |
4458 | + vma->vm_start = addr; | |
4459 | + vma->vm_end = addr + PAGE_SIZE; | |
4460 | + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC; | |
4461 | + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
4462 | + vma->vm_ops = &pax_vm_ops; | |
4463 | + | |
4464 | + ret = insert_vm_struct(current->mm, vma); | |
4465 | + if (ret) | |
4466 | + return ret; | |
4467 | + | |
4468 | + ++current->mm->total_vm; | |
4469 | + return 0; | |
4470 | +} | |
4471 | +#endif | |
4472 | + | |
4473 | +/* | |
4474 | + * PaX: decide what to do with offenders (regs->tpc = fault address) | |
4475 | + * | |
4476 | + * returns 1 when task should be killed | |
4477 | + * 2 when patched PLT trampoline was detected | |
4478 | + * 3 when unpatched PLT trampoline was detected | |
4479 | + */ | |
4480 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
4481 | +{ | |
4482 | + | |
4483 | +#ifdef CONFIG_PAX_EMUPLT | |
4484 | + int err; | |
4485 | + | |
4486 | + do { /* PaX: patched PLT emulation #1 */ | |
4487 | + unsigned int sethi1, sethi2, jmpl; | |
4488 | + | |
4489 | + err = get_user(sethi1, (unsigned int *)regs->tpc); | |
4490 | + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4)); | |
4491 | + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8)); | |
4492 | + | |
4493 | + if (err) | |
4494 | + break; | |
4495 | + | |
4496 | + if ((sethi1 & 0xFFC00000U) == 0x03000000U && | |
4497 | + (sethi2 & 0xFFC00000U) == 0x03000000U && | |
4498 | + (jmpl & 0xFFFFE000U) == 0x81C06000U) | |
4499 | + { | |
4500 | + unsigned long addr; | |
4501 | + | |
4502 | + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10; | |
4503 | + addr = regs->u_regs[UREG_G1]; | |
4504 | + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL); | |
4505 | + | |
4506 | + if (test_thread_flag(TIF_32BIT)) | |
4507 | + addr &= 0xFFFFFFFFUL; | |
4508 | + | |
4509 | + regs->tpc = addr; | |
4510 | + regs->tnpc = addr+4; | |
4511 | + return 2; | |
4512 | + } | |
4513 | + } while (0); | |
4514 | + | |
4515 | + { /* PaX: patched PLT emulation #2 */ | |
4516 | + unsigned int ba; | |
4517 | + | |
4518 | + err = get_user(ba, (unsigned int *)regs->tpc); | |
4519 | + | |
4520 | + if (!err && (ba & 0xFFC00000U) == 0x30800000U) { | |
4521 | + unsigned long addr; | |
4522 | + | |
4523 | + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2); | |
4524 | + | |
4525 | + if (test_thread_flag(TIF_32BIT)) | |
4526 | + addr &= 0xFFFFFFFFUL; | |
4527 | + | |
4528 | + regs->tpc = addr; | |
4529 | + regs->tnpc = addr+4; | |
4530 | + return 2; | |
4531 | + } | |
4532 | + } | |
4533 | + | |
4534 | + do { /* PaX: patched PLT emulation #3 */ | |
4535 | + unsigned int sethi, jmpl, nop; | |
4536 | + | |
4537 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4538 | + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4)); | |
4539 | + err |= get_user(nop, (unsigned int *)(regs->tpc+8)); | |
4540 | + | |
4541 | + if (err) | |
4542 | + break; | |
4543 | + | |
4544 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4545 | + (jmpl & 0xFFFFE000U) == 0x81C06000U && | |
4546 | + nop == 0x01000000U) | |
4547 | + { | |
4548 | + unsigned long addr; | |
4549 | + | |
4550 | + addr = (sethi & 0x003FFFFFU) << 10; | |
4551 | + regs->u_regs[UREG_G1] = addr; | |
4552 | + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL); | |
4553 | + | |
4554 | + if (test_thread_flag(TIF_32BIT)) | |
4555 | + addr &= 0xFFFFFFFFUL; | |
4556 | + | |
4557 | + regs->tpc = addr; | |
4558 | + regs->tnpc = addr+4; | |
4559 | + return 2; | |
4560 | + } | |
4561 | + } while (0); | |
4562 | + | |
4563 | + do { /* PaX: patched PLT emulation #4 */ | |
4564 | + unsigned int sethi, mov1, call, mov2; | |
4565 | + | |
4566 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4567 | + err |= get_user(mov1, (unsigned int *)(regs->tpc+4)); | |
4568 | + err |= get_user(call, (unsigned int *)(regs->tpc+8)); | |
4569 | + err |= get_user(mov2, (unsigned int *)(regs->tpc+12)); | |
4570 | + | |
4571 | + if (err) | |
4572 | + break; | |
4573 | + | |
4574 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4575 | + mov1 == 0x8210000FU && | |
4576 | + (call & 0xC0000000U) == 0x40000000U && | |
4577 | + mov2 == 0x9E100001U) | |
4578 | + { | |
4579 | + unsigned long addr; | |
4580 | + | |
4581 | + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC]; | |
4582 | + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2); | |
4583 | + | |
4584 | + if (test_thread_flag(TIF_32BIT)) | |
4585 | + addr &= 0xFFFFFFFFUL; | |
4586 | + | |
4587 | + regs->tpc = addr; | |
4588 | + regs->tnpc = addr+4; | |
4589 | + return 2; | |
4590 | + } | |
4591 | + } while (0); | |
4592 | + | |
4593 | + do { /* PaX: patched PLT emulation #5 */ | |
4594 | + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop; | |
4595 | + | |
4596 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4597 | + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4)); | |
4598 | + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8)); | |
4599 | + err |= get_user(or1, (unsigned int *)(regs->tpc+12)); | |
4600 | + err |= get_user(or2, (unsigned int *)(regs->tpc+16)); | |
4601 | + err |= get_user(sllx, (unsigned int *)(regs->tpc+20)); | |
4602 | + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24)); | |
4603 | + err |= get_user(nop, (unsigned int *)(regs->tpc+28)); | |
4604 | + | |
4605 | + if (err) | |
4606 | + break; | |
4607 | + | |
4608 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4609 | + (sethi1 & 0xFFC00000U) == 0x03000000U && | |
4610 | + (sethi2 & 0xFFC00000U) == 0x0B000000U && | |
4611 | + (or1 & 0xFFFFE000U) == 0x82106000U && | |
4612 | + (or2 & 0xFFFFE000U) == 0x8A116000U && | |
4613 | + sllx == 0x83287020U && | |
4614 | + jmpl == 0x81C04005U && | |
4615 | + nop == 0x01000000U) | |
4616 | + { | |
4617 | + unsigned long addr; | |
4618 | + | |
4619 | + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU); | |
4620 | + regs->u_regs[UREG_G1] <<= 32; | |
4621 | + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU); | |
4622 | + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5]; | |
4623 | + regs->tpc = addr; | |
4624 | + regs->tnpc = addr+4; | |
4625 | + return 2; | |
4626 | + } | |
4627 | + } while (0); | |
4628 | + | |
4629 | + do { /* PaX: patched PLT emulation #6 */ | |
4630 | + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop; | |
4631 | + | |
4632 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4633 | + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4)); | |
4634 | + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8)); | |
4635 | + err |= get_user(sllx, (unsigned int *)(regs->tpc+12)); | |
4636 | + err |= get_user(or, (unsigned int *)(regs->tpc+16)); | |
4637 | + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20)); | |
4638 | + err |= get_user(nop, (unsigned int *)(regs->tpc+24)); | |
4639 | + | |
4640 | + if (err) | |
4641 | + break; | |
4642 | + | |
4643 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4644 | + (sethi1 & 0xFFC00000U) == 0x03000000U && | |
4645 | + (sethi2 & 0xFFC00000U) == 0x0B000000U && | |
4646 | + sllx == 0x83287020U && | |
4647 | + (or & 0xFFFFE000U) == 0x8A116000U && | |
4648 | + jmpl == 0x81C04005U && | |
4649 | + nop == 0x01000000U) | |
4650 | + { | |
4651 | + unsigned long addr; | |
4652 | + | |
4653 | + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10; | |
4654 | + regs->u_regs[UREG_G1] <<= 32; | |
4655 | + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU); | |
4656 | + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5]; | |
4657 | + regs->tpc = addr; | |
4658 | + regs->tnpc = addr+4; | |
4659 | + return 2; | |
4660 | + } | |
4661 | + } while (0); | |
4662 | + | |
4663 | + do { /* PaX: unpatched PLT emulation step 1 */ | |
4664 | + unsigned int sethi, ba, nop; | |
4665 | + | |
4666 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4667 | + err |= get_user(ba, (unsigned int *)(regs->tpc+4)); | |
4668 | + err |= get_user(nop, (unsigned int *)(regs->tpc+8)); | |
4669 | + | |
4670 | + if (err) | |
4671 | + break; | |
4672 | + | |
4673 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4674 | + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) && | |
4675 | + nop == 0x01000000U) | |
4676 | + { | |
4677 | + unsigned long addr; | |
4678 | + unsigned int save, call; | |
4679 | + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl; | |
4680 | + | |
4681 | + if ((ba & 0xFFC00000U) == 0x30800000U) | |
4682 | + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2); | |
4683 | + else | |
4684 | + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2); | |
4685 | + | |
4686 | + if (test_thread_flag(TIF_32BIT)) | |
4687 | + addr &= 0xFFFFFFFFUL; | |
4688 | + | |
4689 | + err = get_user(save, (unsigned int *)addr); | |
4690 | + err |= get_user(call, (unsigned int *)(addr+4)); | |
4691 | + err |= get_user(nop, (unsigned int *)(addr+8)); | |
4692 | + if (err) | |
4693 | + break; | |
4694 | + | |
4695 | +#ifdef CONFIG_PAX_DLRESOLVE | |
4696 | + if (save == 0x9DE3BFA8U && | |
4697 | + (call & 0xC0000000U) == 0x40000000U && | |
4698 | + nop == 0x01000000U) | |
4699 | + { | |
4700 | + struct vm_area_struct *vma; | |
4701 | + unsigned long call_dl_resolve; | |
4702 | + | |
4703 | + down_read(¤t->mm->mmap_sem); | |
4704 | + call_dl_resolve = current->mm->call_dl_resolve; | |
4705 | + up_read(¤t->mm->mmap_sem); | |
4706 | + if (likely(call_dl_resolve)) | |
4707 | + goto emulate; | |
4708 | + | |
4709 | + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
4710 | + | |
4711 | + down_write(¤t->mm->mmap_sem); | |
4712 | + if (current->mm->call_dl_resolve) { | |
4713 | + call_dl_resolve = current->mm->call_dl_resolve; | |
4714 | + up_write(¤t->mm->mmap_sem); | |
4715 | + if (vma) | |
4716 | + kmem_cache_free(vm_area_cachep, vma); | |
4717 | + goto emulate; | |
4718 | + } | |
4719 | + | |
4720 | + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE); | |
4721 | + if (!vma || (call_dl_resolve & ~PAGE_MASK)) { | |
4722 | + up_write(¤t->mm->mmap_sem); | |
4723 | + if (vma) | |
4724 | + kmem_cache_free(vm_area_cachep, vma); | |
4725 | + return 1; | |
4726 | + } | |
4727 | + | |
4728 | + if (pax_insert_vma(vma, call_dl_resolve)) { | |
4729 | + up_write(¤t->mm->mmap_sem); | |
4730 | + kmem_cache_free(vm_area_cachep, vma); | |
4731 | + return 1; | |
4732 | + } | |
4733 | + | |
4734 | + current->mm->call_dl_resolve = call_dl_resolve; | |
4735 | + up_write(¤t->mm->mmap_sem); | |
4736 | + | |
4737 | +emulate: | |
4738 | + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10; | |
4739 | + regs->tpc = call_dl_resolve; | |
4740 | + regs->tnpc = addr+4; | |
4741 | + return 3; | |
4742 | + } | |
4743 | +#endif | |
4744 | + | |
4745 | + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */ | |
4746 | + if ((save & 0xFFC00000U) == 0x05000000U && | |
4747 | + (call & 0xFFFFE000U) == 0x85C0A000U && | |
4748 | + nop == 0x01000000U) | |
4749 | + { | |
4750 | + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10; | |
4751 | + regs->u_regs[UREG_G2] = addr + 4; | |
4752 | + addr = (save & 0x003FFFFFU) << 10; | |
4753 | + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL); | |
4754 | + | |
4755 | + if (test_thread_flag(TIF_32BIT)) | |
4756 | + addr &= 0xFFFFFFFFUL; | |
4757 | + | |
4758 | + regs->tpc = addr; | |
4759 | + regs->tnpc = addr+4; | |
4760 | + return 3; | |
4761 | + } | |
4762 | + | |
4763 | + /* PaX: 64-bit PLT stub */ | |
4764 | + err = get_user(sethi1, (unsigned int *)addr); | |
4765 | + err |= get_user(sethi2, (unsigned int *)(addr+4)); | |
4766 | + err |= get_user(or1, (unsigned int *)(addr+8)); | |
4767 | + err |= get_user(or2, (unsigned int *)(addr+12)); | |
4768 | + err |= get_user(sllx, (unsigned int *)(addr+16)); | |
4769 | + err |= get_user(add, (unsigned int *)(addr+20)); | |
4770 | + err |= get_user(jmpl, (unsigned int *)(addr+24)); | |
4771 | + err |= get_user(nop, (unsigned int *)(addr+28)); | |
4772 | + if (err) | |
4773 | + break; | |
4774 | + | |
4775 | + if ((sethi1 & 0xFFC00000U) == 0x09000000U && | |
4776 | + (sethi2 & 0xFFC00000U) == 0x0B000000U && | |
4777 | + (or1 & 0xFFFFE000U) == 0x88112000U && | |
4778 | + (or2 & 0xFFFFE000U) == 0x8A116000U && | |
4779 | + sllx == 0x89293020U && | |
4780 | + add == 0x8A010005U && | |
4781 | + jmpl == 0x89C14000U && | |
4782 | + nop == 0x01000000U) | |
4783 | + { | |
4784 | + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10; | |
4785 | + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU); | |
4786 | + regs->u_regs[UREG_G4] <<= 32; | |
4787 | + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU); | |
4788 | + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4]; | |
4789 | + regs->u_regs[UREG_G4] = addr + 24; | |
4790 | + addr = regs->u_regs[UREG_G5]; | |
4791 | + regs->tpc = addr; | |
4792 | + regs->tnpc = addr+4; | |
4793 | + return 3; | |
4794 | + } | |
4795 | + } | |
4796 | + } while (0); | |
4797 | + | |
4798 | +#ifdef CONFIG_PAX_DLRESOLVE | |
4799 | + do { /* PaX: unpatched PLT emulation step 2 */ | |
4800 | + unsigned int save, call, nop; | |
4801 | + | |
4802 | + err = get_user(save, (unsigned int *)(regs->tpc-4)); | |
4803 | + err |= get_user(call, (unsigned int *)regs->tpc); | |
4804 | + err |= get_user(nop, (unsigned int *)(regs->tpc+4)); | |
4805 | + if (err) | |
4806 | + break; | |
4807 | + | |
4808 | + if (save == 0x9DE3BFA8U && | |
4809 | + (call & 0xC0000000U) == 0x40000000U && | |
4810 | + nop == 0x01000000U) | |
4811 | + { | |
4812 | + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2); | |
4813 | + | |
4814 | + if (test_thread_flag(TIF_32BIT)) | |
4815 | + dl_resolve &= 0xFFFFFFFFUL; | |
4816 | + | |
4817 | + regs->u_regs[UREG_RETPC] = regs->tpc; | |
4818 | + regs->tpc = dl_resolve; | |
4819 | + regs->tnpc = dl_resolve+4; | |
4820 | + return 3; | |
4821 | + } | |
4822 | + } while (0); | |
4823 | +#endif | |
4824 | + | |
4825 | + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */ | |
4826 | + unsigned int sethi, ba, nop; | |
4827 | + | |
4828 | + err = get_user(sethi, (unsigned int *)regs->tpc); | |
4829 | + err |= get_user(ba, (unsigned int *)(regs->tpc+4)); | |
4830 | + err |= get_user(nop, (unsigned int *)(regs->tpc+8)); | |
4831 | + | |
4832 | + if (err) | |
4833 | + break; | |
4834 | + | |
4835 | + if ((sethi & 0xFFC00000U) == 0x03000000U && | |
4836 | + (ba & 0xFFF00000U) == 0x30600000U && | |
4837 | + nop == 0x01000000U) | |
4838 | + { | |
4839 | + unsigned long addr; | |
4840 | + | |
4841 | + addr = (sethi & 0x003FFFFFU) << 10; | |
4842 | + regs->u_regs[UREG_G1] = addr; | |
4843 | + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2); | |
4844 | + | |
4845 | + if (test_thread_flag(TIF_32BIT)) | |
4846 | + addr &= 0xFFFFFFFFUL; | |
4847 | + | |
4848 | + regs->tpc = addr; | |
4849 | + regs->tnpc = addr+4; | |
4850 | + return 2; | |
4851 | + } | |
4852 | + } while (0); | |
4853 | + | |
4854 | +#endif | |
4855 | + | |
4856 | + return 1; | |
4857 | +} | |
4858 | + | |
4859 | +void pax_report_insns(void *pc, void *sp) | |
4860 | +{ | |
4861 | + unsigned long i; | |
4862 | + | |
4863 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
4864 | + for (i = 0; i < 8; i++) { | |
4865 | + unsigned int c; | |
4866 | + if (get_user(c, (unsigned int *)pc+i)) | |
4867 | + printk(KERN_CONT "???????? "); | |
4868 | + else | |
4869 | + printk(KERN_CONT "%08x ", c); | |
4870 | + } | |
4871 | + printk("\n"); | |
4872 | +} | |
4873 | +#endif | |
4874 | + | |
4875 | asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) | |
4876 | { | |
4877 | struct mm_struct *mm = current->mm; | |
4878 | @@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau | |
4879 | if (!vma) | |
4880 | goto bad_area; | |
4881 | ||
4882 | +#ifdef CONFIG_PAX_PAGEEXEC | |
4883 | + /* PaX: detect ITLB misses on non-exec pages */ | |
4884 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address && | |
4885 | + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB)) | |
4886 | + { | |
4887 | + if (address != regs->tpc) | |
4888 | + goto good_area; | |
4889 | + | |
4890 | + up_read(&mm->mmap_sem); | |
4891 | + switch (pax_handle_fetch_fault(regs)) { | |
4892 | + | |
4893 | +#ifdef CONFIG_PAX_EMUPLT | |
4894 | + case 2: | |
4895 | + case 3: | |
4896 | + return; | |
4897 | +#endif | |
4898 | + | |
4899 | + } | |
4900 | + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS)); | |
4901 | + do_group_exit(SIGKILL); | |
4902 | + } | |
4903 | +#endif | |
4904 | + | |
4905 | /* Pure DTLB misses do not tell us whether the fault causing | |
4906 | * load/store/atomic was a write or not, it only says that there | |
4907 | * was no match. So in such a case we (carefully) read the | |
4908 | diff -urNp linux-3.0.3/arch/sparc/mm/hugetlbpage.c linux-3.0.3/arch/sparc/mm/hugetlbpage.c | |
4909 | --- linux-3.0.3/arch/sparc/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400 | |
4910 | +++ linux-3.0.3/arch/sparc/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400 | |
4911 | @@ -68,7 +68,7 @@ full_search: | |
4912 | } | |
4913 | return -ENOMEM; | |
4914 | } | |
4915 | - if (likely(!vma || addr + len <= vma->vm_start)) { | |
4916 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
4917 | /* | |
4918 | * Remember the place where we stopped the search: | |
4919 | */ | |
4920 | @@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct | |
4921 | /* make sure it can fit in the remaining address space */ | |
4922 | if (likely(addr > len)) { | |
4923 | vma = find_vma(mm, addr-len); | |
4924 | - if (!vma || addr <= vma->vm_start) { | |
4925 | + if (check_heap_stack_gap(vma, addr - len, len)) { | |
4926 | /* remember the address as a hint for next time */ | |
4927 | return (mm->free_area_cache = addr-len); | |
4928 | } | |
4929 | @@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct | |
4930 | if (unlikely(mm->mmap_base < len)) | |
4931 | goto bottomup; | |
4932 | ||
4933 | - addr = (mm->mmap_base-len) & HPAGE_MASK; | |
4934 | + addr = mm->mmap_base - len; | |
4935 | ||
4936 | do { | |
4937 | + addr &= HPAGE_MASK; | |
4938 | /* | |
4939 | * Lookup failure means no vma is above this address, | |
4940 | * else if new region fits below vma->vm_start, | |
4941 | * return with success: | |
4942 | */ | |
4943 | vma = find_vma(mm, addr); | |
4944 | - if (likely(!vma || addr+len <= vma->vm_start)) { | |
4945 | + if (likely(check_heap_stack_gap(vma, addr, len))) { | |
4946 | /* remember the address as a hint for next time */ | |
4947 | return (mm->free_area_cache = addr); | |
4948 | } | |
4949 | @@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct | |
4950 | mm->cached_hole_size = vma->vm_start - addr; | |
4951 | ||
4952 | /* try just below the current vma->vm_start */ | |
4953 | - addr = (vma->vm_start-len) & HPAGE_MASK; | |
4954 | - } while (likely(len < vma->vm_start)); | |
4955 | + addr = skip_heap_stack_gap(vma, len); | |
4956 | + } while (!IS_ERR_VALUE(addr)); | |
4957 | ||
4958 | bottomup: | |
4959 | /* | |
4960 | @@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f | |
4961 | if (addr) { | |
4962 | addr = ALIGN(addr, HPAGE_SIZE); | |
4963 | vma = find_vma(mm, addr); | |
4964 | - if (task_size - len >= addr && | |
4965 | - (!vma || addr + len <= vma->vm_start)) | |
4966 | + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
4967 | return addr; | |
4968 | } | |
4969 | if (mm->get_unmapped_area == arch_get_unmapped_area) | |
4970 | diff -urNp linux-3.0.3/arch/sparc/mm/init_32.c linux-3.0.3/arch/sparc/mm/init_32.c | |
4971 | --- linux-3.0.3/arch/sparc/mm/init_32.c 2011-07-21 22:17:23.000000000 -0400 | |
4972 | +++ linux-3.0.3/arch/sparc/mm/init_32.c 2011-08-23 21:47:55.000000000 -0400 | |
4973 | @@ -316,6 +316,9 @@ extern void device_scan(void); | |
4974 | pgprot_t PAGE_SHARED __read_mostly; | |
4975 | EXPORT_SYMBOL(PAGE_SHARED); | |
4976 | ||
4977 | +pgprot_t PAGE_SHARED_NOEXEC __read_mostly; | |
4978 | +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC); | |
4979 | + | |
4980 | void __init paging_init(void) | |
4981 | { | |
4982 | switch(sparc_cpu_model) { | |
4983 | @@ -344,17 +347,17 @@ void __init paging_init(void) | |
4984 | ||
4985 | /* Initialize the protection map with non-constant, MMU dependent values. */ | |
4986 | protection_map[0] = PAGE_NONE; | |
4987 | - protection_map[1] = PAGE_READONLY; | |
4988 | - protection_map[2] = PAGE_COPY; | |
4989 | - protection_map[3] = PAGE_COPY; | |
4990 | + protection_map[1] = PAGE_READONLY_NOEXEC; | |
4991 | + protection_map[2] = PAGE_COPY_NOEXEC; | |
4992 | + protection_map[3] = PAGE_COPY_NOEXEC; | |
4993 | protection_map[4] = PAGE_READONLY; | |
4994 | protection_map[5] = PAGE_READONLY; | |
4995 | protection_map[6] = PAGE_COPY; | |
4996 | protection_map[7] = PAGE_COPY; | |
4997 | protection_map[8] = PAGE_NONE; | |
4998 | - protection_map[9] = PAGE_READONLY; | |
4999 | - protection_map[10] = PAGE_SHARED; | |
5000 | - protection_map[11] = PAGE_SHARED; | |
5001 | + protection_map[9] = PAGE_READONLY_NOEXEC; | |
5002 | + protection_map[10] = PAGE_SHARED_NOEXEC; | |
5003 | + protection_map[11] = PAGE_SHARED_NOEXEC; | |
5004 | protection_map[12] = PAGE_READONLY; | |
5005 | protection_map[13] = PAGE_READONLY; | |
5006 | protection_map[14] = PAGE_SHARED; | |
5007 | diff -urNp linux-3.0.3/arch/sparc/mm/Makefile linux-3.0.3/arch/sparc/mm/Makefile | |
5008 | --- linux-3.0.3/arch/sparc/mm/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
5009 | +++ linux-3.0.3/arch/sparc/mm/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
5010 | @@ -2,7 +2,7 @@ | |
5011 | # | |
5012 | ||
5013 | asflags-y := -ansi | |
5014 | -ccflags-y := -Werror | |
5015 | +#ccflags-y := -Werror | |
5016 | ||
5017 | obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o | |
5018 | obj-y += fault_$(BITS).o | |
5019 | diff -urNp linux-3.0.3/arch/sparc/mm/srmmu.c linux-3.0.3/arch/sparc/mm/srmmu.c | |
5020 | --- linux-3.0.3/arch/sparc/mm/srmmu.c 2011-07-21 22:17:23.000000000 -0400 | |
5021 | +++ linux-3.0.3/arch/sparc/mm/srmmu.c 2011-08-23 21:47:55.000000000 -0400 | |
5022 | @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void) | |
5023 | PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED); | |
5024 | BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY)); | |
5025 | BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY)); | |
5026 | + | |
5027 | +#ifdef CONFIG_PAX_PAGEEXEC | |
5028 | + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC); | |
5029 | + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC)); | |
5030 | + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC)); | |
5031 | +#endif | |
5032 | + | |
5033 | BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL)); | |
5034 | page_kernel = pgprot_val(SRMMU_PAGE_KERNEL); | |
5035 | ||
5036 | diff -urNp linux-3.0.3/arch/um/include/asm/kmap_types.h linux-3.0.3/arch/um/include/asm/kmap_types.h | |
5037 | --- linux-3.0.3/arch/um/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
5038 | +++ linux-3.0.3/arch/um/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400 | |
5039 | @@ -23,6 +23,7 @@ enum km_type { | |
5040 | KM_IRQ1, | |
5041 | KM_SOFTIRQ0, | |
5042 | KM_SOFTIRQ1, | |
5043 | + KM_CLEARPAGE, | |
5044 | KM_TYPE_NR | |
5045 | }; | |
5046 | ||
5047 | diff -urNp linux-3.0.3/arch/um/include/asm/page.h linux-3.0.3/arch/um/include/asm/page.h | |
5048 | --- linux-3.0.3/arch/um/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400 | |
5049 | +++ linux-3.0.3/arch/um/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400 | |
5050 | @@ -14,6 +14,9 @@ | |
5051 | #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT) | |
5052 | #define PAGE_MASK (~(PAGE_SIZE-1)) | |
5053 | ||
5054 | +#define ktla_ktva(addr) (addr) | |
5055 | +#define ktva_ktla(addr) (addr) | |
5056 | + | |
5057 | #ifndef __ASSEMBLY__ | |
5058 | ||
5059 | struct page; | |
5060 | diff -urNp linux-3.0.3/arch/um/kernel/process.c linux-3.0.3/arch/um/kernel/process.c | |
5061 | --- linux-3.0.3/arch/um/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
5062 | +++ linux-3.0.3/arch/um/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
5063 | @@ -404,22 +404,6 @@ int singlestepping(void * t) | |
5064 | return 2; | |
5065 | } | |
5066 | ||
5067 | -/* | |
5068 | - * Only x86 and x86_64 have an arch_align_stack(). | |
5069 | - * All other arches have "#define arch_align_stack(x) (x)" | |
5070 | - * in their asm/system.h | |
5071 | - * As this is included in UML from asm-um/system-generic.h, | |
5072 | - * we can use it to behave as the subarch does. | |
5073 | - */ | |
5074 | -#ifndef arch_align_stack | |
5075 | -unsigned long arch_align_stack(unsigned long sp) | |
5076 | -{ | |
5077 | - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) | |
5078 | - sp -= get_random_int() % 8192; | |
5079 | - return sp & ~0xf; | |
5080 | -} | |
5081 | -#endif | |
5082 | - | |
5083 | unsigned long get_wchan(struct task_struct *p) | |
5084 | { | |
5085 | unsigned long stack_page, sp, ip; | |
5086 | diff -urNp linux-3.0.3/arch/um/sys-i386/syscalls.c linux-3.0.3/arch/um/sys-i386/syscalls.c | |
5087 | --- linux-3.0.3/arch/um/sys-i386/syscalls.c 2011-07-21 22:17:23.000000000 -0400 | |
5088 | +++ linux-3.0.3/arch/um/sys-i386/syscalls.c 2011-08-23 21:47:55.000000000 -0400 | |
5089 | @@ -11,6 +11,21 @@ | |
5090 | #include "asm/uaccess.h" | |
5091 | #include "asm/unistd.h" | |
5092 | ||
5093 | +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags) | |
5094 | +{ | |
5095 | + unsigned long pax_task_size = TASK_SIZE; | |
5096 | + | |
5097 | +#ifdef CONFIG_PAX_SEGMEXEC | |
5098 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) | |
5099 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
5100 | +#endif | |
5101 | + | |
5102 | + if (len > pax_task_size || addr > pax_task_size - len) | |
5103 | + return -EINVAL; | |
5104 | + | |
5105 | + return 0; | |
5106 | +} | |
5107 | + | |
5108 | /* | |
5109 | * The prototype on i386 is: | |
5110 | * | |
5111 | diff -urNp linux-3.0.3/arch/x86/boot/bitops.h linux-3.0.3/arch/x86/boot/bitops.h | |
5112 | --- linux-3.0.3/arch/x86/boot/bitops.h 2011-07-21 22:17:23.000000000 -0400 | |
5113 | +++ linux-3.0.3/arch/x86/boot/bitops.h 2011-08-23 21:47:55.000000000 -0400 | |
5114 | @@ -26,7 +26,7 @@ static inline int variable_test_bit(int | |
5115 | u8 v; | |
5116 | const u32 *p = (const u32 *)addr; | |
5117 | ||
5118 | - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr)); | |
5119 | + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr)); | |
5120 | return v; | |
5121 | } | |
5122 | ||
5123 | @@ -37,7 +37,7 @@ static inline int variable_test_bit(int | |
5124 | ||
5125 | static inline void set_bit(int nr, void *addr) | |
5126 | { | |
5127 | - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr)); | |
5128 | + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr)); | |
5129 | } | |
5130 | ||
5131 | #endif /* BOOT_BITOPS_H */ | |
5132 | diff -urNp linux-3.0.3/arch/x86/boot/boot.h linux-3.0.3/arch/x86/boot/boot.h | |
5133 | --- linux-3.0.3/arch/x86/boot/boot.h 2011-07-21 22:17:23.000000000 -0400 | |
5134 | +++ linux-3.0.3/arch/x86/boot/boot.h 2011-08-23 21:47:55.000000000 -0400 | |
5135 | @@ -85,7 +85,7 @@ static inline void io_delay(void) | |
5136 | static inline u16 ds(void) | |
5137 | { | |
5138 | u16 seg; | |
5139 | - asm("movw %%ds,%0" : "=rm" (seg)); | |
5140 | + asm volatile("movw %%ds,%0" : "=rm" (seg)); | |
5141 | return seg; | |
5142 | } | |
5143 | ||
5144 | @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t | |
5145 | static inline int memcmp(const void *s1, const void *s2, size_t len) | |
5146 | { | |
5147 | u8 diff; | |
5148 | - asm("repe; cmpsb; setnz %0" | |
5149 | + asm volatile("repe; cmpsb; setnz %0" | |
5150 | : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len)); | |
5151 | return diff; | |
5152 | } | |
5153 | diff -urNp linux-3.0.3/arch/x86/boot/compressed/head_32.S linux-3.0.3/arch/x86/boot/compressed/head_32.S | |
5154 | --- linux-3.0.3/arch/x86/boot/compressed/head_32.S 2011-07-21 22:17:23.000000000 -0400 | |
5155 | +++ linux-3.0.3/arch/x86/boot/compressed/head_32.S 2011-08-23 21:47:55.000000000 -0400 | |
5156 | @@ -76,7 +76,7 @@ ENTRY(startup_32) | |
5157 | notl %eax | |
5158 | andl %eax, %ebx | |
5159 | #else | |
5160 | - movl $LOAD_PHYSICAL_ADDR, %ebx | |
5161 | + movl $____LOAD_PHYSICAL_ADDR, %ebx | |
5162 | #endif | |
5163 | ||
5164 | /* Target address to relocate to for decompression */ | |
5165 | @@ -162,7 +162,7 @@ relocated: | |
5166 | * and where it was actually loaded. | |
5167 | */ | |
5168 | movl %ebp, %ebx | |
5169 | - subl $LOAD_PHYSICAL_ADDR, %ebx | |
5170 | + subl $____LOAD_PHYSICAL_ADDR, %ebx | |
5171 | jz 2f /* Nothing to be done if loaded at compiled addr. */ | |
5172 | /* | |
5173 | * Process relocations. | |
5174 | @@ -170,8 +170,7 @@ relocated: | |
5175 | ||
5176 | 1: subl $4, %edi | |
5177 | movl (%edi), %ecx | |
5178 | - testl %ecx, %ecx | |
5179 | - jz 2f | |
5180 | + jecxz 2f | |
5181 | addl %ebx, -__PAGE_OFFSET(%ebx, %ecx) | |
5182 | jmp 1b | |
5183 | 2: | |
5184 | diff -urNp linux-3.0.3/arch/x86/boot/compressed/head_64.S linux-3.0.3/arch/x86/boot/compressed/head_64.S | |
5185 | --- linux-3.0.3/arch/x86/boot/compressed/head_64.S 2011-07-21 22:17:23.000000000 -0400 | |
5186 | +++ linux-3.0.3/arch/x86/boot/compressed/head_64.S 2011-08-23 21:47:55.000000000 -0400 | |
5187 | @@ -91,7 +91,7 @@ ENTRY(startup_32) | |
5188 | notl %eax | |
5189 | andl %eax, %ebx | |
5190 | #else | |
5191 | - movl $LOAD_PHYSICAL_ADDR, %ebx | |
5192 | + movl $____LOAD_PHYSICAL_ADDR, %ebx | |
5193 | #endif | |
5194 | ||
5195 | /* Target address to relocate to for decompression */ | |
5196 | @@ -233,7 +233,7 @@ ENTRY(startup_64) | |
5197 | notq %rax | |
5198 | andq %rax, %rbp | |
5199 | #else | |
5200 | - movq $LOAD_PHYSICAL_ADDR, %rbp | |
5201 | + movq $____LOAD_PHYSICAL_ADDR, %rbp | |
5202 | #endif | |
5203 | ||
5204 | /* Target address to relocate to for decompression */ | |
5205 | diff -urNp linux-3.0.3/arch/x86/boot/compressed/Makefile linux-3.0.3/arch/x86/boot/compressed/Makefile | |
5206 | --- linux-3.0.3/arch/x86/boot/compressed/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
5207 | +++ linux-3.0.3/arch/x86/boot/compressed/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
5208 | @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal | |
5209 | KBUILD_CFLAGS += $(cflags-y) | |
5210 | KBUILD_CFLAGS += $(call cc-option,-ffreestanding) | |
5211 | KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector) | |
5212 | +ifdef CONSTIFY_PLUGIN | |
5213 | +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify | |
5214 | +endif | |
5215 | ||
5216 | KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ | |
5217 | GCOV_PROFILE := n | |
5218 | diff -urNp linux-3.0.3/arch/x86/boot/compressed/misc.c linux-3.0.3/arch/x86/boot/compressed/misc.c | |
5219 | --- linux-3.0.3/arch/x86/boot/compressed/misc.c 2011-07-21 22:17:23.000000000 -0400 | |
5220 | +++ linux-3.0.3/arch/x86/boot/compressed/misc.c 2011-08-23 21:47:55.000000000 -0400 | |
5221 | @@ -310,7 +310,7 @@ static void parse_elf(void *output) | |
5222 | case PT_LOAD: | |
5223 | #ifdef CONFIG_RELOCATABLE | |
5224 | dest = output; | |
5225 | - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR); | |
5226 | + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR); | |
5227 | #else | |
5228 | dest = (void *)(phdr->p_paddr); | |
5229 | #endif | |
5230 | @@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void * | |
5231 | error("Destination address too large"); | |
5232 | #endif | |
5233 | #ifndef CONFIG_RELOCATABLE | |
5234 | - if ((unsigned long)output != LOAD_PHYSICAL_ADDR) | |
5235 | + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR) | |
5236 | error("Wrong destination address"); | |
5237 | #endif | |
5238 | ||
5239 | diff -urNp linux-3.0.3/arch/x86/boot/compressed/relocs.c linux-3.0.3/arch/x86/boot/compressed/relocs.c | |
5240 | --- linux-3.0.3/arch/x86/boot/compressed/relocs.c 2011-07-21 22:17:23.000000000 -0400 | |
5241 | +++ linux-3.0.3/arch/x86/boot/compressed/relocs.c 2011-08-23 21:47:55.000000000 -0400 | |
5242 | @@ -13,8 +13,11 @@ | |
5243 | ||
5244 | static void die(char *fmt, ...); | |
5245 | ||
5246 | +#include "../../../../include/generated/autoconf.h" | |
5247 | + | |
5248 | #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) | |
5249 | static Elf32_Ehdr ehdr; | |
5250 | +static Elf32_Phdr *phdr; | |
5251 | static unsigned long reloc_count, reloc_idx; | |
5252 | static unsigned long *relocs; | |
5253 | ||
5254 | @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp) | |
5255 | } | |
5256 | } | |
5257 | ||
5258 | +static void read_phdrs(FILE *fp) | |
5259 | +{ | |
5260 | + unsigned int i; | |
5261 | + | |
5262 | + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr)); | |
5263 | + if (!phdr) { | |
5264 | + die("Unable to allocate %d program headers\n", | |
5265 | + ehdr.e_phnum); | |
5266 | + } | |
5267 | + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) { | |
5268 | + die("Seek to %d failed: %s\n", | |
5269 | + ehdr.e_phoff, strerror(errno)); | |
5270 | + } | |
5271 | + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) { | |
5272 | + die("Cannot read ELF program headers: %s\n", | |
5273 | + strerror(errno)); | |
5274 | + } | |
5275 | + for(i = 0; i < ehdr.e_phnum; i++) { | |
5276 | + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type); | |
5277 | + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset); | |
5278 | + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr); | |
5279 | + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr); | |
5280 | + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz); | |
5281 | + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz); | |
5282 | + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags); | |
5283 | + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align); | |
5284 | + } | |
5285 | + | |
5286 | +} | |
5287 | + | |
5288 | static void read_shdrs(FILE *fp) | |
5289 | { | |
5290 | - int i; | |
5291 | + unsigned int i; | |
5292 | Elf32_Shdr shdr; | |
5293 | ||
5294 | secs = calloc(ehdr.e_shnum, sizeof(struct section)); | |
5295 | @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp) | |
5296 | ||
5297 | static void read_strtabs(FILE *fp) | |
5298 | { | |
5299 | - int i; | |
5300 | + unsigned int i; | |
5301 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5302 | struct section *sec = &secs[i]; | |
5303 | if (sec->shdr.sh_type != SHT_STRTAB) { | |
5304 | @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp) | |
5305 | ||
5306 | static void read_symtabs(FILE *fp) | |
5307 | { | |
5308 | - int i,j; | |
5309 | + unsigned int i,j; | |
5310 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5311 | struct section *sec = &secs[i]; | |
5312 | if (sec->shdr.sh_type != SHT_SYMTAB) { | |
5313 | @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp) | |
5314 | ||
5315 | static void read_relocs(FILE *fp) | |
5316 | { | |
5317 | - int i,j; | |
5318 | + unsigned int i,j; | |
5319 | + uint32_t base; | |
5320 | + | |
5321 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5322 | struct section *sec = &secs[i]; | |
5323 | if (sec->shdr.sh_type != SHT_REL) { | |
5324 | @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp) | |
5325 | die("Cannot read symbol table: %s\n", | |
5326 | strerror(errno)); | |
5327 | } | |
5328 | + base = 0; | |
5329 | + for (j = 0; j < ehdr.e_phnum; j++) { | |
5330 | + if (phdr[j].p_type != PT_LOAD ) | |
5331 | + continue; | |
5332 | + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) | |
5333 | + continue; | |
5334 | + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr; | |
5335 | + break; | |
5336 | + } | |
5337 | for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) { | |
5338 | Elf32_Rel *rel = &sec->reltab[j]; | |
5339 | - rel->r_offset = elf32_to_cpu(rel->r_offset); | |
5340 | + rel->r_offset = elf32_to_cpu(rel->r_offset) + base; | |
5341 | rel->r_info = elf32_to_cpu(rel->r_info); | |
5342 | } | |
5343 | } | |
5344 | @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp) | |
5345 | ||
5346 | static void print_absolute_symbols(void) | |
5347 | { | |
5348 | - int i; | |
5349 | + unsigned int i; | |
5350 | printf("Absolute symbols\n"); | |
5351 | printf(" Num: Value Size Type Bind Visibility Name\n"); | |
5352 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5353 | struct section *sec = &secs[i]; | |
5354 | char *sym_strtab; | |
5355 | Elf32_Sym *sh_symtab; | |
5356 | - int j; | |
5357 | + unsigned int j; | |
5358 | ||
5359 | if (sec->shdr.sh_type != SHT_SYMTAB) { | |
5360 | continue; | |
5361 | @@ -431,14 +475,14 @@ static void print_absolute_symbols(void) | |
5362 | ||
5363 | static void print_absolute_relocs(void) | |
5364 | { | |
5365 | - int i, printed = 0; | |
5366 | + unsigned int i, printed = 0; | |
5367 | ||
5368 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5369 | struct section *sec = &secs[i]; | |
5370 | struct section *sec_applies, *sec_symtab; | |
5371 | char *sym_strtab; | |
5372 | Elf32_Sym *sh_symtab; | |
5373 | - int j; | |
5374 | + unsigned int j; | |
5375 | if (sec->shdr.sh_type != SHT_REL) { | |
5376 | continue; | |
5377 | } | |
5378 | @@ -499,13 +543,13 @@ static void print_absolute_relocs(void) | |
5379 | ||
5380 | static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym)) | |
5381 | { | |
5382 | - int i; | |
5383 | + unsigned int i; | |
5384 | /* Walk through the relocations */ | |
5385 | for (i = 0; i < ehdr.e_shnum; i++) { | |
5386 | char *sym_strtab; | |
5387 | Elf32_Sym *sh_symtab; | |
5388 | struct section *sec_applies, *sec_symtab; | |
5389 | - int j; | |
5390 | + unsigned int j; | |
5391 | struct section *sec = &secs[i]; | |
5392 | ||
5393 | if (sec->shdr.sh_type != SHT_REL) { | |
5394 | @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El | |
5395 | !is_rel_reloc(sym_name(sym_strtab, sym))) { | |
5396 | continue; | |
5397 | } | |
5398 | + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ | |
5399 | + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) | |
5400 | + continue; | |
5401 | + | |
5402 | +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) | |
5403 | + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ | |
5404 | + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext")) | |
5405 | + continue; | |
5406 | + if (!strcmp(sec_name(sym->st_shndx), ".init.text")) | |
5407 | + continue; | |
5408 | + if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) | |
5409 | + continue; | |
5410 | + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) | |
5411 | + continue; | |
5412 | +#endif | |
5413 | + | |
5414 | switch (r_type) { | |
5415 | case R_386_NONE: | |
5416 | case R_386_PC32: | |
5417 | @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co | |
5418 | ||
5419 | static void emit_relocs(int as_text) | |
5420 | { | |
5421 | - int i; | |
5422 | + unsigned int i; | |
5423 | /* Count how many relocations I have and allocate space for them. */ | |
5424 | reloc_count = 0; | |
5425 | walk_relocs(count_reloc); | |
5426 | @@ -665,6 +725,7 @@ int main(int argc, char **argv) | |
5427 | fname, strerror(errno)); | |
5428 | } | |
5429 | read_ehdr(fp); | |
5430 | + read_phdrs(fp); | |
5431 | read_shdrs(fp); | |
5432 | read_strtabs(fp); | |
5433 | read_symtabs(fp); | |
5434 | diff -urNp linux-3.0.3/arch/x86/boot/cpucheck.c linux-3.0.3/arch/x86/boot/cpucheck.c | |
5435 | --- linux-3.0.3/arch/x86/boot/cpucheck.c 2011-07-21 22:17:23.000000000 -0400 | |
5436 | +++ linux-3.0.3/arch/x86/boot/cpucheck.c 2011-08-23 21:47:55.000000000 -0400 | |
5437 | @@ -74,7 +74,7 @@ static int has_fpu(void) | |
5438 | u16 fcw = -1, fsw = -1; | |
5439 | u32 cr0; | |
5440 | ||
5441 | - asm("movl %%cr0,%0" : "=r" (cr0)); | |
5442 | + asm volatile("movl %%cr0,%0" : "=r" (cr0)); | |
5443 | if (cr0 & (X86_CR0_EM|X86_CR0_TS)) { | |
5444 | cr0 &= ~(X86_CR0_EM|X86_CR0_TS); | |
5445 | asm volatile("movl %0,%%cr0" : : "r" (cr0)); | |
5446 | @@ -90,7 +90,7 @@ static int has_eflag(u32 mask) | |
5447 | { | |
5448 | u32 f0, f1; | |
5449 | ||
5450 | - asm("pushfl ; " | |
5451 | + asm volatile("pushfl ; " | |
5452 | "pushfl ; " | |
5453 | "popl %0 ; " | |
5454 | "movl %0,%1 ; " | |
5455 | @@ -115,7 +115,7 @@ static void get_flags(void) | |
5456 | set_bit(X86_FEATURE_FPU, cpu.flags); | |
5457 | ||
5458 | if (has_eflag(X86_EFLAGS_ID)) { | |
5459 | - asm("cpuid" | |
5460 | + asm volatile("cpuid" | |
5461 | : "=a" (max_intel_level), | |
5462 | "=b" (cpu_vendor[0]), | |
5463 | "=d" (cpu_vendor[1]), | |
5464 | @@ -124,7 +124,7 @@ static void get_flags(void) | |
5465 | ||
5466 | if (max_intel_level >= 0x00000001 && | |
5467 | max_intel_level <= 0x0000ffff) { | |
5468 | - asm("cpuid" | |
5469 | + asm volatile("cpuid" | |
5470 | : "=a" (tfms), | |
5471 | "=c" (cpu.flags[4]), | |
5472 | "=d" (cpu.flags[0]) | |
5473 | @@ -136,7 +136,7 @@ static void get_flags(void) | |
5474 | cpu.model += ((tfms >> 16) & 0xf) << 4; | |
5475 | } | |
5476 | ||
5477 | - asm("cpuid" | |
5478 | + asm volatile("cpuid" | |
5479 | : "=a" (max_amd_level) | |
5480 | : "a" (0x80000000) | |
5481 | : "ebx", "ecx", "edx"); | |
5482 | @@ -144,7 +144,7 @@ static void get_flags(void) | |
5483 | if (max_amd_level >= 0x80000001 && | |
5484 | max_amd_level <= 0x8000ffff) { | |
5485 | u32 eax = 0x80000001; | |
5486 | - asm("cpuid" | |
5487 | + asm volatile("cpuid" | |
5488 | : "+a" (eax), | |
5489 | "=c" (cpu.flags[6]), | |
5490 | "=d" (cpu.flags[1]) | |
5491 | @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r | |
5492 | u32 ecx = MSR_K7_HWCR; | |
5493 | u32 eax, edx; | |
5494 | ||
5495 | - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5496 | + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5497 | eax &= ~(1 << 15); | |
5498 | - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5499 | + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5500 | ||
5501 | get_flags(); /* Make sure it really did something */ | |
5502 | err = check_flags(); | |
5503 | @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r | |
5504 | u32 ecx = MSR_VIA_FCR; | |
5505 | u32 eax, edx; | |
5506 | ||
5507 | - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5508 | + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5509 | eax |= (1<<1)|(1<<7); | |
5510 | - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5511 | + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5512 | ||
5513 | set_bit(X86_FEATURE_CX8, cpu.flags); | |
5514 | err = check_flags(); | |
5515 | @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r | |
5516 | u32 eax, edx; | |
5517 | u32 level = 1; | |
5518 | ||
5519 | - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5520 | - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx)); | |
5521 | - asm("cpuid" | |
5522 | + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx)); | |
5523 | + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx)); | |
5524 | + asm volatile("cpuid" | |
5525 | : "+a" (level), "=d" (cpu.flags[0]) | |
5526 | : : "ecx", "ebx"); | |
5527 | - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5528 | + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx)); | |
5529 | ||
5530 | err = check_flags(); | |
5531 | } | |
5532 | diff -urNp linux-3.0.3/arch/x86/boot/header.S linux-3.0.3/arch/x86/boot/header.S | |
5533 | --- linux-3.0.3/arch/x86/boot/header.S 2011-07-21 22:17:23.000000000 -0400 | |
5534 | +++ linux-3.0.3/arch/x86/boot/header.S 2011-08-23 21:47:55.000000000 -0400 | |
5535 | @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical | |
5536 | # single linked list of | |
5537 | # struct setup_data | |
5538 | ||
5539 | -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr | |
5540 | +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr | |
5541 | ||
5542 | #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset) | |
5543 | #define VO_INIT_SIZE (VO__end - VO__text) | |
5544 | diff -urNp linux-3.0.3/arch/x86/boot/Makefile linux-3.0.3/arch/x86/boot/Makefile | |
5545 | --- linux-3.0.3/arch/x86/boot/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
5546 | +++ linux-3.0.3/arch/x86/boot/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
5547 | @@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os | |
5548 | $(call cc-option, -fno-stack-protector) \ | |
5549 | $(call cc-option, -mpreferred-stack-boundary=2) | |
5550 | KBUILD_CFLAGS += $(call cc-option, -m32) | |
5551 | +ifdef CONSTIFY_PLUGIN | |
5552 | +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify | |
5553 | +endif | |
5554 | KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ | |
5555 | GCOV_PROFILE := n | |
5556 | ||
5557 | diff -urNp linux-3.0.3/arch/x86/boot/memory.c linux-3.0.3/arch/x86/boot/memory.c | |
5558 | --- linux-3.0.3/arch/x86/boot/memory.c 2011-07-21 22:17:23.000000000 -0400 | |
5559 | +++ linux-3.0.3/arch/x86/boot/memory.c 2011-08-23 21:47:55.000000000 -0400 | |
5560 | @@ -19,7 +19,7 @@ | |
5561 | ||
5562 | static int detect_memory_e820(void) | |
5563 | { | |
5564 | - int count = 0; | |
5565 | + unsigned int count = 0; | |
5566 | struct biosregs ireg, oreg; | |
5567 | struct e820entry *desc = boot_params.e820_map; | |
5568 | static struct e820entry buf; /* static so it is zeroed */ | |
5569 | diff -urNp linux-3.0.3/arch/x86/boot/video.c linux-3.0.3/arch/x86/boot/video.c | |
5570 | --- linux-3.0.3/arch/x86/boot/video.c 2011-07-21 22:17:23.000000000 -0400 | |
5571 | +++ linux-3.0.3/arch/x86/boot/video.c 2011-08-23 21:47:55.000000000 -0400 | |
5572 | @@ -96,7 +96,7 @@ static void store_mode_params(void) | |
5573 | static unsigned int get_entry(void) | |
5574 | { | |
5575 | char entry_buf[4]; | |
5576 | - int i, len = 0; | |
5577 | + unsigned int i, len = 0; | |
5578 | int key; | |
5579 | unsigned int v; | |
5580 | ||
5581 | diff -urNp linux-3.0.3/arch/x86/boot/video-vesa.c linux-3.0.3/arch/x86/boot/video-vesa.c | |
5582 | --- linux-3.0.3/arch/x86/boot/video-vesa.c 2011-07-21 22:17:23.000000000 -0400 | |
5583 | +++ linux-3.0.3/arch/x86/boot/video-vesa.c 2011-08-23 21:47:55.000000000 -0400 | |
5584 | @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void) | |
5585 | ||
5586 | boot_params.screen_info.vesapm_seg = oreg.es; | |
5587 | boot_params.screen_info.vesapm_off = oreg.di; | |
5588 | + boot_params.screen_info.vesapm_size = oreg.cx; | |
5589 | } | |
5590 | ||
5591 | /* | |
5592 | diff -urNp linux-3.0.3/arch/x86/ia32/ia32_aout.c linux-3.0.3/arch/x86/ia32/ia32_aout.c | |
5593 | --- linux-3.0.3/arch/x86/ia32/ia32_aout.c 2011-07-21 22:17:23.000000000 -0400 | |
5594 | +++ linux-3.0.3/arch/x86/ia32/ia32_aout.c 2011-08-23 21:48:14.000000000 -0400 | |
5595 | @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st | |
5596 | unsigned long dump_start, dump_size; | |
5597 | struct user32 dump; | |
5598 | ||
5599 | + memset(&dump, 0, sizeof(dump)); | |
5600 | + | |
5601 | fs = get_fs(); | |
5602 | set_fs(KERNEL_DS); | |
5603 | has_dumped = 1; | |
5604 | diff -urNp linux-3.0.3/arch/x86/ia32/ia32entry.S linux-3.0.3/arch/x86/ia32/ia32entry.S | |
5605 | --- linux-3.0.3/arch/x86/ia32/ia32entry.S 2011-07-21 22:17:23.000000000 -0400 | |
5606 | +++ linux-3.0.3/arch/x86/ia32/ia32entry.S 2011-08-25 17:36:37.000000000 -0400 | |
5607 | @@ -13,6 +13,7 @@ | |
5608 | #include <asm/thread_info.h> | |
5609 | #include <asm/segment.h> | |
5610 | #include <asm/irqflags.h> | |
5611 | +#include <asm/pgtable.h> | |
5612 | #include <linux/linkage.h> | |
5613 | ||
5614 | /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ | |
5615 | @@ -95,6 +96,29 @@ ENTRY(native_irq_enable_sysexit) | |
5616 | ENDPROC(native_irq_enable_sysexit) | |
5617 | #endif | |
5618 | ||
5619 | + .macro pax_enter_kernel_user | |
5620 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
5621 | + call pax_enter_kernel_user | |
5622 | +#endif | |
5623 | + .endm | |
5624 | + | |
5625 | + .macro pax_exit_kernel_user | |
5626 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
5627 | + call pax_exit_kernel_user | |
5628 | +#endif | |
5629 | +#ifdef CONFIG_PAX_RANDKSTACK | |
5630 | + pushq %rax | |
5631 | + call pax_randomize_kstack | |
5632 | + popq %rax | |
5633 | +#endif | |
5634 | + .endm | |
5635 | + | |
5636 | + .macro pax_erase_kstack | |
5637 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
5638 | + call pax_erase_kstack | |
5639 | +#endif | |
5640 | + .endm | |
5641 | + | |
5642 | /* | |
5643 | * 32bit SYSENTER instruction entry. | |
5644 | * | |
5645 | @@ -121,7 +145,7 @@ ENTRY(ia32_sysenter_target) | |
5646 | CFI_REGISTER rsp,rbp | |
5647 | SWAPGS_UNSAFE_STACK | |
5648 | movq PER_CPU_VAR(kernel_stack), %rsp | |
5649 | - addq $(KERNEL_STACK_OFFSET),%rsp | |
5650 | + pax_enter_kernel_user | |
5651 | /* | |
5652 | * No need to follow this irqs on/off section: the syscall | |
5653 | * disabled irqs, here we enable it straight after entry: | |
5654 | @@ -134,7 +158,8 @@ ENTRY(ia32_sysenter_target) | |
5655 | CFI_REL_OFFSET rsp,0 | |
5656 | pushfq_cfi | |
5657 | /*CFI_REL_OFFSET rflags,0*/ | |
5658 | - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d | |
5659 | + GET_THREAD_INFO(%r10) | |
5660 | + movl TI_sysenter_return(%r10), %r10d | |
5661 | CFI_REGISTER rip,r10 | |
5662 | pushq_cfi $__USER32_CS | |
5663 | /*CFI_REL_OFFSET cs,0*/ | |
5664 | @@ -146,6 +171,12 @@ ENTRY(ia32_sysenter_target) | |
5665 | SAVE_ARGS 0,0,1 | |
5666 | /* no need to do an access_ok check here because rbp has been | |
5667 | 32bit zero extended */ | |
5668 | + | |
5669 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
5670 | + mov $PAX_USER_SHADOW_BASE,%r10 | |
5671 | + add %r10,%rbp | |
5672 | +#endif | |
5673 | + | |
5674 | 1: movl (%rbp),%ebp | |
5675 | .section __ex_table,"a" | |
5676 | .quad 1b,ia32_badarg | |
5677 | @@ -168,6 +199,8 @@ sysenter_dispatch: | |
5678 | testl $_TIF_ALLWORK_MASK,TI_flags(%r10) | |
5679 | jnz sysexit_audit | |
5680 | sysexit_from_sys_call: | |
5681 | + pax_exit_kernel_user | |
5682 | + pax_erase_kstack | |
5683 | andl $~TS_COMPAT,TI_status(%r10) | |
5684 | /* clear IF, that popfq doesn't enable interrupts early */ | |
5685 | andl $~0x200,EFLAGS-R11(%rsp) | |
5686 | @@ -194,6 +227,9 @@ sysexit_from_sys_call: | |
5687 | movl %eax,%esi /* 2nd arg: syscall number */ | |
5688 | movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */ | |
5689 | call audit_syscall_entry | |
5690 | + | |
5691 | + pax_erase_kstack | |
5692 | + | |
5693 | movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */ | |
5694 | cmpq $(IA32_NR_syscalls-1),%rax | |
5695 | ja ia32_badsys | |
5696 | @@ -246,6 +282,9 @@ sysenter_tracesys: | |
5697 | movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */ | |
5698 | movq %rsp,%rdi /* &pt_regs -> arg1 */ | |
5699 | call syscall_trace_enter | |
5700 | + | |
5701 | + pax_erase_kstack | |
5702 | + | |
5703 | LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ | |
5704 | RESTORE_REST | |
5705 | cmpq $(IA32_NR_syscalls-1),%rax | |
5706 | @@ -277,19 +316,24 @@ ENDPROC(ia32_sysenter_target) | |
5707 | ENTRY(ia32_cstar_target) | |
5708 | CFI_STARTPROC32 simple | |
5709 | CFI_SIGNAL_FRAME | |
5710 | - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET | |
5711 | + CFI_DEF_CFA rsp,0 | |
5712 | CFI_REGISTER rip,rcx | |
5713 | /*CFI_REGISTER rflags,r11*/ | |
5714 | SWAPGS_UNSAFE_STACK | |
5715 | movl %esp,%r8d | |
5716 | CFI_REGISTER rsp,r8 | |
5717 | movq PER_CPU_VAR(kernel_stack),%rsp | |
5718 | + | |
5719 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
5720 | + pax_enter_kernel_user | |
5721 | +#endif | |
5722 | + | |
5723 | /* | |
5724 | * No need to follow this irqs on/off section: the syscall | |
5725 | * disabled irqs and here we enable it straight after entry: | |
5726 | */ | |
5727 | ENABLE_INTERRUPTS(CLBR_NONE) | |
5728 | - SAVE_ARGS 8,1,1 | |
5729 | + SAVE_ARGS 8*6,1,1 | |
5730 | movl %eax,%eax /* zero extension */ | |
5731 | movq %rax,ORIG_RAX-ARGOFFSET(%rsp) | |
5732 | movq %rcx,RIP-ARGOFFSET(%rsp) | |
5733 | @@ -305,6 +349,12 @@ ENTRY(ia32_cstar_target) | |
5734 | /* no need to do an access_ok check here because r8 has been | |
5735 | 32bit zero extended */ | |
5736 | /* hardware stack frame is complete now */ | |
5737 | + | |
5738 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
5739 | + mov $PAX_USER_SHADOW_BASE,%r10 | |
5740 | + add %r10,%r8 | |
5741 | +#endif | |
5742 | + | |
5743 | 1: movl (%r8),%r9d | |
5744 | .section __ex_table,"a" | |
5745 | .quad 1b,ia32_badarg | |
5746 | @@ -327,6 +377,8 @@ cstar_dispatch: | |
5747 | testl $_TIF_ALLWORK_MASK,TI_flags(%r10) | |
5748 | jnz sysretl_audit | |
5749 | sysretl_from_sys_call: | |
5750 | + pax_exit_kernel_user | |
5751 | + pax_erase_kstack | |
5752 | andl $~TS_COMPAT,TI_status(%r10) | |
5753 | RESTORE_ARGS 1,-ARG_SKIP,1,1,1 | |
5754 | movl RIP-ARGOFFSET(%rsp),%ecx | |
5755 | @@ -364,6 +416,9 @@ cstar_tracesys: | |
5756 | movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */ | |
5757 | movq %rsp,%rdi /* &pt_regs -> arg1 */ | |
5758 | call syscall_trace_enter | |
5759 | + | |
5760 | + pax_erase_kstack | |
5761 | + | |
5762 | LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */ | |
5763 | RESTORE_REST | |
5764 | xchgl %ebp,%r9d | |
5765 | @@ -409,6 +464,7 @@ ENTRY(ia32_syscall) | |
5766 | CFI_REL_OFFSET rip,RIP-RIP | |
5767 | PARAVIRT_ADJUST_EXCEPTION_FRAME | |
5768 | SWAPGS | |
5769 | + pax_enter_kernel_user | |
5770 | /* | |
5771 | * No need to follow this irqs on/off section: the syscall | |
5772 | * disabled irqs and here we enable it straight after entry: | |
5773 | @@ -441,6 +497,9 @@ ia32_tracesys: | |
5774 | movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */ | |
5775 | movq %rsp,%rdi /* &pt_regs -> arg1 */ | |
5776 | call syscall_trace_enter | |
5777 | + | |
5778 | + pax_erase_kstack | |
5779 | + | |
5780 | LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ | |
5781 | RESTORE_REST | |
5782 | cmpq $(IA32_NR_syscalls-1),%rax | |
5783 | diff -urNp linux-3.0.3/arch/x86/ia32/ia32_signal.c linux-3.0.3/arch/x86/ia32/ia32_signal.c | |
5784 | --- linux-3.0.3/arch/x86/ia32/ia32_signal.c 2011-07-21 22:17:23.000000000 -0400 | |
5785 | +++ linux-3.0.3/arch/x86/ia32/ia32_signal.c 2011-08-23 21:47:55.000000000 -0400 | |
5786 | @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct | |
5787 | sp -= frame_size; | |
5788 | /* Align the stack pointer according to the i386 ABI, | |
5789 | * i.e. so that on function entry ((sp + 4) & 15) == 0. */ | |
5790 | - sp = ((sp + 4) & -16ul) - 4; | |
5791 | + sp = ((sp - 12) & -16ul) - 4; | |
5792 | return (void __user *) sp; | |
5793 | } | |
5794 | ||
5795 | @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s | |
5796 | * These are actually not used anymore, but left because some | |
5797 | * gdb versions depend on them as a marker. | |
5798 | */ | |
5799 | - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); | |
5800 | + put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); | |
5801 | } put_user_catch(err); | |
5802 | ||
5803 | if (err) | |
5804 | @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct | |
5805 | 0xb8, | |
5806 | __NR_ia32_rt_sigreturn, | |
5807 | 0x80cd, | |
5808 | - 0, | |
5809 | + 0 | |
5810 | }; | |
5811 | ||
5812 | frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate); | |
5813 | @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct | |
5814 | ||
5815 | if (ka->sa.sa_flags & SA_RESTORER) | |
5816 | restorer = ka->sa.sa_restorer; | |
5817 | + else if (current->mm->context.vdso) | |
5818 | + /* Return stub is in 32bit vsyscall page */ | |
5819 | + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); | |
5820 | else | |
5821 | - restorer = VDSO32_SYMBOL(current->mm->context.vdso, | |
5822 | - rt_sigreturn); | |
5823 | + restorer = &frame->retcode; | |
5824 | put_user_ex(ptr_to_compat(restorer), &frame->pretcode); | |
5825 | ||
5826 | /* | |
5827 | * Not actually used anymore, but left because some gdb | |
5828 | * versions need it. | |
5829 | */ | |
5830 | - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); | |
5831 | + put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); | |
5832 | } put_user_catch(err); | |
5833 | ||
5834 | if (err) | |
5835 | diff -urNp linux-3.0.3/arch/x86/include/asm/alternative.h linux-3.0.3/arch/x86/include/asm/alternative.h | |
5836 | --- linux-3.0.3/arch/x86/include/asm/alternative.h 2011-07-21 22:17:23.000000000 -0400 | |
5837 | +++ linux-3.0.3/arch/x86/include/asm/alternative.h 2011-08-23 21:47:55.000000000 -0400 | |
5838 | @@ -93,7 +93,7 @@ static inline int alternatives_text_rese | |
5839 | ".section .discard,\"aw\",@progbits\n" \ | |
5840 | " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \ | |
5841 | ".previous\n" \ | |
5842 | - ".section .altinstr_replacement, \"ax\"\n" \ | |
5843 | + ".section .altinstr_replacement, \"a\"\n" \ | |
5844 | "663:\n\t" newinstr "\n664:\n" /* replacement */ \ | |
5845 | ".previous" | |
5846 | ||
5847 | diff -urNp linux-3.0.3/arch/x86/include/asm/apic.h linux-3.0.3/arch/x86/include/asm/apic.h | |
5848 | --- linux-3.0.3/arch/x86/include/asm/apic.h 2011-07-21 22:17:23.000000000 -0400 | |
5849 | +++ linux-3.0.3/arch/x86/include/asm/apic.h 2011-08-23 21:48:14.000000000 -0400 | |
5850 | @@ -45,7 +45,7 @@ static inline void generic_apic_probe(vo | |
5851 | ||
5852 | #ifdef CONFIG_X86_LOCAL_APIC | |
5853 | ||
5854 | -extern unsigned int apic_verbosity; | |
5855 | +extern int apic_verbosity; | |
5856 | extern int local_apic_timer_c2_ok; | |
5857 | ||
5858 | extern int disable_apic; | |
5859 | diff -urNp linux-3.0.3/arch/x86/include/asm/apm.h linux-3.0.3/arch/x86/include/asm/apm.h | |
5860 | --- linux-3.0.3/arch/x86/include/asm/apm.h 2011-07-21 22:17:23.000000000 -0400 | |
5861 | +++ linux-3.0.3/arch/x86/include/asm/apm.h 2011-08-23 21:47:55.000000000 -0400 | |
5862 | @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 | |
5863 | __asm__ __volatile__(APM_DO_ZERO_SEGS | |
5864 | "pushl %%edi\n\t" | |
5865 | "pushl %%ebp\n\t" | |
5866 | - "lcall *%%cs:apm_bios_entry\n\t" | |
5867 | + "lcall *%%ss:apm_bios_entry\n\t" | |
5868 | "setc %%al\n\t" | |
5869 | "popl %%ebp\n\t" | |
5870 | "popl %%edi\n\t" | |
5871 | @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as | |
5872 | __asm__ __volatile__(APM_DO_ZERO_SEGS | |
5873 | "pushl %%edi\n\t" | |
5874 | "pushl %%ebp\n\t" | |
5875 | - "lcall *%%cs:apm_bios_entry\n\t" | |
5876 | + "lcall *%%ss:apm_bios_entry\n\t" | |
5877 | "setc %%bl\n\t" | |
5878 | "popl %%ebp\n\t" | |
5879 | "popl %%edi\n\t" | |
5880 | diff -urNp linux-3.0.3/arch/x86/include/asm/atomic64_32.h linux-3.0.3/arch/x86/include/asm/atomic64_32.h | |
5881 | --- linux-3.0.3/arch/x86/include/asm/atomic64_32.h 2011-07-21 22:17:23.000000000 -0400 | |
5882 | +++ linux-3.0.3/arch/x86/include/asm/atomic64_32.h 2011-08-23 21:47:55.000000000 -0400 | |
5883 | @@ -12,6 +12,14 @@ typedef struct { | |
5884 | u64 __aligned(8) counter; | |
5885 | } atomic64_t; | |
5886 | ||
5887 | +#ifdef CONFIG_PAX_REFCOUNT | |
5888 | +typedef struct { | |
5889 | + u64 __aligned(8) counter; | |
5890 | +} atomic64_unchecked_t; | |
5891 | +#else | |
5892 | +typedef atomic64_t atomic64_unchecked_t; | |
5893 | +#endif | |
5894 | + | |
5895 | #define ATOMIC64_INIT(val) { (val) } | |
5896 | ||
5897 | #ifdef CONFIG_X86_CMPXCHG64 | |
5898 | @@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg | |
5899 | } | |
5900 | ||
5901 | /** | |
5902 | + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable | |
5903 | + * @p: pointer to type atomic64_unchecked_t | |
5904 | + * @o: expected value | |
5905 | + * @n: new value | |
5906 | + * | |
5907 | + * Atomically sets @v to @n if it was equal to @o and returns | |
5908 | + * the old value. | |
5909 | + */ | |
5910 | + | |
5911 | +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n) | |
5912 | +{ | |
5913 | + return cmpxchg64(&v->counter, o, n); | |
5914 | +} | |
5915 | + | |
5916 | +/** | |
5917 | * atomic64_xchg - xchg atomic64 variable | |
5918 | * @v: pointer to type atomic64_t | |
5919 | * @n: value to assign | |
5920 | @@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64 | |
5921 | } | |
5922 | ||
5923 | /** | |
5924 | + * atomic64_set_unchecked - set atomic64 variable | |
5925 | + * @v: pointer to type atomic64_unchecked_t | |
5926 | + * @n: value to assign | |
5927 | + * | |
5928 | + * Atomically sets the value of @v to @n. | |
5929 | + */ | |
5930 | +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i) | |
5931 | +{ | |
5932 | + unsigned high = (unsigned)(i >> 32); | |
5933 | + unsigned low = (unsigned)i; | |
5934 | + asm volatile(ATOMIC64_ALTERNATIVE(set) | |
5935 | + : "+b" (low), "+c" (high) | |
5936 | + : "S" (v) | |
5937 | + : "eax", "edx", "memory" | |
5938 | + ); | |
5939 | +} | |
5940 | + | |
5941 | +/** | |
5942 | * atomic64_read - read atomic64 variable | |
5943 | * @v: pointer to type atomic64_t | |
5944 | * | |
5945 | @@ -93,6 +134,22 @@ static inline long long atomic64_read(at | |
5946 | } | |
5947 | ||
5948 | /** | |
5949 | + * atomic64_read_unchecked - read atomic64 variable | |
5950 | + * @v: pointer to type atomic64_unchecked_t | |
5951 | + * | |
5952 | + * Atomically reads the value of @v and returns it. | |
5953 | + */ | |
5954 | +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v) | |
5955 | +{ | |
5956 | + long long r; | |
5957 | + asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked) | |
5958 | + : "=A" (r), "+c" (v) | |
5959 | + : : "memory" | |
5960 | + ); | |
5961 | + return r; | |
5962 | + } | |
5963 | + | |
5964 | +/** | |
5965 | * atomic64_add_return - add and return | |
5966 | * @i: integer value to add | |
5967 | * @v: pointer to type atomic64_t | |
5968 | @@ -108,6 +165,22 @@ static inline long long atomic64_add_ret | |
5969 | return i; | |
5970 | } | |
5971 | ||
5972 | +/** | |
5973 | + * atomic64_add_return_unchecked - add and return | |
5974 | + * @i: integer value to add | |
5975 | + * @v: pointer to type atomic64_unchecked_t | |
5976 | + * | |
5977 | + * Atomically adds @i to @v and returns @i + *@v | |
5978 | + */ | |
5979 | +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v) | |
5980 | +{ | |
5981 | + asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked) | |
5982 | + : "+A" (i), "+c" (v) | |
5983 | + : : "memory" | |
5984 | + ); | |
5985 | + return i; | |
5986 | +} | |
5987 | + | |
5988 | /* | |
5989 | * Other variants with different arithmetic operators: | |
5990 | */ | |
5991 | @@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret | |
5992 | return a; | |
5993 | } | |
5994 | ||
5995 | +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v) | |
5996 | +{ | |
5997 | + long long a; | |
5998 | + asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked) | |
5999 | + : "=A" (a) | |
6000 | + : "S" (v) | |
6001 | + : "memory", "ecx" | |
6002 | + ); | |
6003 | + return a; | |
6004 | +} | |
6005 | + | |
6006 | static inline long long atomic64_dec_return(atomic64_t *v) | |
6007 | { | |
6008 | long long a; | |
6009 | @@ -159,6 +243,22 @@ static inline long long atomic64_add(lon | |
6010 | } | |
6011 | ||
6012 | /** | |
6013 | + * atomic64_add_unchecked - add integer to atomic64 variable | |
6014 | + * @i: integer value to add | |
6015 | + * @v: pointer to type atomic64_unchecked_t | |
6016 | + * | |
6017 | + * Atomically adds @i to @v. | |
6018 | + */ | |
6019 | +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v) | |
6020 | +{ | |
6021 | + asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked) | |
6022 | + : "+A" (i), "+c" (v) | |
6023 | + : : "memory" | |
6024 | + ); | |
6025 | + return i; | |
6026 | +} | |
6027 | + | |
6028 | +/** | |
6029 | * atomic64_sub - subtract the atomic64 variable | |
6030 | * @i: integer value to subtract | |
6031 | * @v: pointer to type atomic64_t | |
6032 | diff -urNp linux-3.0.3/arch/x86/include/asm/atomic64_64.h linux-3.0.3/arch/x86/include/asm/atomic64_64.h | |
6033 | --- linux-3.0.3/arch/x86/include/asm/atomic64_64.h 2011-07-21 22:17:23.000000000 -0400 | |
6034 | +++ linux-3.0.3/arch/x86/include/asm/atomic64_64.h 2011-08-23 21:47:55.000000000 -0400 | |
6035 | @@ -18,7 +18,19 @@ | |
6036 | */ | |
6037 | static inline long atomic64_read(const atomic64_t *v) | |
6038 | { | |
6039 | - return (*(volatile long *)&(v)->counter); | |
6040 | + return (*(volatile const long *)&(v)->counter); | |
6041 | +} | |
6042 | + | |
6043 | +/** | |
6044 | + * atomic64_read_unchecked - read atomic64 variable | |
6045 | + * @v: pointer of type atomic64_unchecked_t | |
6046 | + * | |
6047 | + * Atomically reads the value of @v. | |
6048 | + * Doesn't imply a read memory barrier. | |
6049 | + */ | |
6050 | +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v) | |
6051 | +{ | |
6052 | + return (*(volatile const long *)&(v)->counter); | |
6053 | } | |
6054 | ||
6055 | /** | |
6056 | @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64 | |
6057 | } | |
6058 | ||
6059 | /** | |
6060 | + * atomic64_set_unchecked - set atomic64 variable | |
6061 | + * @v: pointer to type atomic64_unchecked_t | |
6062 | + * @i: required value | |
6063 | + * | |
6064 | + * Atomically sets the value of @v to @i. | |
6065 | + */ | |
6066 | +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i) | |
6067 | +{ | |
6068 | + v->counter = i; | |
6069 | +} | |
6070 | + | |
6071 | +/** | |
6072 | * atomic64_add - add integer to atomic64 variable | |
6073 | * @i: integer value to add | |
6074 | * @v: pointer to type atomic64_t | |
6075 | @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64 | |
6076 | */ | |
6077 | static inline void atomic64_add(long i, atomic64_t *v) | |
6078 | { | |
6079 | + asm volatile(LOCK_PREFIX "addq %1,%0\n" | |
6080 | + | |
6081 | +#ifdef CONFIG_PAX_REFCOUNT | |
6082 | + "jno 0f\n" | |
6083 | + LOCK_PREFIX "subq %1,%0\n" | |
6084 | + "int $4\n0:\n" | |
6085 | + _ASM_EXTABLE(0b, 0b) | |
6086 | +#endif | |
6087 | + | |
6088 | + : "=m" (v->counter) | |
6089 | + : "er" (i), "m" (v->counter)); | |
6090 | +} | |
6091 | + | |
6092 | +/** | |
6093 | + * atomic64_add_unchecked - add integer to atomic64 variable | |
6094 | + * @i: integer value to add | |
6095 | + * @v: pointer to type atomic64_unchecked_t | |
6096 | + * | |
6097 | + * Atomically adds @i to @v. | |
6098 | + */ | |
6099 | +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v) | |
6100 | +{ | |
6101 | asm volatile(LOCK_PREFIX "addq %1,%0" | |
6102 | : "=m" (v->counter) | |
6103 | : "er" (i), "m" (v->counter)); | |
6104 | @@ -56,7 +102,29 @@ static inline void atomic64_add(long i, | |
6105 | */ | |
6106 | static inline void atomic64_sub(long i, atomic64_t *v) | |
6107 | { | |
6108 | - asm volatile(LOCK_PREFIX "subq %1,%0" | |
6109 | + asm volatile(LOCK_PREFIX "subq %1,%0\n" | |
6110 | + | |
6111 | +#ifdef CONFIG_PAX_REFCOUNT | |
6112 | + "jno 0f\n" | |
6113 | + LOCK_PREFIX "addq %1,%0\n" | |
6114 | + "int $4\n0:\n" | |
6115 | + _ASM_EXTABLE(0b, 0b) | |
6116 | +#endif | |
6117 | + | |
6118 | + : "=m" (v->counter) | |
6119 | + : "er" (i), "m" (v->counter)); | |
6120 | +} | |
6121 | + | |
6122 | +/** | |
6123 | + * atomic64_sub_unchecked - subtract the atomic64 variable | |
6124 | + * @i: integer value to subtract | |
6125 | + * @v: pointer to type atomic64_unchecked_t | |
6126 | + * | |
6127 | + * Atomically subtracts @i from @v. | |
6128 | + */ | |
6129 | +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v) | |
6130 | +{ | |
6131 | + asm volatile(LOCK_PREFIX "subq %1,%0\n" | |
6132 | : "=m" (v->counter) | |
6133 | : "er" (i), "m" (v->counter)); | |
6134 | } | |
6135 | @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test( | |
6136 | { | |
6137 | unsigned char c; | |
6138 | ||
6139 | - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1" | |
6140 | + asm volatile(LOCK_PREFIX "subq %2,%0\n" | |
6141 | + | |
6142 | +#ifdef CONFIG_PAX_REFCOUNT | |
6143 | + "jno 0f\n" | |
6144 | + LOCK_PREFIX "addq %2,%0\n" | |
6145 | + "int $4\n0:\n" | |
6146 | + _ASM_EXTABLE(0b, 0b) | |
6147 | +#endif | |
6148 | + | |
6149 | + "sete %1\n" | |
6150 | : "=m" (v->counter), "=qm" (c) | |
6151 | : "er" (i), "m" (v->counter) : "memory"); | |
6152 | return c; | |
6153 | @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test( | |
6154 | */ | |
6155 | static inline void atomic64_inc(atomic64_t *v) | |
6156 | { | |
6157 | + asm volatile(LOCK_PREFIX "incq %0\n" | |
6158 | + | |
6159 | +#ifdef CONFIG_PAX_REFCOUNT | |
6160 | + "jno 0f\n" | |
6161 | + LOCK_PREFIX "decq %0\n" | |
6162 | + "int $4\n0:\n" | |
6163 | + _ASM_EXTABLE(0b, 0b) | |
6164 | +#endif | |
6165 | + | |
6166 | + : "=m" (v->counter) | |
6167 | + : "m" (v->counter)); | |
6168 | +} | |
6169 | + | |
6170 | +/** | |
6171 | + * atomic64_inc_unchecked - increment atomic64 variable | |
6172 | + * @v: pointer to type atomic64_unchecked_t | |
6173 | + * | |
6174 | + * Atomically increments @v by 1. | |
6175 | + */ | |
6176 | +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v) | |
6177 | +{ | |
6178 | asm volatile(LOCK_PREFIX "incq %0" | |
6179 | : "=m" (v->counter) | |
6180 | : "m" (v->counter)); | |
6181 | @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64 | |
6182 | */ | |
6183 | static inline void atomic64_dec(atomic64_t *v) | |
6184 | { | |
6185 | - asm volatile(LOCK_PREFIX "decq %0" | |
6186 | + asm volatile(LOCK_PREFIX "decq %0\n" | |
6187 | + | |
6188 | +#ifdef CONFIG_PAX_REFCOUNT | |
6189 | + "jno 0f\n" | |
6190 | + LOCK_PREFIX "incq %0\n" | |
6191 | + "int $4\n0:\n" | |
6192 | + _ASM_EXTABLE(0b, 0b) | |
6193 | +#endif | |
6194 | + | |
6195 | + : "=m" (v->counter) | |
6196 | + : "m" (v->counter)); | |
6197 | +} | |
6198 | + | |
6199 | +/** | |
6200 | + * atomic64_dec_unchecked - decrement atomic64 variable | |
6201 | + * @v: pointer to type atomic64_t | |
6202 | + * | |
6203 | + * Atomically decrements @v by 1. | |
6204 | + */ | |
6205 | +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v) | |
6206 | +{ | |
6207 | + asm volatile(LOCK_PREFIX "decq %0\n" | |
6208 | : "=m" (v->counter) | |
6209 | : "m" (v->counter)); | |
6210 | } | |
6211 | @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test( | |
6212 | { | |
6213 | unsigned char c; | |
6214 | ||
6215 | - asm volatile(LOCK_PREFIX "decq %0; sete %1" | |
6216 | + asm volatile(LOCK_PREFIX "decq %0\n" | |
6217 | + | |
6218 | +#ifdef CONFIG_PAX_REFCOUNT | |
6219 | + "jno 0f\n" | |
6220 | + LOCK_PREFIX "incq %0\n" | |
6221 | + "int $4\n0:\n" | |
6222 | + _ASM_EXTABLE(0b, 0b) | |
6223 | +#endif | |
6224 | + | |
6225 | + "sete %1\n" | |
6226 | : "=m" (v->counter), "=qm" (c) | |
6227 | : "m" (v->counter) : "memory"); | |
6228 | return c != 0; | |
6229 | @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test( | |
6230 | { | |
6231 | unsigned char c; | |
6232 | ||
6233 | - asm volatile(LOCK_PREFIX "incq %0; sete %1" | |
6234 | + asm volatile(LOCK_PREFIX "incq %0\n" | |
6235 | + | |
6236 | +#ifdef CONFIG_PAX_REFCOUNT | |
6237 | + "jno 0f\n" | |
6238 | + LOCK_PREFIX "decq %0\n" | |
6239 | + "int $4\n0:\n" | |
6240 | + _ASM_EXTABLE(0b, 0b) | |
6241 | +#endif | |
6242 | + | |
6243 | + "sete %1\n" | |
6244 | : "=m" (v->counter), "=qm" (c) | |
6245 | : "m" (v->counter) : "memory"); | |
6246 | return c != 0; | |
6247 | @@ -155,7 +292,16 @@ static inline int atomic64_add_negative( | |
6248 | { | |
6249 | unsigned char c; | |
6250 | ||
6251 | - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1" | |
6252 | + asm volatile(LOCK_PREFIX "addq %2,%0\n" | |
6253 | + | |
6254 | +#ifdef CONFIG_PAX_REFCOUNT | |
6255 | + "jno 0f\n" | |
6256 | + LOCK_PREFIX "subq %2,%0\n" | |
6257 | + "int $4\n0:\n" | |
6258 | + _ASM_EXTABLE(0b, 0b) | |
6259 | +#endif | |
6260 | + | |
6261 | + "sets %1\n" | |
6262 | : "=m" (v->counter), "=qm" (c) | |
6263 | : "er" (i), "m" (v->counter) : "memory"); | |
6264 | return c; | |
6265 | @@ -171,7 +317,31 @@ static inline int atomic64_add_negative( | |
6266 | static inline long atomic64_add_return(long i, atomic64_t *v) | |
6267 | { | |
6268 | long __i = i; | |
6269 | - asm volatile(LOCK_PREFIX "xaddq %0, %1;" | |
6270 | + asm volatile(LOCK_PREFIX "xaddq %0, %1\n" | |
6271 | + | |
6272 | +#ifdef CONFIG_PAX_REFCOUNT | |
6273 | + "jno 0f\n" | |
6274 | + "movq %0, %1\n" | |
6275 | + "int $4\n0:\n" | |
6276 | + _ASM_EXTABLE(0b, 0b) | |
6277 | +#endif | |
6278 | + | |
6279 | + : "+r" (i), "+m" (v->counter) | |
6280 | + : : "memory"); | |
6281 | + return i + __i; | |
6282 | +} | |
6283 | + | |
6284 | +/** | |
6285 | + * atomic64_add_return_unchecked - add and return | |
6286 | + * @i: integer value to add | |
6287 | + * @v: pointer to type atomic64_unchecked_t | |
6288 | + * | |
6289 | + * Atomically adds @i to @v and returns @i + @v | |
6290 | + */ | |
6291 | +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v) | |
6292 | +{ | |
6293 | + long __i = i; | |
6294 | + asm volatile(LOCK_PREFIX "xaddq %0, %1" | |
6295 | : "+r" (i), "+m" (v->counter) | |
6296 | : : "memory"); | |
6297 | return i + __i; | |
6298 | @@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l | |
6299 | } | |
6300 | ||
6301 | #define atomic64_inc_return(v) (atomic64_add_return(1, (v))) | |
6302 | +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v) | |
6303 | +{ | |
6304 | + return atomic64_add_return_unchecked(1, v); | |
6305 | +} | |
6306 | #define atomic64_dec_return(v) (atomic64_sub_return(1, (v))) | |
6307 | ||
6308 | static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new) | |
6309 | @@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom | |
6310 | return cmpxchg(&v->counter, old, new); | |
6311 | } | |
6312 | ||
6313 | +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new) | |
6314 | +{ | |
6315 | + return cmpxchg(&v->counter, old, new); | |
6316 | +} | |
6317 | + | |
6318 | static inline long atomic64_xchg(atomic64_t *v, long new) | |
6319 | { | |
6320 | return xchg(&v->counter, new); | |
6321 | @@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6 | |
6322 | */ | |
6323 | static inline int atomic64_add_unless(atomic64_t *v, long a, long u) | |
6324 | { | |
6325 | - long c, old; | |
6326 | + long c, old, new; | |
6327 | c = atomic64_read(v); | |
6328 | for (;;) { | |
6329 | - if (unlikely(c == (u))) | |
6330 | + if (unlikely(c == u)) | |
6331 | break; | |
6332 | - old = atomic64_cmpxchg((v), c, c + (a)); | |
6333 | + | |
6334 | + asm volatile("add %2,%0\n" | |
6335 | + | |
6336 | +#ifdef CONFIG_PAX_REFCOUNT | |
6337 | + "jno 0f\n" | |
6338 | + "sub %2,%0\n" | |
6339 | + "int $4\n0:\n" | |
6340 | + _ASM_EXTABLE(0b, 0b) | |
6341 | +#endif | |
6342 | + | |
6343 | + : "=r" (new) | |
6344 | + : "0" (c), "ir" (a)); | |
6345 | + | |
6346 | + old = atomic64_cmpxchg(v, c, new); | |
6347 | if (likely(old == c)) | |
6348 | break; | |
6349 | c = old; | |
6350 | } | |
6351 | - return c != (u); | |
6352 | + return c != u; | |
6353 | } | |
6354 | ||
6355 | #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0) | |
6356 | diff -urNp linux-3.0.3/arch/x86/include/asm/atomic.h linux-3.0.3/arch/x86/include/asm/atomic.h | |
6357 | --- linux-3.0.3/arch/x86/include/asm/atomic.h 2011-07-21 22:17:23.000000000 -0400 | |
6358 | +++ linux-3.0.3/arch/x86/include/asm/atomic.h 2011-08-23 21:47:55.000000000 -0400 | |
6359 | @@ -22,7 +22,18 @@ | |
6360 | */ | |
6361 | static inline int atomic_read(const atomic_t *v) | |
6362 | { | |
6363 | - return (*(volatile int *)&(v)->counter); | |
6364 | + return (*(volatile const int *)&(v)->counter); | |
6365 | +} | |
6366 | + | |
6367 | +/** | |
6368 | + * atomic_read_unchecked - read atomic variable | |
6369 | + * @v: pointer of type atomic_unchecked_t | |
6370 | + * | |
6371 | + * Atomically reads the value of @v. | |
6372 | + */ | |
6373 | +static inline int atomic_read_unchecked(const atomic_unchecked_t *v) | |
6374 | +{ | |
6375 | + return (*(volatile const int *)&(v)->counter); | |
6376 | } | |
6377 | ||
6378 | /** | |
6379 | @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t * | |
6380 | } | |
6381 | ||
6382 | /** | |
6383 | + * atomic_set_unchecked - set atomic variable | |
6384 | + * @v: pointer of type atomic_unchecked_t | |
6385 | + * @i: required value | |
6386 | + * | |
6387 | + * Atomically sets the value of @v to @i. | |
6388 | + */ | |
6389 | +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i) | |
6390 | +{ | |
6391 | + v->counter = i; | |
6392 | +} | |
6393 | + | |
6394 | +/** | |
6395 | * atomic_add - add integer to atomic variable | |
6396 | * @i: integer value to add | |
6397 | * @v: pointer of type atomic_t | |
6398 | @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t * | |
6399 | */ | |
6400 | static inline void atomic_add(int i, atomic_t *v) | |
6401 | { | |
6402 | - asm volatile(LOCK_PREFIX "addl %1,%0" | |
6403 | + asm volatile(LOCK_PREFIX "addl %1,%0\n" | |
6404 | + | |
6405 | +#ifdef CONFIG_PAX_REFCOUNT | |
6406 | + "jno 0f\n" | |
6407 | + LOCK_PREFIX "subl %1,%0\n" | |
6408 | + "int $4\n0:\n" | |
6409 | + _ASM_EXTABLE(0b, 0b) | |
6410 | +#endif | |
6411 | + | |
6412 | + : "+m" (v->counter) | |
6413 | + : "ir" (i)); | |
6414 | +} | |
6415 | + | |
6416 | +/** | |
6417 | + * atomic_add_unchecked - add integer to atomic variable | |
6418 | + * @i: integer value to add | |
6419 | + * @v: pointer of type atomic_unchecked_t | |
6420 | + * | |
6421 | + * Atomically adds @i to @v. | |
6422 | + */ | |
6423 | +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v) | |
6424 | +{ | |
6425 | + asm volatile(LOCK_PREFIX "addl %1,%0\n" | |
6426 | : "+m" (v->counter) | |
6427 | : "ir" (i)); | |
6428 | } | |
6429 | @@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato | |
6430 | */ | |
6431 | static inline void atomic_sub(int i, atomic_t *v) | |
6432 | { | |
6433 | - asm volatile(LOCK_PREFIX "subl %1,%0" | |
6434 | + asm volatile(LOCK_PREFIX "subl %1,%0\n" | |
6435 | + | |
6436 | +#ifdef CONFIG_PAX_REFCOUNT | |
6437 | + "jno 0f\n" | |
6438 | + LOCK_PREFIX "addl %1,%0\n" | |
6439 | + "int $4\n0:\n" | |
6440 | + _ASM_EXTABLE(0b, 0b) | |
6441 | +#endif | |
6442 | + | |
6443 | + : "+m" (v->counter) | |
6444 | + : "ir" (i)); | |
6445 | +} | |
6446 | + | |
6447 | +/** | |
6448 | + * atomic_sub_unchecked - subtract integer from atomic variable | |
6449 | + * @i: integer value to subtract | |
6450 | + * @v: pointer of type atomic_unchecked_t | |
6451 | + * | |
6452 | + * Atomically subtracts @i from @v. | |
6453 | + */ | |
6454 | +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v) | |
6455 | +{ | |
6456 | + asm volatile(LOCK_PREFIX "subl %1,%0\n" | |
6457 | : "+m" (v->counter) | |
6458 | : "ir" (i)); | |
6459 | } | |
6460 | @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in | |
6461 | { | |
6462 | unsigned char c; | |
6463 | ||
6464 | - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1" | |
6465 | + asm volatile(LOCK_PREFIX "subl %2,%0\n" | |
6466 | + | |
6467 | +#ifdef CONFIG_PAX_REFCOUNT | |
6468 | + "jno 0f\n" | |
6469 | + LOCK_PREFIX "addl %2,%0\n" | |
6470 | + "int $4\n0:\n" | |
6471 | + _ASM_EXTABLE(0b, 0b) | |
6472 | +#endif | |
6473 | + | |
6474 | + "sete %1\n" | |
6475 | : "+m" (v->counter), "=qm" (c) | |
6476 | : "ir" (i) : "memory"); | |
6477 | return c; | |
6478 | @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in | |
6479 | */ | |
6480 | static inline void atomic_inc(atomic_t *v) | |
6481 | { | |
6482 | - asm volatile(LOCK_PREFIX "incl %0" | |
6483 | + asm volatile(LOCK_PREFIX "incl %0\n" | |
6484 | + | |
6485 | +#ifdef CONFIG_PAX_REFCOUNT | |
6486 | + "jno 0f\n" | |
6487 | + LOCK_PREFIX "decl %0\n" | |
6488 | + "int $4\n0:\n" | |
6489 | + _ASM_EXTABLE(0b, 0b) | |
6490 | +#endif | |
6491 | + | |
6492 | + : "+m" (v->counter)); | |
6493 | +} | |
6494 | + | |
6495 | +/** | |
6496 | + * atomic_inc_unchecked - increment atomic variable | |
6497 | + * @v: pointer of type atomic_unchecked_t | |
6498 | + * | |
6499 | + * Atomically increments @v by 1. | |
6500 | + */ | |
6501 | +static inline void atomic_inc_unchecked(atomic_unchecked_t *v) | |
6502 | +{ | |
6503 | + asm volatile(LOCK_PREFIX "incl %0\n" | |
6504 | : "+m" (v->counter)); | |
6505 | } | |
6506 | ||
6507 | @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t * | |
6508 | */ | |
6509 | static inline void atomic_dec(atomic_t *v) | |
6510 | { | |
6511 | - asm volatile(LOCK_PREFIX "decl %0" | |
6512 | + asm volatile(LOCK_PREFIX "decl %0\n" | |
6513 | + | |
6514 | +#ifdef CONFIG_PAX_REFCOUNT | |
6515 | + "jno 0f\n" | |
6516 | + LOCK_PREFIX "incl %0\n" | |
6517 | + "int $4\n0:\n" | |
6518 | + _ASM_EXTABLE(0b, 0b) | |
6519 | +#endif | |
6520 | + | |
6521 | + : "+m" (v->counter)); | |
6522 | +} | |
6523 | + | |
6524 | +/** | |
6525 | + * atomic_dec_unchecked - decrement atomic variable | |
6526 | + * @v: pointer of type atomic_unchecked_t | |
6527 | + * | |
6528 | + * Atomically decrements @v by 1. | |
6529 | + */ | |
6530 | +static inline void atomic_dec_unchecked(atomic_unchecked_t *v) | |
6531 | +{ | |
6532 | + asm volatile(LOCK_PREFIX "decl %0\n" | |
6533 | : "+m" (v->counter)); | |
6534 | } | |
6535 | ||
6536 | @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at | |
6537 | { | |
6538 | unsigned char c; | |
6539 | ||
6540 | - asm volatile(LOCK_PREFIX "decl %0; sete %1" | |
6541 | + asm volatile(LOCK_PREFIX "decl %0\n" | |
6542 | + | |
6543 | +#ifdef CONFIG_PAX_REFCOUNT | |
6544 | + "jno 0f\n" | |
6545 | + LOCK_PREFIX "incl %0\n" | |
6546 | + "int $4\n0:\n" | |
6547 | + _ASM_EXTABLE(0b, 0b) | |
6548 | +#endif | |
6549 | + | |
6550 | + "sete %1\n" | |
6551 | : "+m" (v->counter), "=qm" (c) | |
6552 | : : "memory"); | |
6553 | return c != 0; | |
6554 | @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at | |
6555 | { | |
6556 | unsigned char c; | |
6557 | ||
6558 | - asm volatile(LOCK_PREFIX "incl %0; sete %1" | |
6559 | + asm volatile(LOCK_PREFIX "incl %0\n" | |
6560 | + | |
6561 | +#ifdef CONFIG_PAX_REFCOUNT | |
6562 | + "jno 0f\n" | |
6563 | + LOCK_PREFIX "decl %0\n" | |
6564 | + "int $4\n0:\n" | |
6565 | + _ASM_EXTABLE(0b, 0b) | |
6566 | +#endif | |
6567 | + | |
6568 | + "sete %1\n" | |
6569 | + : "+m" (v->counter), "=qm" (c) | |
6570 | + : : "memory"); | |
6571 | + return c != 0; | |
6572 | +} | |
6573 | + | |
6574 | +/** | |
6575 | + * atomic_inc_and_test_unchecked - increment and test | |
6576 | + * @v: pointer of type atomic_unchecked_t | |
6577 | + * | |
6578 | + * Atomically increments @v by 1 | |
6579 | + * and returns true if the result is zero, or false for all | |
6580 | + * other cases. | |
6581 | + */ | |
6582 | +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v) | |
6583 | +{ | |
6584 | + unsigned char c; | |
6585 | + | |
6586 | + asm volatile(LOCK_PREFIX "incl %0\n" | |
6587 | + "sete %1\n" | |
6588 | : "+m" (v->counter), "=qm" (c) | |
6589 | : : "memory"); | |
6590 | return c != 0; | |
6591 | @@ -157,7 +310,16 @@ static inline int atomic_add_negative(in | |
6592 | { | |
6593 | unsigned char c; | |
6594 | ||
6595 | - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1" | |
6596 | + asm volatile(LOCK_PREFIX "addl %2,%0\n" | |
6597 | + | |
6598 | +#ifdef CONFIG_PAX_REFCOUNT | |
6599 | + "jno 0f\n" | |
6600 | + LOCK_PREFIX "subl %2,%0\n" | |
6601 | + "int $4\n0:\n" | |
6602 | + _ASM_EXTABLE(0b, 0b) | |
6603 | +#endif | |
6604 | + | |
6605 | + "sets %1\n" | |
6606 | : "+m" (v->counter), "=qm" (c) | |
6607 | : "ir" (i) : "memory"); | |
6608 | return c; | |
6609 | @@ -180,6 +342,46 @@ static inline int atomic_add_return(int | |
6610 | #endif | |
6611 | /* Modern 486+ processor */ | |
6612 | __i = i; | |
6613 | + asm volatile(LOCK_PREFIX "xaddl %0, %1\n" | |
6614 | + | |
6615 | +#ifdef CONFIG_PAX_REFCOUNT | |
6616 | + "jno 0f\n" | |
6617 | + "movl %0, %1\n" | |
6618 | + "int $4\n0:\n" | |
6619 | + _ASM_EXTABLE(0b, 0b) | |
6620 | +#endif | |
6621 | + | |
6622 | + : "+r" (i), "+m" (v->counter) | |
6623 | + : : "memory"); | |
6624 | + return i + __i; | |
6625 | + | |
6626 | +#ifdef CONFIG_M386 | |
6627 | +no_xadd: /* Legacy 386 processor */ | |
6628 | + local_irq_save(flags); | |
6629 | + __i = atomic_read(v); | |
6630 | + atomic_set(v, i + __i); | |
6631 | + local_irq_restore(flags); | |
6632 | + return i + __i; | |
6633 | +#endif | |
6634 | +} | |
6635 | + | |
6636 | +/** | |
6637 | + * atomic_add_return_unchecked - add integer and return | |
6638 | + * @v: pointer of type atomic_unchecked_t | |
6639 | + * @i: integer value to add | |
6640 | + * | |
6641 | + * Atomically adds @i to @v and returns @i + @v | |
6642 | + */ | |
6643 | +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v) | |
6644 | +{ | |
6645 | + int __i; | |
6646 | +#ifdef CONFIG_M386 | |
6647 | + unsigned long flags; | |
6648 | + if (unlikely(boot_cpu_data.x86 <= 3)) | |
6649 | + goto no_xadd; | |
6650 | +#endif | |
6651 | + /* Modern 486+ processor */ | |
6652 | + __i = i; | |
6653 | asm volatile(LOCK_PREFIX "xaddl %0, %1" | |
6654 | : "+r" (i), "+m" (v->counter) | |
6655 | : : "memory"); | |
6656 | @@ -208,6 +410,10 @@ static inline int atomic_sub_return(int | |
6657 | } | |
6658 | ||
6659 | #define atomic_inc_return(v) (atomic_add_return(1, v)) | |
6660 | +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v) | |
6661 | +{ | |
6662 | + return atomic_add_return_unchecked(1, v); | |
6663 | +} | |
6664 | #define atomic_dec_return(v) (atomic_sub_return(1, v)) | |
6665 | ||
6666 | static inline int atomic_cmpxchg(atomic_t *v, int old, int new) | |
6667 | @@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_ | |
6668 | return cmpxchg(&v->counter, old, new); | |
6669 | } | |
6670 | ||
6671 | +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new) | |
6672 | +{ | |
6673 | + return cmpxchg(&v->counter, old, new); | |
6674 | +} | |
6675 | + | |
6676 | static inline int atomic_xchg(atomic_t *v, int new) | |
6677 | { | |
6678 | return xchg(&v->counter, new); | |
6679 | } | |
6680 | ||
6681 | +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new) | |
6682 | +{ | |
6683 | + return xchg(&v->counter, new); | |
6684 | +} | |
6685 | + | |
6686 | /** | |
6687 | * atomic_add_unless - add unless the number is already a given value | |
6688 | * @v: pointer of type atomic_t | |
6689 | @@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t * | |
6690 | */ | |
6691 | static inline int atomic_add_unless(atomic_t *v, int a, int u) | |
6692 | { | |
6693 | - int c, old; | |
6694 | + int c, old, new; | |
6695 | c = atomic_read(v); | |
6696 | for (;;) { | |
6697 | - if (unlikely(c == (u))) | |
6698 | + if (unlikely(c == u)) | |
6699 | break; | |
6700 | - old = atomic_cmpxchg((v), c, c + (a)); | |
6701 | + | |
6702 | + asm volatile("addl %2,%0\n" | |
6703 | + | |
6704 | +#ifdef CONFIG_PAX_REFCOUNT | |
6705 | + "jno 0f\n" | |
6706 | + "subl %2,%0\n" | |
6707 | + "int $4\n0:\n" | |
6708 | + _ASM_EXTABLE(0b, 0b) | |
6709 | +#endif | |
6710 | + | |
6711 | + : "=r" (new) | |
6712 | + : "0" (c), "ir" (a)); | |
6713 | + | |
6714 | + old = atomic_cmpxchg(v, c, new); | |
6715 | if (likely(old == c)) | |
6716 | break; | |
6717 | c = old; | |
6718 | } | |
6719 | - return c != (u); | |
6720 | + return c != u; | |
6721 | } | |
6722 | ||
6723 | #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0) | |
6724 | ||
6725 | +/** | |
6726 | + * atomic_inc_not_zero_hint - increment if not null | |
6727 | + * @v: pointer of type atomic_t | |
6728 | + * @hint: probable value of the atomic before the increment | |
6729 | + * | |
6730 | + * This version of atomic_inc_not_zero() gives a hint of probable | |
6731 | + * value of the atomic. This helps processor to not read the memory | |
6732 | + * before doing the atomic read/modify/write cycle, lowering | |
6733 | + * number of bus transactions on some arches. | |
6734 | + * | |
6735 | + * Returns: 0 if increment was not done, 1 otherwise. | |
6736 | + */ | |
6737 | +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint | |
6738 | +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint) | |
6739 | +{ | |
6740 | + int val, c = hint, new; | |
6741 | + | |
6742 | + /* sanity test, should be removed by compiler if hint is a constant */ | |
6743 | + if (!hint) | |
6744 | + return atomic_inc_not_zero(v); | |
6745 | + | |
6746 | + do { | |
6747 | + asm volatile("incl %0\n" | |
6748 | + | |
6749 | +#ifdef CONFIG_PAX_REFCOUNT | |
6750 | + "jno 0f\n" | |
6751 | + "decl %0\n" | |
6752 | + "int $4\n0:\n" | |
6753 | + _ASM_EXTABLE(0b, 0b) | |
6754 | +#endif | |
6755 | + | |
6756 | + : "=r" (new) | |
6757 | + : "0" (c)); | |
6758 | + | |
6759 | + val = atomic_cmpxchg(v, c, new); | |
6760 | + if (val == c) | |
6761 | + return 1; | |
6762 | + c = val; | |
6763 | + } while (c); | |
6764 | + | |
6765 | + return 0; | |
6766 | +} | |
6767 | + | |
6768 | /* | |
6769 | * atomic_dec_if_positive - decrement by 1 if old value positive | |
6770 | * @v: pointer of type atomic_t | |
6771 | diff -urNp linux-3.0.3/arch/x86/include/asm/bitops.h linux-3.0.3/arch/x86/include/asm/bitops.h | |
6772 | --- linux-3.0.3/arch/x86/include/asm/bitops.h 2011-07-21 22:17:23.000000000 -0400 | |
6773 | +++ linux-3.0.3/arch/x86/include/asm/bitops.h 2011-08-23 21:47:55.000000000 -0400 | |
6774 | @@ -38,7 +38,7 @@ | |
6775 | * a mask operation on a byte. | |
6776 | */ | |
6777 | #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr)) | |
6778 | -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3)) | |
6779 | +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3)) | |
6780 | #define CONST_MASK(nr) (1 << ((nr) & 7)) | |
6781 | ||
6782 | /** | |
6783 | diff -urNp linux-3.0.3/arch/x86/include/asm/boot.h linux-3.0.3/arch/x86/include/asm/boot.h | |
6784 | --- linux-3.0.3/arch/x86/include/asm/boot.h 2011-07-21 22:17:23.000000000 -0400 | |
6785 | +++ linux-3.0.3/arch/x86/include/asm/boot.h 2011-08-23 21:47:55.000000000 -0400 | |
6786 | @@ -11,10 +11,15 @@ | |
6787 | #include <asm/pgtable_types.h> | |
6788 | ||
6789 | /* Physical address where kernel should be loaded. */ | |
6790 | -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \ | |
6791 | +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \ | |
6792 | + (CONFIG_PHYSICAL_ALIGN - 1)) \ | |
6793 | & ~(CONFIG_PHYSICAL_ALIGN - 1)) | |
6794 | ||
6795 | +#ifndef __ASSEMBLY__ | |
6796 | +extern unsigned char __LOAD_PHYSICAL_ADDR[]; | |
6797 | +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR) | |
6798 | +#endif | |
6799 | + | |
6800 | /* Minimum kernel alignment, as a power of two */ | |
6801 | #ifdef CONFIG_X86_64 | |
6802 | #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT | |
6803 | diff -urNp linux-3.0.3/arch/x86/include/asm/cacheflush.h linux-3.0.3/arch/x86/include/asm/cacheflush.h | |
6804 | --- linux-3.0.3/arch/x86/include/asm/cacheflush.h 2011-07-21 22:17:23.000000000 -0400 | |
6805 | +++ linux-3.0.3/arch/x86/include/asm/cacheflush.h 2011-08-23 21:47:55.000000000 -0400 | |
6806 | @@ -26,7 +26,7 @@ static inline unsigned long get_page_mem | |
6807 | unsigned long pg_flags = pg->flags & _PGMT_MASK; | |
6808 | ||
6809 | if (pg_flags == _PGMT_DEFAULT) | |
6810 | - return -1; | |
6811 | + return ~0UL; | |
6812 | else if (pg_flags == _PGMT_WC) | |
6813 | return _PAGE_CACHE_WC; | |
6814 | else if (pg_flags == _PGMT_UC_MINUS) | |
6815 | diff -urNp linux-3.0.3/arch/x86/include/asm/cache.h linux-3.0.3/arch/x86/include/asm/cache.h | |
6816 | --- linux-3.0.3/arch/x86/include/asm/cache.h 2011-07-21 22:17:23.000000000 -0400 | |
6817 | +++ linux-3.0.3/arch/x86/include/asm/cache.h 2011-08-23 21:47:55.000000000 -0400 | |
6818 | @@ -5,12 +5,13 @@ | |
6819 | ||
6820 | /* L1 cache line size */ | |
6821 | #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT) | |
6822 | -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) | |
6823 | +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) | |
6824 | ||
6825 | #define __read_mostly __attribute__((__section__(".data..read_mostly"))) | |
6826 | +#define __read_only __attribute__((__section__(".data..read_only"))) | |
6827 | ||
6828 | #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT | |
6829 | -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT) | |
6830 | +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT) | |
6831 | ||
6832 | #ifdef CONFIG_X86_VSMP | |
6833 | #ifdef CONFIG_SMP | |
6834 | diff -urNp linux-3.0.3/arch/x86/include/asm/checksum_32.h linux-3.0.3/arch/x86/include/asm/checksum_32.h | |
6835 | --- linux-3.0.3/arch/x86/include/asm/checksum_32.h 2011-07-21 22:17:23.000000000 -0400 | |
6836 | +++ linux-3.0.3/arch/x86/include/asm/checksum_32.h 2011-08-23 21:47:55.000000000 -0400 | |
6837 | @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene | |
6838 | int len, __wsum sum, | |
6839 | int *src_err_ptr, int *dst_err_ptr); | |
6840 | ||
6841 | +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst, | |
6842 | + int len, __wsum sum, | |
6843 | + int *src_err_ptr, int *dst_err_ptr); | |
6844 | + | |
6845 | +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst, | |
6846 | + int len, __wsum sum, | |
6847 | + int *src_err_ptr, int *dst_err_ptr); | |
6848 | + | |
6849 | /* | |
6850 | * Note: when you get a NULL pointer exception here this means someone | |
6851 | * passed in an incorrect kernel address to one of these functions. | |
6852 | @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f | |
6853 | int *err_ptr) | |
6854 | { | |
6855 | might_sleep(); | |
6856 | - return csum_partial_copy_generic((__force void *)src, dst, | |
6857 | + return csum_partial_copy_generic_from_user((__force void *)src, dst, | |
6858 | len, sum, err_ptr, NULL); | |
6859 | } | |
6860 | ||
6861 | @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us | |
6862 | { | |
6863 | might_sleep(); | |
6864 | if (access_ok(VERIFY_WRITE, dst, len)) | |
6865 | - return csum_partial_copy_generic(src, (__force void *)dst, | |
6866 | + return csum_partial_copy_generic_to_user(src, (__force void *)dst, | |
6867 | len, sum, NULL, err_ptr); | |
6868 | ||
6869 | if (len) | |
6870 | diff -urNp linux-3.0.3/arch/x86/include/asm/cpufeature.h linux-3.0.3/arch/x86/include/asm/cpufeature.h | |
6871 | --- linux-3.0.3/arch/x86/include/asm/cpufeature.h 2011-07-21 22:17:23.000000000 -0400 | |
6872 | +++ linux-3.0.3/arch/x86/include/asm/cpufeature.h 2011-08-23 21:47:55.000000000 -0400 | |
6873 | @@ -358,7 +358,7 @@ static __always_inline __pure bool __sta | |
6874 | ".section .discard,\"aw\",@progbits\n" | |
6875 | " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */ | |
6876 | ".previous\n" | |
6877 | - ".section .altinstr_replacement,\"ax\"\n" | |
6878 | + ".section .altinstr_replacement,\"a\"\n" | |
6879 | "3: movb $1,%0\n" | |
6880 | "4:\n" | |
6881 | ".previous\n" | |
6882 | diff -urNp linux-3.0.3/arch/x86/include/asm/desc_defs.h linux-3.0.3/arch/x86/include/asm/desc_defs.h | |
6883 | --- linux-3.0.3/arch/x86/include/asm/desc_defs.h 2011-07-21 22:17:23.000000000 -0400 | |
6884 | +++ linux-3.0.3/arch/x86/include/asm/desc_defs.h 2011-08-23 21:47:55.000000000 -0400 | |
6885 | @@ -31,6 +31,12 @@ struct desc_struct { | |
6886 | unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1; | |
6887 | unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8; | |
6888 | }; | |
6889 | + struct { | |
6890 | + u16 offset_low; | |
6891 | + u16 seg; | |
6892 | + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1; | |
6893 | + unsigned offset_high: 16; | |
6894 | + } gate; | |
6895 | }; | |
6896 | } __attribute__((packed)); | |
6897 | ||
6898 | diff -urNp linux-3.0.3/arch/x86/include/asm/desc.h linux-3.0.3/arch/x86/include/asm/desc.h | |
6899 | --- linux-3.0.3/arch/x86/include/asm/desc.h 2011-07-21 22:17:23.000000000 -0400 | |
6900 | +++ linux-3.0.3/arch/x86/include/asm/desc.h 2011-08-23 21:47:55.000000000 -0400 | |
6901 | @@ -4,6 +4,7 @@ | |
6902 | #include <asm/desc_defs.h> | |
6903 | #include <asm/ldt.h> | |
6904 | #include <asm/mmu.h> | |
6905 | +#include <asm/pgtable.h> | |
6906 | ||
6907 | #include <linux/smp.h> | |
6908 | ||
6909 | @@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_ | |
6910 | ||
6911 | desc->type = (info->read_exec_only ^ 1) << 1; | |
6912 | desc->type |= info->contents << 2; | |
6913 | + desc->type |= info->seg_not_present ^ 1; | |
6914 | ||
6915 | desc->s = 1; | |
6916 | desc->dpl = 0x3; | |
6917 | @@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_ | |
6918 | } | |
6919 | ||
6920 | extern struct desc_ptr idt_descr; | |
6921 | -extern gate_desc idt_table[]; | |
6922 | - | |
6923 | -struct gdt_page { | |
6924 | - struct desc_struct gdt[GDT_ENTRIES]; | |
6925 | -} __attribute__((aligned(PAGE_SIZE))); | |
6926 | - | |
6927 | -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page); | |
6928 | +extern gate_desc idt_table[256]; | |
6929 | ||
6930 | +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)]; | |
6931 | static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu) | |
6932 | { | |
6933 | - return per_cpu(gdt_page, cpu).gdt; | |
6934 | + return cpu_gdt_table[cpu]; | |
6935 | } | |
6936 | ||
6937 | #ifdef CONFIG_X86_64 | |
6938 | @@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc * | |
6939 | unsigned long base, unsigned dpl, unsigned flags, | |
6940 | unsigned short seg) | |
6941 | { | |
6942 | - gate->a = (seg << 16) | (base & 0xffff); | |
6943 | - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8); | |
6944 | + gate->gate.offset_low = base; | |
6945 | + gate->gate.seg = seg; | |
6946 | + gate->gate.reserved = 0; | |
6947 | + gate->gate.type = type; | |
6948 | + gate->gate.s = 0; | |
6949 | + gate->gate.dpl = dpl; | |
6950 | + gate->gate.p = 1; | |
6951 | + gate->gate.offset_high = base >> 16; | |
6952 | } | |
6953 | ||
6954 | #endif | |
6955 | @@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(str | |
6956 | ||
6957 | static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate) | |
6958 | { | |
6959 | + pax_open_kernel(); | |
6960 | memcpy(&idt[entry], gate, sizeof(*gate)); | |
6961 | + pax_close_kernel(); | |
6962 | } | |
6963 | ||
6964 | static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc) | |
6965 | { | |
6966 | + pax_open_kernel(); | |
6967 | memcpy(&ldt[entry], desc, 8); | |
6968 | + pax_close_kernel(); | |
6969 | } | |
6970 | ||
6971 | static inline void | |
6972 | @@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struc | |
6973 | default: size = sizeof(*gdt); break; | |
6974 | } | |
6975 | ||
6976 | + pax_open_kernel(); | |
6977 | memcpy(&gdt[entry], desc, size); | |
6978 | + pax_close_kernel(); | |
6979 | } | |
6980 | ||
6981 | static inline void pack_descriptor(struct desc_struct *desc, unsigned long base, | |
6982 | @@ -207,7 +216,9 @@ static inline void native_set_ldt(const | |
6983 | ||
6984 | static inline void native_load_tr_desc(void) | |
6985 | { | |
6986 | + pax_open_kernel(); | |
6987 | asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8)); | |
6988 | + pax_close_kernel(); | |
6989 | } | |
6990 | ||
6991 | static inline void native_load_gdt(const struct desc_ptr *dtr) | |
6992 | @@ -244,8 +255,10 @@ static inline void native_load_tls(struc | |
6993 | struct desc_struct *gdt = get_cpu_gdt_table(cpu); | |
6994 | unsigned int i; | |
6995 | ||
6996 | + pax_open_kernel(); | |
6997 | for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++) | |
6998 | gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i]; | |
6999 | + pax_close_kernel(); | |
7000 | } | |
7001 | ||
7002 | #define _LDT_empty(info) \ | |
7003 | @@ -307,7 +320,7 @@ static inline void set_desc_limit(struct | |
7004 | desc->limit = (limit >> 16) & 0xf; | |
7005 | } | |
7006 | ||
7007 | -static inline void _set_gate(int gate, unsigned type, void *addr, | |
7008 | +static inline void _set_gate(int gate, unsigned type, const void *addr, | |
7009 | unsigned dpl, unsigned ist, unsigned seg) | |
7010 | { | |
7011 | gate_desc s; | |
7012 | @@ -326,7 +339,7 @@ static inline void _set_gate(int gate, u | |
7013 | * Pentium F0 0F bugfix can have resulted in the mapped | |
7014 | * IDT being write-protected. | |
7015 | */ | |
7016 | -static inline void set_intr_gate(unsigned int n, void *addr) | |
7017 | +static inline void set_intr_gate(unsigned int n, const void *addr) | |
7018 | { | |
7019 | BUG_ON((unsigned)n > 0xFF); | |
7020 | _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS); | |
7021 | @@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsig | |
7022 | /* | |
7023 | * This routine sets up an interrupt gate at directory privilege level 3. | |
7024 | */ | |
7025 | -static inline void set_system_intr_gate(unsigned int n, void *addr) | |
7026 | +static inline void set_system_intr_gate(unsigned int n, const void *addr) | |
7027 | { | |
7028 | BUG_ON((unsigned)n > 0xFF); | |
7029 | _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS); | |
7030 | } | |
7031 | ||
7032 | -static inline void set_system_trap_gate(unsigned int n, void *addr) | |
7033 | +static inline void set_system_trap_gate(unsigned int n, const void *addr) | |
7034 | { | |
7035 | BUG_ON((unsigned)n > 0xFF); | |
7036 | _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS); | |
7037 | } | |
7038 | ||
7039 | -static inline void set_trap_gate(unsigned int n, void *addr) | |
7040 | +static inline void set_trap_gate(unsigned int n, const void *addr) | |
7041 | { | |
7042 | BUG_ON((unsigned)n > 0xFF); | |
7043 | _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS); | |
7044 | @@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigne | |
7045 | static inline void set_task_gate(unsigned int n, unsigned int gdt_entry) | |
7046 | { | |
7047 | BUG_ON((unsigned)n > 0xFF); | |
7048 | - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3)); | |
7049 | + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3)); | |
7050 | } | |
7051 | ||
7052 | -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist) | |
7053 | +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist) | |
7054 | { | |
7055 | BUG_ON((unsigned)n > 0xFF); | |
7056 | _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS); | |
7057 | } | |
7058 | ||
7059 | -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist) | |
7060 | +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist) | |
7061 | { | |
7062 | BUG_ON((unsigned)n > 0xFF); | |
7063 | _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS); | |
7064 | } | |
7065 | ||
7066 | +#ifdef CONFIG_X86_32 | |
7067 | +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu) | |
7068 | +{ | |
7069 | + struct desc_struct d; | |
7070 | + | |
7071 | + if (likely(limit)) | |
7072 | + limit = (limit - 1UL) >> PAGE_SHIFT; | |
7073 | + pack_descriptor(&d, base, limit, 0xFB, 0xC); | |
7074 | + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S); | |
7075 | +} | |
7076 | +#endif | |
7077 | + | |
7078 | #endif /* _ASM_X86_DESC_H */ | |
7079 | diff -urNp linux-3.0.3/arch/x86/include/asm/e820.h linux-3.0.3/arch/x86/include/asm/e820.h | |
7080 | --- linux-3.0.3/arch/x86/include/asm/e820.h 2011-07-21 22:17:23.000000000 -0400 | |
7081 | +++ linux-3.0.3/arch/x86/include/asm/e820.h 2011-08-23 21:47:55.000000000 -0400 | |
7082 | @@ -69,7 +69,7 @@ struct e820map { | |
7083 | #define ISA_START_ADDRESS 0xa0000 | |
7084 | #define ISA_END_ADDRESS 0x100000 | |
7085 | ||
7086 | -#define BIOS_BEGIN 0x000a0000 | |
7087 | +#define BIOS_BEGIN 0x000c0000 | |
7088 | #define BIOS_END 0x00100000 | |
7089 | ||
7090 | #define BIOS_ROM_BASE 0xffe00000 | |
7091 | diff -urNp linux-3.0.3/arch/x86/include/asm/elf.h linux-3.0.3/arch/x86/include/asm/elf.h | |
7092 | --- linux-3.0.3/arch/x86/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
7093 | +++ linux-3.0.3/arch/x86/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400 | |
7094 | @@ -237,7 +237,25 @@ extern int force_personality32; | |
7095 | the loader. We need to make sure that it is out of the way of the program | |
7096 | that it will "exec", and that there is sufficient room for the brk. */ | |
7097 | ||
7098 | +#ifdef CONFIG_PAX_SEGMEXEC | |
7099 | +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2) | |
7100 | +#else | |
7101 | #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) | |
7102 | +#endif | |
7103 | + | |
7104 | +#ifdef CONFIG_PAX_ASLR | |
7105 | +#ifdef CONFIG_X86_32 | |
7106 | +#define PAX_ELF_ET_DYN_BASE 0x10000000UL | |
7107 | + | |
7108 | +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16) | |
7109 | +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16) | |
7110 | +#else | |
7111 | +#define PAX_ELF_ET_DYN_BASE 0x400000UL | |
7112 | + | |
7113 | +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3) | |
7114 | +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3) | |
7115 | +#endif | |
7116 | +#endif | |
7117 | ||
7118 | /* This yields a mask that user programs can use to figure out what | |
7119 | instruction set this CPU supports. This could be done in user space, | |
7120 | @@ -290,9 +308,7 @@ do { \ | |
7121 | ||
7122 | #define ARCH_DLINFO \ | |
7123 | do { \ | |
7124 | - if (vdso_enabled) \ | |
7125 | - NEW_AUX_ENT(AT_SYSINFO_EHDR, \ | |
7126 | - (unsigned long)current->mm->context.vdso); \ | |
7127 | + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \ | |
7128 | } while (0) | |
7129 | ||
7130 | #define AT_SYSINFO 32 | |
7131 | @@ -303,7 +319,7 @@ do { \ | |
7132 | ||
7133 | #endif /* !CONFIG_X86_32 */ | |
7134 | ||
7135 | -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso) | |
7136 | +#define VDSO_CURRENT_BASE (current->mm->context.vdso) | |
7137 | ||
7138 | #define VDSO_ENTRY \ | |
7139 | ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall)) | |
7140 | @@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(s | |
7141 | extern int syscall32_setup_pages(struct linux_binprm *, int exstack); | |
7142 | #define compat_arch_setup_additional_pages syscall32_setup_pages | |
7143 | ||
7144 | -extern unsigned long arch_randomize_brk(struct mm_struct *mm); | |
7145 | -#define arch_randomize_brk arch_randomize_brk | |
7146 | - | |
7147 | #endif /* _ASM_X86_ELF_H */ | |
7148 | diff -urNp linux-3.0.3/arch/x86/include/asm/emergency-restart.h linux-3.0.3/arch/x86/include/asm/emergency-restart.h | |
7149 | --- linux-3.0.3/arch/x86/include/asm/emergency-restart.h 2011-07-21 22:17:23.000000000 -0400 | |
7150 | +++ linux-3.0.3/arch/x86/include/asm/emergency-restart.h 2011-08-23 21:47:55.000000000 -0400 | |
7151 | @@ -15,6 +15,6 @@ enum reboot_type { | |
7152 | ||
7153 | extern enum reboot_type reboot_type; | |
7154 | ||
7155 | -extern void machine_emergency_restart(void); | |
7156 | +extern void machine_emergency_restart(void) __noreturn; | |
7157 | ||
7158 | #endif /* _ASM_X86_EMERGENCY_RESTART_H */ | |
7159 | diff -urNp linux-3.0.3/arch/x86/include/asm/futex.h linux-3.0.3/arch/x86/include/asm/futex.h | |
7160 | --- linux-3.0.3/arch/x86/include/asm/futex.h 2011-07-21 22:17:23.000000000 -0400 | |
7161 | +++ linux-3.0.3/arch/x86/include/asm/futex.h 2011-08-23 21:47:55.000000000 -0400 | |
7162 | @@ -12,16 +12,18 @@ | |
7163 | #include <asm/system.h> | |
7164 | ||
7165 | #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \ | |
7166 | + typecheck(u32 *, uaddr); \ | |
7167 | asm volatile("1:\t" insn "\n" \ | |
7168 | "2:\t.section .fixup,\"ax\"\n" \ | |
7169 | "3:\tmov\t%3, %1\n" \ | |
7170 | "\tjmp\t2b\n" \ | |
7171 | "\t.previous\n" \ | |
7172 | _ASM_EXTABLE(1b, 3b) \ | |
7173 | - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \ | |
7174 | + : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\ | |
7175 | : "i" (-EFAULT), "0" (oparg), "1" (0)) | |
7176 | ||
7177 | #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \ | |
7178 | + typecheck(u32 *, uaddr); \ | |
7179 | asm volatile("1:\tmovl %2, %0\n" \ | |
7180 | "\tmovl\t%0, %3\n" \ | |
7181 | "\t" insn "\n" \ | |
7182 | @@ -34,7 +36,7 @@ | |
7183 | _ASM_EXTABLE(1b, 4b) \ | |
7184 | _ASM_EXTABLE(2b, 4b) \ | |
7185 | : "=&a" (oldval), "=&r" (ret), \ | |
7186 | - "+m" (*uaddr), "=&r" (tem) \ | |
7187 | + "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \ | |
7188 | : "r" (oparg), "i" (-EFAULT), "1" (0)) | |
7189 | ||
7190 | static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr) | |
7191 | @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser | |
7192 | ||
7193 | switch (op) { | |
7194 | case FUTEX_OP_SET: | |
7195 | - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg); | |
7196 | + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg); | |
7197 | break; | |
7198 | case FUTEX_OP_ADD: | |
7199 | - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval, | |
7200 | + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval, | |
7201 | uaddr, oparg); | |
7202 | break; | |
7203 | case FUTEX_OP_OR: | |
7204 | @@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i | |
7205 | if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) | |
7206 | return -EFAULT; | |
7207 | ||
7208 | - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n" | |
7209 | + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n" | |
7210 | "2:\t.section .fixup, \"ax\"\n" | |
7211 | "3:\tmov %3, %0\n" | |
7212 | "\tjmp 2b\n" | |
7213 | "\t.previous\n" | |
7214 | _ASM_EXTABLE(1b, 3b) | |
7215 | - : "+r" (ret), "=a" (oldval), "+m" (*uaddr) | |
7216 | + : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr)) | |
7217 | : "i" (-EFAULT), "r" (newval), "1" (oldval) | |
7218 | : "memory" | |
7219 | ); | |
7220 | diff -urNp linux-3.0.3/arch/x86/include/asm/hw_irq.h linux-3.0.3/arch/x86/include/asm/hw_irq.h | |
7221 | --- linux-3.0.3/arch/x86/include/asm/hw_irq.h 2011-07-21 22:17:23.000000000 -0400 | |
7222 | +++ linux-3.0.3/arch/x86/include/asm/hw_irq.h 2011-08-23 21:47:55.000000000 -0400 | |
7223 | @@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void); | |
7224 | extern void enable_IO_APIC(void); | |
7225 | ||
7226 | /* Statistics */ | |
7227 | -extern atomic_t irq_err_count; | |
7228 | -extern atomic_t irq_mis_count; | |
7229 | +extern atomic_unchecked_t irq_err_count; | |
7230 | +extern atomic_unchecked_t irq_mis_count; | |
7231 | ||
7232 | /* EISA */ | |
7233 | extern void eisa_set_level_irq(unsigned int irq); | |
7234 | diff -urNp linux-3.0.3/arch/x86/include/asm/i387.h linux-3.0.3/arch/x86/include/asm/i387.h | |
7235 | --- linux-3.0.3/arch/x86/include/asm/i387.h 2011-07-21 22:17:23.000000000 -0400 | |
7236 | +++ linux-3.0.3/arch/x86/include/asm/i387.h 2011-08-23 21:47:55.000000000 -0400 | |
7237 | @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc | |
7238 | { | |
7239 | int err; | |
7240 | ||
7241 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
7242 | + if ((unsigned long)fx < PAX_USER_SHADOW_BASE) | |
7243 | + fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE); | |
7244 | +#endif | |
7245 | + | |
7246 | /* See comment in fxsave() below. */ | |
7247 | #ifdef CONFIG_AS_FXSAVEQ | |
7248 | asm volatile("1: fxrstorq %[fx]\n\t" | |
7249 | @@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38 | |
7250 | { | |
7251 | int err; | |
7252 | ||
7253 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
7254 | + if ((unsigned long)fx < PAX_USER_SHADOW_BASE) | |
7255 | + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE); | |
7256 | +#endif | |
7257 | + | |
7258 | /* | |
7259 | * Clear the bytes not touched by the fxsave and reserved | |
7260 | * for the SW usage. | |
7261 | @@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu | |
7262 | #endif /* CONFIG_X86_64 */ | |
7263 | ||
7264 | /* We need a safe address that is cheap to find and that is already | |
7265 | - in L1 during context switch. The best choices are unfortunately | |
7266 | - different for UP and SMP */ | |
7267 | -#ifdef CONFIG_SMP | |
7268 | -#define safe_address (__per_cpu_offset[0]) | |
7269 | -#else | |
7270 | -#define safe_address (kstat_cpu(0).cpustat.user) | |
7271 | -#endif | |
7272 | + in L1 during context switch. */ | |
7273 | +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0) | |
7274 | ||
7275 | /* | |
7276 | * These must be called with preempt disabled | |
7277 | @@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void | |
7278 | struct thread_info *me = current_thread_info(); | |
7279 | preempt_disable(); | |
7280 | if (me->status & TS_USEDFPU) | |
7281 | - __save_init_fpu(me->task); | |
7282 | + __save_init_fpu(current); | |
7283 | else | |
7284 | clts(); | |
7285 | } | |
7286 | diff -urNp linux-3.0.3/arch/x86/include/asm/io.h linux-3.0.3/arch/x86/include/asm/io.h | |
7287 | --- linux-3.0.3/arch/x86/include/asm/io.h 2011-07-21 22:17:23.000000000 -0400 | |
7288 | +++ linux-3.0.3/arch/x86/include/asm/io.h 2011-08-23 21:47:55.000000000 -0400 | |
7289 | @@ -196,6 +196,17 @@ extern void set_iounmap_nonlazy(void); | |
7290 | ||
7291 | #include <linux/vmalloc.h> | |
7292 | ||
7293 | +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE | |
7294 | +static inline int valid_phys_addr_range(unsigned long addr, size_t count) | |
7295 | +{ | |
7296 | + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0; | |
7297 | +} | |
7298 | + | |
7299 | +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count) | |
7300 | +{ | |
7301 | + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0; | |
7302 | +} | |
7303 | + | |
7304 | /* | |
7305 | * Convert a virtual cached pointer to an uncached pointer | |
7306 | */ | |
7307 | diff -urNp linux-3.0.3/arch/x86/include/asm/irqflags.h linux-3.0.3/arch/x86/include/asm/irqflags.h | |
7308 | --- linux-3.0.3/arch/x86/include/asm/irqflags.h 2011-07-21 22:17:23.000000000 -0400 | |
7309 | +++ linux-3.0.3/arch/x86/include/asm/irqflags.h 2011-08-23 21:47:55.000000000 -0400 | |
7310 | @@ -140,6 +140,11 @@ static inline unsigned long arch_local_i | |
7311 | sti; \ | |
7312 | sysexit | |
7313 | ||
7314 | +#define GET_CR0_INTO_RDI mov %cr0, %rdi | |
7315 | +#define SET_RDI_INTO_CR0 mov %rdi, %cr0 | |
7316 | +#define GET_CR3_INTO_RDI mov %cr3, %rdi | |
7317 | +#define SET_RDI_INTO_CR3 mov %rdi, %cr3 | |
7318 | + | |
7319 | #else | |
7320 | #define INTERRUPT_RETURN iret | |
7321 | #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit | |
7322 | diff -urNp linux-3.0.3/arch/x86/include/asm/kprobes.h linux-3.0.3/arch/x86/include/asm/kprobes.h | |
7323 | --- linux-3.0.3/arch/x86/include/asm/kprobes.h 2011-07-21 22:17:23.000000000 -0400 | |
7324 | +++ linux-3.0.3/arch/x86/include/asm/kprobes.h 2011-08-23 21:47:55.000000000 -0400 | |
7325 | @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t; | |
7326 | #define RELATIVEJUMP_SIZE 5 | |
7327 | #define RELATIVECALL_OPCODE 0xe8 | |
7328 | #define RELATIVE_ADDR_SIZE 4 | |
7329 | -#define MAX_STACK_SIZE 64 | |
7330 | -#define MIN_STACK_SIZE(ADDR) \ | |
7331 | - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \ | |
7332 | - THREAD_SIZE - (unsigned long)(ADDR))) \ | |
7333 | - ? (MAX_STACK_SIZE) \ | |
7334 | - : (((unsigned long)current_thread_info()) + \ | |
7335 | - THREAD_SIZE - (unsigned long)(ADDR))) | |
7336 | +#define MAX_STACK_SIZE 64UL | |
7337 | +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR)) | |
7338 | ||
7339 | #define flush_insn_slot(p) do { } while (0) | |
7340 | ||
7341 | diff -urNp linux-3.0.3/arch/x86/include/asm/kvm_host.h linux-3.0.3/arch/x86/include/asm/kvm_host.h | |
7342 | --- linux-3.0.3/arch/x86/include/asm/kvm_host.h 2011-07-21 22:17:23.000000000 -0400 | |
7343 | +++ linux-3.0.3/arch/x86/include/asm/kvm_host.h 2011-08-26 19:49:56.000000000 -0400 | |
7344 | @@ -441,7 +441,7 @@ struct kvm_arch { | |
7345 | unsigned int n_used_mmu_pages; | |
7346 | unsigned int n_requested_mmu_pages; | |
7347 | unsigned int n_max_mmu_pages; | |
7348 | - atomic_t invlpg_counter; | |
7349 | + atomic_unchecked_t invlpg_counter; | |
7350 | struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES]; | |
7351 | /* | |
7352 | * Hash table of struct kvm_mmu_page. | |
7353 | @@ -619,7 +619,7 @@ struct kvm_x86_ops { | |
7354 | enum x86_intercept_stage stage); | |
7355 | ||
7356 | const struct trace_print_flags *exit_reasons_str; | |
7357 | -}; | |
7358 | +} __do_const; | |
7359 | ||
7360 | struct kvm_arch_async_pf { | |
7361 | u32 token; | |
7362 | diff -urNp linux-3.0.3/arch/x86/include/asm/local.h linux-3.0.3/arch/x86/include/asm/local.h | |
7363 | --- linux-3.0.3/arch/x86/include/asm/local.h 2011-07-21 22:17:23.000000000 -0400 | |
7364 | +++ linux-3.0.3/arch/x86/include/asm/local.h 2011-08-23 21:47:55.000000000 -0400 | |
7365 | @@ -18,26 +18,58 @@ typedef struct { | |
7366 | ||
7367 | static inline void local_inc(local_t *l) | |
7368 | { | |
7369 | - asm volatile(_ASM_INC "%0" | |
7370 | + asm volatile(_ASM_INC "%0\n" | |
7371 | + | |
7372 | +#ifdef CONFIG_PAX_REFCOUNT | |
7373 | + "jno 0f\n" | |
7374 | + _ASM_DEC "%0\n" | |
7375 | + "int $4\n0:\n" | |
7376 | + _ASM_EXTABLE(0b, 0b) | |
7377 | +#endif | |
7378 | + | |
7379 | : "+m" (l->a.counter)); | |
7380 | } | |
7381 | ||
7382 | static inline void local_dec(local_t *l) | |
7383 | { | |
7384 | - asm volatile(_ASM_DEC "%0" | |
7385 | + asm volatile(_ASM_DEC "%0\n" | |
7386 | + | |
7387 | +#ifdef CONFIG_PAX_REFCOUNT | |
7388 | + "jno 0f\n" | |
7389 | + _ASM_INC "%0\n" | |
7390 | + "int $4\n0:\n" | |
7391 | + _ASM_EXTABLE(0b, 0b) | |
7392 | +#endif | |
7393 | + | |
7394 | : "+m" (l->a.counter)); | |
7395 | } | |
7396 | ||
7397 | static inline void local_add(long i, local_t *l) | |
7398 | { | |
7399 | - asm volatile(_ASM_ADD "%1,%0" | |
7400 | + asm volatile(_ASM_ADD "%1,%0\n" | |
7401 | + | |
7402 | +#ifdef CONFIG_PAX_REFCOUNT | |
7403 | + "jno 0f\n" | |
7404 | + _ASM_SUB "%1,%0\n" | |
7405 | + "int $4\n0:\n" | |
7406 | + _ASM_EXTABLE(0b, 0b) | |
7407 | +#endif | |
7408 | + | |
7409 | : "+m" (l->a.counter) | |
7410 | : "ir" (i)); | |
7411 | } | |
7412 | ||
7413 | static inline void local_sub(long i, local_t *l) | |
7414 | { | |
7415 | - asm volatile(_ASM_SUB "%1,%0" | |
7416 | + asm volatile(_ASM_SUB "%1,%0\n" | |
7417 | + | |
7418 | +#ifdef CONFIG_PAX_REFCOUNT | |
7419 | + "jno 0f\n" | |
7420 | + _ASM_ADD "%1,%0\n" | |
7421 | + "int $4\n0:\n" | |
7422 | + _ASM_EXTABLE(0b, 0b) | |
7423 | +#endif | |
7424 | + | |
7425 | : "+m" (l->a.counter) | |
7426 | : "ir" (i)); | |
7427 | } | |
7428 | @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon | |
7429 | { | |
7430 | unsigned char c; | |
7431 | ||
7432 | - asm volatile(_ASM_SUB "%2,%0; sete %1" | |
7433 | + asm volatile(_ASM_SUB "%2,%0\n" | |
7434 | + | |
7435 | +#ifdef CONFIG_PAX_REFCOUNT | |
7436 | + "jno 0f\n" | |
7437 | + _ASM_ADD "%2,%0\n" | |
7438 | + "int $4\n0:\n" | |
7439 | + _ASM_EXTABLE(0b, 0b) | |
7440 | +#endif | |
7441 | + | |
7442 | + "sete %1\n" | |
7443 | : "+m" (l->a.counter), "=qm" (c) | |
7444 | : "ir" (i) : "memory"); | |
7445 | return c; | |
7446 | @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc | |
7447 | { | |
7448 | unsigned char c; | |
7449 | ||
7450 | - asm volatile(_ASM_DEC "%0; sete %1" | |
7451 | + asm volatile(_ASM_DEC "%0\n" | |
7452 | + | |
7453 | +#ifdef CONFIG_PAX_REFCOUNT | |
7454 | + "jno 0f\n" | |
7455 | + _ASM_INC "%0\n" | |
7456 | + "int $4\n0:\n" | |
7457 | + _ASM_EXTABLE(0b, 0b) | |
7458 | +#endif | |
7459 | + | |
7460 | + "sete %1\n" | |
7461 | : "+m" (l->a.counter), "=qm" (c) | |
7462 | : : "memory"); | |
7463 | return c != 0; | |
7464 | @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc | |
7465 | { | |
7466 | unsigned char c; | |
7467 | ||
7468 | - asm volatile(_ASM_INC "%0; sete %1" | |
7469 | + asm volatile(_ASM_INC "%0\n" | |
7470 | + | |
7471 | +#ifdef CONFIG_PAX_REFCOUNT | |
7472 | + "jno 0f\n" | |
7473 | + _ASM_DEC "%0\n" | |
7474 | + "int $4\n0:\n" | |
7475 | + _ASM_EXTABLE(0b, 0b) | |
7476 | +#endif | |
7477 | + | |
7478 | + "sete %1\n" | |
7479 | : "+m" (l->a.counter), "=qm" (c) | |
7480 | : : "memory"); | |
7481 | return c != 0; | |
7482 | @@ -110,7 +169,16 @@ static inline int local_add_negative(lon | |
7483 | { | |
7484 | unsigned char c; | |
7485 | ||
7486 | - asm volatile(_ASM_ADD "%2,%0; sets %1" | |
7487 | + asm volatile(_ASM_ADD "%2,%0\n" | |
7488 | + | |
7489 | +#ifdef CONFIG_PAX_REFCOUNT | |
7490 | + "jno 0f\n" | |
7491 | + _ASM_SUB "%2,%0\n" | |
7492 | + "int $4\n0:\n" | |
7493 | + _ASM_EXTABLE(0b, 0b) | |
7494 | +#endif | |
7495 | + | |
7496 | + "sets %1\n" | |
7497 | : "+m" (l->a.counter), "=qm" (c) | |
7498 | : "ir" (i) : "memory"); | |
7499 | return c; | |
7500 | @@ -133,7 +201,15 @@ static inline long local_add_return(long | |
7501 | #endif | |
7502 | /* Modern 486+ processor */ | |
7503 | __i = i; | |
7504 | - asm volatile(_ASM_XADD "%0, %1;" | |
7505 | + asm volatile(_ASM_XADD "%0, %1\n" | |
7506 | + | |
7507 | +#ifdef CONFIG_PAX_REFCOUNT | |
7508 | + "jno 0f\n" | |
7509 | + _ASM_MOV "%0,%1\n" | |
7510 | + "int $4\n0:\n" | |
7511 | + _ASM_EXTABLE(0b, 0b) | |
7512 | +#endif | |
7513 | + | |
7514 | : "+r" (i), "+m" (l->a.counter) | |
7515 | : : "memory"); | |
7516 | return i + __i; | |
7517 | diff -urNp linux-3.0.3/arch/x86/include/asm/mman.h linux-3.0.3/arch/x86/include/asm/mman.h | |
7518 | --- linux-3.0.3/arch/x86/include/asm/mman.h 2011-07-21 22:17:23.000000000 -0400 | |
7519 | +++ linux-3.0.3/arch/x86/include/asm/mman.h 2011-08-23 21:47:55.000000000 -0400 | |
7520 | @@ -5,4 +5,14 @@ | |
7521 | ||
7522 | #include <asm-generic/mman.h> | |
7523 | ||
7524 | +#ifdef __KERNEL__ | |
7525 | +#ifndef __ASSEMBLY__ | |
7526 | +#ifdef CONFIG_X86_32 | |
7527 | +#define arch_mmap_check i386_mmap_check | |
7528 | +int i386_mmap_check(unsigned long addr, unsigned long len, | |
7529 | + unsigned long flags); | |
7530 | +#endif | |
7531 | +#endif | |
7532 | +#endif | |
7533 | + | |
7534 | #endif /* _ASM_X86_MMAN_H */ | |
7535 | diff -urNp linux-3.0.3/arch/x86/include/asm/mmu_context.h linux-3.0.3/arch/x86/include/asm/mmu_context.h | |
7536 | --- linux-3.0.3/arch/x86/include/asm/mmu_context.h 2011-07-21 22:17:23.000000000 -0400 | |
7537 | +++ linux-3.0.3/arch/x86/include/asm/mmu_context.h 2011-08-23 21:48:14.000000000 -0400 | |
7538 | @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m | |
7539 | ||
7540 | static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) | |
7541 | { | |
7542 | + | |
7543 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
7544 | + unsigned int i; | |
7545 | + pgd_t *pgd; | |
7546 | + | |
7547 | + pax_open_kernel(); | |
7548 | + pgd = get_cpu_pgd(smp_processor_id()); | |
7549 | + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i) | |
7550 | + set_pgd_batched(pgd+i, native_make_pgd(0)); | |
7551 | + pax_close_kernel(); | |
7552 | +#endif | |
7553 | + | |
7554 | #ifdef CONFIG_SMP | |
7555 | if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK) | |
7556 | percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY); | |
7557 | @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s | |
7558 | struct task_struct *tsk) | |
7559 | { | |
7560 | unsigned cpu = smp_processor_id(); | |
7561 | +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) | |
7562 | + int tlbstate = TLBSTATE_OK; | |
7563 | +#endif | |
7564 | ||
7565 | if (likely(prev != next)) { | |
7566 | #ifdef CONFIG_SMP | |
7567 | +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) | |
7568 | + tlbstate = percpu_read(cpu_tlbstate.state); | |
7569 | +#endif | |
7570 | percpu_write(cpu_tlbstate.state, TLBSTATE_OK); | |
7571 | percpu_write(cpu_tlbstate.active_mm, next); | |
7572 | #endif | |
7573 | cpumask_set_cpu(cpu, mm_cpumask(next)); | |
7574 | ||
7575 | /* Re-load page tables */ | |
7576 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
7577 | + pax_open_kernel(); | |
7578 | + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS); | |
7579 | + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS); | |
7580 | + pax_close_kernel(); | |
7581 | + load_cr3(get_cpu_pgd(cpu)); | |
7582 | +#else | |
7583 | load_cr3(next->pgd); | |
7584 | +#endif | |
7585 | ||
7586 | /* stop flush ipis for the previous mm */ | |
7587 | cpumask_clear_cpu(cpu, mm_cpumask(prev)); | |
7588 | @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s | |
7589 | */ | |
7590 | if (unlikely(prev->context.ldt != next->context.ldt)) | |
7591 | load_LDT_nolock(&next->context); | |
7592 | - } | |
7593 | + | |
7594 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP) | |
7595 | + if (!(__supported_pte_mask & _PAGE_NX)) { | |
7596 | + smp_mb__before_clear_bit(); | |
7597 | + cpu_clear(cpu, prev->context.cpu_user_cs_mask); | |
7598 | + smp_mb__after_clear_bit(); | |
7599 | + cpu_set(cpu, next->context.cpu_user_cs_mask); | |
7600 | + } | |
7601 | +#endif | |
7602 | + | |
7603 | +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) | |
7604 | + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base || | |
7605 | + prev->context.user_cs_limit != next->context.user_cs_limit)) | |
7606 | + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu); | |
7607 | #ifdef CONFIG_SMP | |
7608 | + else if (unlikely(tlbstate != TLBSTATE_OK)) | |
7609 | + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu); | |
7610 | +#endif | |
7611 | +#endif | |
7612 | + | |
7613 | + } | |
7614 | else { | |
7615 | + | |
7616 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
7617 | + pax_open_kernel(); | |
7618 | + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS); | |
7619 | + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS); | |
7620 | + pax_close_kernel(); | |
7621 | + load_cr3(get_cpu_pgd(cpu)); | |
7622 | +#endif | |
7623 | + | |
7624 | +#ifdef CONFIG_SMP | |
7625 | percpu_write(cpu_tlbstate.state, TLBSTATE_OK); | |
7626 | BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next); | |
7627 | ||
7628 | @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s | |
7629 | * tlb flush IPI delivery. We must reload CR3 | |
7630 | * to make sure to use no freed page tables. | |
7631 | */ | |
7632 | + | |
7633 | +#ifndef CONFIG_PAX_PER_CPU_PGD | |
7634 | load_cr3(next->pgd); | |
7635 | +#endif | |
7636 | + | |
7637 | load_LDT_nolock(&next->context); | |
7638 | + | |
7639 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) | |
7640 | + if (!(__supported_pte_mask & _PAGE_NX)) | |
7641 | + cpu_set(cpu, next->context.cpu_user_cs_mask); | |
7642 | +#endif | |
7643 | + | |
7644 | +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) | |
7645 | +#ifdef CONFIG_PAX_PAGEEXEC | |
7646 | + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX))) | |
7647 | +#endif | |
7648 | + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu); | |
7649 | +#endif | |
7650 | + | |
7651 | } | |
7652 | - } | |
7653 | #endif | |
7654 | + } | |
7655 | } | |
7656 | ||
7657 | #define activate_mm(prev, next) \ | |
7658 | diff -urNp linux-3.0.3/arch/x86/include/asm/mmu.h linux-3.0.3/arch/x86/include/asm/mmu.h | |
7659 | --- linux-3.0.3/arch/x86/include/asm/mmu.h 2011-07-21 22:17:23.000000000 -0400 | |
7660 | +++ linux-3.0.3/arch/x86/include/asm/mmu.h 2011-08-23 21:47:55.000000000 -0400 | |
7661 | @@ -9,7 +9,7 @@ | |
7662 | * we put the segment information here. | |
7663 | */ | |
7664 | typedef struct { | |
7665 | - void *ldt; | |
7666 | + struct desc_struct *ldt; | |
7667 | int size; | |
7668 | ||
7669 | #ifdef CONFIG_X86_64 | |
7670 | @@ -18,7 +18,19 @@ typedef struct { | |
7671 | #endif | |
7672 | ||
7673 | struct mutex lock; | |
7674 | - void *vdso; | |
7675 | + unsigned long vdso; | |
7676 | + | |
7677 | +#ifdef CONFIG_X86_32 | |
7678 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
7679 | + unsigned long user_cs_base; | |
7680 | + unsigned long user_cs_limit; | |
7681 | + | |
7682 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP) | |
7683 | + cpumask_t cpu_user_cs_mask; | |
7684 | +#endif | |
7685 | + | |
7686 | +#endif | |
7687 | +#endif | |
7688 | } mm_context_t; | |
7689 | ||
7690 | #ifdef CONFIG_SMP | |
7691 | diff -urNp linux-3.0.3/arch/x86/include/asm/module.h linux-3.0.3/arch/x86/include/asm/module.h | |
7692 | --- linux-3.0.3/arch/x86/include/asm/module.h 2011-07-21 22:17:23.000000000 -0400 | |
7693 | +++ linux-3.0.3/arch/x86/include/asm/module.h 2011-08-23 21:48:14.000000000 -0400 | |
7694 | @@ -5,6 +5,7 @@ | |
7695 | ||
7696 | #ifdef CONFIG_X86_64 | |
7697 | /* X86_64 does not define MODULE_PROC_FAMILY */ | |
7698 | +#define MODULE_PROC_FAMILY "" | |
7699 | #elif defined CONFIG_M386 | |
7700 | #define MODULE_PROC_FAMILY "386 " | |
7701 | #elif defined CONFIG_M486 | |
7702 | @@ -59,8 +60,30 @@ | |
7703 | #error unknown processor family | |
7704 | #endif | |
7705 | ||
7706 | -#ifdef CONFIG_X86_32 | |
7707 | -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY | |
7708 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
7709 | +#define MODULE_PAX_UDEREF "UDEREF " | |
7710 | +#else | |
7711 | +#define MODULE_PAX_UDEREF "" | |
7712 | +#endif | |
7713 | + | |
7714 | +#ifdef CONFIG_PAX_KERNEXEC | |
7715 | +#define MODULE_PAX_KERNEXEC "KERNEXEC " | |
7716 | +#else | |
7717 | +#define MODULE_PAX_KERNEXEC "" | |
7718 | #endif | |
7719 | ||
7720 | +#ifdef CONFIG_PAX_REFCOUNT | |
7721 | +#define MODULE_PAX_REFCOUNT "REFCOUNT " | |
7722 | +#else | |
7723 | +#define MODULE_PAX_REFCOUNT "" | |
7724 | +#endif | |
7725 | + | |
7726 | +#ifdef CONFIG_GRKERNSEC | |
7727 | +#define MODULE_GRSEC "GRSECURITY " | |
7728 | +#else | |
7729 | +#define MODULE_GRSEC "" | |
7730 | +#endif | |
7731 | + | |
7732 | +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT | |
7733 | + | |
7734 | #endif /* _ASM_X86_MODULE_H */ | |
7735 | diff -urNp linux-3.0.3/arch/x86/include/asm/page_64_types.h linux-3.0.3/arch/x86/include/asm/page_64_types.h | |
7736 | --- linux-3.0.3/arch/x86/include/asm/page_64_types.h 2011-07-21 22:17:23.000000000 -0400 | |
7737 | +++ linux-3.0.3/arch/x86/include/asm/page_64_types.h 2011-08-23 21:47:55.000000000 -0400 | |
7738 | @@ -56,7 +56,7 @@ void copy_page(void *to, void *from); | |
7739 | ||
7740 | /* duplicated to the one in bootmem.h */ | |
7741 | extern unsigned long max_pfn; | |
7742 | -extern unsigned long phys_base; | |
7743 | +extern const unsigned long phys_base; | |
7744 | ||
7745 | extern unsigned long __phys_addr(unsigned long); | |
7746 | #define __phys_reloc_hide(x) (x) | |
7747 | diff -urNp linux-3.0.3/arch/x86/include/asm/paravirt.h linux-3.0.3/arch/x86/include/asm/paravirt.h | |
7748 | --- linux-3.0.3/arch/x86/include/asm/paravirt.h 2011-07-21 22:17:23.000000000 -0400 | |
7749 | +++ linux-3.0.3/arch/x86/include/asm/paravirt.h 2011-08-23 21:47:55.000000000 -0400 | |
7750 | @@ -658,6 +658,18 @@ static inline void set_pgd(pgd_t *pgdp, | |
7751 | val); | |
7752 | } | |
7753 | ||
7754 | +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd) | |
7755 | +{ | |
7756 | + pgdval_t val = native_pgd_val(pgd); | |
7757 | + | |
7758 | + if (sizeof(pgdval_t) > sizeof(long)) | |
7759 | + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp, | |
7760 | + val, (u64)val >> 32); | |
7761 | + else | |
7762 | + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp, | |
7763 | + val); | |
7764 | +} | |
7765 | + | |
7766 | static inline void pgd_clear(pgd_t *pgdp) | |
7767 | { | |
7768 | set_pgd(pgdp, __pgd(0)); | |
7769 | @@ -739,6 +751,21 @@ static inline void __set_fixmap(unsigned | |
7770 | pv_mmu_ops.set_fixmap(idx, phys, flags); | |
7771 | } | |
7772 | ||
7773 | +#ifdef CONFIG_PAX_KERNEXEC | |
7774 | +static inline unsigned long pax_open_kernel(void) | |
7775 | +{ | |
7776 | + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel); | |
7777 | +} | |
7778 | + | |
7779 | +static inline unsigned long pax_close_kernel(void) | |
7780 | +{ | |
7781 | + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel); | |
7782 | +} | |
7783 | +#else | |
7784 | +static inline unsigned long pax_open_kernel(void) { return 0; } | |
7785 | +static inline unsigned long pax_close_kernel(void) { return 0; } | |
7786 | +#endif | |
7787 | + | |
7788 | #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS) | |
7789 | ||
7790 | static inline int arch_spin_is_locked(struct arch_spinlock *lock) | |
7791 | @@ -955,7 +982,7 @@ extern void default_banner(void); | |
7792 | ||
7793 | #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4) | |
7794 | #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4) | |
7795 | -#define PARA_INDIRECT(addr) *%cs:addr | |
7796 | +#define PARA_INDIRECT(addr) *%ss:addr | |
7797 | #endif | |
7798 | ||
7799 | #define INTERRUPT_RETURN \ | |
7800 | @@ -1032,6 +1059,21 @@ extern void default_banner(void); | |
7801 | PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \ | |
7802 | CLBR_NONE, \ | |
7803 | jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit)) | |
7804 | + | |
7805 | +#define GET_CR0_INTO_RDI \ | |
7806 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \ | |
7807 | + mov %rax,%rdi | |
7808 | + | |
7809 | +#define SET_RDI_INTO_CR0 \ | |
7810 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0) | |
7811 | + | |
7812 | +#define GET_CR3_INTO_RDI \ | |
7813 | + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \ | |
7814 | + mov %rax,%rdi | |
7815 | + | |
7816 | +#define SET_RDI_INTO_CR3 \ | |
7817 | + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3) | |
7818 | + | |
7819 | #endif /* CONFIG_X86_32 */ | |
7820 | ||
7821 | #endif /* __ASSEMBLY__ */ | |
7822 | diff -urNp linux-3.0.3/arch/x86/include/asm/paravirt_types.h linux-3.0.3/arch/x86/include/asm/paravirt_types.h | |
7823 | --- linux-3.0.3/arch/x86/include/asm/paravirt_types.h 2011-07-21 22:17:23.000000000 -0400 | |
7824 | +++ linux-3.0.3/arch/x86/include/asm/paravirt_types.h 2011-08-23 21:47:55.000000000 -0400 | |
7825 | @@ -78,19 +78,19 @@ struct pv_init_ops { | |
7826 | */ | |
7827 | unsigned (*patch)(u8 type, u16 clobber, void *insnbuf, | |
7828 | unsigned long addr, unsigned len); | |
7829 | -}; | |
7830 | +} __no_const; | |
7831 | ||
7832 | ||
7833 | struct pv_lazy_ops { | |
7834 | /* Set deferred update mode, used for batching operations. */ | |
7835 | void (*enter)(void); | |
7836 | void (*leave)(void); | |
7837 | -}; | |
7838 | +} __no_const; | |
7839 | ||
7840 | struct pv_time_ops { | |
7841 | unsigned long long (*sched_clock)(void); | |
7842 | unsigned long (*get_tsc_khz)(void); | |
7843 | -}; | |
7844 | +} __no_const; | |
7845 | ||
7846 | struct pv_cpu_ops { | |
7847 | /* hooks for various privileged instructions */ | |
7848 | @@ -186,7 +186,7 @@ struct pv_cpu_ops { | |
7849 | ||
7850 | void (*start_context_switch)(struct task_struct *prev); | |
7851 | void (*end_context_switch)(struct task_struct *next); | |
7852 | -}; | |
7853 | +} __no_const; | |
7854 | ||
7855 | struct pv_irq_ops { | |
7856 | /* | |
7857 | @@ -217,7 +217,7 @@ struct pv_apic_ops { | |
7858 | unsigned long start_eip, | |
7859 | unsigned long start_esp); | |
7860 | #endif | |
7861 | -}; | |
7862 | +} __no_const; | |
7863 | ||
7864 | struct pv_mmu_ops { | |
7865 | unsigned long (*read_cr2)(void); | |
7866 | @@ -306,6 +306,7 @@ struct pv_mmu_ops { | |
7867 | struct paravirt_callee_save make_pud; | |
7868 | ||
7869 | void (*set_pgd)(pgd_t *pudp, pgd_t pgdval); | |
7870 | + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval); | |
7871 | #endif /* PAGETABLE_LEVELS == 4 */ | |
7872 | #endif /* PAGETABLE_LEVELS >= 3 */ | |
7873 | ||
7874 | @@ -317,6 +318,12 @@ struct pv_mmu_ops { | |
7875 | an mfn. We can tell which is which from the index. */ | |
7876 | void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx, | |
7877 | phys_addr_t phys, pgprot_t flags); | |
7878 | + | |
7879 | +#ifdef CONFIG_PAX_KERNEXEC | |
7880 | + unsigned long (*pax_open_kernel)(void); | |
7881 | + unsigned long (*pax_close_kernel)(void); | |
7882 | +#endif | |
7883 | + | |
7884 | }; | |
7885 | ||
7886 | struct arch_spinlock; | |
7887 | @@ -327,7 +334,7 @@ struct pv_lock_ops { | |
7888 | void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags); | |
7889 | int (*spin_trylock)(struct arch_spinlock *lock); | |
7890 | void (*spin_unlock)(struct arch_spinlock *lock); | |
7891 | -}; | |
7892 | +} __no_const; | |
7893 | ||
7894 | /* This contains all the paravirt structures: we get a convenient | |
7895 | * number for each function using the offset which we use to indicate | |
7896 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgalloc.h linux-3.0.3/arch/x86/include/asm/pgalloc.h | |
7897 | --- linux-3.0.3/arch/x86/include/asm/pgalloc.h 2011-07-21 22:17:23.000000000 -0400 | |
7898 | +++ linux-3.0.3/arch/x86/include/asm/pgalloc.h 2011-08-23 21:47:55.000000000 -0400 | |
7899 | @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s | |
7900 | pmd_t *pmd, pte_t *pte) | |
7901 | { | |
7902 | paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT); | |
7903 | + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE)); | |
7904 | +} | |
7905 | + | |
7906 | +static inline void pmd_populate_user(struct mm_struct *mm, | |
7907 | + pmd_t *pmd, pte_t *pte) | |
7908 | +{ | |
7909 | + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT); | |
7910 | set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE)); | |
7911 | } | |
7912 | ||
7913 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable-2level.h linux-3.0.3/arch/x86/include/asm/pgtable-2level.h | |
7914 | --- linux-3.0.3/arch/x86/include/asm/pgtable-2level.h 2011-07-21 22:17:23.000000000 -0400 | |
7915 | +++ linux-3.0.3/arch/x86/include/asm/pgtable-2level.h 2011-08-23 21:47:55.000000000 -0400 | |
7916 | @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t | |
7917 | ||
7918 | static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd) | |
7919 | { | |
7920 | + pax_open_kernel(); | |
7921 | *pmdp = pmd; | |
7922 | + pax_close_kernel(); | |
7923 | } | |
7924 | ||
7925 | static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte) | |
7926 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable_32.h linux-3.0.3/arch/x86/include/asm/pgtable_32.h | |
7927 | --- linux-3.0.3/arch/x86/include/asm/pgtable_32.h 2011-07-21 22:17:23.000000000 -0400 | |
7928 | +++ linux-3.0.3/arch/x86/include/asm/pgtable_32.h 2011-08-23 21:47:55.000000000 -0400 | |
7929 | @@ -25,9 +25,6 @@ | |
7930 | struct mm_struct; | |
7931 | struct vm_area_struct; | |
7932 | ||
7933 | -extern pgd_t swapper_pg_dir[1024]; | |
7934 | -extern pgd_t initial_page_table[1024]; | |
7935 | - | |
7936 | static inline void pgtable_cache_init(void) { } | |
7937 | static inline void check_pgt_cache(void) { } | |
7938 | void paging_init(void); | |
7939 | @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u | |
7940 | # include <asm/pgtable-2level.h> | |
7941 | #endif | |
7942 | ||
7943 | +extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; | |
7944 | +extern pgd_t initial_page_table[PTRS_PER_PGD]; | |
7945 | +#ifdef CONFIG_X86_PAE | |
7946 | +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD]; | |
7947 | +#endif | |
7948 | + | |
7949 | #if defined(CONFIG_HIGHPTE) | |
7950 | #define pte_offset_map(dir, address) \ | |
7951 | ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \ | |
7952 | @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u | |
7953 | /* Clear a kernel PTE and flush it from the TLB */ | |
7954 | #define kpte_clear_flush(ptep, vaddr) \ | |
7955 | do { \ | |
7956 | + pax_open_kernel(); \ | |
7957 | pte_clear(&init_mm, (vaddr), (ptep)); \ | |
7958 | + pax_close_kernel(); \ | |
7959 | __flush_tlb_one((vaddr)); \ | |
7960 | } while (0) | |
7961 | ||
7962 | @@ -74,6 +79,9 @@ do { \ | |
7963 | ||
7964 | #endif /* !__ASSEMBLY__ */ | |
7965 | ||
7966 | +#define HAVE_ARCH_UNMAPPED_AREA | |
7967 | +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN | |
7968 | + | |
7969 | /* | |
7970 | * kern_addr_valid() is (1) for FLATMEM and (0) for | |
7971 | * SPARSEMEM and DISCONTIGMEM | |
7972 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable_32_types.h linux-3.0.3/arch/x86/include/asm/pgtable_32_types.h | |
7973 | --- linux-3.0.3/arch/x86/include/asm/pgtable_32_types.h 2011-07-21 22:17:23.000000000 -0400 | |
7974 | +++ linux-3.0.3/arch/x86/include/asm/pgtable_32_types.h 2011-08-23 21:47:55.000000000 -0400 | |
7975 | @@ -8,7 +8,7 @@ | |
7976 | */ | |
7977 | #ifdef CONFIG_X86_PAE | |
7978 | # include <asm/pgtable-3level_types.h> | |
7979 | -# define PMD_SIZE (1UL << PMD_SHIFT) | |
7980 | +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT) | |
7981 | # define PMD_MASK (~(PMD_SIZE - 1)) | |
7982 | #else | |
7983 | # include <asm/pgtable-2level_types.h> | |
7984 | @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set | |
7985 | # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE) | |
7986 | #endif | |
7987 | ||
7988 | +#ifdef CONFIG_PAX_KERNEXEC | |
7989 | +#ifndef __ASSEMBLY__ | |
7990 | +extern unsigned char MODULES_EXEC_VADDR[]; | |
7991 | +extern unsigned char MODULES_EXEC_END[]; | |
7992 | +#endif | |
7993 | +#include <asm/boot.h> | |
7994 | +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET) | |
7995 | +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET) | |
7996 | +#else | |
7997 | +#define ktla_ktva(addr) (addr) | |
7998 | +#define ktva_ktla(addr) (addr) | |
7999 | +#endif | |
8000 | + | |
8001 | #define MODULES_VADDR VMALLOC_START | |
8002 | #define MODULES_END VMALLOC_END | |
8003 | #define MODULES_LEN (MODULES_VADDR - MODULES_END) | |
8004 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable-3level.h linux-3.0.3/arch/x86/include/asm/pgtable-3level.h | |
8005 | --- linux-3.0.3/arch/x86/include/asm/pgtable-3level.h 2011-07-21 22:17:23.000000000 -0400 | |
8006 | +++ linux-3.0.3/arch/x86/include/asm/pgtable-3level.h 2011-08-23 21:47:55.000000000 -0400 | |
8007 | @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic | |
8008 | ||
8009 | static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd) | |
8010 | { | |
8011 | + pax_open_kernel(); | |
8012 | set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd)); | |
8013 | + pax_close_kernel(); | |
8014 | } | |
8015 | ||
8016 | static inline void native_set_pud(pud_t *pudp, pud_t pud) | |
8017 | { | |
8018 | + pax_open_kernel(); | |
8019 | set_64bit((unsigned long long *)(pudp), native_pud_val(pud)); | |
8020 | + pax_close_kernel(); | |
8021 | } | |
8022 | ||
8023 | /* | |
8024 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable_64.h linux-3.0.3/arch/x86/include/asm/pgtable_64.h | |
8025 | --- linux-3.0.3/arch/x86/include/asm/pgtable_64.h 2011-07-21 22:17:23.000000000 -0400 | |
8026 | +++ linux-3.0.3/arch/x86/include/asm/pgtable_64.h 2011-08-23 21:47:55.000000000 -0400 | |
8027 | @@ -16,10 +16,13 @@ | |
8028 | ||
8029 | extern pud_t level3_kernel_pgt[512]; | |
8030 | extern pud_t level3_ident_pgt[512]; | |
8031 | +extern pud_t level3_vmalloc_pgt[512]; | |
8032 | +extern pud_t level3_vmemmap_pgt[512]; | |
8033 | +extern pud_t level2_vmemmap_pgt[512]; | |
8034 | extern pmd_t level2_kernel_pgt[512]; | |
8035 | extern pmd_t level2_fixmap_pgt[512]; | |
8036 | -extern pmd_t level2_ident_pgt[512]; | |
8037 | -extern pgd_t init_level4_pgt[]; | |
8038 | +extern pmd_t level2_ident_pgt[512*2]; | |
8039 | +extern pgd_t init_level4_pgt[512]; | |
8040 | ||
8041 | #define swapper_pg_dir init_level4_pgt | |
8042 | ||
8043 | @@ -61,7 +64,9 @@ static inline void native_set_pte_atomic | |
8044 | ||
8045 | static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd) | |
8046 | { | |
8047 | + pax_open_kernel(); | |
8048 | *pmdp = pmd; | |
8049 | + pax_close_kernel(); | |
8050 | } | |
8051 | ||
8052 | static inline void native_pmd_clear(pmd_t *pmd) | |
8053 | @@ -107,6 +112,13 @@ static inline void native_pud_clear(pud_ | |
8054 | ||
8055 | static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd) | |
8056 | { | |
8057 | + pax_open_kernel(); | |
8058 | + *pgdp = pgd; | |
8059 | + pax_close_kernel(); | |
8060 | +} | |
8061 | + | |
8062 | +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd) | |
8063 | +{ | |
8064 | *pgdp = pgd; | |
8065 | } | |
8066 | ||
8067 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable_64_types.h linux-3.0.3/arch/x86/include/asm/pgtable_64_types.h | |
8068 | --- linux-3.0.3/arch/x86/include/asm/pgtable_64_types.h 2011-07-21 22:17:23.000000000 -0400 | |
8069 | +++ linux-3.0.3/arch/x86/include/asm/pgtable_64_types.h 2011-08-23 21:47:55.000000000 -0400 | |
8070 | @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t; | |
8071 | #define MODULES_VADDR _AC(0xffffffffa0000000, UL) | |
8072 | #define MODULES_END _AC(0xffffffffff000000, UL) | |
8073 | #define MODULES_LEN (MODULES_END - MODULES_VADDR) | |
8074 | +#define MODULES_EXEC_VADDR MODULES_VADDR | |
8075 | +#define MODULES_EXEC_END MODULES_END | |
8076 | + | |
8077 | +#define ktla_ktva(addr) (addr) | |
8078 | +#define ktva_ktla(addr) (addr) | |
8079 | ||
8080 | #endif /* _ASM_X86_PGTABLE_64_DEFS_H */ | |
8081 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable.h linux-3.0.3/arch/x86/include/asm/pgtable.h | |
8082 | --- linux-3.0.3/arch/x86/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
8083 | +++ linux-3.0.3/arch/x86/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400 | |
8084 | @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm | |
8085 | ||
8086 | #ifndef __PAGETABLE_PUD_FOLDED | |
8087 | #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd) | |
8088 | +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd) | |
8089 | #define pgd_clear(pgd) native_pgd_clear(pgd) | |
8090 | #endif | |
8091 | ||
8092 | @@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm | |
8093 | ||
8094 | #define arch_end_context_switch(prev) do {} while(0) | |
8095 | ||
8096 | +#define pax_open_kernel() native_pax_open_kernel() | |
8097 | +#define pax_close_kernel() native_pax_close_kernel() | |
8098 | #endif /* CONFIG_PARAVIRT */ | |
8099 | ||
8100 | +#define __HAVE_ARCH_PAX_OPEN_KERNEL | |
8101 | +#define __HAVE_ARCH_PAX_CLOSE_KERNEL | |
8102 | + | |
8103 | +#ifdef CONFIG_PAX_KERNEXEC | |
8104 | +static inline unsigned long native_pax_open_kernel(void) | |
8105 | +{ | |
8106 | + unsigned long cr0; | |
8107 | + | |
8108 | + preempt_disable(); | |
8109 | + barrier(); | |
8110 | + cr0 = read_cr0() ^ X86_CR0_WP; | |
8111 | + BUG_ON(unlikely(cr0 & X86_CR0_WP)); | |
8112 | + write_cr0(cr0); | |
8113 | + return cr0 ^ X86_CR0_WP; | |
8114 | +} | |
8115 | + | |
8116 | +static inline unsigned long native_pax_close_kernel(void) | |
8117 | +{ | |
8118 | + unsigned long cr0; | |
8119 | + | |
8120 | + cr0 = read_cr0() ^ X86_CR0_WP; | |
8121 | + BUG_ON(unlikely(!(cr0 & X86_CR0_WP))); | |
8122 | + write_cr0(cr0); | |
8123 | + barrier(); | |
8124 | + preempt_enable_no_resched(); | |
8125 | + return cr0 ^ X86_CR0_WP; | |
8126 | +} | |
8127 | +#else | |
8128 | +static inline unsigned long native_pax_open_kernel(void) { return 0; } | |
8129 | +static inline unsigned long native_pax_close_kernel(void) { return 0; } | |
8130 | +#endif | |
8131 | + | |
8132 | /* | |
8133 | * The following only work if pte_present() is true. | |
8134 | * Undefined behaviour if not.. | |
8135 | */ | |
8136 | +static inline int pte_user(pte_t pte) | |
8137 | +{ | |
8138 | + return pte_val(pte) & _PAGE_USER; | |
8139 | +} | |
8140 | + | |
8141 | static inline int pte_dirty(pte_t pte) | |
8142 | { | |
8143 | return pte_flags(pte) & _PAGE_DIRTY; | |
8144 | @@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t | |
8145 | return pte_clear_flags(pte, _PAGE_RW); | |
8146 | } | |
8147 | ||
8148 | +static inline pte_t pte_mkread(pte_t pte) | |
8149 | +{ | |
8150 | + return __pte(pte_val(pte) | _PAGE_USER); | |
8151 | +} | |
8152 | + | |
8153 | static inline pte_t pte_mkexec(pte_t pte) | |
8154 | { | |
8155 | - return pte_clear_flags(pte, _PAGE_NX); | |
8156 | +#ifdef CONFIG_X86_PAE | |
8157 | + if (__supported_pte_mask & _PAGE_NX) | |
8158 | + return pte_clear_flags(pte, _PAGE_NX); | |
8159 | + else | |
8160 | +#endif | |
8161 | + return pte_set_flags(pte, _PAGE_USER); | |
8162 | +} | |
8163 | + | |
8164 | +static inline pte_t pte_exprotect(pte_t pte) | |
8165 | +{ | |
8166 | +#ifdef CONFIG_X86_PAE | |
8167 | + if (__supported_pte_mask & _PAGE_NX) | |
8168 | + return pte_set_flags(pte, _PAGE_NX); | |
8169 | + else | |
8170 | +#endif | |
8171 | + return pte_clear_flags(pte, _PAGE_USER); | |
8172 | } | |
8173 | ||
8174 | static inline pte_t pte_mkdirty(pte_t pte) | |
8175 | @@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long | |
8176 | #endif | |
8177 | ||
8178 | #ifndef __ASSEMBLY__ | |
8179 | + | |
8180 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
8181 | +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD]; | |
8182 | +static inline pgd_t *get_cpu_pgd(unsigned int cpu) | |
8183 | +{ | |
8184 | + return cpu_pgd[cpu]; | |
8185 | +} | |
8186 | +#endif | |
8187 | + | |
8188 | #include <linux/mm_types.h> | |
8189 | ||
8190 | static inline int pte_none(pte_t pte) | |
8191 | @@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *p | |
8192 | ||
8193 | static inline int pgd_bad(pgd_t pgd) | |
8194 | { | |
8195 | - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE; | |
8196 | + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE; | |
8197 | } | |
8198 | ||
8199 | static inline int pgd_none(pgd_t pgd) | |
8200 | @@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd) | |
8201 | * pgd_offset() returns a (pgd_t *) | |
8202 | * pgd_index() is used get the offset into the pgd page's array of pgd_t's; | |
8203 | */ | |
8204 | -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address))) | |
8205 | +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address)) | |
8206 | + | |
8207 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
8208 | +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address)) | |
8209 | +#endif | |
8210 | + | |
8211 | /* | |
8212 | * a shortcut which implies the use of the kernel's pgd, instead | |
8213 | * of a process's | |
8214 | @@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd) | |
8215 | #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET) | |
8216 | #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY) | |
8217 | ||
8218 | +#ifdef CONFIG_X86_32 | |
8219 | +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY | |
8220 | +#else | |
8221 | +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT | |
8222 | +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT)) | |
8223 | + | |
8224 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
8225 | +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT) | |
8226 | +#else | |
8227 | +#define PAX_USER_SHADOW_BASE (_AC(0,UL)) | |
8228 | +#endif | |
8229 | + | |
8230 | +#endif | |
8231 | + | |
8232 | #ifndef __ASSEMBLY__ | |
8233 | ||
8234 | extern int direct_gbpages; | |
8235 | @@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(st | |
8236 | * dst and src can be on the same page, but the range must not overlap, | |
8237 | * and must not cross a page boundary. | |
8238 | */ | |
8239 | -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count) | |
8240 | +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count) | |
8241 | { | |
8242 | - memcpy(dst, src, count * sizeof(pgd_t)); | |
8243 | + pax_open_kernel(); | |
8244 | + while (count--) | |
8245 | + *dst++ = *src++; | |
8246 | + pax_close_kernel(); | |
8247 | } | |
8248 | ||
8249 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
8250 | +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count); | |
8251 | +#endif | |
8252 | + | |
8253 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
8254 | +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count); | |
8255 | +#else | |
8256 | +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {} | |
8257 | +#endif | |
8258 | ||
8259 | #include <asm-generic/pgtable.h> | |
8260 | #endif /* __ASSEMBLY__ */ | |
8261 | diff -urNp linux-3.0.3/arch/x86/include/asm/pgtable_types.h linux-3.0.3/arch/x86/include/asm/pgtable_types.h | |
8262 | --- linux-3.0.3/arch/x86/include/asm/pgtable_types.h 2011-07-21 22:17:23.000000000 -0400 | |
8263 | +++ linux-3.0.3/arch/x86/include/asm/pgtable_types.h 2011-08-23 21:47:55.000000000 -0400 | |
8264 | @@ -16,13 +16,12 @@ | |
8265 | #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */ | |
8266 | #define _PAGE_BIT_PAT 7 /* on 4KB pages */ | |
8267 | #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */ | |
8268 | -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */ | |
8269 | +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */ | |
8270 | #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */ | |
8271 | #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */ | |
8272 | #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */ | |
8273 | -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1 | |
8274 | -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1 | |
8275 | -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */ | |
8276 | +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL | |
8277 | +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */ | |
8278 | #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */ | |
8279 | ||
8280 | /* If _PAGE_BIT_PRESENT is clear, we use these: */ | |
8281 | @@ -40,7 +39,6 @@ | |
8282 | #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY) | |
8283 | #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE) | |
8284 | #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL) | |
8285 | -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1) | |
8286 | #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP) | |
8287 | #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT) | |
8288 | #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE) | |
8289 | @@ -57,8 +55,10 @@ | |
8290 | ||
8291 | #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) | |
8292 | #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX) | |
8293 | -#else | |
8294 | +#elif defined(CONFIG_KMEMCHECK) | |
8295 | #define _PAGE_NX (_AT(pteval_t, 0)) | |
8296 | +#else | |
8297 | +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN) | |
8298 | #endif | |
8299 | ||
8300 | #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE) | |
8301 | @@ -96,6 +96,9 @@ | |
8302 | #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \ | |
8303 | _PAGE_ACCESSED) | |
8304 | ||
8305 | +#define PAGE_READONLY_NOEXEC PAGE_READONLY | |
8306 | +#define PAGE_SHARED_NOEXEC PAGE_SHARED | |
8307 | + | |
8308 | #define __PAGE_KERNEL_EXEC \ | |
8309 | (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL) | |
8310 | #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX) | |
8311 | @@ -106,8 +109,8 @@ | |
8312 | #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC) | |
8313 | #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT) | |
8314 | #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD) | |
8315 | -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER) | |
8316 | -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT) | |
8317 | +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER) | |
8318 | +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER) | |
8319 | #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE) | |
8320 | #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE) | |
8321 | #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE) | |
8322 | @@ -166,8 +169,8 @@ | |
8323 | * bits are combined, this will alow user to access the high address mapped | |
8324 | * VDSO in the presence of CONFIG_COMPAT_VDSO | |
8325 | */ | |
8326 | -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */ | |
8327 | -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */ | |
8328 | +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */ | |
8329 | +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */ | |
8330 | #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */ | |
8331 | #endif | |
8332 | ||
8333 | @@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p | |
8334 | { | |
8335 | return native_pgd_val(pgd) & PTE_FLAGS_MASK; | |
8336 | } | |
8337 | +#endif | |
8338 | ||
8339 | +#if PAGETABLE_LEVELS == 3 | |
8340 | +#include <asm-generic/pgtable-nopud.h> | |
8341 | +#endif | |
8342 | + | |
8343 | +#if PAGETABLE_LEVELS == 2 | |
8344 | +#include <asm-generic/pgtable-nopmd.h> | |
8345 | +#endif | |
8346 | + | |
8347 | +#ifndef __ASSEMBLY__ | |
8348 | #if PAGETABLE_LEVELS > 3 | |
8349 | typedef struct { pudval_t pud; } pud_t; | |
8350 | ||
8351 | @@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu | |
8352 | return pud.pud; | |
8353 | } | |
8354 | #else | |
8355 | -#include <asm-generic/pgtable-nopud.h> | |
8356 | - | |
8357 | static inline pudval_t native_pud_val(pud_t pud) | |
8358 | { | |
8359 | return native_pgd_val(pud.pgd); | |
8360 | @@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm | |
8361 | return pmd.pmd; | |
8362 | } | |
8363 | #else | |
8364 | -#include <asm-generic/pgtable-nopmd.h> | |
8365 | - | |
8366 | static inline pmdval_t native_pmd_val(pmd_t pmd) | |
8367 | { | |
8368 | return native_pgd_val(pmd.pud.pgd); | |
8369 | @@ -281,7 +290,6 @@ typedef struct page *pgtable_t; | |
8370 | ||
8371 | extern pteval_t __supported_pte_mask; | |
8372 | extern void set_nx(void); | |
8373 | -extern int nx_enabled; | |
8374 | ||
8375 | #define pgprot_writecombine pgprot_writecombine | |
8376 | extern pgprot_t pgprot_writecombine(pgprot_t prot); | |
8377 | diff -urNp linux-3.0.3/arch/x86/include/asm/processor.h linux-3.0.3/arch/x86/include/asm/processor.h | |
8378 | --- linux-3.0.3/arch/x86/include/asm/processor.h 2011-07-21 22:17:23.000000000 -0400 | |
8379 | +++ linux-3.0.3/arch/x86/include/asm/processor.h 2011-08-23 21:47:55.000000000 -0400 | |
8380 | @@ -266,7 +266,7 @@ struct tss_struct { | |
8381 | ||
8382 | } ____cacheline_aligned; | |
8383 | ||
8384 | -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss); | |
8385 | +extern struct tss_struct init_tss[NR_CPUS]; | |
8386 | ||
8387 | /* | |
8388 | * Save the original ist values for checking stack pointers during debugging | |
8389 | @@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co | |
8390 | */ | |
8391 | #define TASK_SIZE PAGE_OFFSET | |
8392 | #define TASK_SIZE_MAX TASK_SIZE | |
8393 | + | |
8394 | +#ifdef CONFIG_PAX_SEGMEXEC | |
8395 | +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2) | |
8396 | +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE) | |
8397 | +#else | |
8398 | #define STACK_TOP TASK_SIZE | |
8399 | -#define STACK_TOP_MAX STACK_TOP | |
8400 | +#endif | |
8401 | + | |
8402 | +#define STACK_TOP_MAX TASK_SIZE | |
8403 | ||
8404 | #define INIT_THREAD { \ | |
8405 | - .sp0 = sizeof(init_stack) + (long)&init_stack, \ | |
8406 | + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \ | |
8407 | .vm86_info = NULL, \ | |
8408 | .sysenter_cs = __KERNEL_CS, \ | |
8409 | .io_bitmap_ptr = NULL, \ | |
8410 | @@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co | |
8411 | */ | |
8412 | #define INIT_TSS { \ | |
8413 | .x86_tss = { \ | |
8414 | - .sp0 = sizeof(init_stack) + (long)&init_stack, \ | |
8415 | + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \ | |
8416 | .ss0 = __KERNEL_DS, \ | |
8417 | .ss1 = __KERNEL_CS, \ | |
8418 | .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \ | |
8419 | @@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co | |
8420 | extern unsigned long thread_saved_pc(struct task_struct *tsk); | |
8421 | ||
8422 | #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long)) | |
8423 | -#define KSTK_TOP(info) \ | |
8424 | -({ \ | |
8425 | - unsigned long *__ptr = (unsigned long *)(info); \ | |
8426 | - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \ | |
8427 | -}) | |
8428 | +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0) | |
8429 | ||
8430 | /* | |
8431 | * The below -8 is to reserve 8 bytes on top of the ring0 stack. | |
8432 | @@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str | |
8433 | #define task_pt_regs(task) \ | |
8434 | ({ \ | |
8435 | struct pt_regs *__regs__; \ | |
8436 | - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \ | |
8437 | + __regs__ = (struct pt_regs *)((task)->thread.sp0); \ | |
8438 | __regs__ - 1; \ | |
8439 | }) | |
8440 | ||
8441 | @@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str | |
8442 | /* | |
8443 | * User space process size. 47bits minus one guard page. | |
8444 | */ | |
8445 | -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE) | |
8446 | +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE) | |
8447 | ||
8448 | /* This decides where the kernel will search for a free chunk of vm | |
8449 | * space during mmap's. | |
8450 | */ | |
8451 | #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \ | |
8452 | - 0xc0000000 : 0xFFFFe000) | |
8453 | + 0xc0000000 : 0xFFFFf000) | |
8454 | ||
8455 | #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \ | |
8456 | IA32_PAGE_OFFSET : TASK_SIZE_MAX) | |
8457 | @@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str | |
8458 | #define STACK_TOP_MAX TASK_SIZE_MAX | |
8459 | ||
8460 | #define INIT_THREAD { \ | |
8461 | - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \ | |
8462 | + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \ | |
8463 | } | |
8464 | ||
8465 | #define INIT_TSS { \ | |
8466 | - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \ | |
8467 | + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \ | |
8468 | } | |
8469 | ||
8470 | /* | |
8471 | @@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs | |
8472 | */ | |
8473 | #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3)) | |
8474 | ||
8475 | +#ifdef CONFIG_PAX_SEGMEXEC | |
8476 | +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3)) | |
8477 | +#endif | |
8478 | + | |
8479 | #define KSTK_EIP(task) (task_pt_regs(task)->ip) | |
8480 | ||
8481 | /* Get/set a process' ability to use the timestamp counter instruction */ | |
8482 | diff -urNp linux-3.0.3/arch/x86/include/asm/ptrace.h linux-3.0.3/arch/x86/include/asm/ptrace.h | |
8483 | --- linux-3.0.3/arch/x86/include/asm/ptrace.h 2011-07-21 22:17:23.000000000 -0400 | |
8484 | +++ linux-3.0.3/arch/x86/include/asm/ptrace.h 2011-08-23 21:47:55.000000000 -0400 | |
8485 | @@ -153,28 +153,29 @@ static inline unsigned long regs_return_ | |
8486 | } | |
8487 | ||
8488 | /* | |
8489 | - * user_mode_vm(regs) determines whether a register set came from user mode. | |
8490 | + * user_mode(regs) determines whether a register set came from user mode. | |
8491 | * This is true if V8086 mode was enabled OR if the register set was from | |
8492 | * protected mode with RPL-3 CS value. This tricky test checks that with | |
8493 | * one comparison. Many places in the kernel can bypass this full check | |
8494 | - * if they have already ruled out V8086 mode, so user_mode(regs) can be used. | |
8495 | + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can | |
8496 | + * be used. | |
8497 | */ | |
8498 | -static inline int user_mode(struct pt_regs *regs) | |
8499 | +static inline int user_mode_novm(struct pt_regs *regs) | |
8500 | { | |
8501 | #ifdef CONFIG_X86_32 | |
8502 | return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL; | |
8503 | #else | |
8504 | - return !!(regs->cs & 3); | |
8505 | + return !!(regs->cs & SEGMENT_RPL_MASK); | |
8506 | #endif | |
8507 | } | |
8508 | ||
8509 | -static inline int user_mode_vm(struct pt_regs *regs) | |
8510 | +static inline int user_mode(struct pt_regs *regs) | |
8511 | { | |
8512 | #ifdef CONFIG_X86_32 | |
8513 | return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >= | |
8514 | USER_RPL; | |
8515 | #else | |
8516 | - return user_mode(regs); | |
8517 | + return user_mode_novm(regs); | |
8518 | #endif | |
8519 | } | |
8520 | ||
8521 | diff -urNp linux-3.0.3/arch/x86/include/asm/reboot.h linux-3.0.3/arch/x86/include/asm/reboot.h | |
8522 | --- linux-3.0.3/arch/x86/include/asm/reboot.h 2011-07-21 22:17:23.000000000 -0400 | |
8523 | +++ linux-3.0.3/arch/x86/include/asm/reboot.h 2011-08-23 21:47:55.000000000 -0400 | |
8524 | @@ -6,19 +6,19 @@ | |
8525 | struct pt_regs; | |
8526 | ||
8527 | struct machine_ops { | |
8528 | - void (*restart)(char *cmd); | |
8529 | - void (*halt)(void); | |
8530 | - void (*power_off)(void); | |
8531 | + void (* __noreturn restart)(char *cmd); | |
8532 | + void (* __noreturn halt)(void); | |
8533 | + void (* __noreturn power_off)(void); | |
8534 | void (*shutdown)(void); | |
8535 | void (*crash_shutdown)(struct pt_regs *); | |
8536 | - void (*emergency_restart)(void); | |
8537 | -}; | |
8538 | + void (* __noreturn emergency_restart)(void); | |
8539 | +} __no_const; | |
8540 | ||
8541 | extern struct machine_ops machine_ops; | |
8542 | ||
8543 | void native_machine_crash_shutdown(struct pt_regs *regs); | |
8544 | void native_machine_shutdown(void); | |
8545 | -void machine_real_restart(unsigned int type); | |
8546 | +void machine_real_restart(unsigned int type) __noreturn; | |
8547 | /* These must match dispatch_table in reboot_32.S */ | |
8548 | #define MRR_BIOS 0 | |
8549 | #define MRR_APM 1 | |
8550 | diff -urNp linux-3.0.3/arch/x86/include/asm/rwsem.h linux-3.0.3/arch/x86/include/asm/rwsem.h | |
8551 | --- linux-3.0.3/arch/x86/include/asm/rwsem.h 2011-07-21 22:17:23.000000000 -0400 | |
8552 | +++ linux-3.0.3/arch/x86/include/asm/rwsem.h 2011-08-23 21:47:55.000000000 -0400 | |
8553 | @@ -64,6 +64,14 @@ static inline void __down_read(struct rw | |
8554 | { | |
8555 | asm volatile("# beginning down_read\n\t" | |
8556 | LOCK_PREFIX _ASM_INC "(%1)\n\t" | |
8557 | + | |
8558 | +#ifdef CONFIG_PAX_REFCOUNT | |
8559 | + "jno 0f\n" | |
8560 | + LOCK_PREFIX _ASM_DEC "(%1)\n" | |
8561 | + "int $4\n0:\n" | |
8562 | + _ASM_EXTABLE(0b, 0b) | |
8563 | +#endif | |
8564 | + | |
8565 | /* adds 0x00000001 */ | |
8566 | " jns 1f\n" | |
8567 | " call call_rwsem_down_read_failed\n" | |
8568 | @@ -85,6 +93,14 @@ static inline int __down_read_trylock(st | |
8569 | "1:\n\t" | |
8570 | " mov %1,%2\n\t" | |
8571 | " add %3,%2\n\t" | |
8572 | + | |
8573 | +#ifdef CONFIG_PAX_REFCOUNT | |
8574 | + "jno 0f\n" | |
8575 | + "sub %3,%2\n" | |
8576 | + "int $4\n0:\n" | |
8577 | + _ASM_EXTABLE(0b, 0b) | |
8578 | +#endif | |
8579 | + | |
8580 | " jle 2f\n\t" | |
8581 | LOCK_PREFIX " cmpxchg %2,%0\n\t" | |
8582 | " jnz 1b\n\t" | |
8583 | @@ -104,6 +120,14 @@ static inline void __down_write_nested(s | |
8584 | long tmp; | |
8585 | asm volatile("# beginning down_write\n\t" | |
8586 | LOCK_PREFIX " xadd %1,(%2)\n\t" | |
8587 | + | |
8588 | +#ifdef CONFIG_PAX_REFCOUNT | |
8589 | + "jno 0f\n" | |
8590 | + "mov %1,(%2)\n" | |
8591 | + "int $4\n0:\n" | |
8592 | + _ASM_EXTABLE(0b, 0b) | |
8593 | +#endif | |
8594 | + | |
8595 | /* adds 0xffff0001, returns the old value */ | |
8596 | " test %1,%1\n\t" | |
8597 | /* was the count 0 before? */ | |
8598 | @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s | |
8599 | long tmp; | |
8600 | asm volatile("# beginning __up_read\n\t" | |
8601 | LOCK_PREFIX " xadd %1,(%2)\n\t" | |
8602 | + | |
8603 | +#ifdef CONFIG_PAX_REFCOUNT | |
8604 | + "jno 0f\n" | |
8605 | + "mov %1,(%2)\n" | |
8606 | + "int $4\n0:\n" | |
8607 | + _ASM_EXTABLE(0b, 0b) | |
8608 | +#endif | |
8609 | + | |
8610 | /* subtracts 1, returns the old value */ | |
8611 | " jns 1f\n\t" | |
8612 | " call call_rwsem_wake\n" /* expects old value in %edx */ | |
8613 | @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_ | |
8614 | long tmp; | |
8615 | asm volatile("# beginning __up_write\n\t" | |
8616 | LOCK_PREFIX " xadd %1,(%2)\n\t" | |
8617 | + | |
8618 | +#ifdef CONFIG_PAX_REFCOUNT | |
8619 | + "jno 0f\n" | |
8620 | + "mov %1,(%2)\n" | |
8621 | + "int $4\n0:\n" | |
8622 | + _ASM_EXTABLE(0b, 0b) | |
8623 | +#endif | |
8624 | + | |
8625 | /* subtracts 0xffff0001, returns the old value */ | |
8626 | " jns 1f\n\t" | |
8627 | " call call_rwsem_wake\n" /* expects old value in %edx */ | |
8628 | @@ -176,6 +216,14 @@ static inline void __downgrade_write(str | |
8629 | { | |
8630 | asm volatile("# beginning __downgrade_write\n\t" | |
8631 | LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t" | |
8632 | + | |
8633 | +#ifdef CONFIG_PAX_REFCOUNT | |
8634 | + "jno 0f\n" | |
8635 | + LOCK_PREFIX _ASM_SUB "%2,(%1)\n" | |
8636 | + "int $4\n0:\n" | |
8637 | + _ASM_EXTABLE(0b, 0b) | |
8638 | +#endif | |
8639 | + | |
8640 | /* | |
8641 | * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386) | |
8642 | * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64) | |
8643 | @@ -194,7 +242,15 @@ static inline void __downgrade_write(str | |
8644 | */ | |
8645 | static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem) | |
8646 | { | |
8647 | - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0" | |
8648 | + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n" | |
8649 | + | |
8650 | +#ifdef CONFIG_PAX_REFCOUNT | |
8651 | + "jno 0f\n" | |
8652 | + LOCK_PREFIX _ASM_SUB "%1,%0\n" | |
8653 | + "int $4\n0:\n" | |
8654 | + _ASM_EXTABLE(0b, 0b) | |
8655 | +#endif | |
8656 | + | |
8657 | : "+m" (sem->count) | |
8658 | : "er" (delta)); | |
8659 | } | |
8660 | @@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l | |
8661 | { | |
8662 | long tmp = delta; | |
8663 | ||
8664 | - asm volatile(LOCK_PREFIX "xadd %0,%1" | |
8665 | + asm volatile(LOCK_PREFIX "xadd %0,%1\n" | |
8666 | + | |
8667 | +#ifdef CONFIG_PAX_REFCOUNT | |
8668 | + "jno 0f\n" | |
8669 | + "mov %0,%1\n" | |
8670 | + "int $4\n0:\n" | |
8671 | + _ASM_EXTABLE(0b, 0b) | |
8672 | +#endif | |
8673 | + | |
8674 | : "+r" (tmp), "+m" (sem->count) | |
8675 | : : "memory"); | |
8676 | ||
8677 | diff -urNp linux-3.0.3/arch/x86/include/asm/segment.h linux-3.0.3/arch/x86/include/asm/segment.h | |
8678 | --- linux-3.0.3/arch/x86/include/asm/segment.h 2011-07-21 22:17:23.000000000 -0400 | |
8679 | +++ linux-3.0.3/arch/x86/include/asm/segment.h 2011-08-23 21:47:55.000000000 -0400 | |
8680 | @@ -64,8 +64,8 @@ | |
8681 | * 26 - ESPFIX small SS | |
8682 | * 27 - per-cpu [ offset to per-cpu data area ] | |
8683 | * 28 - stack_canary-20 [ for stack protector ] | |
8684 | - * 29 - unused | |
8685 | - * 30 - unused | |
8686 | + * 29 - PCI BIOS CS | |
8687 | + * 30 - PCI BIOS DS | |
8688 | * 31 - TSS for double fault handler | |
8689 | */ | |
8690 | #define GDT_ENTRY_TLS_MIN 6 | |
8691 | @@ -79,6 +79,8 @@ | |
8692 | ||
8693 | #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0) | |
8694 | ||
8695 | +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4) | |
8696 | + | |
8697 | #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1) | |
8698 | ||
8699 | #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4) | |
8700 | @@ -104,6 +106,12 @@ | |
8701 | #define __KERNEL_STACK_CANARY 0 | |
8702 | #endif | |
8703 | ||
8704 | +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17) | |
8705 | +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8) | |
8706 | + | |
8707 | +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18) | |
8708 | +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8) | |
8709 | + | |
8710 | #define GDT_ENTRY_DOUBLEFAULT_TSS 31 | |
8711 | ||
8712 | /* | |
8713 | @@ -141,7 +149,7 @@ | |
8714 | */ | |
8715 | ||
8716 | /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */ | |
8717 | -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8) | |
8718 | +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16) | |
8719 | ||
8720 | ||
8721 | #else | |
8722 | @@ -165,6 +173,8 @@ | |
8723 | #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3) | |
8724 | #define __USER32_DS __USER_DS | |
8725 | ||
8726 | +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7 | |
8727 | + | |
8728 | #define GDT_ENTRY_TSS 8 /* needs two entries */ | |
8729 | #define GDT_ENTRY_LDT 10 /* needs two entries */ | |
8730 | #define GDT_ENTRY_TLS_MIN 12 | |
8731 | @@ -185,6 +195,7 @@ | |
8732 | #endif | |
8733 | ||
8734 | #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8) | |
8735 | +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8) | |
8736 | #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8) | |
8737 | #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3) | |
8738 | #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3) | |
8739 | diff -urNp linux-3.0.3/arch/x86/include/asm/smp.h linux-3.0.3/arch/x86/include/asm/smp.h | |
8740 | --- linux-3.0.3/arch/x86/include/asm/smp.h 2011-07-21 22:17:23.000000000 -0400 | |
8741 | +++ linux-3.0.3/arch/x86/include/asm/smp.h 2011-08-23 21:47:55.000000000 -0400 | |
8742 | @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_ | |
8743 | /* cpus sharing the last level cache: */ | |
8744 | DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map); | |
8745 | DECLARE_PER_CPU(u16, cpu_llc_id); | |
8746 | -DECLARE_PER_CPU(int, cpu_number); | |
8747 | +DECLARE_PER_CPU(unsigned int, cpu_number); | |
8748 | ||
8749 | static inline struct cpumask *cpu_sibling_mask(int cpu) | |
8750 | { | |
8751 | @@ -77,7 +77,7 @@ struct smp_ops { | |
8752 | ||
8753 | void (*send_call_func_ipi)(const struct cpumask *mask); | |
8754 | void (*send_call_func_single_ipi)(int cpu); | |
8755 | -}; | |
8756 | +} __no_const; | |
8757 | ||
8758 | /* Globals due to paravirt */ | |
8759 | extern void set_cpu_sibling_map(int cpu); | |
8760 | @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd | |
8761 | extern int safe_smp_processor_id(void); | |
8762 | ||
8763 | #elif defined(CONFIG_X86_64_SMP) | |
8764 | -#define raw_smp_processor_id() (percpu_read(cpu_number)) | |
8765 | - | |
8766 | -#define stack_smp_processor_id() \ | |
8767 | -({ \ | |
8768 | - struct thread_info *ti; \ | |
8769 | - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \ | |
8770 | - ti->cpu; \ | |
8771 | -}) | |
8772 | +#define raw_smp_processor_id() (percpu_read(cpu_number)) | |
8773 | +#define stack_smp_processor_id() raw_smp_processor_id() | |
8774 | #define safe_smp_processor_id() smp_processor_id() | |
8775 | ||
8776 | #endif | |
8777 | diff -urNp linux-3.0.3/arch/x86/include/asm/spinlock.h linux-3.0.3/arch/x86/include/asm/spinlock.h | |
8778 | --- linux-3.0.3/arch/x86/include/asm/spinlock.h 2011-07-21 22:17:23.000000000 -0400 | |
8779 | +++ linux-3.0.3/arch/x86/include/asm/spinlock.h 2011-08-23 21:47:55.000000000 -0400 | |
8780 | @@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar | |
8781 | static inline void arch_read_lock(arch_rwlock_t *rw) | |
8782 | { | |
8783 | asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t" | |
8784 | + | |
8785 | +#ifdef CONFIG_PAX_REFCOUNT | |
8786 | + "jno 0f\n" | |
8787 | + LOCK_PREFIX " addl $1,(%0)\n" | |
8788 | + "int $4\n0:\n" | |
8789 | + _ASM_EXTABLE(0b, 0b) | |
8790 | +#endif | |
8791 | + | |
8792 | "jns 1f\n" | |
8793 | "call __read_lock_failed\n\t" | |
8794 | "1:\n" | |
8795 | @@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r | |
8796 | static inline void arch_write_lock(arch_rwlock_t *rw) | |
8797 | { | |
8798 | asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t" | |
8799 | + | |
8800 | +#ifdef CONFIG_PAX_REFCOUNT | |
8801 | + "jno 0f\n" | |
8802 | + LOCK_PREFIX " addl %1,(%0)\n" | |
8803 | + "int $4\n0:\n" | |
8804 | + _ASM_EXTABLE(0b, 0b) | |
8805 | +#endif | |
8806 | + | |
8807 | "jz 1f\n" | |
8808 | "call __write_lock_failed\n\t" | |
8809 | "1:\n" | |
8810 | @@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc | |
8811 | ||
8812 | static inline void arch_read_unlock(arch_rwlock_t *rw) | |
8813 | { | |
8814 | - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory"); | |
8815 | + asm volatile(LOCK_PREFIX "incl %0\n" | |
8816 | + | |
8817 | +#ifdef CONFIG_PAX_REFCOUNT | |
8818 | + "jno 0f\n" | |
8819 | + LOCK_PREFIX "decl %0\n" | |
8820 | + "int $4\n0:\n" | |
8821 | + _ASM_EXTABLE(0b, 0b) | |
8822 | +#endif | |
8823 | + | |
8824 | + :"+m" (rw->lock) : : "memory"); | |
8825 | } | |
8826 | ||
8827 | static inline void arch_write_unlock(arch_rwlock_t *rw) | |
8828 | { | |
8829 | - asm volatile(LOCK_PREFIX "addl %1, %0" | |
8830 | + asm volatile(LOCK_PREFIX "addl %1, %0\n" | |
8831 | + | |
8832 | +#ifdef CONFIG_PAX_REFCOUNT | |
8833 | + "jno 0f\n" | |
8834 | + LOCK_PREFIX "subl %1, %0\n" | |
8835 | + "int $4\n0:\n" | |
8836 | + _ASM_EXTABLE(0b, 0b) | |
8837 | +#endif | |
8838 | + | |
8839 | : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory"); | |
8840 | } | |
8841 | ||
8842 | diff -urNp linux-3.0.3/arch/x86/include/asm/stackprotector.h linux-3.0.3/arch/x86/include/asm/stackprotector.h | |
8843 | --- linux-3.0.3/arch/x86/include/asm/stackprotector.h 2011-07-21 22:17:23.000000000 -0400 | |
8844 | +++ linux-3.0.3/arch/x86/include/asm/stackprotector.h 2011-08-23 21:47:55.000000000 -0400 | |
8845 | @@ -48,7 +48,7 @@ | |
8846 | * head_32 for boot CPU and setup_per_cpu_areas() for others. | |
8847 | */ | |
8848 | #define GDT_STACK_CANARY_INIT \ | |
8849 | - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18), | |
8850 | + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17), | |
8851 | ||
8852 | /* | |
8853 | * Initialize the stackprotector canary value. | |
8854 | @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se | |
8855 | ||
8856 | static inline void load_stack_canary_segment(void) | |
8857 | { | |
8858 | -#ifdef CONFIG_X86_32 | |
8859 | +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF) | |
8860 | asm volatile ("mov %0, %%gs" : : "r" (0)); | |
8861 | #endif | |
8862 | } | |
8863 | diff -urNp linux-3.0.3/arch/x86/include/asm/stacktrace.h linux-3.0.3/arch/x86/include/asm/stacktrace.h | |
8864 | --- linux-3.0.3/arch/x86/include/asm/stacktrace.h 2011-07-21 22:17:23.000000000 -0400 | |
8865 | +++ linux-3.0.3/arch/x86/include/asm/stacktrace.h 2011-08-23 21:47:55.000000000 -0400 | |
8866 | @@ -11,28 +11,20 @@ | |
8867 | ||
8868 | extern int kstack_depth_to_print; | |
8869 | ||
8870 | -struct thread_info; | |
8871 | +struct task_struct; | |
8872 | struct stacktrace_ops; | |
8873 | ||
8874 | -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo, | |
8875 | - unsigned long *stack, | |
8876 | - unsigned long bp, | |
8877 | - const struct stacktrace_ops *ops, | |
8878 | - void *data, | |
8879 | - unsigned long *end, | |
8880 | - int *graph); | |
8881 | - | |
8882 | -extern unsigned long | |
8883 | -print_context_stack(struct thread_info *tinfo, | |
8884 | - unsigned long *stack, unsigned long bp, | |
8885 | - const struct stacktrace_ops *ops, void *data, | |
8886 | - unsigned long *end, int *graph); | |
8887 | - | |
8888 | -extern unsigned long | |
8889 | -print_context_stack_bp(struct thread_info *tinfo, | |
8890 | - unsigned long *stack, unsigned long bp, | |
8891 | - const struct stacktrace_ops *ops, void *data, | |
8892 | - unsigned long *end, int *graph); | |
8893 | +typedef unsigned long walk_stack_t(struct task_struct *task, | |
8894 | + void *stack_start, | |
8895 | + unsigned long *stack, | |
8896 | + unsigned long bp, | |
8897 | + const struct stacktrace_ops *ops, | |
8898 | + void *data, | |
8899 | + unsigned long *end, | |
8900 | + int *graph); | |
8901 | + | |
8902 | +extern walk_stack_t print_context_stack; | |
8903 | +extern walk_stack_t print_context_stack_bp; | |
8904 | ||
8905 | /* Generic stack tracer with callbacks */ | |
8906 | ||
8907 | @@ -40,7 +32,7 @@ struct stacktrace_ops { | |
8908 | void (*address)(void *data, unsigned long address, int reliable); | |
8909 | /* On negative return stop dumping */ | |
8910 | int (*stack)(void *data, char *name); | |
8911 | - walk_stack_t walk_stack; | |
8912 | + walk_stack_t *walk_stack; | |
8913 | }; | |
8914 | ||
8915 | void dump_trace(struct task_struct *tsk, struct pt_regs *regs, | |
8916 | diff -urNp linux-3.0.3/arch/x86/include/asm/system.h linux-3.0.3/arch/x86/include/asm/system.h | |
8917 | --- linux-3.0.3/arch/x86/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 | |
8918 | +++ linux-3.0.3/arch/x86/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 | |
8919 | @@ -129,7 +129,7 @@ do { \ | |
8920 | "call __switch_to\n\t" \ | |
8921 | "movq "__percpu_arg([current_task])",%%rsi\n\t" \ | |
8922 | __switch_canary \ | |
8923 | - "movq %P[thread_info](%%rsi),%%r8\n\t" \ | |
8924 | + "movq "__percpu_arg([thread_info])",%%r8\n\t" \ | |
8925 | "movq %%rax,%%rdi\n\t" \ | |
8926 | "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \ | |
8927 | "jnz ret_from_fork\n\t" \ | |
8928 | @@ -140,7 +140,7 @@ do { \ | |
8929 | [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \ | |
8930 | [ti_flags] "i" (offsetof(struct thread_info, flags)), \ | |
8931 | [_tif_fork] "i" (_TIF_FORK), \ | |
8932 | - [thread_info] "i" (offsetof(struct task_struct, stack)), \ | |
8933 | + [thread_info] "m" (current_tinfo), \ | |
8934 | [current_task] "m" (current_task) \ | |
8935 | __switch_canary_iparam \ | |
8936 | : "memory", "cc" __EXTRA_CLOBBER) | |
8937 | @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un | |
8938 | { | |
8939 | unsigned long __limit; | |
8940 | asm("lsll %1,%0" : "=r" (__limit) : "r" (segment)); | |
8941 | - return __limit + 1; | |
8942 | + return __limit; | |
8943 | } | |
8944 | ||
8945 | static inline void native_clts(void) | |
8946 | @@ -397,12 +397,12 @@ void enable_hlt(void); | |
8947 | ||
8948 | void cpu_idle_wait(void); | |
8949 | ||
8950 | -extern unsigned long arch_align_stack(unsigned long sp); | |
8951 | +#define arch_align_stack(x) ((x) & ~0xfUL) | |
8952 | extern void free_init_pages(char *what, unsigned long begin, unsigned long end); | |
8953 | ||
8954 | void default_idle(void); | |
8955 | ||
8956 | -void stop_this_cpu(void *dummy); | |
8957 | +void stop_this_cpu(void *dummy) __noreturn; | |
8958 | ||
8959 | /* | |
8960 | * Force strict CPU ordering. | |
8961 | diff -urNp linux-3.0.3/arch/x86/include/asm/thread_info.h linux-3.0.3/arch/x86/include/asm/thread_info.h | |
8962 | --- linux-3.0.3/arch/x86/include/asm/thread_info.h 2011-07-21 22:17:23.000000000 -0400 | |
8963 | +++ linux-3.0.3/arch/x86/include/asm/thread_info.h 2011-08-23 21:47:55.000000000 -0400 | |
8964 | @@ -10,6 +10,7 @@ | |
8965 | #include <linux/compiler.h> | |
8966 | #include <asm/page.h> | |
8967 | #include <asm/types.h> | |
8968 | +#include <asm/percpu.h> | |
8969 | ||
8970 | /* | |
8971 | * low level task data that entry.S needs immediate access to | |
8972 | @@ -24,7 +25,6 @@ struct exec_domain; | |
8973 | #include <asm/atomic.h> | |
8974 | ||
8975 | struct thread_info { | |
8976 | - struct task_struct *task; /* main task structure */ | |
8977 | struct exec_domain *exec_domain; /* execution domain */ | |
8978 | __u32 flags; /* low level flags */ | |
8979 | __u32 status; /* thread synchronous flags */ | |
8980 | @@ -34,18 +34,12 @@ struct thread_info { | |
8981 | mm_segment_t addr_limit; | |
8982 | struct restart_block restart_block; | |
8983 | void __user *sysenter_return; | |
8984 | -#ifdef CONFIG_X86_32 | |
8985 | - unsigned long previous_esp; /* ESP of the previous stack in | |
8986 | - case of nested (IRQ) stacks | |
8987 | - */ | |
8988 | - __u8 supervisor_stack[0]; | |
8989 | -#endif | |
8990 | + unsigned long lowest_stack; | |
8991 | int uaccess_err; | |
8992 | }; | |
8993 | ||
8994 | -#define INIT_THREAD_INFO(tsk) \ | |
8995 | +#define INIT_THREAD_INFO \ | |
8996 | { \ | |
8997 | - .task = &tsk, \ | |
8998 | .exec_domain = &default_exec_domain, \ | |
8999 | .flags = 0, \ | |
9000 | .cpu = 0, \ | |
9001 | @@ -56,7 +50,7 @@ struct thread_info { | |
9002 | }, \ | |
9003 | } | |
9004 | ||
9005 | -#define init_thread_info (init_thread_union.thread_info) | |
9006 | +#define init_thread_info (init_thread_union.stack) | |
9007 | #define init_stack (init_thread_union.stack) | |
9008 | ||
9009 | #else /* !__ASSEMBLY__ */ | |
9010 | @@ -170,6 +164,23 @@ struct thread_info { | |
9011 | ret; \ | |
9012 | }) | |
9013 | ||
9014 | +#ifdef __ASSEMBLY__ | |
9015 | +/* how to get the thread information struct from ASM */ | |
9016 | +#define GET_THREAD_INFO(reg) \ | |
9017 | + mov PER_CPU_VAR(current_tinfo), reg | |
9018 | + | |
9019 | +/* use this one if reg already contains %esp */ | |
9020 | +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg) | |
9021 | +#else | |
9022 | +/* how to get the thread information struct from C */ | |
9023 | +DECLARE_PER_CPU(struct thread_info *, current_tinfo); | |
9024 | + | |
9025 | +static __always_inline struct thread_info *current_thread_info(void) | |
9026 | +{ | |
9027 | + return percpu_read_stable(current_tinfo); | |
9028 | +} | |
9029 | +#endif | |
9030 | + | |
9031 | #ifdef CONFIG_X86_32 | |
9032 | ||
9033 | #define STACK_WARN (THREAD_SIZE/8) | |
9034 | @@ -180,35 +191,13 @@ struct thread_info { | |
9035 | */ | |
9036 | #ifndef __ASSEMBLY__ | |
9037 | ||
9038 | - | |
9039 | /* how to get the current stack pointer from C */ | |
9040 | register unsigned long current_stack_pointer asm("esp") __used; | |
9041 | ||
9042 | -/* how to get the thread information struct from C */ | |
9043 | -static inline struct thread_info *current_thread_info(void) | |
9044 | -{ | |
9045 | - return (struct thread_info *) | |
9046 | - (current_stack_pointer & ~(THREAD_SIZE - 1)); | |
9047 | -} | |
9048 | - | |
9049 | -#else /* !__ASSEMBLY__ */ | |
9050 | - | |
9051 | -/* how to get the thread information struct from ASM */ | |
9052 | -#define GET_THREAD_INFO(reg) \ | |
9053 | - movl $-THREAD_SIZE, reg; \ | |
9054 | - andl %esp, reg | |
9055 | - | |
9056 | -/* use this one if reg already contains %esp */ | |
9057 | -#define GET_THREAD_INFO_WITH_ESP(reg) \ | |
9058 | - andl $-THREAD_SIZE, reg | |
9059 | - | |
9060 | #endif | |
9061 | ||
9062 | #else /* X86_32 */ | |
9063 | ||
9064 | -#include <asm/percpu.h> | |
9065 | -#define KERNEL_STACK_OFFSET (5*8) | |
9066 | - | |
9067 | /* | |
9068 | * macros/functions for gaining access to the thread information structure | |
9069 | * preempt_count needs to be 1 initially, until the scheduler is functional. | |
9070 | @@ -216,21 +205,8 @@ static inline struct thread_info *curren | |
9071 | #ifndef __ASSEMBLY__ | |
9072 | DECLARE_PER_CPU(unsigned long, kernel_stack); | |
9073 | ||
9074 | -static inline struct thread_info *current_thread_info(void) | |
9075 | -{ | |
9076 | - struct thread_info *ti; | |
9077 | - ti = (void *)(percpu_read_stable(kernel_stack) + | |
9078 | - KERNEL_STACK_OFFSET - THREAD_SIZE); | |
9079 | - return ti; | |
9080 | -} | |
9081 | - | |
9082 | -#else /* !__ASSEMBLY__ */ | |
9083 | - | |
9084 | -/* how to get the thread information struct from ASM */ | |
9085 | -#define GET_THREAD_INFO(reg) \ | |
9086 | - movq PER_CPU_VAR(kernel_stack),reg ; \ | |
9087 | - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg | |
9088 | - | |
9089 | +/* how to get the current stack pointer from C */ | |
9090 | +register unsigned long current_stack_pointer asm("rsp") __used; | |
9091 | #endif | |
9092 | ||
9093 | #endif /* !X86_32 */ | |
9094 | @@ -266,5 +242,16 @@ extern void arch_task_cache_init(void); | |
9095 | extern void free_thread_info(struct thread_info *ti); | |
9096 | extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src); | |
9097 | #define arch_task_cache_init arch_task_cache_init | |
9098 | + | |
9099 | +#define __HAVE_THREAD_FUNCTIONS | |
9100 | +#define task_thread_info(task) (&(task)->tinfo) | |
9101 | +#define task_stack_page(task) ((task)->stack) | |
9102 | +#define setup_thread_stack(p, org) do {} while (0) | |
9103 | +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1) | |
9104 | + | |
9105 | +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR | |
9106 | +extern struct task_struct *alloc_task_struct_node(int node); | |
9107 | +extern void free_task_struct(struct task_struct *); | |
9108 | + | |
9109 | #endif | |
9110 | #endif /* _ASM_X86_THREAD_INFO_H */ | |
9111 | diff -urNp linux-3.0.3/arch/x86/include/asm/uaccess_32.h linux-3.0.3/arch/x86/include/asm/uaccess_32.h | |
9112 | --- linux-3.0.3/arch/x86/include/asm/uaccess_32.h 2011-07-21 22:17:23.000000000 -0400 | |
9113 | +++ linux-3.0.3/arch/x86/include/asm/uaccess_32.h 2011-08-23 21:48:14.000000000 -0400 | |
9114 | @@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_u | |
9115 | static __always_inline unsigned long __must_check | |
9116 | __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n) | |
9117 | { | |
9118 | + pax_track_stack(); | |
9119 | + | |
9120 | + if ((long)n < 0) | |
9121 | + return n; | |
9122 | + | |
9123 | if (__builtin_constant_p(n)) { | |
9124 | unsigned long ret; | |
9125 | ||
9126 | @@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to, | |
9127 | return ret; | |
9128 | } | |
9129 | } | |
9130 | + if (!__builtin_constant_p(n)) | |
9131 | + check_object_size(from, n, true); | |
9132 | return __copy_to_user_ll(to, from, n); | |
9133 | } | |
9134 | ||
9135 | @@ -82,12 +89,16 @@ static __always_inline unsigned long __m | |
9136 | __copy_to_user(void __user *to, const void *from, unsigned long n) | |
9137 | { | |
9138 | might_fault(); | |
9139 | + | |
9140 | return __copy_to_user_inatomic(to, from, n); | |
9141 | } | |
9142 | ||
9143 | static __always_inline unsigned long | |
9144 | __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) | |
9145 | { | |
9146 | + if ((long)n < 0) | |
9147 | + return n; | |
9148 | + | |
9149 | /* Avoid zeroing the tail if the copy fails.. | |
9150 | * If 'n' is constant and 1, 2, or 4, we do still zero on a failure, | |
9151 | * but as the zeroing behaviour is only significant when n is not | |
9152 | @@ -137,6 +148,12 @@ static __always_inline unsigned long | |
9153 | __copy_from_user(void *to, const void __user *from, unsigned long n) | |
9154 | { | |
9155 | might_fault(); | |
9156 | + | |
9157 | + pax_track_stack(); | |
9158 | + | |
9159 | + if ((long)n < 0) | |
9160 | + return n; | |
9161 | + | |
9162 | if (__builtin_constant_p(n)) { | |
9163 | unsigned long ret; | |
9164 | ||
9165 | @@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __ | |
9166 | return ret; | |
9167 | } | |
9168 | } | |
9169 | + if (!__builtin_constant_p(n)) | |
9170 | + check_object_size(to, n, false); | |
9171 | return __copy_from_user_ll(to, from, n); | |
9172 | } | |
9173 | ||
9174 | @@ -159,6 +178,10 @@ static __always_inline unsigned long __c | |
9175 | const void __user *from, unsigned long n) | |
9176 | { | |
9177 | might_fault(); | |
9178 | + | |
9179 | + if ((long)n < 0) | |
9180 | + return n; | |
9181 | + | |
9182 | if (__builtin_constant_p(n)) { | |
9183 | unsigned long ret; | |
9184 | ||
9185 | @@ -181,15 +204,19 @@ static __always_inline unsigned long | |
9186 | __copy_from_user_inatomic_nocache(void *to, const void __user *from, | |
9187 | unsigned long n) | |
9188 | { | |
9189 | - return __copy_from_user_ll_nocache_nozero(to, from, n); | |
9190 | -} | |
9191 | + if ((long)n < 0) | |
9192 | + return n; | |
9193 | ||
9194 | -unsigned long __must_check copy_to_user(void __user *to, | |
9195 | - const void *from, unsigned long n); | |
9196 | -unsigned long __must_check _copy_from_user(void *to, | |
9197 | - const void __user *from, | |
9198 | - unsigned long n); | |
9199 | + return __copy_from_user_ll_nocache_nozero(to, from, n); | |
9200 | +} | |
9201 | ||
9202 | +extern void copy_to_user_overflow(void) | |
9203 | +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS | |
9204 | + __compiletime_error("copy_to_user() buffer size is not provably correct") | |
9205 | +#else | |
9206 | + __compiletime_warning("copy_to_user() buffer size is not provably correct") | |
9207 | +#endif | |
9208 | +; | |
9209 | ||
9210 | extern void copy_from_user_overflow(void) | |
9211 | #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS | |
9212 | @@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void | |
9213 | #endif | |
9214 | ; | |
9215 | ||
9216 | -static inline unsigned long __must_check copy_from_user(void *to, | |
9217 | - const void __user *from, | |
9218 | - unsigned long n) | |
9219 | +/** | |
9220 | + * copy_to_user: - Copy a block of data into user space. | |
9221 | + * @to: Destination address, in user space. | |
9222 | + * @from: Source address, in kernel space. | |
9223 | + * @n: Number of bytes to copy. | |
9224 | + * | |
9225 | + * Context: User context only. This function may sleep. | |
9226 | + * | |
9227 | + * Copy data from kernel space to user space. | |
9228 | + * | |
9229 | + * Returns number of bytes that could not be copied. | |
9230 | + * On success, this will be zero. | |
9231 | + */ | |
9232 | +static inline unsigned long __must_check | |
9233 | +copy_to_user(void __user *to, const void *from, unsigned long n) | |
9234 | +{ | |
9235 | + int sz = __compiletime_object_size(from); | |
9236 | + | |
9237 | + if (unlikely(sz != -1 && sz < n)) | |
9238 | + copy_to_user_overflow(); | |
9239 | + else if (access_ok(VERIFY_WRITE, to, n)) | |
9240 | + n = __copy_to_user(to, from, n); | |
9241 | + return n; | |
9242 | +} | |
9243 | + | |
9244 | +/** | |
9245 | + * copy_from_user: - Copy a block of data from user space. | |
9246 | + * @to: Destination address, in kernel space. | |
9247 | + * @from: Source address, in user space. | |
9248 | + * @n: Number of bytes to copy. | |
9249 | + * | |
9250 | + * Context: User context only. This function may sleep. | |
9251 | + * | |
9252 | + * Copy data from user space to kernel space. | |
9253 | + * | |
9254 | + * Returns number of bytes that could not be copied. | |
9255 | + * On success, this will be zero. | |
9256 | + * | |
9257 | + * If some data could not be copied, this function will pad the copied | |
9258 | + * data to the requested size using zero bytes. | |
9259 | + */ | |
9260 | +static inline unsigned long __must_check | |
9261 | +copy_from_user(void *to, const void __user *from, unsigned long n) | |
9262 | { | |
9263 | int sz = __compiletime_object_size(to); | |
9264 | ||
9265 | - if (likely(sz == -1 || sz >= n)) | |
9266 | - n = _copy_from_user(to, from, n); | |
9267 | - else | |
9268 | + if (unlikely(sz != -1 && sz < n)) | |
9269 | copy_from_user_overflow(); | |
9270 | - | |
9271 | + else if (access_ok(VERIFY_READ, from, n)) | |
9272 | + n = __copy_from_user(to, from, n); | |
9273 | + else if ((long)n > 0) { | |
9274 | + if (!__builtin_constant_p(n)) | |
9275 | + check_object_size(to, n, false); | |
9276 | + memset(to, 0, n); | |
9277 | + } | |
9278 | return n; | |
9279 | } | |
9280 | ||
9281 | diff -urNp linux-3.0.3/arch/x86/include/asm/uaccess_64.h linux-3.0.3/arch/x86/include/asm/uaccess_64.h | |
9282 | --- linux-3.0.3/arch/x86/include/asm/uaccess_64.h 2011-07-21 22:17:23.000000000 -0400 | |
9283 | +++ linux-3.0.3/arch/x86/include/asm/uaccess_64.h 2011-08-23 21:48:14.000000000 -0400 | |
9284 | @@ -10,6 +10,9 @@ | |
9285 | #include <asm/alternative.h> | |
9286 | #include <asm/cpufeature.h> | |
9287 | #include <asm/page.h> | |
9288 | +#include <asm/pgtable.h> | |
9289 | + | |
9290 | +#define set_fs(x) (current_thread_info()->addr_limit = (x)) | |
9291 | ||
9292 | /* | |
9293 | * Copy To/From Userspace | |
9294 | @@ -36,26 +39,26 @@ copy_user_generic(void *to, const void * | |
9295 | return ret; | |
9296 | } | |
9297 | ||
9298 | -__must_check unsigned long | |
9299 | -_copy_to_user(void __user *to, const void *from, unsigned len); | |
9300 | -__must_check unsigned long | |
9301 | -_copy_from_user(void *to, const void __user *from, unsigned len); | |
9302 | +static __always_inline __must_check unsigned long | |
9303 | +__copy_to_user(void __user *to, const void *from, unsigned len); | |
9304 | +static __always_inline __must_check unsigned long | |
9305 | +__copy_from_user(void *to, const void __user *from, unsigned len); | |
9306 | __must_check unsigned long | |
9307 | copy_in_user(void __user *to, const void __user *from, unsigned len); | |
9308 | ||
9309 | static inline unsigned long __must_check copy_from_user(void *to, | |
9310 | const void __user *from, | |
9311 | - unsigned long n) | |
9312 | + unsigned n) | |
9313 | { | |
9314 | - int sz = __compiletime_object_size(to); | |
9315 | - | |
9316 | might_fault(); | |
9317 | - if (likely(sz == -1 || sz >= n)) | |
9318 | - n = _copy_from_user(to, from, n); | |
9319 | -#ifdef CONFIG_DEBUG_VM | |
9320 | - else | |
9321 | - WARN(1, "Buffer overflow detected!\n"); | |
9322 | -#endif | |
9323 | + | |
9324 | + if (access_ok(VERIFY_READ, from, n)) | |
9325 | + n = __copy_from_user(to, from, n); | |
9326 | + else if ((int)n > 0) { | |
9327 | + if (!__builtin_constant_p(n)) | |
9328 | + check_object_size(to, n, false); | |
9329 | + memset(to, 0, n); | |
9330 | + } | |
9331 | return n; | |
9332 | } | |
9333 | ||
9334 | @@ -64,110 +67,198 @@ int copy_to_user(void __user *dst, const | |
9335 | { | |
9336 | might_fault(); | |
9337 | ||
9338 | - return _copy_to_user(dst, src, size); | |
9339 | + if (access_ok(VERIFY_WRITE, dst, size)) | |
9340 | + size = __copy_to_user(dst, src, size); | |
9341 | + return size; | |
9342 | } | |
9343 | ||
9344 | static __always_inline __must_check | |
9345 | -int __copy_from_user(void *dst, const void __user *src, unsigned size) | |
9346 | +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size) | |
9347 | { | |
9348 | - int ret = 0; | |
9349 | + int sz = __compiletime_object_size(dst); | |
9350 | + unsigned ret = 0; | |
9351 | ||
9352 | might_fault(); | |
9353 | - if (!__builtin_constant_p(size)) | |
9354 | - return copy_user_generic(dst, (__force void *)src, size); | |
9355 | + | |
9356 | + pax_track_stack(); | |
9357 | + | |
9358 | + if ((int)size < 0) | |
9359 | + return size; | |
9360 | + | |
9361 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9362 | + if (!__access_ok(VERIFY_READ, src, size)) | |
9363 | + return size; | |
9364 | +#endif | |
9365 | + | |
9366 | + if (unlikely(sz != -1 && sz < size)) { | |
9367 | +#ifdef CONFIG_DEBUG_VM | |
9368 | + WARN(1, "Buffer overflow detected!\n"); | |
9369 | +#endif | |
9370 | + return size; | |
9371 | + } | |
9372 | + | |
9373 | + if (!__builtin_constant_p(size)) { | |
9374 | + check_object_size(dst, size, false); | |
9375 | + | |
9376 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9377 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
9378 | + src += PAX_USER_SHADOW_BASE; | |
9379 | +#endif | |
9380 | + | |
9381 | + return copy_user_generic(dst, (__force const void *)src, size); | |
9382 | + } | |
9383 | switch (size) { | |
9384 | - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src, | |
9385 | + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src, | |
9386 | ret, "b", "b", "=q", 1); | |
9387 | return ret; | |
9388 | - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src, | |
9389 | + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src, | |
9390 | ret, "w", "w", "=r", 2); | |
9391 | return ret; | |
9392 | - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src, | |
9393 | + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src, | |
9394 | ret, "l", "k", "=r", 4); | |
9395 | return ret; | |
9396 | - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src, | |
9397 | + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src, | |
9398 | ret, "q", "", "=r", 8); | |
9399 | return ret; | |
9400 | case 10: | |
9401 | - __get_user_asm(*(u64 *)dst, (u64 __user *)src, | |
9402 | + __get_user_asm(*(u64 *)dst, (const u64 __user *)src, | |
9403 | ret, "q", "", "=r", 10); | |
9404 | if (unlikely(ret)) | |
9405 | return ret; | |
9406 | __get_user_asm(*(u16 *)(8 + (char *)dst), | |
9407 | - (u16 __user *)(8 + (char __user *)src), | |
9408 | + (const u16 __user *)(8 + (const char __user *)src), | |
9409 | ret, "w", "w", "=r", 2); | |
9410 | return ret; | |
9411 | case 16: | |
9412 | - __get_user_asm(*(u64 *)dst, (u64 __user *)src, | |
9413 | + __get_user_asm(*(u64 *)dst, (const u64 __user *)src, | |
9414 | ret, "q", "", "=r", 16); | |
9415 | if (unlikely(ret)) | |
9416 | return ret; | |
9417 | __get_user_asm(*(u64 *)(8 + (char *)dst), | |
9418 | - (u64 __user *)(8 + (char __user *)src), | |
9419 | + (const u64 __user *)(8 + (const char __user *)src), | |
9420 | ret, "q", "", "=r", 8); | |
9421 | return ret; | |
9422 | default: | |
9423 | - return copy_user_generic(dst, (__force void *)src, size); | |
9424 | + | |
9425 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9426 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
9427 | + src += PAX_USER_SHADOW_BASE; | |
9428 | +#endif | |
9429 | + | |
9430 | + return copy_user_generic(dst, (__force const void *)src, size); | |
9431 | } | |
9432 | } | |
9433 | ||
9434 | static __always_inline __must_check | |
9435 | -int __copy_to_user(void __user *dst, const void *src, unsigned size) | |
9436 | +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size) | |
9437 | { | |
9438 | - int ret = 0; | |
9439 | + int sz = __compiletime_object_size(src); | |
9440 | + unsigned ret = 0; | |
9441 | ||
9442 | might_fault(); | |
9443 | - if (!__builtin_constant_p(size)) | |
9444 | + | |
9445 | + pax_track_stack(); | |
9446 | + | |
9447 | + if ((int)size < 0) | |
9448 | + return size; | |
9449 | + | |
9450 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9451 | + if (!__access_ok(VERIFY_WRITE, dst, size)) | |
9452 | + return size; | |
9453 | +#endif | |
9454 | + | |
9455 | + if (unlikely(sz != -1 && sz < size)) { | |
9456 | +#ifdef CONFIG_DEBUG_VM | |
9457 | + WARN(1, "Buffer overflow detected!\n"); | |
9458 | +#endif | |
9459 | + return size; | |
9460 | + } | |
9461 | + | |
9462 | + if (!__builtin_constant_p(size)) { | |
9463 | + check_object_size(src, size, true); | |
9464 | + | |
9465 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9466 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
9467 | + dst += PAX_USER_SHADOW_BASE; | |
9468 | +#endif | |
9469 | + | |
9470 | return copy_user_generic((__force void *)dst, src, size); | |
9471 | + } | |
9472 | switch (size) { | |
9473 | - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst, | |
9474 | + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst, | |
9475 | ret, "b", "b", "iq", 1); | |
9476 | return ret; | |
9477 | - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst, | |
9478 | + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst, | |
9479 | ret, "w", "w", "ir", 2); | |
9480 | return ret; | |
9481 | - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst, | |
9482 | + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst, | |
9483 | ret, "l", "k", "ir", 4); | |
9484 | return ret; | |
9485 | - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst, | |
9486 | + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst, | |
9487 | ret, "q", "", "er", 8); | |
9488 | return ret; | |
9489 | case 10: | |
9490 | - __put_user_asm(*(u64 *)src, (u64 __user *)dst, | |
9491 | + __put_user_asm(*(const u64 *)src, (u64 __user *)dst, | |
9492 | ret, "q", "", "er", 10); | |
9493 | if (unlikely(ret)) | |
9494 | return ret; | |
9495 | asm("":::"memory"); | |
9496 | - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst, | |
9497 | + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst, | |
9498 | ret, "w", "w", "ir", 2); | |
9499 | return ret; | |
9500 | case 16: | |
9501 | - __put_user_asm(*(u64 *)src, (u64 __user *)dst, | |
9502 | + __put_user_asm(*(const u64 *)src, (u64 __user *)dst, | |
9503 | ret, "q", "", "er", 16); | |
9504 | if (unlikely(ret)) | |
9505 | return ret; | |
9506 | asm("":::"memory"); | |
9507 | - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst, | |
9508 | + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst, | |
9509 | ret, "q", "", "er", 8); | |
9510 | return ret; | |
9511 | default: | |
9512 | + | |
9513 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9514 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
9515 | + dst += PAX_USER_SHADOW_BASE; | |
9516 | +#endif | |
9517 | + | |
9518 | return copy_user_generic((__force void *)dst, src, size); | |
9519 | } | |
9520 | } | |
9521 | ||
9522 | static __always_inline __must_check | |
9523 | -int __copy_in_user(void __user *dst, const void __user *src, unsigned size) | |
9524 | +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size) | |
9525 | { | |
9526 | - int ret = 0; | |
9527 | + unsigned ret = 0; | |
9528 | ||
9529 | might_fault(); | |
9530 | - if (!__builtin_constant_p(size)) | |
9531 | + | |
9532 | + if ((int)size < 0) | |
9533 | + return size; | |
9534 | + | |
9535 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9536 | + if (!__access_ok(VERIFY_READ, src, size)) | |
9537 | + return size; | |
9538 | + if (!__access_ok(VERIFY_WRITE, dst, size)) | |
9539 | + return size; | |
9540 | +#endif | |
9541 | + | |
9542 | + if (!__builtin_constant_p(size)) { | |
9543 | + | |
9544 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9545 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
9546 | + src += PAX_USER_SHADOW_BASE; | |
9547 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
9548 | + dst += PAX_USER_SHADOW_BASE; | |
9549 | +#endif | |
9550 | + | |
9551 | return copy_user_generic((__force void *)dst, | |
9552 | - (__force void *)src, size); | |
9553 | + (__force const void *)src, size); | |
9554 | + } | |
9555 | switch (size) { | |
9556 | case 1: { | |
9557 | u8 tmp; | |
9558 | - __get_user_asm(tmp, (u8 __user *)src, | |
9559 | + __get_user_asm(tmp, (const u8 __user *)src, | |
9560 | ret, "b", "b", "=q", 1); | |
9561 | if (likely(!ret)) | |
9562 | __put_user_asm(tmp, (u8 __user *)dst, | |
9563 | @@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, con | |
9564 | } | |
9565 | case 2: { | |
9566 | u16 tmp; | |
9567 | - __get_user_asm(tmp, (u16 __user *)src, | |
9568 | + __get_user_asm(tmp, (const u16 __user *)src, | |
9569 | ret, "w", "w", "=r", 2); | |
9570 | if (likely(!ret)) | |
9571 | __put_user_asm(tmp, (u16 __user *)dst, | |
9572 | @@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, con | |
9573 | ||
9574 | case 4: { | |
9575 | u32 tmp; | |
9576 | - __get_user_asm(tmp, (u32 __user *)src, | |
9577 | + __get_user_asm(tmp, (const u32 __user *)src, | |
9578 | ret, "l", "k", "=r", 4); | |
9579 | if (likely(!ret)) | |
9580 | __put_user_asm(tmp, (u32 __user *)dst, | |
9581 | @@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, con | |
9582 | } | |
9583 | case 8: { | |
9584 | u64 tmp; | |
9585 | - __get_user_asm(tmp, (u64 __user *)src, | |
9586 | + __get_user_asm(tmp, (const u64 __user *)src, | |
9587 | ret, "q", "", "=r", 8); | |
9588 | if (likely(!ret)) | |
9589 | __put_user_asm(tmp, (u64 __user *)dst, | |
9590 | @@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, con | |
9591 | return ret; | |
9592 | } | |
9593 | default: | |
9594 | + | |
9595 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9596 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
9597 | + src += PAX_USER_SHADOW_BASE; | |
9598 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
9599 | + dst += PAX_USER_SHADOW_BASE; | |
9600 | +#endif | |
9601 | + | |
9602 | return copy_user_generic((__force void *)dst, | |
9603 | - (__force void *)src, size); | |
9604 | + (__force const void *)src, size); | |
9605 | } | |
9606 | } | |
9607 | ||
9608 | @@ -221,33 +320,72 @@ __must_check unsigned long __clear_user( | |
9609 | static __must_check __always_inline int | |
9610 | __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size) | |
9611 | { | |
9612 | + pax_track_stack(); | |
9613 | + | |
9614 | + if ((int)size < 0) | |
9615 | + return size; | |
9616 | + | |
9617 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9618 | + if (!__access_ok(VERIFY_READ, src, size)) | |
9619 | + return size; | |
9620 | + | |
9621 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
9622 | + src += PAX_USER_SHADOW_BASE; | |
9623 | +#endif | |
9624 | + | |
9625 | return copy_user_generic(dst, (__force const void *)src, size); | |
9626 | } | |
9627 | ||
9628 | -static __must_check __always_inline int | |
9629 | +static __must_check __always_inline unsigned long | |
9630 | __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size) | |
9631 | { | |
9632 | + if ((int)size < 0) | |
9633 | + return size; | |
9634 | + | |
9635 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9636 | + if (!__access_ok(VERIFY_WRITE, dst, size)) | |
9637 | + return size; | |
9638 | + | |
9639 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
9640 | + dst += PAX_USER_SHADOW_BASE; | |
9641 | +#endif | |
9642 | + | |
9643 | return copy_user_generic((__force void *)dst, src, size); | |
9644 | } | |
9645 | ||
9646 | -extern long __copy_user_nocache(void *dst, const void __user *src, | |
9647 | +extern unsigned long __copy_user_nocache(void *dst, const void __user *src, | |
9648 | unsigned size, int zerorest); | |
9649 | ||
9650 | -static inline int | |
9651 | -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size) | |
9652 | +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size) | |
9653 | { | |
9654 | might_sleep(); | |
9655 | + | |
9656 | + if ((int)size < 0) | |
9657 | + return size; | |
9658 | + | |
9659 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9660 | + if (!__access_ok(VERIFY_READ, src, size)) | |
9661 | + return size; | |
9662 | +#endif | |
9663 | + | |
9664 | return __copy_user_nocache(dst, src, size, 1); | |
9665 | } | |
9666 | ||
9667 | -static inline int | |
9668 | -__copy_from_user_inatomic_nocache(void *dst, const void __user *src, | |
9669 | +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src, | |
9670 | unsigned size) | |
9671 | { | |
9672 | + if ((int)size < 0) | |
9673 | + return size; | |
9674 | + | |
9675 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
9676 | + if (!__access_ok(VERIFY_READ, src, size)) | |
9677 | + return size; | |
9678 | +#endif | |
9679 | + | |
9680 | return __copy_user_nocache(dst, src, size, 0); | |
9681 | } | |
9682 | ||
9683 | -unsigned long | |
9684 | +extern unsigned long | |
9685 | copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest); | |
9686 | ||
9687 | #endif /* _ASM_X86_UACCESS_64_H */ | |
9688 | diff -urNp linux-3.0.3/arch/x86/include/asm/uaccess.h linux-3.0.3/arch/x86/include/asm/uaccess.h | |
9689 | --- linux-3.0.3/arch/x86/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
9690 | +++ linux-3.0.3/arch/x86/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 | |
9691 | @@ -7,12 +7,15 @@ | |
9692 | #include <linux/compiler.h> | |
9693 | #include <linux/thread_info.h> | |
9694 | #include <linux/string.h> | |
9695 | +#include <linux/sched.h> | |
9696 | #include <asm/asm.h> | |
9697 | #include <asm/page.h> | |
9698 | ||
9699 | #define VERIFY_READ 0 | |
9700 | #define VERIFY_WRITE 1 | |
9701 | ||
9702 | +extern void check_object_size(const void *ptr, unsigned long n, bool to); | |
9703 | + | |
9704 | /* | |
9705 | * The fs value determines whether argument validity checking should be | |
9706 | * performed or not. If get_fs() == USER_DS, checking is performed, with | |
9707 | @@ -28,7 +31,12 @@ | |
9708 | ||
9709 | #define get_ds() (KERNEL_DS) | |
9710 | #define get_fs() (current_thread_info()->addr_limit) | |
9711 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
9712 | +void __set_fs(mm_segment_t x); | |
9713 | +void set_fs(mm_segment_t x); | |
9714 | +#else | |
9715 | #define set_fs(x) (current_thread_info()->addr_limit = (x)) | |
9716 | +#endif | |
9717 | ||
9718 | #define segment_eq(a, b) ((a).seg == (b).seg) | |
9719 | ||
9720 | @@ -76,7 +84,33 @@ | |
9721 | * checks that the pointer is in the user space range - after calling | |
9722 | * this function, memory access functions may still return -EFAULT. | |
9723 | */ | |
9724 | -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0)) | |
9725 | +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0)) | |
9726 | +#define access_ok(type, addr, size) \ | |
9727 | +({ \ | |
9728 | + long __size = size; \ | |
9729 | + unsigned long __addr = (unsigned long)addr; \ | |
9730 | + unsigned long __addr_ao = __addr & PAGE_MASK; \ | |
9731 | + unsigned long __end_ao = __addr + __size - 1; \ | |
9732 | + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \ | |
9733 | + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \ | |
9734 | + while(__addr_ao <= __end_ao) { \ | |
9735 | + char __c_ao; \ | |
9736 | + __addr_ao += PAGE_SIZE; \ | |
9737 | + if (__size > PAGE_SIZE) \ | |
9738 | + cond_resched(); \ | |
9739 | + if (__get_user(__c_ao, (char __user *)__addr)) \ | |
9740 | + break; \ | |
9741 | + if (type != VERIFY_WRITE) { \ | |
9742 | + __addr = __addr_ao; \ | |
9743 | + continue; \ | |
9744 | + } \ | |
9745 | + if (__put_user(__c_ao, (char __user *)__addr)) \ | |
9746 | + break; \ | |
9747 | + __addr = __addr_ao; \ | |
9748 | + } \ | |
9749 | + } \ | |
9750 | + __ret_ao; \ | |
9751 | +}) | |
9752 | ||
9753 | /* | |
9754 | * The exception table consists of pairs of addresses: the first is the | |
9755 | @@ -182,12 +216,20 @@ extern int __get_user_bad(void); | |
9756 | asm volatile("call __put_user_" #size : "=a" (__ret_pu) \ | |
9757 | : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx") | |
9758 | ||
9759 | - | |
9760 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
9761 | +#define __copyuser_seg "gs;" | |
9762 | +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n" | |
9763 | +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n" | |
9764 | +#else | |
9765 | +#define __copyuser_seg | |
9766 | +#define __COPYUSER_SET_ES | |
9767 | +#define __COPYUSER_RESTORE_ES | |
9768 | +#endif | |
9769 | ||
9770 | #ifdef CONFIG_X86_32 | |
9771 | #define __put_user_asm_u64(x, addr, err, errret) \ | |
9772 | - asm volatile("1: movl %%eax,0(%2)\n" \ | |
9773 | - "2: movl %%edx,4(%2)\n" \ | |
9774 | + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \ | |
9775 | + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \ | |
9776 | "3:\n" \ | |
9777 | ".section .fixup,\"ax\"\n" \ | |
9778 | "4: movl %3,%0\n" \ | |
9779 | @@ -199,8 +241,8 @@ extern int __get_user_bad(void); | |
9780 | : "A" (x), "r" (addr), "i" (errret), "0" (err)) | |
9781 | ||
9782 | #define __put_user_asm_ex_u64(x, addr) \ | |
9783 | - asm volatile("1: movl %%eax,0(%1)\n" \ | |
9784 | - "2: movl %%edx,4(%1)\n" \ | |
9785 | + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \ | |
9786 | + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \ | |
9787 | "3:\n" \ | |
9788 | _ASM_EXTABLE(1b, 2b - 1b) \ | |
9789 | _ASM_EXTABLE(2b, 3b - 2b) \ | |
9790 | @@ -373,7 +415,7 @@ do { \ | |
9791 | } while (0) | |
9792 | ||
9793 | #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \ | |
9794 | - asm volatile("1: mov"itype" %2,%"rtype"1\n" \ | |
9795 | + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\ | |
9796 | "2:\n" \ | |
9797 | ".section .fixup,\"ax\"\n" \ | |
9798 | "3: mov %3,%0\n" \ | |
9799 | @@ -381,7 +423,7 @@ do { \ | |
9800 | " jmp 2b\n" \ | |
9801 | ".previous\n" \ | |
9802 | _ASM_EXTABLE(1b, 3b) \ | |
9803 | - : "=r" (err), ltype(x) \ | |
9804 | + : "=r" (err), ltype (x) \ | |
9805 | : "m" (__m(addr)), "i" (errret), "0" (err)) | |
9806 | ||
9807 | #define __get_user_size_ex(x, ptr, size) \ | |
9808 | @@ -406,7 +448,7 @@ do { \ | |
9809 | } while (0) | |
9810 | ||
9811 | #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ | |
9812 | - asm volatile("1: mov"itype" %1,%"rtype"0\n" \ | |
9813 | + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\ | |
9814 | "2:\n" \ | |
9815 | _ASM_EXTABLE(1b, 2b - 1b) \ | |
9816 | : ltype(x) : "m" (__m(addr))) | |
9817 | @@ -423,13 +465,24 @@ do { \ | |
9818 | int __gu_err; \ | |
9819 | unsigned long __gu_val; \ | |
9820 | __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ | |
9821 | - (x) = (__force __typeof__(*(ptr)))__gu_val; \ | |
9822 | + (x) = (__typeof__(*(ptr)))__gu_val; \ | |
9823 | __gu_err; \ | |
9824 | }) | |
9825 | ||
9826 | /* FIXME: this hack is definitely wrong -AK */ | |
9827 | struct __large_struct { unsigned long buf[100]; }; | |
9828 | -#define __m(x) (*(struct __large_struct __user *)(x)) | |
9829 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
9830 | +#define ____m(x) \ | |
9831 | +({ \ | |
9832 | + unsigned long ____x = (unsigned long)(x); \ | |
9833 | + if (____x < PAX_USER_SHADOW_BASE) \ | |
9834 | + ____x += PAX_USER_SHADOW_BASE; \ | |
9835 | + (void __user *)____x; \ | |
9836 | +}) | |
9837 | +#else | |
9838 | +#define ____m(x) (x) | |
9839 | +#endif | |
9840 | +#define __m(x) (*(struct __large_struct __user *)____m(x)) | |
9841 | ||
9842 | /* | |
9843 | * Tell gcc we read from memory instead of writing: this is because | |
9844 | @@ -437,7 +490,7 @@ struct __large_struct { unsigned long bu | |
9845 | * aliasing issues. | |
9846 | */ | |
9847 | #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \ | |
9848 | - asm volatile("1: mov"itype" %"rtype"1,%2\n" \ | |
9849 | + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\ | |
9850 | "2:\n" \ | |
9851 | ".section .fixup,\"ax\"\n" \ | |
9852 | "3: mov %3,%0\n" \ | |
9853 | @@ -445,10 +498,10 @@ struct __large_struct { unsigned long bu | |
9854 | ".previous\n" \ | |
9855 | _ASM_EXTABLE(1b, 3b) \ | |
9856 | : "=r"(err) \ | |
9857 | - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err)) | |
9858 | + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err)) | |
9859 | ||
9860 | #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \ | |
9861 | - asm volatile("1: mov"itype" %"rtype"0,%1\n" \ | |
9862 | + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\ | |
9863 | "2:\n" \ | |
9864 | _ASM_EXTABLE(1b, 2b - 1b) \ | |
9865 | : : ltype(x), "m" (__m(addr))) | |
9866 | @@ -487,8 +540,12 @@ struct __large_struct { unsigned long bu | |
9867 | * On error, the variable @x is set to zero. | |
9868 | */ | |
9869 | ||
9870 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
9871 | +#define __get_user(x, ptr) get_user((x), (ptr)) | |
9872 | +#else | |
9873 | #define __get_user(x, ptr) \ | |
9874 | __get_user_nocheck((x), (ptr), sizeof(*(ptr))) | |
9875 | +#endif | |
9876 | ||
9877 | /** | |
9878 | * __put_user: - Write a simple value into user space, with less checking. | |
9879 | @@ -510,8 +567,12 @@ struct __large_struct { unsigned long bu | |
9880 | * Returns zero on success, or -EFAULT on error. | |
9881 | */ | |
9882 | ||
9883 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
9884 | +#define __put_user(x, ptr) put_user((x), (ptr)) | |
9885 | +#else | |
9886 | #define __put_user(x, ptr) \ | |
9887 | __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr))) | |
9888 | +#endif | |
9889 | ||
9890 | #define __get_user_unaligned __get_user | |
9891 | #define __put_user_unaligned __put_user | |
9892 | @@ -529,7 +590,7 @@ struct __large_struct { unsigned long bu | |
9893 | #define get_user_ex(x, ptr) do { \ | |
9894 | unsigned long __gue_val; \ | |
9895 | __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ | |
9896 | - (x) = (__force __typeof__(*(ptr)))__gue_val; \ | |
9897 | + (x) = (__typeof__(*(ptr)))__gue_val; \ | |
9898 | } while (0) | |
9899 | ||
9900 | #ifdef CONFIG_X86_WP_WORKS_OK | |
9901 | diff -urNp linux-3.0.3/arch/x86/include/asm/vgtod.h linux-3.0.3/arch/x86/include/asm/vgtod.h | |
9902 | --- linux-3.0.3/arch/x86/include/asm/vgtod.h 2011-07-21 22:17:23.000000000 -0400 | |
9903 | +++ linux-3.0.3/arch/x86/include/asm/vgtod.h 2011-08-23 21:47:55.000000000 -0400 | |
9904 | @@ -14,6 +14,7 @@ struct vsyscall_gtod_data { | |
9905 | int sysctl_enabled; | |
9906 | struct timezone sys_tz; | |
9907 | struct { /* extract of a clocksource struct */ | |
9908 | + char name[8]; | |
9909 | cycle_t (*vread)(void); | |
9910 | cycle_t cycle_last; | |
9911 | cycle_t mask; | |
9912 | diff -urNp linux-3.0.3/arch/x86/include/asm/x86_init.h linux-3.0.3/arch/x86/include/asm/x86_init.h | |
9913 | --- linux-3.0.3/arch/x86/include/asm/x86_init.h 2011-07-21 22:17:23.000000000 -0400 | |
9914 | +++ linux-3.0.3/arch/x86/include/asm/x86_init.h 2011-08-23 21:47:55.000000000 -0400 | |
9915 | @@ -28,7 +28,7 @@ struct x86_init_mpparse { | |
9916 | void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name); | |
9917 | void (*find_smp_config)(void); | |
9918 | void (*get_smp_config)(unsigned int early); | |
9919 | -}; | |
9920 | +} __no_const; | |
9921 | ||
9922 | /** | |
9923 | * struct x86_init_resources - platform specific resource related ops | |
9924 | @@ -42,7 +42,7 @@ struct x86_init_resources { | |
9925 | void (*probe_roms)(void); | |
9926 | void (*reserve_resources)(void); | |
9927 | char *(*memory_setup)(void); | |
9928 | -}; | |
9929 | +} __no_const; | |
9930 | ||
9931 | /** | |
9932 | * struct x86_init_irqs - platform specific interrupt setup | |
9933 | @@ -55,7 +55,7 @@ struct x86_init_irqs { | |
9934 | void (*pre_vector_init)(void); | |
9935 | void (*intr_init)(void); | |
9936 | void (*trap_init)(void); | |
9937 | -}; | |
9938 | +} __no_const; | |
9939 | ||
9940 | /** | |
9941 | * struct x86_init_oem - oem platform specific customizing functions | |
9942 | @@ -65,7 +65,7 @@ struct x86_init_irqs { | |
9943 | struct x86_init_oem { | |
9944 | void (*arch_setup)(void); | |
9945 | void (*banner)(void); | |
9946 | -}; | |
9947 | +} __no_const; | |
9948 | ||
9949 | /** | |
9950 | * struct x86_init_mapping - platform specific initial kernel pagetable setup | |
9951 | @@ -76,7 +76,7 @@ struct x86_init_oem { | |
9952 | */ | |
9953 | struct x86_init_mapping { | |
9954 | void (*pagetable_reserve)(u64 start, u64 end); | |
9955 | -}; | |
9956 | +} __no_const; | |
9957 | ||
9958 | /** | |
9959 | * struct x86_init_paging - platform specific paging functions | |
9960 | @@ -86,7 +86,7 @@ struct x86_init_mapping { | |
9961 | struct x86_init_paging { | |
9962 | void (*pagetable_setup_start)(pgd_t *base); | |
9963 | void (*pagetable_setup_done)(pgd_t *base); | |
9964 | -}; | |
9965 | +} __no_const; | |
9966 | ||
9967 | /** | |
9968 | * struct x86_init_timers - platform specific timer setup | |
9969 | @@ -101,7 +101,7 @@ struct x86_init_timers { | |
9970 | void (*tsc_pre_init)(void); | |
9971 | void (*timer_init)(void); | |
9972 | void (*wallclock_init)(void); | |
9973 | -}; | |
9974 | +} __no_const; | |
9975 | ||
9976 | /** | |
9977 | * struct x86_init_iommu - platform specific iommu setup | |
9978 | @@ -109,7 +109,7 @@ struct x86_init_timers { | |
9979 | */ | |
9980 | struct x86_init_iommu { | |
9981 | int (*iommu_init)(void); | |
9982 | -}; | |
9983 | +} __no_const; | |
9984 | ||
9985 | /** | |
9986 | * struct x86_init_pci - platform specific pci init functions | |
9987 | @@ -123,7 +123,7 @@ struct x86_init_pci { | |
9988 | int (*init)(void); | |
9989 | void (*init_irq)(void); | |
9990 | void (*fixup_irqs)(void); | |
9991 | -}; | |
9992 | +} __no_const; | |
9993 | ||
9994 | /** | |
9995 | * struct x86_init_ops - functions for platform specific setup | |
9996 | @@ -139,7 +139,7 @@ struct x86_init_ops { | |
9997 | struct x86_init_timers timers; | |
9998 | struct x86_init_iommu iommu; | |
9999 | struct x86_init_pci pci; | |
10000 | -}; | |
10001 | +} __no_const; | |
10002 | ||
10003 | /** | |
10004 | * struct x86_cpuinit_ops - platform specific cpu hotplug setups | |
10005 | @@ -147,7 +147,7 @@ struct x86_init_ops { | |
10006 | */ | |
10007 | struct x86_cpuinit_ops { | |
10008 | void (*setup_percpu_clockev)(void); | |
10009 | -}; | |
10010 | +} __no_const; | |
10011 | ||
10012 | /** | |
10013 | * struct x86_platform_ops - platform specific runtime functions | |
10014 | @@ -166,7 +166,7 @@ struct x86_platform_ops { | |
10015 | bool (*is_untracked_pat_range)(u64 start, u64 end); | |
10016 | void (*nmi_init)(void); | |
10017 | int (*i8042_detect)(void); | |
10018 | -}; | |
10019 | +} __no_const; | |
10020 | ||
10021 | struct pci_dev; | |
10022 | ||
10023 | @@ -174,7 +174,7 @@ struct x86_msi_ops { | |
10024 | int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type); | |
10025 | void (*teardown_msi_irq)(unsigned int irq); | |
10026 | void (*teardown_msi_irqs)(struct pci_dev *dev); | |
10027 | -}; | |
10028 | +} __no_const; | |
10029 | ||
10030 | extern struct x86_init_ops x86_init; | |
10031 | extern struct x86_cpuinit_ops x86_cpuinit; | |
10032 | diff -urNp linux-3.0.3/arch/x86/include/asm/xsave.h linux-3.0.3/arch/x86/include/asm/xsave.h | |
10033 | --- linux-3.0.3/arch/x86/include/asm/xsave.h 2011-07-21 22:17:23.000000000 -0400 | |
10034 | +++ linux-3.0.3/arch/x86/include/asm/xsave.h 2011-08-23 21:47:55.000000000 -0400 | |
10035 | @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav | |
10036 | { | |
10037 | int err; | |
10038 | ||
10039 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
10040 | + if ((unsigned long)buf < PAX_USER_SHADOW_BASE) | |
10041 | + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE); | |
10042 | +#endif | |
10043 | + | |
10044 | /* | |
10045 | * Clear the xsave header first, so that reserved fields are | |
10046 | * initialized to zero. | |
10047 | @@ -100,6 +105,11 @@ static inline int xrestore_user(struct x | |
10048 | u32 lmask = mask; | |
10049 | u32 hmask = mask >> 32; | |
10050 | ||
10051 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
10052 | + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE) | |
10053 | + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE); | |
10054 | +#endif | |
10055 | + | |
10056 | __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n" | |
10057 | "2:\n" | |
10058 | ".section .fixup,\"ax\"\n" | |
10059 | diff -urNp linux-3.0.3/arch/x86/Kconfig linux-3.0.3/arch/x86/Kconfig | |
10060 | --- linux-3.0.3/arch/x86/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
10061 | +++ linux-3.0.3/arch/x86/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
10062 | @@ -229,7 +229,7 @@ config X86_HT | |
10063 | ||
10064 | config X86_32_LAZY_GS | |
10065 | def_bool y | |
10066 | - depends on X86_32 && !CC_STACKPROTECTOR | |
10067 | + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF | |
10068 | ||
10069 | config ARCH_HWEIGHT_CFLAGS | |
10070 | string | |
10071 | @@ -1018,7 +1018,7 @@ choice | |
10072 | ||
10073 | config NOHIGHMEM | |
10074 | bool "off" | |
10075 | - depends on !X86_NUMAQ | |
10076 | + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE) | |
10077 | ---help--- | |
10078 | Linux can use up to 64 Gigabytes of physical memory on x86 systems. | |
10079 | However, the address space of 32-bit x86 processors is only 4 | |
10080 | @@ -1055,7 +1055,7 @@ config NOHIGHMEM | |
10081 | ||
10082 | config HIGHMEM4G | |
10083 | bool "4GB" | |
10084 | - depends on !X86_NUMAQ | |
10085 | + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE) | |
10086 | ---help--- | |
10087 | Select this if you have a 32-bit processor and between 1 and 4 | |
10088 | gigabytes of physical RAM. | |
10089 | @@ -1109,7 +1109,7 @@ config PAGE_OFFSET | |
10090 | hex | |
10091 | default 0xB0000000 if VMSPLIT_3G_OPT | |
10092 | default 0x80000000 if VMSPLIT_2G | |
10093 | - default 0x78000000 if VMSPLIT_2G_OPT | |
10094 | + default 0x70000000 if VMSPLIT_2G_OPT | |
10095 | default 0x40000000 if VMSPLIT_1G | |
10096 | default 0xC0000000 | |
10097 | depends on X86_32 | |
10098 | @@ -1453,7 +1453,7 @@ config ARCH_USES_PG_UNCACHED | |
10099 | ||
10100 | config EFI | |
10101 | bool "EFI runtime service support" | |
10102 | - depends on ACPI | |
10103 | + depends on ACPI && !PAX_KERNEXEC | |
10104 | ---help--- | |
10105 | This enables the kernel to use EFI runtime services that are | |
10106 | available (such as the EFI variable services). | |
10107 | @@ -1483,6 +1483,7 @@ config SECCOMP | |
10108 | ||
10109 | config CC_STACKPROTECTOR | |
10110 | bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)" | |
10111 | + depends on X86_64 || !PAX_MEMORY_UDEREF | |
10112 | ---help--- | |
10113 | This option turns on the -fstack-protector GCC feature. This | |
10114 | feature puts, at the beginning of functions, a canary value on | |
10115 | @@ -1540,6 +1541,7 @@ config KEXEC_JUMP | |
10116 | config PHYSICAL_START | |
10117 | hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP) | |
10118 | default "0x1000000" | |
10119 | + range 0x400000 0x40000000 | |
10120 | ---help--- | |
10121 | This gives the physical address where the kernel is loaded. | |
10122 | ||
10123 | @@ -1603,6 +1605,7 @@ config X86_NEED_RELOCS | |
10124 | config PHYSICAL_ALIGN | |
10125 | hex "Alignment value to which kernel should be aligned" if X86_32 | |
10126 | default "0x1000000" | |
10127 | + range 0x400000 0x1000000 if PAX_KERNEXEC | |
10128 | range 0x2000 0x1000000 | |
10129 | ---help--- | |
10130 | This value puts the alignment restrictions on physical address | |
10131 | @@ -1634,9 +1637,10 @@ config HOTPLUG_CPU | |
10132 | Say N if you want to disable CPU hotplug. | |
10133 | ||
10134 | config COMPAT_VDSO | |
10135 | - def_bool y | |
10136 | + def_bool n | |
10137 | prompt "Compat VDSO support" | |
10138 | depends on X86_32 || IA32_EMULATION | |
10139 | + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF | |
10140 | ---help--- | |
10141 | Map the 32-bit VDSO to the predictable old-style address too. | |
10142 | ||
10143 | diff -urNp linux-3.0.3/arch/x86/Kconfig.cpu linux-3.0.3/arch/x86/Kconfig.cpu | |
10144 | --- linux-3.0.3/arch/x86/Kconfig.cpu 2011-07-21 22:17:23.000000000 -0400 | |
10145 | +++ linux-3.0.3/arch/x86/Kconfig.cpu 2011-08-23 21:47:55.000000000 -0400 | |
10146 | @@ -338,7 +338,7 @@ config X86_PPRO_FENCE | |
10147 | ||
10148 | config X86_F00F_BUG | |
10149 | def_bool y | |
10150 | - depends on M586MMX || M586TSC || M586 || M486 || M386 | |
10151 | + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC | |
10152 | ||
10153 | config X86_INVD_BUG | |
10154 | def_bool y | |
10155 | @@ -362,7 +362,7 @@ config X86_POPAD_OK | |
10156 | ||
10157 | config X86_ALIGNMENT_16 | |
10158 | def_bool y | |
10159 | - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1 | |
10160 | + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1 | |
10161 | ||
10162 | config X86_INTEL_USERCOPY | |
10163 | def_bool y | |
10164 | @@ -408,7 +408,7 @@ config X86_CMPXCHG64 | |
10165 | # generates cmov. | |
10166 | config X86_CMOV | |
10167 | def_bool y | |
10168 | - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX) | |
10169 | + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX) | |
10170 | ||
10171 | config X86_MINIMUM_CPU_FAMILY | |
10172 | int | |
10173 | diff -urNp linux-3.0.3/arch/x86/Kconfig.debug linux-3.0.3/arch/x86/Kconfig.debug | |
10174 | --- linux-3.0.3/arch/x86/Kconfig.debug 2011-07-21 22:17:23.000000000 -0400 | |
10175 | +++ linux-3.0.3/arch/x86/Kconfig.debug 2011-08-23 21:47:55.000000000 -0400 | |
10176 | @@ -81,7 +81,7 @@ config X86_PTDUMP | |
10177 | config DEBUG_RODATA | |
10178 | bool "Write protect kernel read-only data structures" | |
10179 | default y | |
10180 | - depends on DEBUG_KERNEL | |
10181 | + depends on DEBUG_KERNEL && BROKEN | |
10182 | ---help--- | |
10183 | Mark the kernel read-only data as write-protected in the pagetables, | |
10184 | in order to catch accidental (and incorrect) writes to such const | |
10185 | @@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST | |
10186 | ||
10187 | config DEBUG_SET_MODULE_RONX | |
10188 | bool "Set loadable kernel module data as NX and text as RO" | |
10189 | - depends on MODULES | |
10190 | + depends on MODULES && BROKEN | |
10191 | ---help--- | |
10192 | This option helps catch unintended modifications to loadable | |
10193 | kernel module's text and read-only data. It also prevents execution | |
10194 | diff -urNp linux-3.0.3/arch/x86/kernel/acpi/realmode/Makefile linux-3.0.3/arch/x86/kernel/acpi/realmode/Makefile | |
10195 | --- linux-3.0.3/arch/x86/kernel/acpi/realmode/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
10196 | +++ linux-3.0.3/arch/x86/kernel/acpi/realmode/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
10197 | @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os | |
10198 | $(call cc-option, -fno-stack-protector) \ | |
10199 | $(call cc-option, -mpreferred-stack-boundary=2) | |
10200 | KBUILD_CFLAGS += $(call cc-option, -m32) | |
10201 | +ifdef CONSTIFY_PLUGIN | |
10202 | +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify | |
10203 | +endif | |
10204 | KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ | |
10205 | GCOV_PROFILE := n | |
10206 | ||
10207 | diff -urNp linux-3.0.3/arch/x86/kernel/acpi/realmode/wakeup.S linux-3.0.3/arch/x86/kernel/acpi/realmode/wakeup.S | |
10208 | --- linux-3.0.3/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-21 22:17:23.000000000 -0400 | |
10209 | +++ linux-3.0.3/arch/x86/kernel/acpi/realmode/wakeup.S 2011-08-23 21:48:14.000000000 -0400 | |
10210 | @@ -108,6 +108,9 @@ wakeup_code: | |
10211 | /* Do any other stuff... */ | |
10212 | ||
10213 | #ifndef CONFIG_64BIT | |
10214 | + /* Recheck NX bit overrides (64bit path does this in trampoline */ | |
10215 | + call verify_cpu | |
10216 | + | |
10217 | /* This could also be done in C code... */ | |
10218 | movl pmode_cr3, %eax | |
10219 | movl %eax, %cr3 | |
10220 | @@ -131,6 +134,7 @@ wakeup_code: | |
10221 | movl pmode_cr0, %eax | |
10222 | movl %eax, %cr0 | |
10223 | jmp pmode_return | |
10224 | +# include "../../verify_cpu.S" | |
10225 | #else | |
10226 | pushw $0 | |
10227 | pushw trampoline_segment | |
10228 | diff -urNp linux-3.0.3/arch/x86/kernel/acpi/sleep.c linux-3.0.3/arch/x86/kernel/acpi/sleep.c | |
10229 | --- linux-3.0.3/arch/x86/kernel/acpi/sleep.c 2011-07-21 22:17:23.000000000 -0400 | |
10230 | +++ linux-3.0.3/arch/x86/kernel/acpi/sleep.c 2011-08-23 21:47:55.000000000 -0400 | |
10231 | @@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void) | |
10232 | header->trampoline_segment = trampoline_address() >> 4; | |
10233 | #ifdef CONFIG_SMP | |
10234 | stack_start = (unsigned long)temp_stack + sizeof(temp_stack); | |
10235 | + | |
10236 | + pax_open_kernel(); | |
10237 | early_gdt_descr.address = | |
10238 | (unsigned long)get_cpu_gdt_table(smp_processor_id()); | |
10239 | + pax_close_kernel(); | |
10240 | + | |
10241 | initial_gs = per_cpu_offset(smp_processor_id()); | |
10242 | #endif | |
10243 | initial_code = (unsigned long)wakeup_long64; | |
10244 | diff -urNp linux-3.0.3/arch/x86/kernel/acpi/wakeup_32.S linux-3.0.3/arch/x86/kernel/acpi/wakeup_32.S | |
10245 | --- linux-3.0.3/arch/x86/kernel/acpi/wakeup_32.S 2011-07-21 22:17:23.000000000 -0400 | |
10246 | +++ linux-3.0.3/arch/x86/kernel/acpi/wakeup_32.S 2011-08-23 21:47:55.000000000 -0400 | |
10247 | @@ -30,13 +30,11 @@ wakeup_pmode_return: | |
10248 | # and restore the stack ... but you need gdt for this to work | |
10249 | movl saved_context_esp, %esp | |
10250 | ||
10251 | - movl %cs:saved_magic, %eax | |
10252 | - cmpl $0x12345678, %eax | |
10253 | + cmpl $0x12345678, saved_magic | |
10254 | jne bogus_magic | |
10255 | ||
10256 | # jump to place where we left off | |
10257 | - movl saved_eip, %eax | |
10258 | - jmp *%eax | |
10259 | + jmp *(saved_eip) | |
10260 | ||
10261 | bogus_magic: | |
10262 | jmp bogus_magic | |
10263 | diff -urNp linux-3.0.3/arch/x86/kernel/alternative.c linux-3.0.3/arch/x86/kernel/alternative.c | |
10264 | --- linux-3.0.3/arch/x86/kernel/alternative.c 2011-07-21 22:17:23.000000000 -0400 | |
10265 | +++ linux-3.0.3/arch/x86/kernel/alternative.c 2011-08-23 21:47:55.000000000 -0400 | |
10266 | @@ -313,7 +313,7 @@ static void alternatives_smp_lock(const | |
10267 | if (!*poff || ptr < text || ptr >= text_end) | |
10268 | continue; | |
10269 | /* turn DS segment override prefix into lock prefix */ | |
10270 | - if (*ptr == 0x3e) | |
10271 | + if (*ktla_ktva(ptr) == 0x3e) | |
10272 | text_poke(ptr, ((unsigned char []){0xf0}), 1); | |
10273 | }; | |
10274 | mutex_unlock(&text_mutex); | |
10275 | @@ -334,7 +334,7 @@ static void alternatives_smp_unlock(cons | |
10276 | if (!*poff || ptr < text || ptr >= text_end) | |
10277 | continue; | |
10278 | /* turn lock prefix into DS segment override prefix */ | |
10279 | - if (*ptr == 0xf0) | |
10280 | + if (*ktla_ktva(ptr) == 0xf0) | |
10281 | text_poke(ptr, ((unsigned char []){0x3E}), 1); | |
10282 | }; | |
10283 | mutex_unlock(&text_mutex); | |
10284 | @@ -503,7 +503,7 @@ void __init_or_module apply_paravirt(str | |
10285 | ||
10286 | BUG_ON(p->len > MAX_PATCH_LEN); | |
10287 | /* prep the buffer with the original instructions */ | |
10288 | - memcpy(insnbuf, p->instr, p->len); | |
10289 | + memcpy(insnbuf, ktla_ktva(p->instr), p->len); | |
10290 | used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf, | |
10291 | (unsigned long)p->instr, p->len); | |
10292 | ||
10293 | @@ -571,7 +571,7 @@ void __init alternative_instructions(voi | |
10294 | if (smp_alt_once) | |
10295 | free_init_pages("SMP alternatives", | |
10296 | (unsigned long)__smp_locks, | |
10297 | - (unsigned long)__smp_locks_end); | |
10298 | + PAGE_ALIGN((unsigned long)__smp_locks_end)); | |
10299 | ||
10300 | restart_nmi(); | |
10301 | } | |
10302 | @@ -588,13 +588,17 @@ void __init alternative_instructions(voi | |
10303 | * instructions. And on the local CPU you need to be protected again NMI or MCE | |
10304 | * handlers seeing an inconsistent instruction while you patch. | |
10305 | */ | |
10306 | -void *__init_or_module text_poke_early(void *addr, const void *opcode, | |
10307 | +void *__kprobes text_poke_early(void *addr, const void *opcode, | |
10308 | size_t len) | |
10309 | { | |
10310 | unsigned long flags; | |
10311 | local_irq_save(flags); | |
10312 | - memcpy(addr, opcode, len); | |
10313 | + | |
10314 | + pax_open_kernel(); | |
10315 | + memcpy(ktla_ktva(addr), opcode, len); | |
10316 | sync_core(); | |
10317 | + pax_close_kernel(); | |
10318 | + | |
10319 | local_irq_restore(flags); | |
10320 | /* Could also do a CLFLUSH here to speed up CPU recovery; but | |
10321 | that causes hangs on some VIA CPUs. */ | |
10322 | @@ -616,36 +620,22 @@ void *__init_or_module text_poke_early(v | |
10323 | */ | |
10324 | void *__kprobes text_poke(void *addr, const void *opcode, size_t len) | |
10325 | { | |
10326 | - unsigned long flags; | |
10327 | - char *vaddr; | |
10328 | + unsigned char *vaddr = ktla_ktva(addr); | |
10329 | struct page *pages[2]; | |
10330 | - int i; | |
10331 | + size_t i; | |
10332 | ||
10333 | if (!core_kernel_text((unsigned long)addr)) { | |
10334 | - pages[0] = vmalloc_to_page(addr); | |
10335 | - pages[1] = vmalloc_to_page(addr + PAGE_SIZE); | |
10336 | + pages[0] = vmalloc_to_page(vaddr); | |
10337 | + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE); | |
10338 | } else { | |
10339 | - pages[0] = virt_to_page(addr); | |
10340 | + pages[0] = virt_to_page(vaddr); | |
10341 | WARN_ON(!PageReserved(pages[0])); | |
10342 | - pages[1] = virt_to_page(addr + PAGE_SIZE); | |
10343 | + pages[1] = virt_to_page(vaddr + PAGE_SIZE); | |
10344 | } | |
10345 | BUG_ON(!pages[0]); | |
10346 | - local_irq_save(flags); | |
10347 | - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0])); | |
10348 | - if (pages[1]) | |
10349 | - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1])); | |
10350 | - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0); | |
10351 | - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len); | |
10352 | - clear_fixmap(FIX_TEXT_POKE0); | |
10353 | - if (pages[1]) | |
10354 | - clear_fixmap(FIX_TEXT_POKE1); | |
10355 | - local_flush_tlb(); | |
10356 | - sync_core(); | |
10357 | - /* Could also do a CLFLUSH here to speed up CPU recovery; but | |
10358 | - that causes hangs on some VIA CPUs. */ | |
10359 | + text_poke_early(addr, opcode, len); | |
10360 | for (i = 0; i < len; i++) | |
10361 | - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]); | |
10362 | - local_irq_restore(flags); | |
10363 | + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]); | |
10364 | return addr; | |
10365 | } | |
10366 | ||
10367 | diff -urNp linux-3.0.3/arch/x86/kernel/apic/apic.c linux-3.0.3/arch/x86/kernel/apic/apic.c | |
10368 | --- linux-3.0.3/arch/x86/kernel/apic/apic.c 2011-07-21 22:17:23.000000000 -0400 | |
10369 | +++ linux-3.0.3/arch/x86/kernel/apic/apic.c 2011-08-23 21:48:14.000000000 -0400 | |
10370 | @@ -173,7 +173,7 @@ int first_system_vector = 0xfe; | |
10371 | /* | |
10372 | * Debug level, exported for io_apic.c | |
10373 | */ | |
10374 | -unsigned int apic_verbosity; | |
10375 | +int apic_verbosity; | |
10376 | ||
10377 | int pic_mode; | |
10378 | ||
10379 | @@ -1834,7 +1834,7 @@ void smp_error_interrupt(struct pt_regs | |
10380 | apic_write(APIC_ESR, 0); | |
10381 | v1 = apic_read(APIC_ESR); | |
10382 | ack_APIC_irq(); | |
10383 | - atomic_inc(&irq_err_count); | |
10384 | + atomic_inc_unchecked(&irq_err_count); | |
10385 | ||
10386 | apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)", | |
10387 | smp_processor_id(), v0 , v1); | |
10388 | @@ -2190,6 +2190,8 @@ static int __cpuinit apic_cluster_num(vo | |
10389 | u16 *bios_cpu_apicid; | |
10390 | DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS); | |
10391 | ||
10392 | + pax_track_stack(); | |
10393 | + | |
10394 | bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid); | |
10395 | bitmap_zero(clustermap, NUM_APIC_CLUSTERS); | |
10396 | ||
10397 | diff -urNp linux-3.0.3/arch/x86/kernel/apic/io_apic.c linux-3.0.3/arch/x86/kernel/apic/io_apic.c | |
10398 | --- linux-3.0.3/arch/x86/kernel/apic/io_apic.c 2011-07-21 22:17:23.000000000 -0400 | |
10399 | +++ linux-3.0.3/arch/x86/kernel/apic/io_apic.c 2011-08-23 21:47:55.000000000 -0400 | |
10400 | @@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, | |
10401 | } | |
10402 | EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector); | |
10403 | ||
10404 | -void lock_vector_lock(void) | |
10405 | +void lock_vector_lock(void) __acquires(vector_lock) | |
10406 | { | |
10407 | /* Used to the online set of cpus does not change | |
10408 | * during assign_irq_vector. | |
10409 | @@ -1036,7 +1036,7 @@ void lock_vector_lock(void) | |
10410 | raw_spin_lock(&vector_lock); | |
10411 | } | |
10412 | ||
10413 | -void unlock_vector_lock(void) | |
10414 | +void unlock_vector_lock(void) __releases(vector_lock) | |
10415 | { | |
10416 | raw_spin_unlock(&vector_lock); | |
10417 | } | |
10418 | @@ -2364,7 +2364,7 @@ static void ack_apic_edge(struct irq_dat | |
10419 | ack_APIC_irq(); | |
10420 | } | |
10421 | ||
10422 | -atomic_t irq_mis_count; | |
10423 | +atomic_unchecked_t irq_mis_count; | |
10424 | ||
10425 | /* | |
10426 | * IO-APIC versions below 0x20 don't support EOI register. | |
10427 | @@ -2472,7 +2472,7 @@ static void ack_apic_level(struct irq_da | |
10428 | * at the cpu. | |
10429 | */ | |
10430 | if (!(v & (1 << (i & 0x1f)))) { | |
10431 | - atomic_inc(&irq_mis_count); | |
10432 | + atomic_inc_unchecked(&irq_mis_count); | |
10433 | ||
10434 | eoi_ioapic_irq(irq, cfg); | |
10435 | } | |
10436 | diff -urNp linux-3.0.3/arch/x86/kernel/apm_32.c linux-3.0.3/arch/x86/kernel/apm_32.c | |
10437 | --- linux-3.0.3/arch/x86/kernel/apm_32.c 2011-07-21 22:17:23.000000000 -0400 | |
10438 | +++ linux-3.0.3/arch/x86/kernel/apm_32.c 2011-08-23 21:47:55.000000000 -0400 | |
10439 | @@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex); | |
10440 | * This is for buggy BIOS's that refer to (real mode) segment 0x40 | |
10441 | * even though they are called in protected mode. | |
10442 | */ | |
10443 | -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092, | |
10444 | +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093, | |
10445 | (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1); | |
10446 | ||
10447 | static const char driver_version[] = "1.16ac"; /* no spaces */ | |
10448 | @@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call) | |
10449 | BUG_ON(cpu != 0); | |
10450 | gdt = get_cpu_gdt_table(cpu); | |
10451 | save_desc_40 = gdt[0x40 / 8]; | |
10452 | + | |
10453 | + pax_open_kernel(); | |
10454 | gdt[0x40 / 8] = bad_bios_desc; | |
10455 | + pax_close_kernel(); | |
10456 | ||
10457 | apm_irq_save(flags); | |
10458 | APM_DO_SAVE_SEGS; | |
10459 | @@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call) | |
10460 | &call->esi); | |
10461 | APM_DO_RESTORE_SEGS; | |
10462 | apm_irq_restore(flags); | |
10463 | + | |
10464 | + pax_open_kernel(); | |
10465 | gdt[0x40 / 8] = save_desc_40; | |
10466 | + pax_close_kernel(); | |
10467 | + | |
10468 | put_cpu(); | |
10469 | ||
10470 | return call->eax & 0xff; | |
10471 | @@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void | |
10472 | BUG_ON(cpu != 0); | |
10473 | gdt = get_cpu_gdt_table(cpu); | |
10474 | save_desc_40 = gdt[0x40 / 8]; | |
10475 | + | |
10476 | + pax_open_kernel(); | |
10477 | gdt[0x40 / 8] = bad_bios_desc; | |
10478 | + pax_close_kernel(); | |
10479 | ||
10480 | apm_irq_save(flags); | |
10481 | APM_DO_SAVE_SEGS; | |
10482 | @@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void | |
10483 | &call->eax); | |
10484 | APM_DO_RESTORE_SEGS; | |
10485 | apm_irq_restore(flags); | |
10486 | + | |
10487 | + pax_open_kernel(); | |
10488 | gdt[0x40 / 8] = save_desc_40; | |
10489 | + pax_close_kernel(); | |
10490 | + | |
10491 | put_cpu(); | |
10492 | return error; | |
10493 | } | |
10494 | @@ -2349,12 +2363,15 @@ static int __init apm_init(void) | |
10495 | * code to that CPU. | |
10496 | */ | |
10497 | gdt = get_cpu_gdt_table(0); | |
10498 | + | |
10499 | + pax_open_kernel(); | |
10500 | set_desc_base(&gdt[APM_CS >> 3], | |
10501 | (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4)); | |
10502 | set_desc_base(&gdt[APM_CS_16 >> 3], | |
10503 | (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4)); | |
10504 | set_desc_base(&gdt[APM_DS >> 3], | |
10505 | (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4)); | |
10506 | + pax_close_kernel(); | |
10507 | ||
10508 | proc_create("apm", 0, NULL, &apm_file_ops); | |
10509 | ||
10510 | diff -urNp linux-3.0.3/arch/x86/kernel/asm-offsets_64.c linux-3.0.3/arch/x86/kernel/asm-offsets_64.c | |
10511 | --- linux-3.0.3/arch/x86/kernel/asm-offsets_64.c 2011-07-21 22:17:23.000000000 -0400 | |
10512 | +++ linux-3.0.3/arch/x86/kernel/asm-offsets_64.c 2011-08-23 21:47:55.000000000 -0400 | |
10513 | @@ -69,6 +69,7 @@ int main(void) | |
10514 | BLANK(); | |
10515 | #undef ENTRY | |
10516 | ||
10517 | + DEFINE(TSS_size, sizeof(struct tss_struct)); | |
10518 | OFFSET(TSS_ist, tss_struct, x86_tss.ist); | |
10519 | BLANK(); | |
10520 | ||
10521 | diff -urNp linux-3.0.3/arch/x86/kernel/asm-offsets.c linux-3.0.3/arch/x86/kernel/asm-offsets.c | |
10522 | --- linux-3.0.3/arch/x86/kernel/asm-offsets.c 2011-07-21 22:17:23.000000000 -0400 | |
10523 | +++ linux-3.0.3/arch/x86/kernel/asm-offsets.c 2011-08-23 21:47:55.000000000 -0400 | |
10524 | @@ -33,6 +33,8 @@ void common(void) { | |
10525 | OFFSET(TI_status, thread_info, status); | |
10526 | OFFSET(TI_addr_limit, thread_info, addr_limit); | |
10527 | OFFSET(TI_preempt_count, thread_info, preempt_count); | |
10528 | + OFFSET(TI_lowest_stack, thread_info, lowest_stack); | |
10529 | + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo)); | |
10530 | ||
10531 | BLANK(); | |
10532 | OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx); | |
10533 | @@ -53,8 +55,26 @@ void common(void) { | |
10534 | OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit); | |
10535 | OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0); | |
10536 | OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2); | |
10537 | + | |
10538 | +#ifdef CONFIG_PAX_KERNEXEC | |
10539 | + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0); | |
10540 | +#endif | |
10541 | + | |
10542 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
10543 | + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3); | |
10544 | + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3); | |
10545 | +#ifdef CONFIG_X86_64 | |
10546 | + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched); | |
10547 | +#endif | |
10548 | #endif | |
10549 | ||
10550 | +#endif | |
10551 | + | |
10552 | + BLANK(); | |
10553 | + DEFINE(PAGE_SIZE_asm, PAGE_SIZE); | |
10554 | + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT); | |
10555 | + DEFINE(THREAD_SIZE_asm, THREAD_SIZE); | |
10556 | + | |
10557 | #ifdef CONFIG_XEN | |
10558 | BLANK(); | |
10559 | OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask); | |
10560 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/amd.c linux-3.0.3/arch/x86/kernel/cpu/amd.c | |
10561 | --- linux-3.0.3/arch/x86/kernel/cpu/amd.c 2011-07-21 22:17:23.000000000 -0400 | |
10562 | +++ linux-3.0.3/arch/x86/kernel/cpu/amd.c 2011-08-23 21:47:55.000000000 -0400 | |
10563 | @@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c | |
10564 | unsigned int size) | |
10565 | { | |
10566 | /* AMD errata T13 (order #21922) */ | |
10567 | - if ((c->x86 == 6)) { | |
10568 | + if (c->x86 == 6) { | |
10569 | /* Duron Rev A0 */ | |
10570 | if (c->x86_model == 3 && c->x86_mask == 0) | |
10571 | size = 64; | |
10572 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/common.c linux-3.0.3/arch/x86/kernel/cpu/common.c | |
10573 | --- linux-3.0.3/arch/x86/kernel/cpu/common.c 2011-07-21 22:17:23.000000000 -0400 | |
10574 | +++ linux-3.0.3/arch/x86/kernel/cpu/common.c 2011-08-23 21:47:55.000000000 -0400 | |
10575 | @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon | |
10576 | ||
10577 | static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu; | |
10578 | ||
10579 | -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = { | |
10580 | -#ifdef CONFIG_X86_64 | |
10581 | - /* | |
10582 | - * We need valid kernel segments for data and code in long mode too | |
10583 | - * IRET will check the segment types kkeil 2000/10/28 | |
10584 | - * Also sysret mandates a special GDT layout | |
10585 | - * | |
10586 | - * TLS descriptors are currently at a different place compared to i386. | |
10587 | - * Hopefully nobody expects them at a fixed place (Wine?) | |
10588 | - */ | |
10589 | - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff), | |
10590 | - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff), | |
10591 | - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff), | |
10592 | - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff), | |
10593 | - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff), | |
10594 | - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff), | |
10595 | -#else | |
10596 | - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff), | |
10597 | - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff), | |
10598 | - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff), | |
10599 | - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff), | |
10600 | - /* | |
10601 | - * Segments used for calling PnP BIOS have byte granularity. | |
10602 | - * They code segments and data segments have fixed 64k limits, | |
10603 | - * the transfer segment sizes are set at run time. | |
10604 | - */ | |
10605 | - /* 32-bit code */ | |
10606 | - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff), | |
10607 | - /* 16-bit code */ | |
10608 | - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff), | |
10609 | - /* 16-bit data */ | |
10610 | - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff), | |
10611 | - /* 16-bit data */ | |
10612 | - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0), | |
10613 | - /* 16-bit data */ | |
10614 | - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0), | |
10615 | - /* | |
10616 | - * The APM segments have byte granularity and their bases | |
10617 | - * are set at run time. All have 64k limits. | |
10618 | - */ | |
10619 | - /* 32-bit code */ | |
10620 | - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff), | |
10621 | - /* 16-bit code */ | |
10622 | - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff), | |
10623 | - /* data */ | |
10624 | - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff), | |
10625 | - | |
10626 | - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff), | |
10627 | - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff), | |
10628 | - GDT_STACK_CANARY_INIT | |
10629 | -#endif | |
10630 | -} }; | |
10631 | -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page); | |
10632 | - | |
10633 | static int __init x86_xsave_setup(char *s) | |
10634 | { | |
10635 | setup_clear_cpu_cap(X86_FEATURE_XSAVE); | |
10636 | @@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu) | |
10637 | { | |
10638 | struct desc_ptr gdt_descr; | |
10639 | ||
10640 | - gdt_descr.address = (long)get_cpu_gdt_table(cpu); | |
10641 | + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu); | |
10642 | gdt_descr.size = GDT_SIZE - 1; | |
10643 | load_gdt(&gdt_descr); | |
10644 | /* Reload the per-cpu base */ | |
10645 | @@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struc | |
10646 | /* Filter out anything that depends on CPUID levels we don't have */ | |
10647 | filter_cpuid_features(c, true); | |
10648 | ||
10649 | +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32)) | |
10650 | + setup_clear_cpu_cap(X86_FEATURE_SEP); | |
10651 | +#endif | |
10652 | + | |
10653 | /* If the model name is still unset, do table lookup. */ | |
10654 | if (!c->x86_model_id[0]) { | |
10655 | const char *p; | |
10656 | @@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(cha | |
10657 | } | |
10658 | __setup("clearcpuid=", setup_disablecpuid); | |
10659 | ||
10660 | +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo; | |
10661 | +EXPORT_PER_CPU_SYMBOL(current_tinfo); | |
10662 | + | |
10663 | #ifdef CONFIG_X86_64 | |
10664 | struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table }; | |
10665 | ||
10666 | @@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, cur | |
10667 | EXPORT_PER_CPU_SYMBOL(current_task); | |
10668 | ||
10669 | DEFINE_PER_CPU(unsigned long, kernel_stack) = | |
10670 | - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE; | |
10671 | + (unsigned long)&init_thread_union - 16 + THREAD_SIZE; | |
10672 | EXPORT_PER_CPU_SYMBOL(kernel_stack); | |
10673 | ||
10674 | DEFINE_PER_CPU(char *, irq_stack_ptr) = | |
10675 | @@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(str | |
10676 | { | |
10677 | memset(regs, 0, sizeof(struct pt_regs)); | |
10678 | regs->fs = __KERNEL_PERCPU; | |
10679 | - regs->gs = __KERNEL_STACK_CANARY; | |
10680 | + savesegment(gs, regs->gs); | |
10681 | ||
10682 | return regs; | |
10683 | } | |
10684 | @@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void) | |
10685 | int i; | |
10686 | ||
10687 | cpu = stack_smp_processor_id(); | |
10688 | - t = &per_cpu(init_tss, cpu); | |
10689 | + t = init_tss + cpu; | |
10690 | oist = &per_cpu(orig_ist, cpu); | |
10691 | ||
10692 | #ifdef CONFIG_NUMA | |
10693 | @@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void) | |
10694 | switch_to_new_gdt(cpu); | |
10695 | loadsegment(fs, 0); | |
10696 | ||
10697 | - load_idt((const struct desc_ptr *)&idt_descr); | |
10698 | + load_idt(&idt_descr); | |
10699 | ||
10700 | memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8); | |
10701 | syscall_init(); | |
10702 | @@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void) | |
10703 | wrmsrl(MSR_KERNEL_GS_BASE, 0); | |
10704 | barrier(); | |
10705 | ||
10706 | - x86_configure_nx(); | |
10707 | if (cpu != 0) | |
10708 | enable_x2apic(); | |
10709 | ||
10710 | @@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void) | |
10711 | { | |
10712 | int cpu = smp_processor_id(); | |
10713 | struct task_struct *curr = current; | |
10714 | - struct tss_struct *t = &per_cpu(init_tss, cpu); | |
10715 | + struct tss_struct *t = init_tss + cpu; | |
10716 | struct thread_struct *thread = &curr->thread; | |
10717 | ||
10718 | if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) { | |
10719 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/intel.c linux-3.0.3/arch/x86/kernel/cpu/intel.c | |
10720 | --- linux-3.0.3/arch/x86/kernel/cpu/intel.c 2011-08-23 21:44:40.000000000 -0400 | |
10721 | +++ linux-3.0.3/arch/x86/kernel/cpu/intel.c 2011-08-26 19:49:56.000000000 -0400 | |
10722 | @@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug | |
10723 | * Update the IDT descriptor and reload the IDT so that | |
10724 | * it uses the read-only mapped virtual address. | |
10725 | */ | |
10726 | - idt_descr.address = fix_to_virt(FIX_F00F_IDT); | |
10727 | + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT); | |
10728 | load_idt(&idt_descr); | |
10729 | } | |
10730 | #endif | |
10731 | @@ -466,7 +466,7 @@ static void __cpuinit init_intel(struct | |
10732 | ||
10733 | rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb); | |
10734 | if ((epb & 0xF) == 0) { | |
10735 | - printk_once(KERN_WARNING, "x86: updated energy_perf_bias" | |
10736 | + printk_once(KERN_WARNING "x86: updated energy_perf_bias" | |
10737 | " to 'normal' from 'performance'\n" | |
10738 | "You can view and update epb via utility," | |
10739 | " such as x86_energy_perf_policy(8)\n"); | |
10740 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/Makefile linux-3.0.3/arch/x86/kernel/cpu/Makefile | |
10741 | --- linux-3.0.3/arch/x86/kernel/cpu/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
10742 | +++ linux-3.0.3/arch/x86/kernel/cpu/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
10743 | @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg | |
10744 | CFLAGS_REMOVE_perf_event.o = -pg | |
10745 | endif | |
10746 | ||
10747 | -# Make sure load_percpu_segment has no stackprotector | |
10748 | -nostackp := $(call cc-option, -fno-stack-protector) | |
10749 | -CFLAGS_common.o := $(nostackp) | |
10750 | - | |
10751 | obj-y := intel_cacheinfo.o scattered.o topology.o | |
10752 | obj-y += proc.o capflags.o powerflags.o common.o | |
10753 | obj-y += vmware.o hypervisor.o sched.o mshyperv.o | |
10754 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce.c linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce.c | |
10755 | --- linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce.c 2011-07-21 22:17:23.000000000 -0400 | |
10756 | +++ linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce.c 2011-08-23 21:47:55.000000000 -0400 | |
10757 | @@ -46,6 +46,7 @@ | |
10758 | #include <asm/ipi.h> | |
10759 | #include <asm/mce.h> | |
10760 | #include <asm/msr.h> | |
10761 | +#include <asm/local.h> | |
10762 | ||
10763 | #include "mce-internal.h" | |
10764 | ||
10765 | @@ -208,7 +209,7 @@ static void print_mce(struct mce *m) | |
10766 | !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "", | |
10767 | m->cs, m->ip); | |
10768 | ||
10769 | - if (m->cs == __KERNEL_CS) | |
10770 | + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS) | |
10771 | print_symbol("{%s}", m->ip); | |
10772 | pr_cont("\n"); | |
10773 | } | |
10774 | @@ -236,10 +237,10 @@ static void print_mce(struct mce *m) | |
10775 | ||
10776 | #define PANIC_TIMEOUT 5 /* 5 seconds */ | |
10777 | ||
10778 | -static atomic_t mce_paniced; | |
10779 | +static atomic_unchecked_t mce_paniced; | |
10780 | ||
10781 | static int fake_panic; | |
10782 | -static atomic_t mce_fake_paniced; | |
10783 | +static atomic_unchecked_t mce_fake_paniced; | |
10784 | ||
10785 | /* Panic in progress. Enable interrupts and wait for final IPI */ | |
10786 | static void wait_for_panic(void) | |
10787 | @@ -263,7 +264,7 @@ static void mce_panic(char *msg, struct | |
10788 | /* | |
10789 | * Make sure only one CPU runs in machine check panic | |
10790 | */ | |
10791 | - if (atomic_inc_return(&mce_paniced) > 1) | |
10792 | + if (atomic_inc_return_unchecked(&mce_paniced) > 1) | |
10793 | wait_for_panic(); | |
10794 | barrier(); | |
10795 | ||
10796 | @@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct | |
10797 | console_verbose(); | |
10798 | } else { | |
10799 | /* Don't log too much for fake panic */ | |
10800 | - if (atomic_inc_return(&mce_fake_paniced) > 1) | |
10801 | + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1) | |
10802 | return; | |
10803 | } | |
10804 | /* First print corrected ones that are still unlogged */ | |
10805 | @@ -638,7 +639,7 @@ static int mce_timed_out(u64 *t) | |
10806 | * might have been modified by someone else. | |
10807 | */ | |
10808 | rmb(); | |
10809 | - if (atomic_read(&mce_paniced)) | |
10810 | + if (atomic_read_unchecked(&mce_paniced)) | |
10811 | wait_for_panic(); | |
10812 | if (!monarch_timeout) | |
10813 | goto out; | |
10814 | @@ -1452,14 +1453,14 @@ void __cpuinit mcheck_cpu_init(struct cp | |
10815 | */ | |
10816 | ||
10817 | static DEFINE_SPINLOCK(mce_state_lock); | |
10818 | -static int open_count; /* #times opened */ | |
10819 | +static local_t open_count; /* #times opened */ | |
10820 | static int open_exclu; /* already open exclusive? */ | |
10821 | ||
10822 | static int mce_open(struct inode *inode, struct file *file) | |
10823 | { | |
10824 | spin_lock(&mce_state_lock); | |
10825 | ||
10826 | - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) { | |
10827 | + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) { | |
10828 | spin_unlock(&mce_state_lock); | |
10829 | ||
10830 | return -EBUSY; | |
10831 | @@ -1467,7 +1468,7 @@ static int mce_open(struct inode *inode, | |
10832 | ||
10833 | if (file->f_flags & O_EXCL) | |
10834 | open_exclu = 1; | |
10835 | - open_count++; | |
10836 | + local_inc(&open_count); | |
10837 | ||
10838 | spin_unlock(&mce_state_lock); | |
10839 | ||
10840 | @@ -1478,7 +1479,7 @@ static int mce_release(struct inode *ino | |
10841 | { | |
10842 | spin_lock(&mce_state_lock); | |
10843 | ||
10844 | - open_count--; | |
10845 | + local_dec(&open_count); | |
10846 | open_exclu = 0; | |
10847 | ||
10848 | spin_unlock(&mce_state_lock); | |
10849 | @@ -2163,7 +2164,7 @@ struct dentry *mce_get_debugfs_dir(void) | |
10850 | static void mce_reset(void) | |
10851 | { | |
10852 | cpu_missing = 0; | |
10853 | - atomic_set(&mce_fake_paniced, 0); | |
10854 | + atomic_set_unchecked(&mce_fake_paniced, 0); | |
10855 | atomic_set(&mce_executing, 0); | |
10856 | atomic_set(&mce_callin, 0); | |
10857 | atomic_set(&global_nwo, 0); | |
10858 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce-inject.c | |
10859 | --- linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-07-21 22:17:23.000000000 -0400 | |
10860 | +++ linux-3.0.3/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-23 21:47:55.000000000 -0400 | |
10861 | @@ -215,7 +215,9 @@ static int inject_init(void) | |
10862 | if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL)) | |
10863 | return -ENOMEM; | |
10864 | printk(KERN_INFO "Machine check injector initialized\n"); | |
10865 | - mce_chrdev_ops.write = mce_write; | |
10866 | + pax_open_kernel(); | |
10867 | + *(void **)&mce_chrdev_ops.write = mce_write; | |
10868 | + pax_close_kernel(); | |
10869 | register_die_notifier(&mce_raise_nb); | |
10870 | return 0; | |
10871 | } | |
10872 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/mtrr/main.c linux-3.0.3/arch/x86/kernel/cpu/mtrr/main.c | |
10873 | --- linux-3.0.3/arch/x86/kernel/cpu/mtrr/main.c 2011-07-21 22:17:23.000000000 -0400 | |
10874 | +++ linux-3.0.3/arch/x86/kernel/cpu/mtrr/main.c 2011-08-23 21:47:55.000000000 -0400 | |
10875 | @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex); | |
10876 | u64 size_or_mask, size_and_mask; | |
10877 | static bool mtrr_aps_delayed_init; | |
10878 | ||
10879 | -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM]; | |
10880 | +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only; | |
10881 | ||
10882 | const struct mtrr_ops *mtrr_if; | |
10883 | ||
10884 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/mtrr/mtrr.h linux-3.0.3/arch/x86/kernel/cpu/mtrr/mtrr.h | |
10885 | --- linux-3.0.3/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-07-21 22:17:23.000000000 -0400 | |
10886 | +++ linux-3.0.3/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-08-26 19:49:56.000000000 -0400 | |
10887 | @@ -25,7 +25,7 @@ struct mtrr_ops { | |
10888 | int (*validate_add_page)(unsigned long base, unsigned long size, | |
10889 | unsigned int type); | |
10890 | int (*have_wrcomb)(void); | |
10891 | -}; | |
10892 | +} __do_const; | |
10893 | ||
10894 | extern int generic_get_free_region(unsigned long base, unsigned long size, | |
10895 | int replace_reg); | |
10896 | diff -urNp linux-3.0.3/arch/x86/kernel/cpu/perf_event.c linux-3.0.3/arch/x86/kernel/cpu/perf_event.c | |
10897 | --- linux-3.0.3/arch/x86/kernel/cpu/perf_event.c 2011-07-21 22:17:23.000000000 -0400 | |
10898 | +++ linux-3.0.3/arch/x86/kernel/cpu/perf_event.c 2011-08-23 21:48:14.000000000 -0400 | |
10899 | @@ -781,6 +781,8 @@ static int x86_schedule_events(struct cp | |
10900 | int i, j, w, wmax, num = 0; | |
10901 | struct hw_perf_event *hwc; | |
10902 | ||
10903 | + pax_track_stack(); | |
10904 | + | |
10905 | bitmap_zero(used_mask, X86_PMC_IDX_MAX); | |
10906 | ||
10907 | for (i = 0; i < n; i++) { | |
10908 | @@ -1872,7 +1874,7 @@ perf_callchain_user(struct perf_callchai | |
10909 | break; | |
10910 | ||
10911 | perf_callchain_store(entry, frame.return_address); | |
10912 | - fp = frame.next_frame; | |
10913 | + fp = (__force const void __user *)frame.next_frame; | |
10914 | } | |
10915 | } | |
10916 | ||
10917 | diff -urNp linux-3.0.3/arch/x86/kernel/crash.c linux-3.0.3/arch/x86/kernel/crash.c | |
10918 | --- linux-3.0.3/arch/x86/kernel/crash.c 2011-07-21 22:17:23.000000000 -0400 | |
10919 | +++ linux-3.0.3/arch/x86/kernel/crash.c 2011-08-23 21:47:55.000000000 -0400 | |
10920 | @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, | |
10921 | regs = args->regs; | |
10922 | ||
10923 | #ifdef CONFIG_X86_32 | |
10924 | - if (!user_mode_vm(regs)) { | |
10925 | + if (!user_mode(regs)) { | |
10926 | crash_fixup_ss_esp(&fixed_regs, regs); | |
10927 | regs = &fixed_regs; | |
10928 | } | |
10929 | diff -urNp linux-3.0.3/arch/x86/kernel/doublefault_32.c linux-3.0.3/arch/x86/kernel/doublefault_32.c | |
10930 | --- linux-3.0.3/arch/x86/kernel/doublefault_32.c 2011-07-21 22:17:23.000000000 -0400 | |
10931 | +++ linux-3.0.3/arch/x86/kernel/doublefault_32.c 2011-08-23 21:47:55.000000000 -0400 | |
10932 | @@ -11,7 +11,7 @@ | |
10933 | ||
10934 | #define DOUBLEFAULT_STACKSIZE (1024) | |
10935 | static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE]; | |
10936 | -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE) | |
10937 | +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2) | |
10938 | ||
10939 | #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM) | |
10940 | ||
10941 | @@ -21,7 +21,7 @@ static void doublefault_fn(void) | |
10942 | unsigned long gdt, tss; | |
10943 | ||
10944 | store_gdt(&gdt_desc); | |
10945 | - gdt = gdt_desc.address; | |
10946 | + gdt = (unsigned long)gdt_desc.address; | |
10947 | ||
10948 | printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size); | |
10949 | ||
10950 | @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach | |
10951 | /* 0x2 bit is always set */ | |
10952 | .flags = X86_EFLAGS_SF | 0x2, | |
10953 | .sp = STACK_START, | |
10954 | - .es = __USER_DS, | |
10955 | + .es = __KERNEL_DS, | |
10956 | .cs = __KERNEL_CS, | |
10957 | .ss = __KERNEL_DS, | |
10958 | - .ds = __USER_DS, | |
10959 | + .ds = __KERNEL_DS, | |
10960 | .fs = __KERNEL_PERCPU, | |
10961 | ||
10962 | .__cr3 = __pa_nodebug(swapper_pg_dir), | |
10963 | diff -urNp linux-3.0.3/arch/x86/kernel/dumpstack_32.c linux-3.0.3/arch/x86/kernel/dumpstack_32.c | |
10964 | --- linux-3.0.3/arch/x86/kernel/dumpstack_32.c 2011-07-21 22:17:23.000000000 -0400 | |
10965 | +++ linux-3.0.3/arch/x86/kernel/dumpstack_32.c 2011-08-23 21:47:55.000000000 -0400 | |
10966 | @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task | |
10967 | bp = stack_frame(task, regs); | |
10968 | ||
10969 | for (;;) { | |
10970 | - struct thread_info *context; | |
10971 | + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1)); | |
10972 | ||
10973 | - context = (struct thread_info *) | |
10974 | - ((unsigned long)stack & (~(THREAD_SIZE - 1))); | |
10975 | - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph); | |
10976 | + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph); | |
10977 | ||
10978 | - stack = (unsigned long *)context->previous_esp; | |
10979 | - if (!stack) | |
10980 | + if (stack_start == task_stack_page(task)) | |
10981 | break; | |
10982 | + stack = *(unsigned long **)stack_start; | |
10983 | if (ops->stack(data, "IRQ") < 0) | |
10984 | break; | |
10985 | touch_nmi_watchdog(); | |
10986 | @@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs | |
10987 | * When in-kernel, we also print out the stack and code at the | |
10988 | * time of the fault.. | |
10989 | */ | |
10990 | - if (!user_mode_vm(regs)) { | |
10991 | + if (!user_mode(regs)) { | |
10992 | unsigned int code_prologue = code_bytes * 43 / 64; | |
10993 | unsigned int code_len = code_bytes; | |
10994 | unsigned char c; | |
10995 | u8 *ip; | |
10996 | + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]); | |
10997 | ||
10998 | printk(KERN_EMERG "Stack:\n"); | |
10999 | show_stack_log_lvl(NULL, regs, ®s->sp, 0, KERN_EMERG); | |
11000 | ||
11001 | printk(KERN_EMERG "Code: "); | |
11002 | ||
11003 | - ip = (u8 *)regs->ip - code_prologue; | |
11004 | + ip = (u8 *)regs->ip - code_prologue + cs_base; | |
11005 | if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) { | |
11006 | /* try starting at IP */ | |
11007 | - ip = (u8 *)regs->ip; | |
11008 | + ip = (u8 *)regs->ip + cs_base; | |
11009 | code_len = code_len - code_prologue + 1; | |
11010 | } | |
11011 | for (i = 0; i < code_len; i++, ip++) { | |
11012 | @@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs | |
11013 | printk(" Bad EIP value."); | |
11014 | break; | |
11015 | } | |
11016 | - if (ip == (u8 *)regs->ip) | |
11017 | + if (ip == (u8 *)regs->ip + cs_base) | |
11018 | printk("<%02x> ", c); | |
11019 | else | |
11020 | printk("%02x ", c); | |
11021 | @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip) | |
11022 | { | |
11023 | unsigned short ud2; | |
11024 | ||
11025 | + ip = ktla_ktva(ip); | |
11026 | if (ip < PAGE_OFFSET) | |
11027 | return 0; | |
11028 | if (probe_kernel_address((unsigned short *)ip, ud2)) | |
11029 | diff -urNp linux-3.0.3/arch/x86/kernel/dumpstack_64.c linux-3.0.3/arch/x86/kernel/dumpstack_64.c | |
11030 | --- linux-3.0.3/arch/x86/kernel/dumpstack_64.c 2011-07-21 22:17:23.000000000 -0400 | |
11031 | +++ linux-3.0.3/arch/x86/kernel/dumpstack_64.c 2011-08-23 21:47:55.000000000 -0400 | |
11032 | @@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task | |
11033 | unsigned long *irq_stack_end = | |
11034 | (unsigned long *)per_cpu(irq_stack_ptr, cpu); | |
11035 | unsigned used = 0; | |
11036 | - struct thread_info *tinfo; | |
11037 | int graph = 0; | |
11038 | unsigned long dummy; | |
11039 | + void *stack_start; | |
11040 | ||
11041 | if (!task) | |
11042 | task = current; | |
11043 | @@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task | |
11044 | * current stack address. If the stacks consist of nested | |
11045 | * exceptions | |
11046 | */ | |
11047 | - tinfo = task_thread_info(task); | |
11048 | for (;;) { | |
11049 | char *id; | |
11050 | unsigned long *estack_end; | |
11051 | + | |
11052 | estack_end = in_exception_stack(cpu, (unsigned long)stack, | |
11053 | &used, &id); | |
11054 | ||
11055 | @@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task | |
11056 | if (ops->stack(data, id) < 0) | |
11057 | break; | |
11058 | ||
11059 | - bp = ops->walk_stack(tinfo, stack, bp, ops, | |
11060 | + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops, | |
11061 | data, estack_end, &graph); | |
11062 | ops->stack(data, "<EOE>"); | |
11063 | /* | |
11064 | @@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task | |
11065 | if (in_irq_stack(stack, irq_stack, irq_stack_end)) { | |
11066 | if (ops->stack(data, "IRQ") < 0) | |
11067 | break; | |
11068 | - bp = ops->walk_stack(tinfo, stack, bp, | |
11069 | + bp = ops->walk_stack(task, irq_stack, stack, bp, | |
11070 | ops, data, irq_stack_end, &graph); | |
11071 | /* | |
11072 | * We link to the next stack (which would be | |
11073 | @@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task | |
11074 | /* | |
11075 | * This handles the process stack: | |
11076 | */ | |
11077 | - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph); | |
11078 | + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1)); | |
11079 | + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph); | |
11080 | put_cpu(); | |
11081 | } | |
11082 | EXPORT_SYMBOL(dump_trace); | |
11083 | diff -urNp linux-3.0.3/arch/x86/kernel/dumpstack.c linux-3.0.3/arch/x86/kernel/dumpstack.c | |
11084 | --- linux-3.0.3/arch/x86/kernel/dumpstack.c 2011-07-21 22:17:23.000000000 -0400 | |
11085 | +++ linux-3.0.3/arch/x86/kernel/dumpstack.c 2011-08-23 21:48:14.000000000 -0400 | |
11086 | @@ -2,6 +2,9 @@ | |
11087 | * Copyright (C) 1991, 1992 Linus Torvalds | |
11088 | * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs | |
11089 | */ | |
11090 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
11091 | +#define __INCLUDED_BY_HIDESYM 1 | |
11092 | +#endif | |
11093 | #include <linux/kallsyms.h> | |
11094 | #include <linux/kprobes.h> | |
11095 | #include <linux/uaccess.h> | |
11096 | @@ -35,9 +38,8 @@ void printk_address(unsigned long addres | |
11097 | static void | |
11098 | print_ftrace_graph_addr(unsigned long addr, void *data, | |
11099 | const struct stacktrace_ops *ops, | |
11100 | - struct thread_info *tinfo, int *graph) | |
11101 | + struct task_struct *task, int *graph) | |
11102 | { | |
11103 | - struct task_struct *task = tinfo->task; | |
11104 | unsigned long ret_addr; | |
11105 | int index = task->curr_ret_stack; | |
11106 | ||
11107 | @@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad | |
11108 | static inline void | |
11109 | print_ftrace_graph_addr(unsigned long addr, void *data, | |
11110 | const struct stacktrace_ops *ops, | |
11111 | - struct thread_info *tinfo, int *graph) | |
11112 | + struct task_struct *task, int *graph) | |
11113 | { } | |
11114 | #endif | |
11115 | ||
11116 | @@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad | |
11117 | * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack | |
11118 | */ | |
11119 | ||
11120 | -static inline int valid_stack_ptr(struct thread_info *tinfo, | |
11121 | - void *p, unsigned int size, void *end) | |
11122 | +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end) | |
11123 | { | |
11124 | - void *t = tinfo; | |
11125 | if (end) { | |
11126 | if (p < end && p >= (end-THREAD_SIZE)) | |
11127 | return 1; | |
11128 | @@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct | |
11129 | } | |
11130 | ||
11131 | unsigned long | |
11132 | -print_context_stack(struct thread_info *tinfo, | |
11133 | +print_context_stack(struct task_struct *task, void *stack_start, | |
11134 | unsigned long *stack, unsigned long bp, | |
11135 | const struct stacktrace_ops *ops, void *data, | |
11136 | unsigned long *end, int *graph) | |
11137 | { | |
11138 | struct stack_frame *frame = (struct stack_frame *)bp; | |
11139 | ||
11140 | - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) { | |
11141 | + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) { | |
11142 | unsigned long addr; | |
11143 | ||
11144 | addr = *stack; | |
11145 | @@ -102,7 +102,7 @@ print_context_stack(struct thread_info * | |
11146 | } else { | |
11147 | ops->address(data, addr, 0); | |
11148 | } | |
11149 | - print_ftrace_graph_addr(addr, data, ops, tinfo, graph); | |
11150 | + print_ftrace_graph_addr(addr, data, ops, task, graph); | |
11151 | } | |
11152 | stack++; | |
11153 | } | |
11154 | @@ -111,7 +111,7 @@ print_context_stack(struct thread_info * | |
11155 | EXPORT_SYMBOL_GPL(print_context_stack); | |
11156 | ||
11157 | unsigned long | |
11158 | -print_context_stack_bp(struct thread_info *tinfo, | |
11159 | +print_context_stack_bp(struct task_struct *task, void *stack_start, | |
11160 | unsigned long *stack, unsigned long bp, | |
11161 | const struct stacktrace_ops *ops, void *data, | |
11162 | unsigned long *end, int *graph) | |
11163 | @@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf | |
11164 | struct stack_frame *frame = (struct stack_frame *)bp; | |
11165 | unsigned long *ret_addr = &frame->return_address; | |
11166 | ||
11167 | - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) { | |
11168 | + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) { | |
11169 | unsigned long addr = *ret_addr; | |
11170 | ||
11171 | if (!__kernel_text_address(addr)) | |
11172 | @@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf | |
11173 | ops->address(data, addr, 1); | |
11174 | frame = frame->next_frame; | |
11175 | ret_addr = &frame->return_address; | |
11176 | - print_ftrace_graph_addr(addr, data, ops, tinfo, graph); | |
11177 | + print_ftrace_graph_addr(addr, data, ops, task, graph); | |
11178 | } | |
11179 | ||
11180 | return (unsigned long)frame; | |
11181 | @@ -186,7 +186,7 @@ void dump_stack(void) | |
11182 | ||
11183 | bp = stack_frame(current, NULL); | |
11184 | printk("Pid: %d, comm: %.20s %s %s %.*s\n", | |
11185 | - current->pid, current->comm, print_tainted(), | |
11186 | + task_pid_nr(current), current->comm, print_tainted(), | |
11187 | init_utsname()->release, | |
11188 | (int)strcspn(init_utsname()->version, " "), | |
11189 | init_utsname()->version); | |
11190 | @@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void) | |
11191 | } | |
11192 | EXPORT_SYMBOL_GPL(oops_begin); | |
11193 | ||
11194 | +extern void gr_handle_kernel_exploit(void); | |
11195 | + | |
11196 | void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr) | |
11197 | { | |
11198 | if (regs && kexec_should_crash(current)) | |
11199 | @@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long fl | |
11200 | panic("Fatal exception in interrupt"); | |
11201 | if (panic_on_oops) | |
11202 | panic("Fatal exception"); | |
11203 | - do_exit(signr); | |
11204 | + | |
11205 | + gr_handle_kernel_exploit(); | |
11206 | + | |
11207 | + do_group_exit(signr); | |
11208 | } | |
11209 | ||
11210 | int __kprobes __die(const char *str, struct pt_regs *regs, long err) | |
11211 | @@ -269,7 +274,7 @@ int __kprobes __die(const char *str, str | |
11212 | ||
11213 | show_registers(regs); | |
11214 | #ifdef CONFIG_X86_32 | |
11215 | - if (user_mode_vm(regs)) { | |
11216 | + if (user_mode(regs)) { | |
11217 | sp = regs->sp; | |
11218 | ss = regs->ss & 0xffff; | |
11219 | } else { | |
11220 | @@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs | |
11221 | unsigned long flags = oops_begin(); | |
11222 | int sig = SIGSEGV; | |
11223 | ||
11224 | - if (!user_mode_vm(regs)) | |
11225 | + if (!user_mode(regs)) | |
11226 | report_bug(regs->ip, regs); | |
11227 | ||
11228 | if (__die(str, regs, err)) | |
11229 | diff -urNp linux-3.0.3/arch/x86/kernel/early_printk.c linux-3.0.3/arch/x86/kernel/early_printk.c | |
11230 | --- linux-3.0.3/arch/x86/kernel/early_printk.c 2011-07-21 22:17:23.000000000 -0400 | |
11231 | +++ linux-3.0.3/arch/x86/kernel/early_printk.c 2011-08-23 21:48:14.000000000 -0400 | |
11232 | @@ -7,6 +7,7 @@ | |
11233 | #include <linux/pci_regs.h> | |
11234 | #include <linux/pci_ids.h> | |
11235 | #include <linux/errno.h> | |
11236 | +#include <linux/sched.h> | |
11237 | #include <asm/io.h> | |
11238 | #include <asm/processor.h> | |
11239 | #include <asm/fcntl.h> | |
11240 | @@ -179,6 +180,8 @@ asmlinkage void early_printk(const char | |
11241 | int n; | |
11242 | va_list ap; | |
11243 | ||
11244 | + pax_track_stack(); | |
11245 | + | |
11246 | va_start(ap, fmt); | |
11247 | n = vscnprintf(buf, sizeof(buf), fmt, ap); | |
11248 | early_console->write(early_console, buf, n); | |
11249 | diff -urNp linux-3.0.3/arch/x86/kernel/entry_32.S linux-3.0.3/arch/x86/kernel/entry_32.S | |
11250 | --- linux-3.0.3/arch/x86/kernel/entry_32.S 2011-07-21 22:17:23.000000000 -0400 | |
11251 | +++ linux-3.0.3/arch/x86/kernel/entry_32.S 2011-08-23 21:48:14.000000000 -0400 | |
11252 | @@ -185,13 +185,146 @@ | |
11253 | /*CFI_REL_OFFSET gs, PT_GS*/ | |
11254 | .endm | |
11255 | .macro SET_KERNEL_GS reg | |
11256 | + | |
11257 | +#ifdef CONFIG_CC_STACKPROTECTOR | |
11258 | movl $(__KERNEL_STACK_CANARY), \reg | |
11259 | +#elif defined(CONFIG_PAX_MEMORY_UDEREF) | |
11260 | + movl $(__USER_DS), \reg | |
11261 | +#else | |
11262 | + xorl \reg, \reg | |
11263 | +#endif | |
11264 | + | |
11265 | movl \reg, %gs | |
11266 | .endm | |
11267 | ||
11268 | #endif /* CONFIG_X86_32_LAZY_GS */ | |
11269 | ||
11270 | -.macro SAVE_ALL | |
11271 | +.macro pax_enter_kernel | |
11272 | +#ifdef CONFIG_PAX_KERNEXEC | |
11273 | + call pax_enter_kernel | |
11274 | +#endif | |
11275 | +.endm | |
11276 | + | |
11277 | +.macro pax_exit_kernel | |
11278 | +#ifdef CONFIG_PAX_KERNEXEC | |
11279 | + call pax_exit_kernel | |
11280 | +#endif | |
11281 | +.endm | |
11282 | + | |
11283 | +#ifdef CONFIG_PAX_KERNEXEC | |
11284 | +ENTRY(pax_enter_kernel) | |
11285 | +#ifdef CONFIG_PARAVIRT | |
11286 | + pushl %eax | |
11287 | + pushl %ecx | |
11288 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0) | |
11289 | + mov %eax, %esi | |
11290 | +#else | |
11291 | + mov %cr0, %esi | |
11292 | +#endif | |
11293 | + bts $16, %esi | |
11294 | + jnc 1f | |
11295 | + mov %cs, %esi | |
11296 | + cmp $__KERNEL_CS, %esi | |
11297 | + jz 3f | |
11298 | + ljmp $__KERNEL_CS, $3f | |
11299 | +1: ljmp $__KERNEXEC_KERNEL_CS, $2f | |
11300 | +2: | |
11301 | +#ifdef CONFIG_PARAVIRT | |
11302 | + mov %esi, %eax | |
11303 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0) | |
11304 | +#else | |
11305 | + mov %esi, %cr0 | |
11306 | +#endif | |
11307 | +3: | |
11308 | +#ifdef CONFIG_PARAVIRT | |
11309 | + popl %ecx | |
11310 | + popl %eax | |
11311 | +#endif | |
11312 | + ret | |
11313 | +ENDPROC(pax_enter_kernel) | |
11314 | + | |
11315 | +ENTRY(pax_exit_kernel) | |
11316 | +#ifdef CONFIG_PARAVIRT | |
11317 | + pushl %eax | |
11318 | + pushl %ecx | |
11319 | +#endif | |
11320 | + mov %cs, %esi | |
11321 | + cmp $__KERNEXEC_KERNEL_CS, %esi | |
11322 | + jnz 2f | |
11323 | +#ifdef CONFIG_PARAVIRT | |
11324 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); | |
11325 | + mov %eax, %esi | |
11326 | +#else | |
11327 | + mov %cr0, %esi | |
11328 | +#endif | |
11329 | + btr $16, %esi | |
11330 | + ljmp $__KERNEL_CS, $1f | |
11331 | +1: | |
11332 | +#ifdef CONFIG_PARAVIRT | |
11333 | + mov %esi, %eax | |
11334 | + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0); | |
11335 | +#else | |
11336 | + mov %esi, %cr0 | |
11337 | +#endif | |
11338 | +2: | |
11339 | +#ifdef CONFIG_PARAVIRT | |
11340 | + popl %ecx | |
11341 | + popl %eax | |
11342 | +#endif | |
11343 | + ret | |
11344 | +ENDPROC(pax_exit_kernel) | |
11345 | +#endif | |
11346 | + | |
11347 | +.macro pax_erase_kstack | |
11348 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
11349 | + call pax_erase_kstack | |
11350 | +#endif | |
11351 | +.endm | |
11352 | + | |
11353 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
11354 | +/* | |
11355 | + * ebp: thread_info | |
11356 | + * ecx, edx: can be clobbered | |
11357 | + */ | |
11358 | +ENTRY(pax_erase_kstack) | |
11359 | + pushl %edi | |
11360 | + pushl %eax | |
11361 | + | |
11362 | + mov TI_lowest_stack(%ebp), %edi | |
11363 | + mov $-0xBEEF, %eax | |
11364 | + std | |
11365 | + | |
11366 | +1: mov %edi, %ecx | |
11367 | + and $THREAD_SIZE_asm - 1, %ecx | |
11368 | + shr $2, %ecx | |
11369 | + repne scasl | |
11370 | + jecxz 2f | |
11371 | + | |
11372 | + cmp $2*16, %ecx | |
11373 | + jc 2f | |
11374 | + | |
11375 | + mov $2*16, %ecx | |
11376 | + repe scasl | |
11377 | + jecxz 2f | |
11378 | + jne 1b | |
11379 | + | |
11380 | +2: cld | |
11381 | + mov %esp, %ecx | |
11382 | + sub %edi, %ecx | |
11383 | + shr $2, %ecx | |
11384 | + rep stosl | |
11385 | + | |
11386 | + mov TI_task_thread_sp0(%ebp), %edi | |
11387 | + sub $128, %edi | |
11388 | + mov %edi, TI_lowest_stack(%ebp) | |
11389 | + | |
11390 | + popl %eax | |
11391 | + popl %edi | |
11392 | + ret | |
11393 | +ENDPROC(pax_erase_kstack) | |
11394 | +#endif | |
11395 | + | |
11396 | +.macro __SAVE_ALL _DS | |
11397 | cld | |
11398 | PUSH_GS | |
11399 | pushl_cfi %fs | |
11400 | @@ -214,7 +347,7 @@ | |
11401 | CFI_REL_OFFSET ecx, 0 | |
11402 | pushl_cfi %ebx | |
11403 | CFI_REL_OFFSET ebx, 0 | |
11404 | - movl $(__USER_DS), %edx | |
11405 | + movl $\_DS, %edx | |
11406 | movl %edx, %ds | |
11407 | movl %edx, %es | |
11408 | movl $(__KERNEL_PERCPU), %edx | |
11409 | @@ -222,6 +355,15 @@ | |
11410 | SET_KERNEL_GS %edx | |
11411 | .endm | |
11412 | ||
11413 | +.macro SAVE_ALL | |
11414 | +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF) | |
11415 | + __SAVE_ALL __KERNEL_DS | |
11416 | + pax_enter_kernel | |
11417 | +#else | |
11418 | + __SAVE_ALL __USER_DS | |
11419 | +#endif | |
11420 | +.endm | |
11421 | + | |
11422 | .macro RESTORE_INT_REGS | |
11423 | popl_cfi %ebx | |
11424 | CFI_RESTORE ebx | |
11425 | @@ -332,7 +474,15 @@ check_userspace: | |
11426 | movb PT_CS(%esp), %al | |
11427 | andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax | |
11428 | cmpl $USER_RPL, %eax | |
11429 | + | |
11430 | +#ifdef CONFIG_PAX_KERNEXEC | |
11431 | + jae resume_userspace | |
11432 | + | |
11433 | + PAX_EXIT_KERNEL | |
11434 | + jmp resume_kernel | |
11435 | +#else | |
11436 | jb resume_kernel # not returning to v8086 or userspace | |
11437 | +#endif | |
11438 | ||
11439 | ENTRY(resume_userspace) | |
11440 | LOCKDEP_SYS_EXIT | |
11441 | @@ -344,7 +494,7 @@ ENTRY(resume_userspace) | |
11442 | andl $_TIF_WORK_MASK, %ecx # is there any work to be done on | |
11443 | # int/exception return? | |
11444 | jne work_pending | |
11445 | - jmp restore_all | |
11446 | + jmp restore_all_pax | |
11447 | END(ret_from_exception) | |
11448 | ||
11449 | #ifdef CONFIG_PREEMPT | |
11450 | @@ -394,23 +544,34 @@ sysenter_past_esp: | |
11451 | /*CFI_REL_OFFSET cs, 0*/ | |
11452 | /* | |
11453 | * Push current_thread_info()->sysenter_return to the stack. | |
11454 | - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words | |
11455 | - * pushed above; +8 corresponds to copy_thread's esp0 setting. | |
11456 | */ | |
11457 | - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp) | |
11458 | + pushl_cfi $0 | |
11459 | CFI_REL_OFFSET eip, 0 | |
11460 | ||
11461 | pushl_cfi %eax | |
11462 | SAVE_ALL | |
11463 | + GET_THREAD_INFO(%ebp) | |
11464 | + movl TI_sysenter_return(%ebp),%ebp | |
11465 | + movl %ebp,PT_EIP(%esp) | |
11466 | ENABLE_INTERRUPTS(CLBR_NONE) | |
11467 | ||
11468 | /* | |
11469 | * Load the potential sixth argument from user stack. | |
11470 | * Careful about security. | |
11471 | */ | |
11472 | + movl PT_OLDESP(%esp),%ebp | |
11473 | + | |
11474 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
11475 | + mov PT_OLDSS(%esp),%ds | |
11476 | +1: movl %ds:(%ebp),%ebp | |
11477 | + push %ss | |
11478 | + pop %ds | |
11479 | +#else | |
11480 | cmpl $__PAGE_OFFSET-3,%ebp | |
11481 | jae syscall_fault | |
11482 | 1: movl (%ebp),%ebp | |
11483 | +#endif | |
11484 | + | |
11485 | movl %ebp,PT_EBP(%esp) | |
11486 | .section __ex_table,"a" | |
11487 | .align 4 | |
11488 | @@ -433,12 +594,23 @@ sysenter_do_call: | |
11489 | testl $_TIF_ALLWORK_MASK, %ecx | |
11490 | jne sysexit_audit | |
11491 | sysenter_exit: | |
11492 | + | |
11493 | +#ifdef CONFIG_PAX_RANDKSTACK | |
11494 | + pushl_cfi %eax | |
11495 | + call pax_randomize_kstack | |
11496 | + popl_cfi %eax | |
11497 | +#endif | |
11498 | + | |
11499 | + pax_erase_kstack | |
11500 | + | |
11501 | /* if something modifies registers it must also disable sysexit */ | |
11502 | movl PT_EIP(%esp), %edx | |
11503 | movl PT_OLDESP(%esp), %ecx | |
11504 | xorl %ebp,%ebp | |
11505 | TRACE_IRQS_ON | |
11506 | 1: mov PT_FS(%esp), %fs | |
11507 | +2: mov PT_DS(%esp), %ds | |
11508 | +3: mov PT_ES(%esp), %es | |
11509 | PTGS_TO_GS | |
11510 | ENABLE_INTERRUPTS_SYSEXIT | |
11511 | ||
11512 | @@ -455,6 +627,9 @@ sysenter_audit: | |
11513 | movl %eax,%edx /* 2nd arg: syscall number */ | |
11514 | movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */ | |
11515 | call audit_syscall_entry | |
11516 | + | |
11517 | + pax_erase_kstack | |
11518 | + | |
11519 | pushl_cfi %ebx | |
11520 | movl PT_EAX(%esp),%eax /* reload syscall number */ | |
11521 | jmp sysenter_do_call | |
11522 | @@ -481,11 +656,17 @@ sysexit_audit: | |
11523 | ||
11524 | CFI_ENDPROC | |
11525 | .pushsection .fixup,"ax" | |
11526 | -2: movl $0,PT_FS(%esp) | |
11527 | +4: movl $0,PT_FS(%esp) | |
11528 | + jmp 1b | |
11529 | +5: movl $0,PT_DS(%esp) | |
11530 | + jmp 1b | |
11531 | +6: movl $0,PT_ES(%esp) | |
11532 | jmp 1b | |
11533 | .section __ex_table,"a" | |
11534 | .align 4 | |
11535 | - .long 1b,2b | |
11536 | + .long 1b,4b | |
11537 | + .long 2b,5b | |
11538 | + .long 3b,6b | |
11539 | .popsection | |
11540 | PTGS_TO_GS_EX | |
11541 | ENDPROC(ia32_sysenter_target) | |
11542 | @@ -518,6 +699,14 @@ syscall_exit: | |
11543 | testl $_TIF_ALLWORK_MASK, %ecx # current->work | |
11544 | jne syscall_exit_work | |
11545 | ||
11546 | +restore_all_pax: | |
11547 | + | |
11548 | +#ifdef CONFIG_PAX_RANDKSTACK | |
11549 | + call pax_randomize_kstack | |
11550 | +#endif | |
11551 | + | |
11552 | + pax_erase_kstack | |
11553 | + | |
11554 | restore_all: | |
11555 | TRACE_IRQS_IRET | |
11556 | restore_all_notrace: | |
11557 | @@ -577,14 +766,34 @@ ldt_ss: | |
11558 | * compensating for the offset by changing to the ESPFIX segment with | |
11559 | * a base address that matches for the difference. | |
11560 | */ | |
11561 | -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8) | |
11562 | +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx) | |
11563 | mov %esp, %edx /* load kernel esp */ | |
11564 | mov PT_OLDESP(%esp), %eax /* load userspace esp */ | |
11565 | mov %dx, %ax /* eax: new kernel esp */ | |
11566 | sub %eax, %edx /* offset (low word is 0) */ | |
11567 | +#ifdef CONFIG_SMP | |
11568 | + movl PER_CPU_VAR(cpu_number), %ebx | |
11569 | + shll $PAGE_SHIFT_asm, %ebx | |
11570 | + addl $cpu_gdt_table, %ebx | |
11571 | +#else | |
11572 | + movl $cpu_gdt_table, %ebx | |
11573 | +#endif | |
11574 | shr $16, %edx | |
11575 | - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */ | |
11576 | - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */ | |
11577 | + | |
11578 | +#ifdef CONFIG_PAX_KERNEXEC | |
11579 | + mov %cr0, %esi | |
11580 | + btr $16, %esi | |
11581 | + mov %esi, %cr0 | |
11582 | +#endif | |
11583 | + | |
11584 | + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */ | |
11585 | + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */ | |
11586 | + | |
11587 | +#ifdef CONFIG_PAX_KERNEXEC | |
11588 | + bts $16, %esi | |
11589 | + mov %esi, %cr0 | |
11590 | +#endif | |
11591 | + | |
11592 | pushl_cfi $__ESPFIX_SS | |
11593 | pushl_cfi %eax /* new kernel esp */ | |
11594 | /* Disable interrupts, but do not irqtrace this section: we | |
11595 | @@ -613,29 +822,23 @@ work_resched: | |
11596 | movl TI_flags(%ebp), %ecx | |
11597 | andl $_TIF_WORK_MASK, %ecx # is there any work to be done other | |
11598 | # than syscall tracing? | |
11599 | - jz restore_all | |
11600 | + jz restore_all_pax | |
11601 | testb $_TIF_NEED_RESCHED, %cl | |
11602 | jnz work_resched | |
11603 | ||
11604 | work_notifysig: # deal with pending signals and | |
11605 | # notify-resume requests | |
11606 | + movl %esp, %eax | |
11607 | #ifdef CONFIG_VM86 | |
11608 | testl $X86_EFLAGS_VM, PT_EFLAGS(%esp) | |
11609 | - movl %esp, %eax | |
11610 | - jne work_notifysig_v86 # returning to kernel-space or | |
11611 | + jz 1f # returning to kernel-space or | |
11612 | # vm86-space | |
11613 | - xorl %edx, %edx | |
11614 | - call do_notify_resume | |
11615 | - jmp resume_userspace_sig | |
11616 | ||
11617 | - ALIGN | |
11618 | -work_notifysig_v86: | |
11619 | pushl_cfi %ecx # save ti_flags for do_notify_resume | |
11620 | call save_v86_state # %eax contains pt_regs pointer | |
11621 | popl_cfi %ecx | |
11622 | movl %eax, %esp | |
11623 | -#else | |
11624 | - movl %esp, %eax | |
11625 | +1: | |
11626 | #endif | |
11627 | xorl %edx, %edx | |
11628 | call do_notify_resume | |
11629 | @@ -648,6 +851,9 @@ syscall_trace_entry: | |
11630 | movl $-ENOSYS,PT_EAX(%esp) | |
11631 | movl %esp, %eax | |
11632 | call syscall_trace_enter | |
11633 | + | |
11634 | + pax_erase_kstack | |
11635 | + | |
11636 | /* What it returned is what we'll actually use. */ | |
11637 | cmpl $(nr_syscalls), %eax | |
11638 | jnae syscall_call | |
11639 | @@ -670,6 +876,10 @@ END(syscall_exit_work) | |
11640 | ||
11641 | RING0_INT_FRAME # can't unwind into user space anyway | |
11642 | syscall_fault: | |
11643 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
11644 | + push %ss | |
11645 | + pop %ds | |
11646 | +#endif | |
11647 | GET_THREAD_INFO(%ebp) | |
11648 | movl $-EFAULT,PT_EAX(%esp) | |
11649 | jmp resume_userspace | |
11650 | @@ -752,6 +962,36 @@ ptregs_clone: | |
11651 | CFI_ENDPROC | |
11652 | ENDPROC(ptregs_clone) | |
11653 | ||
11654 | + ALIGN; | |
11655 | +ENTRY(kernel_execve) | |
11656 | + CFI_STARTPROC | |
11657 | + pushl_cfi %ebp | |
11658 | + sub $PT_OLDSS+4,%esp | |
11659 | + pushl_cfi %edi | |
11660 | + pushl_cfi %ecx | |
11661 | + pushl_cfi %eax | |
11662 | + lea 3*4(%esp),%edi | |
11663 | + mov $PT_OLDSS/4+1,%ecx | |
11664 | + xorl %eax,%eax | |
11665 | + rep stosl | |
11666 | + popl_cfi %eax | |
11667 | + popl_cfi %ecx | |
11668 | + popl_cfi %edi | |
11669 | + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp) | |
11670 | + pushl_cfi %esp | |
11671 | + call sys_execve | |
11672 | + add $4,%esp | |
11673 | + CFI_ADJUST_CFA_OFFSET -4 | |
11674 | + GET_THREAD_INFO(%ebp) | |
11675 | + test %eax,%eax | |
11676 | + jz syscall_exit | |
11677 | + add $PT_OLDSS+4,%esp | |
11678 | + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4 | |
11679 | + popl_cfi %ebp | |
11680 | + ret | |
11681 | + CFI_ENDPROC | |
11682 | +ENDPROC(kernel_execve) | |
11683 | + | |
11684 | .macro FIXUP_ESPFIX_STACK | |
11685 | /* | |
11686 | * Switch back for ESPFIX stack to the normal zerobased stack | |
11687 | @@ -761,8 +1001,15 @@ ENDPROC(ptregs_clone) | |
11688 | * normal stack and adjusts ESP with the matching offset. | |
11689 | */ | |
11690 | /* fixup the stack */ | |
11691 | - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */ | |
11692 | - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */ | |
11693 | +#ifdef CONFIG_SMP | |
11694 | + movl PER_CPU_VAR(cpu_number), %ebx | |
11695 | + shll $PAGE_SHIFT_asm, %ebx | |
11696 | + addl $cpu_gdt_table, %ebx | |
11697 | +#else | |
11698 | + movl $cpu_gdt_table, %ebx | |
11699 | +#endif | |
11700 | + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */ | |
11701 | + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */ | |
11702 | shl $16, %eax | |
11703 | addl %esp, %eax /* the adjusted stack pointer */ | |
11704 | pushl_cfi $__KERNEL_DS | |
11705 | @@ -1213,7 +1460,6 @@ return_to_handler: | |
11706 | jmp *%ecx | |
11707 | #endif | |
11708 | ||
11709 | -.section .rodata,"a" | |
11710 | #include "syscall_table_32.S" | |
11711 | ||
11712 | syscall_table_size=(.-sys_call_table) | |
11713 | @@ -1259,9 +1505,12 @@ error_code: | |
11714 | movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart | |
11715 | REG_TO_PTGS %ecx | |
11716 | SET_KERNEL_GS %ecx | |
11717 | - movl $(__USER_DS), %ecx | |
11718 | + movl $(__KERNEL_DS), %ecx | |
11719 | movl %ecx, %ds | |
11720 | movl %ecx, %es | |
11721 | + | |
11722 | + pax_enter_kernel | |
11723 | + | |
11724 | TRACE_IRQS_OFF | |
11725 | movl %esp,%eax # pt_regs pointer | |
11726 | call *%edi | |
11727 | @@ -1346,6 +1595,9 @@ nmi_stack_correct: | |
11728 | xorl %edx,%edx # zero error code | |
11729 | movl %esp,%eax # pt_regs pointer | |
11730 | call do_nmi | |
11731 | + | |
11732 | + pax_exit_kernel | |
11733 | + | |
11734 | jmp restore_all_notrace | |
11735 | CFI_ENDPROC | |
11736 | ||
11737 | @@ -1382,6 +1634,9 @@ nmi_espfix_stack: | |
11738 | FIXUP_ESPFIX_STACK # %eax == %esp | |
11739 | xorl %edx,%edx # zero error code | |
11740 | call do_nmi | |
11741 | + | |
11742 | + pax_exit_kernel | |
11743 | + | |
11744 | RESTORE_REGS | |
11745 | lss 12+4(%esp), %esp # back to espfix stack | |
11746 | CFI_ADJUST_CFA_OFFSET -24 | |
11747 | diff -urNp linux-3.0.3/arch/x86/kernel/entry_64.S linux-3.0.3/arch/x86/kernel/entry_64.S | |
11748 | --- linux-3.0.3/arch/x86/kernel/entry_64.S 2011-07-21 22:17:23.000000000 -0400 | |
11749 | +++ linux-3.0.3/arch/x86/kernel/entry_64.S 2011-08-26 19:49:56.000000000 -0400 | |
11750 | @@ -53,6 +53,7 @@ | |
11751 | #include <asm/paravirt.h> | |
11752 | #include <asm/ftrace.h> | |
11753 | #include <asm/percpu.h> | |
11754 | +#include <asm/pgtable.h> | |
11755 | ||
11756 | /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ | |
11757 | #include <linux/elf-em.h> | |
11758 | @@ -176,6 +177,264 @@ ENTRY(native_usergs_sysret64) | |
11759 | ENDPROC(native_usergs_sysret64) | |
11760 | #endif /* CONFIG_PARAVIRT */ | |
11761 | ||
11762 | + .macro ljmpq sel, off | |
11763 | +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM) | |
11764 | + .byte 0x48; ljmp *1234f(%rip) | |
11765 | + .pushsection .rodata | |
11766 | + .align 16 | |
11767 | + 1234: .quad \off; .word \sel | |
11768 | + .popsection | |
11769 | +#else | |
11770 | + pushq $\sel | |
11771 | + pushq $\off | |
11772 | + lretq | |
11773 | +#endif | |
11774 | + .endm | |
11775 | + | |
11776 | + .macro pax_enter_kernel | |
11777 | +#ifdef CONFIG_PAX_KERNEXEC | |
11778 | + call pax_enter_kernel | |
11779 | +#endif | |
11780 | + .endm | |
11781 | + | |
11782 | + .macro pax_exit_kernel | |
11783 | +#ifdef CONFIG_PAX_KERNEXEC | |
11784 | + call pax_exit_kernel | |
11785 | +#endif | |
11786 | + .endm | |
11787 | + | |
11788 | +#ifdef CONFIG_PAX_KERNEXEC | |
11789 | +ENTRY(pax_enter_kernel) | |
11790 | + pushq %rdi | |
11791 | + | |
11792 | +#ifdef CONFIG_PARAVIRT | |
11793 | + PV_SAVE_REGS(CLBR_RDI) | |
11794 | +#endif | |
11795 | + | |
11796 | + GET_CR0_INTO_RDI | |
11797 | + bts $16,%rdi | |
11798 | + jnc 1f | |
11799 | + mov %cs,%edi | |
11800 | + cmp $__KERNEL_CS,%edi | |
11801 | + jz 3f | |
11802 | + ljmpq __KERNEL_CS,3f | |
11803 | +1: ljmpq __KERNEXEC_KERNEL_CS,2f | |
11804 | +2: SET_RDI_INTO_CR0 | |
11805 | +3: | |
11806 | + | |
11807 | +#ifdef CONFIG_PARAVIRT | |
11808 | + PV_RESTORE_REGS(CLBR_RDI) | |
11809 | +#endif | |
11810 | + | |
11811 | + popq %rdi | |
11812 | + retq | |
11813 | +ENDPROC(pax_enter_kernel) | |
11814 | + | |
11815 | +ENTRY(pax_exit_kernel) | |
11816 | + pushq %rdi | |
11817 | + | |
11818 | +#ifdef CONFIG_PARAVIRT | |
11819 | + PV_SAVE_REGS(CLBR_RDI) | |
11820 | +#endif | |
11821 | + | |
11822 | + mov %cs,%rdi | |
11823 | + cmp $__KERNEXEC_KERNEL_CS,%edi | |
11824 | + jnz 2f | |
11825 | + GET_CR0_INTO_RDI | |
11826 | + btr $16,%rdi | |
11827 | + ljmpq __KERNEL_CS,1f | |
11828 | +1: SET_RDI_INTO_CR0 | |
11829 | +2: | |
11830 | + | |
11831 | +#ifdef CONFIG_PARAVIRT | |
11832 | + PV_RESTORE_REGS(CLBR_RDI); | |
11833 | +#endif | |
11834 | + | |
11835 | + popq %rdi | |
11836 | + retq | |
11837 | +ENDPROC(pax_exit_kernel) | |
11838 | +#endif | |
11839 | + | |
11840 | + .macro pax_enter_kernel_user | |
11841 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
11842 | + call pax_enter_kernel_user | |
11843 | +#endif | |
11844 | + .endm | |
11845 | + | |
11846 | + .macro pax_exit_kernel_user | |
11847 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
11848 | + call pax_exit_kernel_user | |
11849 | +#endif | |
11850 | +#ifdef CONFIG_PAX_RANDKSTACK | |
11851 | + push %rax | |
11852 | + call pax_randomize_kstack | |
11853 | + pop %rax | |
11854 | +#endif | |
11855 | + .endm | |
11856 | + | |
11857 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
11858 | +ENTRY(pax_enter_kernel_user) | |
11859 | + pushq %rdi | |
11860 | + pushq %rbx | |
11861 | + | |
11862 | +#ifdef CONFIG_PARAVIRT | |
11863 | + PV_SAVE_REGS(CLBR_RDI) | |
11864 | +#endif | |
11865 | + | |
11866 | + GET_CR3_INTO_RDI | |
11867 | + mov %rdi,%rbx | |
11868 | + add $__START_KERNEL_map,%rbx | |
11869 | + sub phys_base(%rip),%rbx | |
11870 | + | |
11871 | +#ifdef CONFIG_PARAVIRT | |
11872 | + pushq %rdi | |
11873 | + cmpl $0, pv_info+PARAVIRT_enabled | |
11874 | + jz 1f | |
11875 | + i = 0 | |
11876 | + .rept USER_PGD_PTRS | |
11877 | + mov i*8(%rbx),%rsi | |
11878 | + mov $0,%sil | |
11879 | + lea i*8(%rbx),%rdi | |
11880 | + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched) | |
11881 | + i = i + 1 | |
11882 | + .endr | |
11883 | + jmp 2f | |
11884 | +1: | |
11885 | +#endif | |
11886 | + | |
11887 | + i = 0 | |
11888 | + .rept USER_PGD_PTRS | |
11889 | + movb $0,i*8(%rbx) | |
11890 | + i = i + 1 | |
11891 | + .endr | |
11892 | + | |
11893 | +#ifdef CONFIG_PARAVIRT | |
11894 | +2: popq %rdi | |
11895 | +#endif | |
11896 | + SET_RDI_INTO_CR3 | |
11897 | + | |
11898 | +#ifdef CONFIG_PAX_KERNEXEC | |
11899 | + GET_CR0_INTO_RDI | |
11900 | + bts $16,%rdi | |
11901 | + SET_RDI_INTO_CR0 | |
11902 | +#endif | |
11903 | + | |
11904 | +#ifdef CONFIG_PARAVIRT | |
11905 | + PV_RESTORE_REGS(CLBR_RDI) | |
11906 | +#endif | |
11907 | + | |
11908 | + popq %rbx | |
11909 | + popq %rdi | |
11910 | + retq | |
11911 | +ENDPROC(pax_enter_kernel_user) | |
11912 | + | |
11913 | +ENTRY(pax_exit_kernel_user) | |
11914 | + push %rdi | |
11915 | + | |
11916 | +#ifdef CONFIG_PARAVIRT | |
11917 | + pushq %rbx | |
11918 | + PV_SAVE_REGS(CLBR_RDI) | |
11919 | +#endif | |
11920 | + | |
11921 | +#ifdef CONFIG_PAX_KERNEXEC | |
11922 | + GET_CR0_INTO_RDI | |
11923 | + btr $16,%rdi | |
11924 | + SET_RDI_INTO_CR0 | |
11925 | +#endif | |
11926 | + | |
11927 | + GET_CR3_INTO_RDI | |
11928 | + add $__START_KERNEL_map,%rdi | |
11929 | + sub phys_base(%rip),%rdi | |
11930 | + | |
11931 | +#ifdef CONFIG_PARAVIRT | |
11932 | + cmpl $0, pv_info+PARAVIRT_enabled | |
11933 | + jz 1f | |
11934 | + mov %rdi,%rbx | |
11935 | + i = 0 | |
11936 | + .rept USER_PGD_PTRS | |
11937 | + mov i*8(%rbx),%rsi | |
11938 | + mov $0x67,%sil | |
11939 | + lea i*8(%rbx),%rdi | |
11940 | + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched) | |
11941 | + i = i + 1 | |
11942 | + .endr | |
11943 | + jmp 2f | |
11944 | +1: | |
11945 | +#endif | |
11946 | + | |
11947 | + i = 0 | |
11948 | + .rept USER_PGD_PTRS | |
11949 | + movb $0x67,i*8(%rdi) | |
11950 | + i = i + 1 | |
11951 | + .endr | |
11952 | + | |
11953 | +#ifdef CONFIG_PARAVIRT | |
11954 | +2: PV_RESTORE_REGS(CLBR_RDI) | |
11955 | + popq %rbx | |
11956 | +#endif | |
11957 | + | |
11958 | + popq %rdi | |
11959 | + retq | |
11960 | +ENDPROC(pax_exit_kernel_user) | |
11961 | +#endif | |
11962 | + | |
11963 | + .macro pax_erase_kstack | |
11964 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
11965 | + call pax_erase_kstack | |
11966 | +#endif | |
11967 | + .endm | |
11968 | + | |
11969 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
11970 | +/* | |
11971 | + * r10: thread_info | |
11972 | + * rcx, rdx: can be clobbered | |
11973 | + */ | |
11974 | +ENTRY(pax_erase_kstack) | |
11975 | + pushq %rdi | |
11976 | + pushq %rax | |
11977 | + pushq %r10 | |
11978 | + | |
11979 | + GET_THREAD_INFO(%r10) | |
11980 | + mov TI_lowest_stack(%r10), %rdi | |
11981 | + mov $-0xBEEF, %rax | |
11982 | + std | |
11983 | + | |
11984 | +1: mov %edi, %ecx | |
11985 | + and $THREAD_SIZE_asm - 1, %ecx | |
11986 | + shr $3, %ecx | |
11987 | + repne scasq | |
11988 | + jecxz 2f | |
11989 | + | |
11990 | + cmp $2*8, %ecx | |
11991 | + jc 2f | |
11992 | + | |
11993 | + mov $2*8, %ecx | |
11994 | + repe scasq | |
11995 | + jecxz 2f | |
11996 | + jne 1b | |
11997 | + | |
11998 | +2: cld | |
11999 | + mov %esp, %ecx | |
12000 | + sub %edi, %ecx | |
12001 | + | |
12002 | + cmp $THREAD_SIZE_asm, %rcx | |
12003 | + jb 3f | |
12004 | + ud2 | |
12005 | +3: | |
12006 | + | |
12007 | + shr $3, %ecx | |
12008 | + rep stosq | |
12009 | + | |
12010 | + mov TI_task_thread_sp0(%r10), %rdi | |
12011 | + sub $256, %rdi | |
12012 | + mov %rdi, TI_lowest_stack(%r10) | |
12013 | + | |
12014 | + popq %r10 | |
12015 | + popq %rax | |
12016 | + popq %rdi | |
12017 | + ret | |
12018 | +ENDPROC(pax_erase_kstack) | |
12019 | +#endif | |
12020 | ||
12021 | .macro TRACE_IRQS_IRETQ offset=ARGOFFSET | |
12022 | #ifdef CONFIG_TRACE_IRQFLAGS | |
12023 | @@ -318,7 +577,7 @@ ENTRY(save_args) | |
12024 | leaq -RBP+8(%rsp),%rdi /* arg1 for handler */ | |
12025 | movq_cfi rbp, 8 /* push %rbp */ | |
12026 | leaq 8(%rsp), %rbp /* mov %rsp, %ebp */ | |
12027 | - testl $3, CS(%rdi) | |
12028 | + testb $3, CS(%rdi) | |
12029 | je 1f | |
12030 | SWAPGS | |
12031 | /* | |
12032 | @@ -409,7 +668,7 @@ ENTRY(ret_from_fork) | |
12033 | ||
12034 | RESTORE_REST | |
12035 | ||
12036 | - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread? | |
12037 | + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread? | |
12038 | je int_ret_from_sys_call | |
12039 | ||
12040 | testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET | |
12041 | @@ -455,7 +714,7 @@ END(ret_from_fork) | |
12042 | ENTRY(system_call) | |
12043 | CFI_STARTPROC simple | |
12044 | CFI_SIGNAL_FRAME | |
12045 | - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET | |
12046 | + CFI_DEF_CFA rsp,0 | |
12047 | CFI_REGISTER rip,rcx | |
12048 | /*CFI_REGISTER rflags,r11*/ | |
12049 | SWAPGS_UNSAFE_STACK | |
12050 | @@ -468,12 +727,13 @@ ENTRY(system_call_after_swapgs) | |
12051 | ||
12052 | movq %rsp,PER_CPU_VAR(old_rsp) | |
12053 | movq PER_CPU_VAR(kernel_stack),%rsp | |
12054 | + pax_enter_kernel_user | |
12055 | /* | |
12056 | * No need to follow this irqs off/on section - it's straight | |
12057 | * and short: | |
12058 | */ | |
12059 | ENABLE_INTERRUPTS(CLBR_NONE) | |
12060 | - SAVE_ARGS 8,1 | |
12061 | + SAVE_ARGS 8*6,1 | |
12062 | movq %rax,ORIG_RAX-ARGOFFSET(%rsp) | |
12063 | movq %rcx,RIP-ARGOFFSET(%rsp) | |
12064 | CFI_REL_OFFSET rip,RIP-ARGOFFSET | |
12065 | @@ -502,6 +762,8 @@ sysret_check: | |
12066 | andl %edi,%edx | |
12067 | jnz sysret_careful | |
12068 | CFI_REMEMBER_STATE | |
12069 | + pax_exit_kernel_user | |
12070 | + pax_erase_kstack | |
12071 | /* | |
12072 | * sysretq will re-enable interrupts: | |
12073 | */ | |
12074 | @@ -560,6 +822,9 @@ auditsys: | |
12075 | movq %rax,%rsi /* 2nd arg: syscall number */ | |
12076 | movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */ | |
12077 | call audit_syscall_entry | |
12078 | + | |
12079 | + pax_erase_kstack | |
12080 | + | |
12081 | LOAD_ARGS 0 /* reload call-clobbered registers */ | |
12082 | jmp system_call_fastpath | |
12083 | ||
12084 | @@ -590,6 +855,9 @@ tracesys: | |
12085 | FIXUP_TOP_OF_STACK %rdi | |
12086 | movq %rsp,%rdi | |
12087 | call syscall_trace_enter | |
12088 | + | |
12089 | + pax_erase_kstack | |
12090 | + | |
12091 | /* | |
12092 | * Reload arg registers from stack in case ptrace changed them. | |
12093 | * We don't reload %rax because syscall_trace_enter() returned | |
12094 | @@ -611,7 +879,7 @@ tracesys: | |
12095 | GLOBAL(int_ret_from_sys_call) | |
12096 | DISABLE_INTERRUPTS(CLBR_NONE) | |
12097 | TRACE_IRQS_OFF | |
12098 | - testl $3,CS-ARGOFFSET(%rsp) | |
12099 | + testb $3,CS-ARGOFFSET(%rsp) | |
12100 | je retint_restore_args | |
12101 | movl $_TIF_ALLWORK_MASK,%edi | |
12102 | /* edi: mask to check */ | |
12103 | @@ -793,6 +1061,16 @@ END(interrupt) | |
12104 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP | |
12105 | call save_args | |
12106 | PARTIAL_FRAME 0 | |
12107 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12108 | + testb $3, CS(%rdi) | |
12109 | + jnz 1f | |
12110 | + pax_enter_kernel | |
12111 | + jmp 2f | |
12112 | +1: pax_enter_kernel_user | |
12113 | +2: | |
12114 | +#else | |
12115 | + pax_enter_kernel | |
12116 | +#endif | |
12117 | call \func | |
12118 | .endm | |
12119 | ||
12120 | @@ -825,7 +1103,7 @@ ret_from_intr: | |
12121 | CFI_ADJUST_CFA_OFFSET -8 | |
12122 | exit_intr: | |
12123 | GET_THREAD_INFO(%rcx) | |
12124 | - testl $3,CS-ARGOFFSET(%rsp) | |
12125 | + testb $3,CS-ARGOFFSET(%rsp) | |
12126 | je retint_kernel | |
12127 | ||
12128 | /* Interrupt came from user space */ | |
12129 | @@ -847,12 +1125,15 @@ retint_swapgs: /* return to user-space | |
12130 | * The iretq could re-enable interrupts: | |
12131 | */ | |
12132 | DISABLE_INTERRUPTS(CLBR_ANY) | |
12133 | + pax_exit_kernel_user | |
12134 | + pax_erase_kstack | |
12135 | TRACE_IRQS_IRETQ | |
12136 | SWAPGS | |
12137 | jmp restore_args | |
12138 | ||
12139 | retint_restore_args: /* return to kernel space */ | |
12140 | DISABLE_INTERRUPTS(CLBR_ANY) | |
12141 | + pax_exit_kernel | |
12142 | /* | |
12143 | * The iretq could re-enable interrupts: | |
12144 | */ | |
12145 | @@ -1027,6 +1308,16 @@ ENTRY(\sym) | |
12146 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 | |
12147 | call error_entry | |
12148 | DEFAULT_FRAME 0 | |
12149 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12150 | + testb $3, CS(%rsp) | |
12151 | + jnz 1f | |
12152 | + pax_enter_kernel | |
12153 | + jmp 2f | |
12154 | +1: pax_enter_kernel_user | |
12155 | +2: | |
12156 | +#else | |
12157 | + pax_enter_kernel | |
12158 | +#endif | |
12159 | movq %rsp,%rdi /* pt_regs pointer */ | |
12160 | xorl %esi,%esi /* no error code */ | |
12161 | call \do_sym | |
12162 | @@ -1044,6 +1335,16 @@ ENTRY(\sym) | |
12163 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 | |
12164 | call save_paranoid | |
12165 | TRACE_IRQS_OFF | |
12166 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12167 | + testb $3, CS(%rsp) | |
12168 | + jnz 1f | |
12169 | + pax_enter_kernel | |
12170 | + jmp 2f | |
12171 | +1: pax_enter_kernel_user | |
12172 | +2: | |
12173 | +#else | |
12174 | + pax_enter_kernel | |
12175 | +#endif | |
12176 | movq %rsp,%rdi /* pt_regs pointer */ | |
12177 | xorl %esi,%esi /* no error code */ | |
12178 | call \do_sym | |
12179 | @@ -1052,7 +1353,7 @@ ENTRY(\sym) | |
12180 | END(\sym) | |
12181 | .endm | |
12182 | ||
12183 | -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8) | |
12184 | +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12) | |
12185 | .macro paranoidzeroentry_ist sym do_sym ist | |
12186 | ENTRY(\sym) | |
12187 | INTR_FRAME | |
12188 | @@ -1062,8 +1363,24 @@ ENTRY(\sym) | |
12189 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 | |
12190 | call save_paranoid | |
12191 | TRACE_IRQS_OFF | |
12192 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12193 | + testb $3, CS(%rsp) | |
12194 | + jnz 1f | |
12195 | + pax_enter_kernel | |
12196 | + jmp 2f | |
12197 | +1: pax_enter_kernel_user | |
12198 | +2: | |
12199 | +#else | |
12200 | + pax_enter_kernel | |
12201 | +#endif | |
12202 | movq %rsp,%rdi /* pt_regs pointer */ | |
12203 | xorl %esi,%esi /* no error code */ | |
12204 | +#ifdef CONFIG_SMP | |
12205 | + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d | |
12206 | + lea init_tss(%r12), %r12 | |
12207 | +#else | |
12208 | + lea init_tss(%rip), %r12 | |
12209 | +#endif | |
12210 | subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist) | |
12211 | call \do_sym | |
12212 | addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist) | |
12213 | @@ -1080,6 +1397,16 @@ ENTRY(\sym) | |
12214 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 | |
12215 | call error_entry | |
12216 | DEFAULT_FRAME 0 | |
12217 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12218 | + testb $3, CS(%rsp) | |
12219 | + jnz 1f | |
12220 | + pax_enter_kernel | |
12221 | + jmp 2f | |
12222 | +1: pax_enter_kernel_user | |
12223 | +2: | |
12224 | +#else | |
12225 | + pax_enter_kernel | |
12226 | +#endif | |
12227 | movq %rsp,%rdi /* pt_regs pointer */ | |
12228 | movq ORIG_RAX(%rsp),%rsi /* get error code */ | |
12229 | movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ | |
12230 | @@ -1099,6 +1426,16 @@ ENTRY(\sym) | |
12231 | call save_paranoid | |
12232 | DEFAULT_FRAME 0 | |
12233 | TRACE_IRQS_OFF | |
12234 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12235 | + testb $3, CS(%rsp) | |
12236 | + jnz 1f | |
12237 | + pax_enter_kernel | |
12238 | + jmp 2f | |
12239 | +1: pax_enter_kernel_user | |
12240 | +2: | |
12241 | +#else | |
12242 | + pax_enter_kernel | |
12243 | +#endif | |
12244 | movq %rsp,%rdi /* pt_regs pointer */ | |
12245 | movq ORIG_RAX(%rsp),%rsi /* get error code */ | |
12246 | movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ | |
12247 | @@ -1361,14 +1698,27 @@ ENTRY(paranoid_exit) | |
12248 | TRACE_IRQS_OFF | |
12249 | testl %ebx,%ebx /* swapgs needed? */ | |
12250 | jnz paranoid_restore | |
12251 | - testl $3,CS(%rsp) | |
12252 | + testb $3,CS(%rsp) | |
12253 | jnz paranoid_userspace | |
12254 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12255 | + pax_exit_kernel | |
12256 | + TRACE_IRQS_IRETQ 0 | |
12257 | + SWAPGS_UNSAFE_STACK | |
12258 | + RESTORE_ALL 8 | |
12259 | + jmp irq_return | |
12260 | +#endif | |
12261 | paranoid_swapgs: | |
12262 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12263 | + pax_exit_kernel_user | |
12264 | +#else | |
12265 | + pax_exit_kernel | |
12266 | +#endif | |
12267 | TRACE_IRQS_IRETQ 0 | |
12268 | SWAPGS_UNSAFE_STACK | |
12269 | RESTORE_ALL 8 | |
12270 | jmp irq_return | |
12271 | paranoid_restore: | |
12272 | + pax_exit_kernel | |
12273 | TRACE_IRQS_IRETQ 0 | |
12274 | RESTORE_ALL 8 | |
12275 | jmp irq_return | |
12276 | @@ -1426,7 +1776,7 @@ ENTRY(error_entry) | |
12277 | movq_cfi r14, R14+8 | |
12278 | movq_cfi r15, R15+8 | |
12279 | xorl %ebx,%ebx | |
12280 | - testl $3,CS+8(%rsp) | |
12281 | + testb $3,CS+8(%rsp) | |
12282 | je error_kernelspace | |
12283 | error_swapgs: | |
12284 | SWAPGS | |
12285 | @@ -1490,6 +1840,16 @@ ENTRY(nmi) | |
12286 | CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 | |
12287 | call save_paranoid | |
12288 | DEFAULT_FRAME 0 | |
12289 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12290 | + testb $3, CS(%rsp) | |
12291 | + jnz 1f | |
12292 | + pax_enter_kernel | |
12293 | + jmp 2f | |
12294 | +1: pax_enter_kernel_user | |
12295 | +2: | |
12296 | +#else | |
12297 | + pax_enter_kernel | |
12298 | +#endif | |
12299 | /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ | |
12300 | movq %rsp,%rdi | |
12301 | movq $-1,%rsi | |
12302 | @@ -1500,11 +1860,25 @@ ENTRY(nmi) | |
12303 | DISABLE_INTERRUPTS(CLBR_NONE) | |
12304 | testl %ebx,%ebx /* swapgs needed? */ | |
12305 | jnz nmi_restore | |
12306 | - testl $3,CS(%rsp) | |
12307 | + testb $3,CS(%rsp) | |
12308 | jnz nmi_userspace | |
12309 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12310 | + pax_exit_kernel | |
12311 | + SWAPGS_UNSAFE_STACK | |
12312 | + RESTORE_ALL 8 | |
12313 | + jmp irq_return | |
12314 | +#endif | |
12315 | nmi_swapgs: | |
12316 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12317 | + pax_exit_kernel_user | |
12318 | +#else | |
12319 | + pax_exit_kernel | |
12320 | +#endif | |
12321 | SWAPGS_UNSAFE_STACK | |
12322 | + RESTORE_ALL 8 | |
12323 | + jmp irq_return | |
12324 | nmi_restore: | |
12325 | + pax_exit_kernel | |
12326 | RESTORE_ALL 8 | |
12327 | jmp irq_return | |
12328 | nmi_userspace: | |
12329 | diff -urNp linux-3.0.3/arch/x86/kernel/ftrace.c linux-3.0.3/arch/x86/kernel/ftrace.c | |
12330 | --- linux-3.0.3/arch/x86/kernel/ftrace.c 2011-07-21 22:17:23.000000000 -0400 | |
12331 | +++ linux-3.0.3/arch/x86/kernel/ftrace.c 2011-08-23 21:47:55.000000000 -0400 | |
12332 | @@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the | |
12333 | static const void *mod_code_newcode; /* holds the text to write to the IP */ | |
12334 | ||
12335 | static unsigned nmi_wait_count; | |
12336 | -static atomic_t nmi_update_count = ATOMIC_INIT(0); | |
12337 | +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0); | |
12338 | ||
12339 | int ftrace_arch_read_dyn_info(char *buf, int size) | |
12340 | { | |
12341 | @@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, | |
12342 | ||
12343 | r = snprintf(buf, size, "%u %u", | |
12344 | nmi_wait_count, | |
12345 | - atomic_read(&nmi_update_count)); | |
12346 | + atomic_read_unchecked(&nmi_update_count)); | |
12347 | return r; | |
12348 | } | |
12349 | ||
12350 | @@ -177,8 +177,10 @@ void ftrace_nmi_enter(void) | |
12351 | ||
12352 | if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) { | |
12353 | smp_rmb(); | |
12354 | + pax_open_kernel(); | |
12355 | ftrace_mod_code(); | |
12356 | - atomic_inc(&nmi_update_count); | |
12357 | + pax_close_kernel(); | |
12358 | + atomic_inc_unchecked(&nmi_update_count); | |
12359 | } | |
12360 | /* Must have previous changes seen before executions */ | |
12361 | smp_mb(); | |
12362 | @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns | |
12363 | { | |
12364 | unsigned char replaced[MCOUNT_INSN_SIZE]; | |
12365 | ||
12366 | + ip = ktla_ktva(ip); | |
12367 | + | |
12368 | /* | |
12369 | * Note: Due to modules and __init, code can | |
12370 | * disappear and change, we need to protect against faulting | |
12371 | @@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun | |
12372 | unsigned char old[MCOUNT_INSN_SIZE], *new; | |
12373 | int ret; | |
12374 | ||
12375 | - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE); | |
12376 | + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE); | |
12377 | new = ftrace_call_replace(ip, (unsigned long)func); | |
12378 | ret = ftrace_modify_code(ip, old, new); | |
12379 | ||
12380 | @@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long | |
12381 | { | |
12382 | unsigned char code[MCOUNT_INSN_SIZE]; | |
12383 | ||
12384 | + ip = ktla_ktva(ip); | |
12385 | + | |
12386 | if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE)) | |
12387 | return -EFAULT; | |
12388 | ||
12389 | diff -urNp linux-3.0.3/arch/x86/kernel/head32.c linux-3.0.3/arch/x86/kernel/head32.c | |
12390 | --- linux-3.0.3/arch/x86/kernel/head32.c 2011-07-21 22:17:23.000000000 -0400 | |
12391 | +++ linux-3.0.3/arch/x86/kernel/head32.c 2011-08-23 21:47:55.000000000 -0400 | |
12392 | @@ -19,6 +19,7 @@ | |
12393 | #include <asm/io_apic.h> | |
12394 | #include <asm/bios_ebda.h> | |
12395 | #include <asm/tlbflush.h> | |
12396 | +#include <asm/boot.h> | |
12397 | ||
12398 | static void __init i386_default_early_setup(void) | |
12399 | { | |
12400 | @@ -33,7 +34,7 @@ void __init i386_start_kernel(void) | |
12401 | { | |
12402 | memblock_init(); | |
12403 | ||
12404 | - memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS"); | |
12405 | + memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS"); | |
12406 | ||
12407 | #ifdef CONFIG_BLK_DEV_INITRD | |
12408 | /* Reserve INITRD */ | |
12409 | diff -urNp linux-3.0.3/arch/x86/kernel/head_32.S linux-3.0.3/arch/x86/kernel/head_32.S | |
12410 | --- linux-3.0.3/arch/x86/kernel/head_32.S 2011-07-21 22:17:23.000000000 -0400 | |
12411 | +++ linux-3.0.3/arch/x86/kernel/head_32.S 2011-08-23 21:47:55.000000000 -0400 | |
12412 | @@ -25,6 +25,12 @@ | |
12413 | /* Physical address */ | |
12414 | #define pa(X) ((X) - __PAGE_OFFSET) | |
12415 | ||
12416 | +#ifdef CONFIG_PAX_KERNEXEC | |
12417 | +#define ta(X) (X) | |
12418 | +#else | |
12419 | +#define ta(X) ((X) - __PAGE_OFFSET) | |
12420 | +#endif | |
12421 | + | |
12422 | /* | |
12423 | * References to members of the new_cpu_data structure. | |
12424 | */ | |
12425 | @@ -54,11 +60,7 @@ | |
12426 | * and small than max_low_pfn, otherwise will waste some page table entries | |
12427 | */ | |
12428 | ||
12429 | -#if PTRS_PER_PMD > 1 | |
12430 | -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD) | |
12431 | -#else | |
12432 | -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD) | |
12433 | -#endif | |
12434 | +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE) | |
12435 | ||
12436 | /* Number of possible pages in the lowmem region */ | |
12437 | LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT) | |
12438 | @@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P | |
12439 | RESERVE_BRK(pagetables, INIT_MAP_SIZE) | |
12440 | ||
12441 | /* | |
12442 | + * Real beginning of normal "text" segment | |
12443 | + */ | |
12444 | +ENTRY(stext) | |
12445 | +ENTRY(_stext) | |
12446 | + | |
12447 | +/* | |
12448 | * 32-bit kernel entrypoint; only used by the boot CPU. On entry, | |
12449 | * %esi points to the real-mode code as a 32-bit pointer. | |
12450 | * CS and DS must be 4 GB flat segments, but we don't depend on | |
12451 | @@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE) | |
12452 | * can. | |
12453 | */ | |
12454 | __HEAD | |
12455 | + | |
12456 | +#ifdef CONFIG_PAX_KERNEXEC | |
12457 | + jmp startup_32 | |
12458 | +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */ | |
12459 | +.fill PAGE_SIZE-5,1,0xcc | |
12460 | +#endif | |
12461 | + | |
12462 | ENTRY(startup_32) | |
12463 | movl pa(stack_start),%ecx | |
12464 | ||
12465 | @@ -105,6 +120,57 @@ ENTRY(startup_32) | |
12466 | 2: | |
12467 | leal -__PAGE_OFFSET(%ecx),%esp | |
12468 | ||
12469 | +#ifdef CONFIG_SMP | |
12470 | + movl $pa(cpu_gdt_table),%edi | |
12471 | + movl $__per_cpu_load,%eax | |
12472 | + movw %ax,__KERNEL_PERCPU + 2(%edi) | |
12473 | + rorl $16,%eax | |
12474 | + movb %al,__KERNEL_PERCPU + 4(%edi) | |
12475 | + movb %ah,__KERNEL_PERCPU + 7(%edi) | |
12476 | + movl $__per_cpu_end - 1,%eax | |
12477 | + subl $__per_cpu_start,%eax | |
12478 | + movw %ax,__KERNEL_PERCPU + 0(%edi) | |
12479 | +#endif | |
12480 | + | |
12481 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
12482 | + movl $NR_CPUS,%ecx | |
12483 | + movl $pa(cpu_gdt_table),%edi | |
12484 | +1: | |
12485 | + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi) | |
12486 | + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi) | |
12487 | + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi) | |
12488 | + addl $PAGE_SIZE_asm,%edi | |
12489 | + loop 1b | |
12490 | +#endif | |
12491 | + | |
12492 | +#ifdef CONFIG_PAX_KERNEXEC | |
12493 | + movl $pa(boot_gdt),%edi | |
12494 | + movl $__LOAD_PHYSICAL_ADDR,%eax | |
12495 | + movw %ax,__BOOT_CS + 2(%edi) | |
12496 | + rorl $16,%eax | |
12497 | + movb %al,__BOOT_CS + 4(%edi) | |
12498 | + movb %ah,__BOOT_CS + 7(%edi) | |
12499 | + rorl $16,%eax | |
12500 | + | |
12501 | + ljmp $(__BOOT_CS),$1f | |
12502 | +1: | |
12503 | + | |
12504 | + movl $NR_CPUS,%ecx | |
12505 | + movl $pa(cpu_gdt_table),%edi | |
12506 | + addl $__PAGE_OFFSET,%eax | |
12507 | +1: | |
12508 | + movw %ax,__KERNEL_CS + 2(%edi) | |
12509 | + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi) | |
12510 | + rorl $16,%eax | |
12511 | + movb %al,__KERNEL_CS + 4(%edi) | |
12512 | + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi) | |
12513 | + movb %ah,__KERNEL_CS + 7(%edi) | |
12514 | + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi) | |
12515 | + rorl $16,%eax | |
12516 | + addl $PAGE_SIZE_asm,%edi | |
12517 | + loop 1b | |
12518 | +#endif | |
12519 | + | |
12520 | /* | |
12521 | * Clear BSS first so that there are no surprises... | |
12522 | */ | |
12523 | @@ -195,8 +261,11 @@ ENTRY(startup_32) | |
12524 | movl %eax, pa(max_pfn_mapped) | |
12525 | ||
12526 | /* Do early initialization of the fixmap area */ | |
12527 | - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax | |
12528 | - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8) | |
12529 | +#ifdef CONFIG_COMPAT_VDSO | |
12530 | + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8) | |
12531 | +#else | |
12532 | + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8) | |
12533 | +#endif | |
12534 | #else /* Not PAE */ | |
12535 | ||
12536 | page_pde_offset = (__PAGE_OFFSET >> 20); | |
12537 | @@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20); | |
12538 | movl %eax, pa(max_pfn_mapped) | |
12539 | ||
12540 | /* Do early initialization of the fixmap area */ | |
12541 | - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax | |
12542 | - movl %eax,pa(initial_page_table+0xffc) | |
12543 | +#ifdef CONFIG_COMPAT_VDSO | |
12544 | + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc) | |
12545 | +#else | |
12546 | + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc) | |
12547 | +#endif | |
12548 | #endif | |
12549 | ||
12550 | #ifdef CONFIG_PARAVIRT | |
12551 | @@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20); | |
12552 | cmpl $num_subarch_entries, %eax | |
12553 | jae bad_subarch | |
12554 | ||
12555 | - movl pa(subarch_entries)(,%eax,4), %eax | |
12556 | - subl $__PAGE_OFFSET, %eax | |
12557 | - jmp *%eax | |
12558 | + jmp *pa(subarch_entries)(,%eax,4) | |
12559 | ||
12560 | bad_subarch: | |
12561 | WEAK(lguest_entry) | |
12562 | @@ -255,10 +325,10 @@ WEAK(xen_entry) | |
12563 | __INITDATA | |
12564 | ||
12565 | subarch_entries: | |
12566 | - .long default_entry /* normal x86/PC */ | |
12567 | - .long lguest_entry /* lguest hypervisor */ | |
12568 | - .long xen_entry /* Xen hypervisor */ | |
12569 | - .long default_entry /* Moorestown MID */ | |
12570 | + .long ta(default_entry) /* normal x86/PC */ | |
12571 | + .long ta(lguest_entry) /* lguest hypervisor */ | |
12572 | + .long ta(xen_entry) /* Xen hypervisor */ | |
12573 | + .long ta(default_entry) /* Moorestown MID */ | |
12574 | num_subarch_entries = (. - subarch_entries) / 4 | |
12575 | .previous | |
12576 | #else | |
12577 | @@ -312,6 +382,7 @@ default_entry: | |
12578 | orl %edx,%eax | |
12579 | movl %eax,%cr4 | |
12580 | ||
12581 | +#ifdef CONFIG_X86_PAE | |
12582 | testb $X86_CR4_PAE, %al # check if PAE is enabled | |
12583 | jz 6f | |
12584 | ||
12585 | @@ -340,6 +411,9 @@ default_entry: | |
12586 | /* Make changes effective */ | |
12587 | wrmsr | |
12588 | ||
12589 | + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4) | |
12590 | +#endif | |
12591 | + | |
12592 | 6: | |
12593 | ||
12594 | /* | |
12595 | @@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP | |
12596 | 1: movl $(__KERNEL_DS),%eax # reload all the segment registers | |
12597 | movl %eax,%ss # after changing gdt. | |
12598 | ||
12599 | - movl $(__USER_DS),%eax # DS/ES contains default USER segment | |
12600 | +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment | |
12601 | movl %eax,%ds | |
12602 | movl %eax,%es | |
12603 | ||
12604 | @@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP | |
12605 | */ | |
12606 | cmpb $0,ready | |
12607 | jne 1f | |
12608 | - movl $gdt_page,%eax | |
12609 | + movl $cpu_gdt_table,%eax | |
12610 | movl $stack_canary,%ecx | |
12611 | +#ifdef CONFIG_SMP | |
12612 | + addl $__per_cpu_load,%ecx | |
12613 | +#endif | |
12614 | movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax) | |
12615 | shrl $16, %ecx | |
12616 | movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax) | |
12617 | movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax) | |
12618 | 1: | |
12619 | -#endif | |
12620 | movl $(__KERNEL_STACK_CANARY),%eax | |
12621 | +#elif defined(CONFIG_PAX_MEMORY_UDEREF) | |
12622 | + movl $(__USER_DS),%eax | |
12623 | +#else | |
12624 | + xorl %eax,%eax | |
12625 | +#endif | |
12626 | movl %eax,%gs | |
12627 | ||
12628 | xorl %eax,%eax # Clear LDT | |
12629 | @@ -558,22 +639,22 @@ early_page_fault: | |
12630 | jmp early_fault | |
12631 | ||
12632 | early_fault: | |
12633 | - cld | |
12634 | #ifdef CONFIG_PRINTK | |
12635 | + cmpl $1,%ss:early_recursion_flag | |
12636 | + je hlt_loop | |
12637 | + incl %ss:early_recursion_flag | |
12638 | + cld | |
12639 | pusha | |
12640 | movl $(__KERNEL_DS),%eax | |
12641 | movl %eax,%ds | |
12642 | movl %eax,%es | |
12643 | - cmpl $2,early_recursion_flag | |
12644 | - je hlt_loop | |
12645 | - incl early_recursion_flag | |
12646 | movl %cr2,%eax | |
12647 | pushl %eax | |
12648 | pushl %edx /* trapno */ | |
12649 | pushl $fault_msg | |
12650 | call printk | |
12651 | +; call dump_stack | |
12652 | #endif | |
12653 | - call dump_stack | |
12654 | hlt_loop: | |
12655 | hlt | |
12656 | jmp hlt_loop | |
12657 | @@ -581,8 +662,11 @@ hlt_loop: | |
12658 | /* This is the default interrupt "handler" :-) */ | |
12659 | ALIGN | |
12660 | ignore_int: | |
12661 | - cld | |
12662 | #ifdef CONFIG_PRINTK | |
12663 | + cmpl $2,%ss:early_recursion_flag | |
12664 | + je hlt_loop | |
12665 | + incl %ss:early_recursion_flag | |
12666 | + cld | |
12667 | pushl %eax | |
12668 | pushl %ecx | |
12669 | pushl %edx | |
12670 | @@ -591,9 +675,6 @@ ignore_int: | |
12671 | movl $(__KERNEL_DS),%eax | |
12672 | movl %eax,%ds | |
12673 | movl %eax,%es | |
12674 | - cmpl $2,early_recursion_flag | |
12675 | - je hlt_loop | |
12676 | - incl early_recursion_flag | |
12677 | pushl 16(%esp) | |
12678 | pushl 24(%esp) | |
12679 | pushl 32(%esp) | |
12680 | @@ -622,29 +703,43 @@ ENTRY(initial_code) | |
12681 | /* | |
12682 | * BSS section | |
12683 | */ | |
12684 | -__PAGE_ALIGNED_BSS | |
12685 | - .align PAGE_SIZE | |
12686 | #ifdef CONFIG_X86_PAE | |
12687 | +.section .initial_pg_pmd,"a",@progbits | |
12688 | initial_pg_pmd: | |
12689 | .fill 1024*KPMDS,4,0 | |
12690 | #else | |
12691 | +.section .initial_page_table,"a",@progbits | |
12692 | ENTRY(initial_page_table) | |
12693 | .fill 1024,4,0 | |
12694 | #endif | |
12695 | +.section .initial_pg_fixmap,"a",@progbits | |
12696 | initial_pg_fixmap: | |
12697 | .fill 1024,4,0 | |
12698 | +.section .empty_zero_page,"a",@progbits | |
12699 | ENTRY(empty_zero_page) | |
12700 | .fill 4096,1,0 | |
12701 | +.section .swapper_pg_dir,"a",@progbits | |
12702 | ENTRY(swapper_pg_dir) | |
12703 | +#ifdef CONFIG_X86_PAE | |
12704 | + .fill 4,8,0 | |
12705 | +#else | |
12706 | .fill 1024,4,0 | |
12707 | +#endif | |
12708 | + | |
12709 | +/* | |
12710 | + * The IDT has to be page-aligned to simplify the Pentium | |
12711 | + * F0 0F bug workaround.. We have a special link segment | |
12712 | + * for this. | |
12713 | + */ | |
12714 | +.section .idt,"a",@progbits | |
12715 | +ENTRY(idt_table) | |
12716 | + .fill 256,8,0 | |
12717 | ||
12718 | /* | |
12719 | * This starts the data section. | |
12720 | */ | |
12721 | #ifdef CONFIG_X86_PAE | |
12722 | -__PAGE_ALIGNED_DATA | |
12723 | - /* Page-aligned for the benefit of paravirt? */ | |
12724 | - .align PAGE_SIZE | |
12725 | +.section .initial_page_table,"a",@progbits | |
12726 | ENTRY(initial_page_table) | |
12727 | .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */ | |
12728 | # if KPMDS == 3 | |
12729 | @@ -663,18 +758,27 @@ ENTRY(initial_page_table) | |
12730 | # error "Kernel PMDs should be 1, 2 or 3" | |
12731 | # endif | |
12732 | .align PAGE_SIZE /* needs to be page-sized too */ | |
12733 | + | |
12734 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
12735 | +ENTRY(cpu_pgd) | |
12736 | + .rept NR_CPUS | |
12737 | + .fill 4,8,0 | |
12738 | + .endr | |
12739 | +#endif | |
12740 | + | |
12741 | #endif | |
12742 | ||
12743 | .data | |
12744 | .balign 4 | |
12745 | ENTRY(stack_start) | |
12746 | - .long init_thread_union+THREAD_SIZE | |
12747 | + .long init_thread_union+THREAD_SIZE-8 | |
12748 | + | |
12749 | +ready: .byte 0 | |
12750 | ||
12751 | +.section .rodata,"a",@progbits | |
12752 | early_recursion_flag: | |
12753 | .long 0 | |
12754 | ||
12755 | -ready: .byte 0 | |
12756 | - | |
12757 | int_msg: | |
12758 | .asciz "Unknown interrupt or fault at: %p %p %p\n" | |
12759 | ||
12760 | @@ -707,7 +811,7 @@ fault_msg: | |
12761 | .word 0 # 32 bit align gdt_desc.address | |
12762 | boot_gdt_descr: | |
12763 | .word __BOOT_DS+7 | |
12764 | - .long boot_gdt - __PAGE_OFFSET | |
12765 | + .long pa(boot_gdt) | |
12766 | ||
12767 | .word 0 # 32-bit align idt_desc.address | |
12768 | idt_descr: | |
12769 | @@ -718,7 +822,7 @@ idt_descr: | |
12770 | .word 0 # 32 bit align gdt_desc.address | |
12771 | ENTRY(early_gdt_descr) | |
12772 | .word GDT_ENTRIES*8-1 | |
12773 | - .long gdt_page /* Overwritten for secondary CPUs */ | |
12774 | + .long cpu_gdt_table /* Overwritten for secondary CPUs */ | |
12775 | ||
12776 | /* | |
12777 | * The boot_gdt must mirror the equivalent in setup.S and is | |
12778 | @@ -727,5 +831,65 @@ ENTRY(early_gdt_descr) | |
12779 | .align L1_CACHE_BYTES | |
12780 | ENTRY(boot_gdt) | |
12781 | .fill GDT_ENTRY_BOOT_CS,8,0 | |
12782 | - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */ | |
12783 | - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */ | |
12784 | + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */ | |
12785 | + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */ | |
12786 | + | |
12787 | + .align PAGE_SIZE_asm | |
12788 | +ENTRY(cpu_gdt_table) | |
12789 | + .rept NR_CPUS | |
12790 | + .quad 0x0000000000000000 /* NULL descriptor */ | |
12791 | + .quad 0x0000000000000000 /* 0x0b reserved */ | |
12792 | + .quad 0x0000000000000000 /* 0x13 reserved */ | |
12793 | + .quad 0x0000000000000000 /* 0x1b reserved */ | |
12794 | + | |
12795 | +#ifdef CONFIG_PAX_KERNEXEC | |
12796 | + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */ | |
12797 | +#else | |
12798 | + .quad 0x0000000000000000 /* 0x20 unused */ | |
12799 | +#endif | |
12800 | + | |
12801 | + .quad 0x0000000000000000 /* 0x28 unused */ | |
12802 | + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */ | |
12803 | + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */ | |
12804 | + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */ | |
12805 | + .quad 0x0000000000000000 /* 0x4b reserved */ | |
12806 | + .quad 0x0000000000000000 /* 0x53 reserved */ | |
12807 | + .quad 0x0000000000000000 /* 0x5b reserved */ | |
12808 | + | |
12809 | + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */ | |
12810 | + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */ | |
12811 | + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */ | |
12812 | + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */ | |
12813 | + | |
12814 | + .quad 0x0000000000000000 /* 0x80 TSS descriptor */ | |
12815 | + .quad 0x0000000000000000 /* 0x88 LDT descriptor */ | |
12816 | + | |
12817 | + /* | |
12818 | + * Segments used for calling PnP BIOS have byte granularity. | |
12819 | + * The code segments and data segments have fixed 64k limits, | |
12820 | + * the transfer segment sizes are set at run time. | |
12821 | + */ | |
12822 | + .quad 0x00409b000000ffff /* 0x90 32-bit code */ | |
12823 | + .quad 0x00009b000000ffff /* 0x98 16-bit code */ | |
12824 | + .quad 0x000093000000ffff /* 0xa0 16-bit data */ | |
12825 | + .quad 0x0000930000000000 /* 0xa8 16-bit data */ | |
12826 | + .quad 0x0000930000000000 /* 0xb0 16-bit data */ | |
12827 | + | |
12828 | + /* | |
12829 | + * The APM segments have byte granularity and their bases | |
12830 | + * are set at run time. All have 64k limits. | |
12831 | + */ | |
12832 | + .quad 0x00409b000000ffff /* 0xb8 APM CS code */ | |
12833 | + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */ | |
12834 | + .quad 0x004093000000ffff /* 0xc8 APM DS data */ | |
12835 | + | |
12836 | + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */ | |
12837 | + .quad 0x0040930000000000 /* 0xd8 - PERCPU */ | |
12838 | + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */ | |
12839 | + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */ | |
12840 | + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */ | |
12841 | + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */ | |
12842 | + | |
12843 | + /* Be sure this is zeroed to avoid false validations in Xen */ | |
12844 | + .fill PAGE_SIZE_asm - GDT_SIZE,1,0 | |
12845 | + .endr | |
12846 | diff -urNp linux-3.0.3/arch/x86/kernel/head_64.S linux-3.0.3/arch/x86/kernel/head_64.S | |
12847 | --- linux-3.0.3/arch/x86/kernel/head_64.S 2011-07-21 22:17:23.000000000 -0400 | |
12848 | +++ linux-3.0.3/arch/x86/kernel/head_64.S 2011-08-23 21:47:55.000000000 -0400 | |
12849 | @@ -19,6 +19,7 @@ | |
12850 | #include <asm/cache.h> | |
12851 | #include <asm/processor-flags.h> | |
12852 | #include <asm/percpu.h> | |
12853 | +#include <asm/cpufeature.h> | |
12854 | ||
12855 | #ifdef CONFIG_PARAVIRT | |
12856 | #include <asm/asm-offsets.h> | |
12857 | @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET | |
12858 | L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET) | |
12859 | L4_START_KERNEL = pgd_index(__START_KERNEL_map) | |
12860 | L3_START_KERNEL = pud_index(__START_KERNEL_map) | |
12861 | +L4_VMALLOC_START = pgd_index(VMALLOC_START) | |
12862 | +L3_VMALLOC_START = pud_index(VMALLOC_START) | |
12863 | +L4_VMEMMAP_START = pgd_index(VMEMMAP_START) | |
12864 | +L3_VMEMMAP_START = pud_index(VMEMMAP_START) | |
12865 | ||
12866 | .text | |
12867 | __HEAD | |
12868 | @@ -85,35 +90,22 @@ startup_64: | |
12869 | */ | |
12870 | addq %rbp, init_level4_pgt + 0(%rip) | |
12871 | addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip) | |
12872 | + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip) | |
12873 | + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip) | |
12874 | addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip) | |
12875 | ||
12876 | addq %rbp, level3_ident_pgt + 0(%rip) | |
12877 | +#ifndef CONFIG_XEN | |
12878 | + addq %rbp, level3_ident_pgt + 8(%rip) | |
12879 | +#endif | |
12880 | ||
12881 | - addq %rbp, level3_kernel_pgt + (510*8)(%rip) | |
12882 | - addq %rbp, level3_kernel_pgt + (511*8)(%rip) | |
12883 | + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip) | |
12884 | ||
12885 | - addq %rbp, level2_fixmap_pgt + (506*8)(%rip) | |
12886 | + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip) | |
12887 | + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip) | |
12888 | ||
12889 | - /* Add an Identity mapping if I am above 1G */ | |
12890 | - leaq _text(%rip), %rdi | |
12891 | - andq $PMD_PAGE_MASK, %rdi | |
12892 | - | |
12893 | - movq %rdi, %rax | |
12894 | - shrq $PUD_SHIFT, %rax | |
12895 | - andq $(PTRS_PER_PUD - 1), %rax | |
12896 | - jz ident_complete | |
12897 | - | |
12898 | - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx | |
12899 | - leaq level3_ident_pgt(%rip), %rbx | |
12900 | - movq %rdx, 0(%rbx, %rax, 8) | |
12901 | - | |
12902 | - movq %rdi, %rax | |
12903 | - shrq $PMD_SHIFT, %rax | |
12904 | - andq $(PTRS_PER_PMD - 1), %rax | |
12905 | - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx | |
12906 | - leaq level2_spare_pgt(%rip), %rbx | |
12907 | - movq %rdx, 0(%rbx, %rax, 8) | |
12908 | -ident_complete: | |
12909 | + addq %rbp, level2_fixmap_pgt + (506*8)(%rip) | |
12910 | + addq %rbp, level2_fixmap_pgt + (507*8)(%rip) | |
12911 | ||
12912 | /* | |
12913 | * Fixup the kernel text+data virtual addresses. Note that | |
12914 | @@ -160,8 +152,8 @@ ENTRY(secondary_startup_64) | |
12915 | * after the boot processor executes this code. | |
12916 | */ | |
12917 | ||
12918 | - /* Enable PAE mode and PGE */ | |
12919 | - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax | |
12920 | + /* Enable PAE mode and PSE/PGE */ | |
12921 | + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax | |
12922 | movq %rax, %cr4 | |
12923 | ||
12924 | /* Setup early boot stage 4 level pagetables. */ | |
12925 | @@ -183,9 +175,14 @@ ENTRY(secondary_startup_64) | |
12926 | movl $MSR_EFER, %ecx | |
12927 | rdmsr | |
12928 | btsl $_EFER_SCE, %eax /* Enable System Call */ | |
12929 | - btl $20,%edi /* No Execute supported? */ | |
12930 | + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */ | |
12931 | jnc 1f | |
12932 | btsl $_EFER_NX, %eax | |
12933 | + leaq init_level4_pgt(%rip), %rdi | |
12934 | + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi) | |
12935 | + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi) | |
12936 | + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi) | |
12937 | + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip) | |
12938 | 1: wrmsr /* Make changes effective */ | |
12939 | ||
12940 | /* Setup cr0 */ | |
12941 | @@ -269,7 +266,7 @@ ENTRY(secondary_startup_64) | |
12942 | bad_address: | |
12943 | jmp bad_address | |
12944 | ||
12945 | - .section ".init.text","ax" | |
12946 | + __INIT | |
12947 | #ifdef CONFIG_EARLY_PRINTK | |
12948 | .globl early_idt_handlers | |
12949 | early_idt_handlers: | |
12950 | @@ -314,18 +311,23 @@ ENTRY(early_idt_handler) | |
12951 | #endif /* EARLY_PRINTK */ | |
12952 | 1: hlt | |
12953 | jmp 1b | |
12954 | + .previous | |
12955 | ||
12956 | #ifdef CONFIG_EARLY_PRINTK | |
12957 | + __INITDATA | |
12958 | early_recursion_flag: | |
12959 | .long 0 | |
12960 | + .previous | |
12961 | ||
12962 | + .section .rodata,"a",@progbits | |
12963 | early_idt_msg: | |
12964 | .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n" | |
12965 | early_idt_ripmsg: | |
12966 | .asciz "RIP %s\n" | |
12967 | -#endif /* CONFIG_EARLY_PRINTK */ | |
12968 | .previous | |
12969 | +#endif /* CONFIG_EARLY_PRINTK */ | |
12970 | ||
12971 | + .section .rodata,"a",@progbits | |
12972 | #define NEXT_PAGE(name) \ | |
12973 | .balign PAGE_SIZE; \ | |
12974 | ENTRY(name) | |
12975 | @@ -338,7 +340,6 @@ ENTRY(name) | |
12976 | i = i + 1 ; \ | |
12977 | .endr | |
12978 | ||
12979 | - .data | |
12980 | /* | |
12981 | * This default setting generates an ident mapping at address 0x100000 | |
12982 | * and a mapping for the kernel that precisely maps virtual address | |
12983 | @@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt) | |
12984 | .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
12985 | .org init_level4_pgt + L4_PAGE_OFFSET*8, 0 | |
12986 | .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
12987 | + .org init_level4_pgt + L4_VMALLOC_START*8, 0 | |
12988 | + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
12989 | + .org init_level4_pgt + L4_VMEMMAP_START*8, 0 | |
12990 | + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
12991 | .org init_level4_pgt + L4_START_KERNEL*8, 0 | |
12992 | /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */ | |
12993 | .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE | |
12994 | ||
12995 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
12996 | +NEXT_PAGE(cpu_pgd) | |
12997 | + .rept NR_CPUS | |
12998 | + .fill 512,8,0 | |
12999 | + .endr | |
13000 | +#endif | |
13001 | + | |
13002 | NEXT_PAGE(level3_ident_pgt) | |
13003 | .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
13004 | +#ifdef CONFIG_XEN | |
13005 | .fill 511,8,0 | |
13006 | +#else | |
13007 | + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE | |
13008 | + .fill 510,8,0 | |
13009 | +#endif | |
13010 | + | |
13011 | +NEXT_PAGE(level3_vmalloc_pgt) | |
13012 | + .fill 512,8,0 | |
13013 | + | |
13014 | +NEXT_PAGE(level3_vmemmap_pgt) | |
13015 | + .fill L3_VMEMMAP_START,8,0 | |
13016 | + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
13017 | ||
13018 | NEXT_PAGE(level3_kernel_pgt) | |
13019 | .fill L3_START_KERNEL,8,0 | |
13020 | @@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt) | |
13021 | .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE | |
13022 | .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE | |
13023 | ||
13024 | +NEXT_PAGE(level2_vmemmap_pgt) | |
13025 | + .fill 512,8,0 | |
13026 | + | |
13027 | NEXT_PAGE(level2_fixmap_pgt) | |
13028 | - .fill 506,8,0 | |
13029 | - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE | |
13030 | - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */ | |
13031 | - .fill 5,8,0 | |
13032 | + .fill 507,8,0 | |
13033 | + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE | |
13034 | + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */ | |
13035 | + .fill 4,8,0 | |
13036 | ||
13037 | -NEXT_PAGE(level1_fixmap_pgt) | |
13038 | +NEXT_PAGE(level1_vsyscall_pgt) | |
13039 | .fill 512,8,0 | |
13040 | ||
13041 | -NEXT_PAGE(level2_ident_pgt) | |
13042 | - /* Since I easily can, map the first 1G. | |
13043 | + /* Since I easily can, map the first 2G. | |
13044 | * Don't set NX because code runs from these pages. | |
13045 | */ | |
13046 | - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD) | |
13047 | +NEXT_PAGE(level2_ident_pgt) | |
13048 | + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD) | |
13049 | ||
13050 | NEXT_PAGE(level2_kernel_pgt) | |
13051 | /* | |
13052 | @@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt) | |
13053 | * If you want to increase this then increase MODULES_VADDR | |
13054 | * too.) | |
13055 | */ | |
13056 | - PMDS(0, __PAGE_KERNEL_LARGE_EXEC, | |
13057 | - KERNEL_IMAGE_SIZE/PMD_SIZE) | |
13058 | - | |
13059 | -NEXT_PAGE(level2_spare_pgt) | |
13060 | - .fill 512, 8, 0 | |
13061 | + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE) | |
13062 | ||
13063 | #undef PMDS | |
13064 | #undef NEXT_PAGE | |
13065 | ||
13066 | - .data | |
13067 | + .align PAGE_SIZE | |
13068 | +ENTRY(cpu_gdt_table) | |
13069 | + .rept NR_CPUS | |
13070 | + .quad 0x0000000000000000 /* NULL descriptor */ | |
13071 | + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */ | |
13072 | + .quad 0x00af9b000000ffff /* __KERNEL_CS */ | |
13073 | + .quad 0x00cf93000000ffff /* __KERNEL_DS */ | |
13074 | + .quad 0x00cffb000000ffff /* __USER32_CS */ | |
13075 | + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */ | |
13076 | + .quad 0x00affb000000ffff /* __USER_CS */ | |
13077 | + | |
13078 | +#ifdef CONFIG_PAX_KERNEXEC | |
13079 | + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */ | |
13080 | +#else | |
13081 | + .quad 0x0 /* unused */ | |
13082 | +#endif | |
13083 | + | |
13084 | + .quad 0,0 /* TSS */ | |
13085 | + .quad 0,0 /* LDT */ | |
13086 | + .quad 0,0,0 /* three TLS descriptors */ | |
13087 | + .quad 0x0000f40000000000 /* node/CPU stored in limit */ | |
13088 | + /* asm/segment.h:GDT_ENTRIES must match this */ | |
13089 | + | |
13090 | + /* zero the remaining page */ | |
13091 | + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0 | |
13092 | + .endr | |
13093 | + | |
13094 | .align 16 | |
13095 | .globl early_gdt_descr | |
13096 | early_gdt_descr: | |
13097 | .word GDT_ENTRIES*8-1 | |
13098 | early_gdt_descr_base: | |
13099 | - .quad INIT_PER_CPU_VAR(gdt_page) | |
13100 | + .quad cpu_gdt_table | |
13101 | ||
13102 | ENTRY(phys_base) | |
13103 | /* This must match the first entry in level2_kernel_pgt */ | |
13104 | .quad 0x0000000000000000 | |
13105 | ||
13106 | #include "../../x86/xen/xen-head.S" | |
13107 | - | |
13108 | - .section .bss, "aw", @nobits | |
13109 | + | |
13110 | + .section .rodata,"a",@progbits | |
13111 | .align L1_CACHE_BYTES | |
13112 | ENTRY(idt_table) | |
13113 | - .skip IDT_ENTRIES * 16 | |
13114 | + .fill 512,8,0 | |
13115 | ||
13116 | __PAGE_ALIGNED_BSS | |
13117 | .align PAGE_SIZE | |
13118 | diff -urNp linux-3.0.3/arch/x86/kernel/i386_ksyms_32.c linux-3.0.3/arch/x86/kernel/i386_ksyms_32.c | |
13119 | --- linux-3.0.3/arch/x86/kernel/i386_ksyms_32.c 2011-07-21 22:17:23.000000000 -0400 | |
13120 | +++ linux-3.0.3/arch/x86/kernel/i386_ksyms_32.c 2011-08-23 21:47:55.000000000 -0400 | |
13121 | @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void); | |
13122 | EXPORT_SYMBOL(cmpxchg8b_emu); | |
13123 | #endif | |
13124 | ||
13125 | +EXPORT_SYMBOL_GPL(cpu_gdt_table); | |
13126 | + | |
13127 | /* Networking helper routines. */ | |
13128 | EXPORT_SYMBOL(csum_partial_copy_generic); | |
13129 | +EXPORT_SYMBOL(csum_partial_copy_generic_to_user); | |
13130 | +EXPORT_SYMBOL(csum_partial_copy_generic_from_user); | |
13131 | ||
13132 | EXPORT_SYMBOL(__get_user_1); | |
13133 | EXPORT_SYMBOL(__get_user_2); | |
13134 | @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr); | |
13135 | ||
13136 | EXPORT_SYMBOL(csum_partial); | |
13137 | EXPORT_SYMBOL(empty_zero_page); | |
13138 | + | |
13139 | +#ifdef CONFIG_PAX_KERNEXEC | |
13140 | +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR); | |
13141 | +#endif | |
13142 | diff -urNp linux-3.0.3/arch/x86/kernel/i8259.c linux-3.0.3/arch/x86/kernel/i8259.c | |
13143 | --- linux-3.0.3/arch/x86/kernel/i8259.c 2011-07-21 22:17:23.000000000 -0400 | |
13144 | +++ linux-3.0.3/arch/x86/kernel/i8259.c 2011-08-23 21:47:55.000000000 -0400 | |
13145 | @@ -210,7 +210,7 @@ spurious_8259A_irq: | |
13146 | "spurious 8259A interrupt: IRQ%d.\n", irq); | |
13147 | spurious_irq_mask |= irqmask; | |
13148 | } | |
13149 | - atomic_inc(&irq_err_count); | |
13150 | + atomic_inc_unchecked(&irq_err_count); | |
13151 | /* | |
13152 | * Theoretically we do not have to handle this IRQ, | |
13153 | * but in Linux this does not cause problems and is | |
13154 | diff -urNp linux-3.0.3/arch/x86/kernel/init_task.c linux-3.0.3/arch/x86/kernel/init_task.c | |
13155 | --- linux-3.0.3/arch/x86/kernel/init_task.c 2011-07-21 22:17:23.000000000 -0400 | |
13156 | +++ linux-3.0.3/arch/x86/kernel/init_task.c 2011-08-23 21:47:55.000000000 -0400 | |
13157 | @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan | |
13158 | * way process stacks are handled. This is done by having a special | |
13159 | * "init_task" linker map entry.. | |
13160 | */ | |
13161 | -union thread_union init_thread_union __init_task_data = | |
13162 | - { INIT_THREAD_INFO(init_task) }; | |
13163 | +union thread_union init_thread_union __init_task_data; | |
13164 | ||
13165 | /* | |
13166 | * Initial task structure. | |
13167 | @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task); | |
13168 | * section. Since TSS's are completely CPU-local, we want them | |
13169 | * on exact cacheline boundaries, to eliminate cacheline ping-pong. | |
13170 | */ | |
13171 | -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS; | |
13172 | - | |
13173 | +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS }; | |
13174 | +EXPORT_SYMBOL(init_tss); | |
13175 | diff -urNp linux-3.0.3/arch/x86/kernel/ioport.c linux-3.0.3/arch/x86/kernel/ioport.c | |
13176 | --- linux-3.0.3/arch/x86/kernel/ioport.c 2011-07-21 22:17:23.000000000 -0400 | |
13177 | +++ linux-3.0.3/arch/x86/kernel/ioport.c 2011-08-23 21:48:14.000000000 -0400 | |
13178 | @@ -6,6 +6,7 @@ | |
13179 | #include <linux/sched.h> | |
13180 | #include <linux/kernel.h> | |
13181 | #include <linux/capability.h> | |
13182 | +#include <linux/security.h> | |
13183 | #include <linux/errno.h> | |
13184 | #include <linux/types.h> | |
13185 | #include <linux/ioport.h> | |
13186 | @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long | |
13187 | ||
13188 | if ((from + num <= from) || (from + num > IO_BITMAP_BITS)) | |
13189 | return -EINVAL; | |
13190 | +#ifdef CONFIG_GRKERNSEC_IO | |
13191 | + if (turn_on && grsec_disable_privio) { | |
13192 | + gr_handle_ioperm(); | |
13193 | + return -EPERM; | |
13194 | + } | |
13195 | +#endif | |
13196 | if (turn_on && !capable(CAP_SYS_RAWIO)) | |
13197 | return -EPERM; | |
13198 | ||
13199 | @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long | |
13200 | * because the ->io_bitmap_max value must match the bitmap | |
13201 | * contents: | |
13202 | */ | |
13203 | - tss = &per_cpu(init_tss, get_cpu()); | |
13204 | + tss = init_tss + get_cpu(); | |
13205 | ||
13206 | if (turn_on) | |
13207 | bitmap_clear(t->io_bitmap_ptr, from, num); | |
13208 | @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct | |
13209 | return -EINVAL; | |
13210 | /* Trying to gain more privileges? */ | |
13211 | if (level > old) { | |
13212 | +#ifdef CONFIG_GRKERNSEC_IO | |
13213 | + if (grsec_disable_privio) { | |
13214 | + gr_handle_iopl(); | |
13215 | + return -EPERM; | |
13216 | + } | |
13217 | +#endif | |
13218 | if (!capable(CAP_SYS_RAWIO)) | |
13219 | return -EPERM; | |
13220 | } | |
13221 | diff -urNp linux-3.0.3/arch/x86/kernel/irq_32.c linux-3.0.3/arch/x86/kernel/irq_32.c | |
13222 | --- linux-3.0.3/arch/x86/kernel/irq_32.c 2011-07-21 22:17:23.000000000 -0400 | |
13223 | +++ linux-3.0.3/arch/x86/kernel/irq_32.c 2011-08-23 21:47:55.000000000 -0400 | |
13224 | @@ -36,7 +36,7 @@ static int check_stack_overflow(void) | |
13225 | __asm__ __volatile__("andl %%esp,%0" : | |
13226 | "=r" (sp) : "0" (THREAD_SIZE - 1)); | |
13227 | ||
13228 | - return sp < (sizeof(struct thread_info) + STACK_WARN); | |
13229 | + return sp < STACK_WARN; | |
13230 | } | |
13231 | ||
13232 | static void print_stack_overflow(void) | |
13233 | @@ -54,8 +54,8 @@ static inline void print_stack_overflow( | |
13234 | * per-CPU IRQ handling contexts (thread information and stack) | |
13235 | */ | |
13236 | union irq_ctx { | |
13237 | - struct thread_info tinfo; | |
13238 | - u32 stack[THREAD_SIZE/sizeof(u32)]; | |
13239 | + unsigned long previous_esp; | |
13240 | + u32 stack[THREAD_SIZE/sizeof(u32)]; | |
13241 | } __attribute__((aligned(THREAD_SIZE))); | |
13242 | ||
13243 | static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx); | |
13244 | @@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo | |
13245 | static inline int | |
13246 | execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq) | |
13247 | { | |
13248 | - union irq_ctx *curctx, *irqctx; | |
13249 | + union irq_ctx *irqctx; | |
13250 | u32 *isp, arg1, arg2; | |
13251 | ||
13252 | - curctx = (union irq_ctx *) current_thread_info(); | |
13253 | irqctx = __this_cpu_read(hardirq_ctx); | |
13254 | ||
13255 | /* | |
13256 | @@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struc | |
13257 | * handler) we can't do that and just have to keep using the | |
13258 | * current stack (which is the irq stack already after all) | |
13259 | */ | |
13260 | - if (unlikely(curctx == irqctx)) | |
13261 | + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE)) | |
13262 | return 0; | |
13263 | ||
13264 | /* build the stack frame on the IRQ stack */ | |
13265 | - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx)); | |
13266 | - irqctx->tinfo.task = curctx->tinfo.task; | |
13267 | - irqctx->tinfo.previous_esp = current_stack_pointer; | |
13268 | + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8); | |
13269 | + irqctx->previous_esp = current_stack_pointer; | |
13270 | ||
13271 | - /* | |
13272 | - * Copy the softirq bits in preempt_count so that the | |
13273 | - * softirq checks work in the hardirq context. | |
13274 | - */ | |
13275 | - irqctx->tinfo.preempt_count = | |
13276 | - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) | | |
13277 | - (curctx->tinfo.preempt_count & SOFTIRQ_MASK); | |
13278 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
13279 | + __set_fs(MAKE_MM_SEG(0)); | |
13280 | +#endif | |
13281 | ||
13282 | if (unlikely(overflow)) | |
13283 | call_on_stack(print_stack_overflow, isp); | |
13284 | @@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struc | |
13285 | : "0" (irq), "1" (desc), "2" (isp), | |
13286 | "D" (desc->handle_irq) | |
13287 | : "memory", "cc", "ecx"); | |
13288 | + | |
13289 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
13290 | + __set_fs(current_thread_info()->addr_limit); | |
13291 | +#endif | |
13292 | + | |
13293 | return 1; | |
13294 | } | |
13295 | ||
13296 | @@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struc | |
13297 | */ | |
13298 | void __cpuinit irq_ctx_init(int cpu) | |
13299 | { | |
13300 | - union irq_ctx *irqctx; | |
13301 | - | |
13302 | if (per_cpu(hardirq_ctx, cpu)) | |
13303 | return; | |
13304 | ||
13305 | - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu), | |
13306 | - THREAD_FLAGS, | |
13307 | - THREAD_ORDER)); | |
13308 | - memset(&irqctx->tinfo, 0, sizeof(struct thread_info)); | |
13309 | - irqctx->tinfo.cpu = cpu; | |
13310 | - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET; | |
13311 | - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0); | |
13312 | - | |
13313 | - per_cpu(hardirq_ctx, cpu) = irqctx; | |
13314 | - | |
13315 | - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu), | |
13316 | - THREAD_FLAGS, | |
13317 | - THREAD_ORDER)); | |
13318 | - memset(&irqctx->tinfo, 0, sizeof(struct thread_info)); | |
13319 | - irqctx->tinfo.cpu = cpu; | |
13320 | - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0); | |
13321 | - | |
13322 | - per_cpu(softirq_ctx, cpu) = irqctx; | |
13323 | + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER)); | |
13324 | + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER)); | |
13325 | ||
13326 | printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n", | |
13327 | cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu)); | |
13328 | @@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu) | |
13329 | asmlinkage void do_softirq(void) | |
13330 | { | |
13331 | unsigned long flags; | |
13332 | - struct thread_info *curctx; | |
13333 | union irq_ctx *irqctx; | |
13334 | u32 *isp; | |
13335 | ||
13336 | @@ -162,15 +142,22 @@ asmlinkage void do_softirq(void) | |
13337 | local_irq_save(flags); | |
13338 | ||
13339 | if (local_softirq_pending()) { | |
13340 | - curctx = current_thread_info(); | |
13341 | irqctx = __this_cpu_read(softirq_ctx); | |
13342 | - irqctx->tinfo.task = curctx->task; | |
13343 | - irqctx->tinfo.previous_esp = current_stack_pointer; | |
13344 | + irqctx->previous_esp = current_stack_pointer; | |
13345 | ||
13346 | /* build the stack frame on the softirq stack */ | |
13347 | - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx)); | |
13348 | + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8); | |
13349 | + | |
13350 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
13351 | + __set_fs(MAKE_MM_SEG(0)); | |
13352 | +#endif | |
13353 | ||
13354 | call_on_stack(__do_softirq, isp); | |
13355 | + | |
13356 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
13357 | + __set_fs(current_thread_info()->addr_limit); | |
13358 | +#endif | |
13359 | + | |
13360 | /* | |
13361 | * Shouldn't happen, we returned above if in_interrupt(): | |
13362 | */ | |
13363 | diff -urNp linux-3.0.3/arch/x86/kernel/irq.c linux-3.0.3/arch/x86/kernel/irq.c | |
13364 | --- linux-3.0.3/arch/x86/kernel/irq.c 2011-07-21 22:17:23.000000000 -0400 | |
13365 | +++ linux-3.0.3/arch/x86/kernel/irq.c 2011-08-23 21:47:55.000000000 -0400 | |
13366 | @@ -17,7 +17,7 @@ | |
13367 | #include <asm/mce.h> | |
13368 | #include <asm/hw_irq.h> | |
13369 | ||
13370 | -atomic_t irq_err_count; | |
13371 | +atomic_unchecked_t irq_err_count; | |
13372 | ||
13373 | /* Function pointer for generic interrupt vector handling */ | |
13374 | void (*x86_platform_ipi_callback)(void) = NULL; | |
13375 | @@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file | |
13376 | seq_printf(p, "%10u ", per_cpu(mce_poll_count, j)); | |
13377 | seq_printf(p, " Machine check polls\n"); | |
13378 | #endif | |
13379 | - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count)); | |
13380 | + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count)); | |
13381 | #if defined(CONFIG_X86_IO_APIC) | |
13382 | - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count)); | |
13383 | + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count)); | |
13384 | #endif | |
13385 | return 0; | |
13386 | } | |
13387 | @@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu) | |
13388 | ||
13389 | u64 arch_irq_stat(void) | |
13390 | { | |
13391 | - u64 sum = atomic_read(&irq_err_count); | |
13392 | + u64 sum = atomic_read_unchecked(&irq_err_count); | |
13393 | ||
13394 | #ifdef CONFIG_X86_IO_APIC | |
13395 | - sum += atomic_read(&irq_mis_count); | |
13396 | + sum += atomic_read_unchecked(&irq_mis_count); | |
13397 | #endif | |
13398 | return sum; | |
13399 | } | |
13400 | diff -urNp linux-3.0.3/arch/x86/kernel/kgdb.c linux-3.0.3/arch/x86/kernel/kgdb.c | |
13401 | --- linux-3.0.3/arch/x86/kernel/kgdb.c 2011-07-21 22:17:23.000000000 -0400 | |
13402 | +++ linux-3.0.3/arch/x86/kernel/kgdb.c 2011-08-23 21:47:55.000000000 -0400 | |
13403 | @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, | |
13404 | #ifdef CONFIG_X86_32 | |
13405 | switch (regno) { | |
13406 | case GDB_SS: | |
13407 | - if (!user_mode_vm(regs)) | |
13408 | + if (!user_mode(regs)) | |
13409 | *(unsigned long *)mem = __KERNEL_DS; | |
13410 | break; | |
13411 | case GDB_SP: | |
13412 | - if (!user_mode_vm(regs)) | |
13413 | + if (!user_mode(regs)) | |
13414 | *(unsigned long *)mem = kernel_stack_pointer(regs); | |
13415 | break; | |
13416 | case GDB_GS: | |
13417 | @@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec | |
13418 | case 'k': | |
13419 | /* clear the trace bit */ | |
13420 | linux_regs->flags &= ~X86_EFLAGS_TF; | |
13421 | - atomic_set(&kgdb_cpu_doing_single_step, -1); | |
13422 | + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1); | |
13423 | ||
13424 | /* set the trace bit if we're stepping */ | |
13425 | if (remcomInBuffer[0] == 's') { | |
13426 | linux_regs->flags |= X86_EFLAGS_TF; | |
13427 | - atomic_set(&kgdb_cpu_doing_single_step, | |
13428 | + atomic_set_unchecked(&kgdb_cpu_doing_single_step, | |
13429 | raw_smp_processor_id()); | |
13430 | } | |
13431 | ||
13432 | @@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args | |
13433 | return NOTIFY_DONE; | |
13434 | ||
13435 | case DIE_DEBUG: | |
13436 | - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) { | |
13437 | + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) { | |
13438 | if (user_mode(regs)) | |
13439 | return single_step_cont(regs, args); | |
13440 | break; | |
13441 | diff -urNp linux-3.0.3/arch/x86/kernel/kprobes.c linux-3.0.3/arch/x86/kernel/kprobes.c | |
13442 | --- linux-3.0.3/arch/x86/kernel/kprobes.c 2011-07-21 22:17:23.000000000 -0400 | |
13443 | +++ linux-3.0.3/arch/x86/kernel/kprobes.c 2011-08-23 21:47:55.000000000 -0400 | |
13444 | @@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat | |
13445 | } __attribute__((packed)) *insn; | |
13446 | ||
13447 | insn = (struct __arch_relative_insn *)from; | |
13448 | + | |
13449 | + pax_open_kernel(); | |
13450 | insn->raddr = (s32)((long)(to) - ((long)(from) + 5)); | |
13451 | insn->op = op; | |
13452 | + pax_close_kernel(); | |
13453 | } | |
13454 | ||
13455 | /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/ | |
13456 | @@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op | |
13457 | kprobe_opcode_t opcode; | |
13458 | kprobe_opcode_t *orig_opcodes = opcodes; | |
13459 | ||
13460 | - if (search_exception_tables((unsigned long)opcodes)) | |
13461 | + if (search_exception_tables(ktva_ktla((unsigned long)opcodes))) | |
13462 | return 0; /* Page fault may occur on this address. */ | |
13463 | ||
13464 | retry: | |
13465 | @@ -314,7 +317,9 @@ static int __kprobes __copy_instruction( | |
13466 | } | |
13467 | } | |
13468 | insn_get_length(&insn); | |
13469 | + pax_open_kernel(); | |
13470 | memcpy(dest, insn.kaddr, insn.length); | |
13471 | + pax_close_kernel(); | |
13472 | ||
13473 | #ifdef CONFIG_X86_64 | |
13474 | if (insn_rip_relative(&insn)) { | |
13475 | @@ -338,7 +343,9 @@ static int __kprobes __copy_instruction( | |
13476 | (u8 *) dest; | |
13477 | BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */ | |
13478 | disp = (u8 *) dest + insn_offset_displacement(&insn); | |
13479 | + pax_open_kernel(); | |
13480 | *(s32 *) disp = (s32) newdisp; | |
13481 | + pax_close_kernel(); | |
13482 | } | |
13483 | #endif | |
13484 | return insn.length; | |
13485 | @@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s | |
13486 | */ | |
13487 | __copy_instruction(p->ainsn.insn, p->addr, 0); | |
13488 | ||
13489 | - if (can_boost(p->addr)) | |
13490 | + if (can_boost(ktla_ktva(p->addr))) | |
13491 | p->ainsn.boostable = 0; | |
13492 | else | |
13493 | p->ainsn.boostable = -1; | |
13494 | ||
13495 | - p->opcode = *p->addr; | |
13496 | + p->opcode = *(ktla_ktva(p->addr)); | |
13497 | } | |
13498 | ||
13499 | int __kprobes arch_prepare_kprobe(struct kprobe *p) | |
13500 | @@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s | |
13501 | * nor set current_kprobe, because it doesn't use single | |
13502 | * stepping. | |
13503 | */ | |
13504 | - regs->ip = (unsigned long)p->ainsn.insn; | |
13505 | + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn); | |
13506 | preempt_enable_no_resched(); | |
13507 | return; | |
13508 | } | |
13509 | @@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s | |
13510 | if (p->opcode == BREAKPOINT_INSTRUCTION) | |
13511 | regs->ip = (unsigned long)p->addr; | |
13512 | else | |
13513 | - regs->ip = (unsigned long)p->ainsn.insn; | |
13514 | + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn); | |
13515 | } | |
13516 | ||
13517 | /* | |
13518 | @@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru | |
13519 | setup_singlestep(p, regs, kcb, 0); | |
13520 | return 1; | |
13521 | } | |
13522 | - } else if (*addr != BREAKPOINT_INSTRUCTION) { | |
13523 | + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) { | |
13524 | /* | |
13525 | * The breakpoint instruction was removed right | |
13526 | * after we hit it. Another cpu has removed | |
13527 | @@ -817,7 +824,7 @@ static void __kprobes resume_execution(s | |
13528 | struct pt_regs *regs, struct kprobe_ctlblk *kcb) | |
13529 | { | |
13530 | unsigned long *tos = stack_addr(regs); | |
13531 | - unsigned long copy_ip = (unsigned long)p->ainsn.insn; | |
13532 | + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn); | |
13533 | unsigned long orig_ip = (unsigned long)p->addr; | |
13534 | kprobe_opcode_t *insn = p->ainsn.insn; | |
13535 | ||
13536 | @@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s | |
13537 | struct die_args *args = data; | |
13538 | int ret = NOTIFY_DONE; | |
13539 | ||
13540 | - if (args->regs && user_mode_vm(args->regs)) | |
13541 | + if (args->regs && user_mode(args->regs)) | |
13542 | return ret; | |
13543 | ||
13544 | switch (val) { | |
13545 | @@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr | |
13546 | * Verify if the address gap is in 2GB range, because this uses | |
13547 | * a relative jump. | |
13548 | */ | |
13549 | - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE; | |
13550 | + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE; | |
13551 | if (abs(rel) > 0x7fffffff) | |
13552 | return -ERANGE; | |
13553 | ||
13554 | @@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr | |
13555 | synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op); | |
13556 | ||
13557 | /* Set probe function call */ | |
13558 | - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback); | |
13559 | + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback)); | |
13560 | ||
13561 | /* Set returning jmp instruction at the tail of out-of-line buffer */ | |
13562 | synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size, | |
13563 | - (u8 *)op->kp.addr + op->optinsn.size); | |
13564 | + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size); | |
13565 | ||
13566 | flush_icache_range((unsigned long) buf, | |
13567 | (unsigned long) buf + TMPL_END_IDX + | |
13568 | @@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr | |
13569 | ((long)op->kp.addr + RELATIVEJUMP_SIZE)); | |
13570 | ||
13571 | /* Backup instructions which will be replaced by jump address */ | |
13572 | - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE, | |
13573 | + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE, | |
13574 | RELATIVE_ADDR_SIZE); | |
13575 | ||
13576 | insn_buf[0] = RELATIVEJUMP_OPCODE; | |
13577 | diff -urNp linux-3.0.3/arch/x86/kernel/kvm.c linux-3.0.3/arch/x86/kernel/kvm.c | |
13578 | --- linux-3.0.3/arch/x86/kernel/kvm.c 2011-07-21 22:17:23.000000000 -0400 | |
13579 | +++ linux-3.0.3/arch/x86/kernel/kvm.c 2011-08-24 18:10:12.000000000 -0400 | |
13580 | @@ -426,6 +426,7 @@ static void __init paravirt_ops_setup(vo | |
13581 | pv_mmu_ops.set_pud = kvm_set_pud; | |
13582 | #if PAGETABLE_LEVELS == 4 | |
13583 | pv_mmu_ops.set_pgd = kvm_set_pgd; | |
13584 | + pv_mmu_ops.set_pgd_batched = kvm_set_pgd; | |
13585 | #endif | |
13586 | #endif | |
13587 | pv_mmu_ops.flush_tlb_user = kvm_flush_tlb; | |
13588 | diff -urNp linux-3.0.3/arch/x86/kernel/ldt.c linux-3.0.3/arch/x86/kernel/ldt.c | |
13589 | --- linux-3.0.3/arch/x86/kernel/ldt.c 2011-07-21 22:17:23.000000000 -0400 | |
13590 | +++ linux-3.0.3/arch/x86/kernel/ldt.c 2011-08-23 21:47:55.000000000 -0400 | |
13591 | @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i | |
13592 | if (reload) { | |
13593 | #ifdef CONFIG_SMP | |
13594 | preempt_disable(); | |
13595 | - load_LDT(pc); | |
13596 | + load_LDT_nolock(pc); | |
13597 | if (!cpumask_equal(mm_cpumask(current->mm), | |
13598 | cpumask_of(smp_processor_id()))) | |
13599 | smp_call_function(flush_ldt, current->mm, 1); | |
13600 | preempt_enable(); | |
13601 | #else | |
13602 | - load_LDT(pc); | |
13603 | + load_LDT_nolock(pc); | |
13604 | #endif | |
13605 | } | |
13606 | if (oldsize) { | |
13607 | @@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t | |
13608 | return err; | |
13609 | ||
13610 | for (i = 0; i < old->size; i++) | |
13611 | - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE); | |
13612 | + write_ldt_entry(new->ldt, i, old->ldt + i); | |
13613 | return 0; | |
13614 | } | |
13615 | ||
13616 | @@ -116,6 +116,24 @@ int init_new_context(struct task_struct | |
13617 | retval = copy_ldt(&mm->context, &old_mm->context); | |
13618 | mutex_unlock(&old_mm->context.lock); | |
13619 | } | |
13620 | + | |
13621 | + if (tsk == current) { | |
13622 | + mm->context.vdso = 0; | |
13623 | + | |
13624 | +#ifdef CONFIG_X86_32 | |
13625 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
13626 | + mm->context.user_cs_base = 0UL; | |
13627 | + mm->context.user_cs_limit = ~0UL; | |
13628 | + | |
13629 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP) | |
13630 | + cpus_clear(mm->context.cpu_user_cs_mask); | |
13631 | +#endif | |
13632 | + | |
13633 | +#endif | |
13634 | +#endif | |
13635 | + | |
13636 | + } | |
13637 | + | |
13638 | return retval; | |
13639 | } | |
13640 | ||
13641 | @@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u | |
13642 | } | |
13643 | } | |
13644 | ||
13645 | +#ifdef CONFIG_PAX_SEGMEXEC | |
13646 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) { | |
13647 | + error = -EINVAL; | |
13648 | + goto out_unlock; | |
13649 | + } | |
13650 | +#endif | |
13651 | + | |
13652 | fill_ldt(&ldt, &ldt_info); | |
13653 | if (oldmode) | |
13654 | ldt.avl = 0; | |
13655 | diff -urNp linux-3.0.3/arch/x86/kernel/machine_kexec_32.c linux-3.0.3/arch/x86/kernel/machine_kexec_32.c | |
13656 | --- linux-3.0.3/arch/x86/kernel/machine_kexec_32.c 2011-07-21 22:17:23.000000000 -0400 | |
13657 | +++ linux-3.0.3/arch/x86/kernel/machine_kexec_32.c 2011-08-23 21:47:55.000000000 -0400 | |
13658 | @@ -27,7 +27,7 @@ | |
13659 | #include <asm/cacheflush.h> | |
13660 | #include <asm/debugreg.h> | |
13661 | ||
13662 | -static void set_idt(void *newidt, __u16 limit) | |
13663 | +static void set_idt(struct desc_struct *newidt, __u16 limit) | |
13664 | { | |
13665 | struct desc_ptr curidt; | |
13666 | ||
13667 | @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16 | |
13668 | } | |
13669 | ||
13670 | ||
13671 | -static void set_gdt(void *newgdt, __u16 limit) | |
13672 | +static void set_gdt(struct desc_struct *newgdt, __u16 limit) | |
13673 | { | |
13674 | struct desc_ptr curgdt; | |
13675 | ||
13676 | @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image) | |
13677 | } | |
13678 | ||
13679 | control_page = page_address(image->control_code_page); | |
13680 | - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE); | |
13681 | + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE); | |
13682 | ||
13683 | relocate_kernel_ptr = control_page; | |
13684 | page_list[PA_CONTROL_PAGE] = __pa(control_page); | |
13685 | diff -urNp linux-3.0.3/arch/x86/kernel/microcode_intel.c linux-3.0.3/arch/x86/kernel/microcode_intel.c | |
13686 | --- linux-3.0.3/arch/x86/kernel/microcode_intel.c 2011-07-21 22:17:23.000000000 -0400 | |
13687 | +++ linux-3.0.3/arch/x86/kernel/microcode_intel.c 2011-08-23 21:47:55.000000000 -0400 | |
13688 | @@ -440,13 +440,13 @@ static enum ucode_state request_microcod | |
13689 | ||
13690 | static int get_ucode_user(void *to, const void *from, size_t n) | |
13691 | { | |
13692 | - return copy_from_user(to, from, n); | |
13693 | + return copy_from_user(to, (__force const void __user *)from, n); | |
13694 | } | |
13695 | ||
13696 | static enum ucode_state | |
13697 | request_microcode_user(int cpu, const void __user *buf, size_t size) | |
13698 | { | |
13699 | - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user); | |
13700 | + return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user); | |
13701 | } | |
13702 | ||
13703 | static void microcode_fini_cpu(int cpu) | |
13704 | diff -urNp linux-3.0.3/arch/x86/kernel/module.c linux-3.0.3/arch/x86/kernel/module.c | |
13705 | --- linux-3.0.3/arch/x86/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
13706 | +++ linux-3.0.3/arch/x86/kernel/module.c 2011-08-23 21:47:55.000000000 -0400 | |
13707 | @@ -36,21 +36,66 @@ | |
13708 | #define DEBUGP(fmt...) | |
13709 | #endif | |
13710 | ||
13711 | -void *module_alloc(unsigned long size) | |
13712 | +static inline void *__module_alloc(unsigned long size, pgprot_t prot) | |
13713 | { | |
13714 | if (PAGE_ALIGN(size) > MODULES_LEN) | |
13715 | return NULL; | |
13716 | return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END, | |
13717 | - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC, | |
13718 | + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot, | |
13719 | -1, __builtin_return_address(0)); | |
13720 | } | |
13721 | ||
13722 | +void *module_alloc(unsigned long size) | |
13723 | +{ | |
13724 | + | |
13725 | +#ifdef CONFIG_PAX_KERNEXEC | |
13726 | + return __module_alloc(size, PAGE_KERNEL); | |
13727 | +#else | |
13728 | + return __module_alloc(size, PAGE_KERNEL_EXEC); | |
13729 | +#endif | |
13730 | + | |
13731 | +} | |
13732 | + | |
13733 | /* Free memory returned from module_alloc */ | |
13734 | void module_free(struct module *mod, void *module_region) | |
13735 | { | |
13736 | vfree(module_region); | |
13737 | } | |
13738 | ||
13739 | +#ifdef CONFIG_PAX_KERNEXEC | |
13740 | +#ifdef CONFIG_X86_32 | |
13741 | +void *module_alloc_exec(unsigned long size) | |
13742 | +{ | |
13743 | + struct vm_struct *area; | |
13744 | + | |
13745 | + if (size == 0) | |
13746 | + return NULL; | |
13747 | + | |
13748 | + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END); | |
13749 | + return area ? area->addr : NULL; | |
13750 | +} | |
13751 | +EXPORT_SYMBOL(module_alloc_exec); | |
13752 | + | |
13753 | +void module_free_exec(struct module *mod, void *module_region) | |
13754 | +{ | |
13755 | + vunmap(module_region); | |
13756 | +} | |
13757 | +EXPORT_SYMBOL(module_free_exec); | |
13758 | +#else | |
13759 | +void module_free_exec(struct module *mod, void *module_region) | |
13760 | +{ | |
13761 | + module_free(mod, module_region); | |
13762 | +} | |
13763 | +EXPORT_SYMBOL(module_free_exec); | |
13764 | + | |
13765 | +void *module_alloc_exec(unsigned long size) | |
13766 | +{ | |
13767 | + return __module_alloc(size, PAGE_KERNEL_RX); | |
13768 | +} | |
13769 | +EXPORT_SYMBOL(module_alloc_exec); | |
13770 | +#endif | |
13771 | +#endif | |
13772 | + | |
13773 | /* We don't need anything special. */ | |
13774 | int module_frob_arch_sections(Elf_Ehdr *hdr, | |
13775 | Elf_Shdr *sechdrs, | |
13776 | @@ -70,14 +115,16 @@ int apply_relocate(Elf32_Shdr *sechdrs, | |
13777 | unsigned int i; | |
13778 | Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr; | |
13779 | Elf32_Sym *sym; | |
13780 | - uint32_t *location; | |
13781 | + uint32_t *plocation, location; | |
13782 | ||
13783 | DEBUGP("Applying relocate section %u to %u\n", relsec, | |
13784 | sechdrs[relsec].sh_info); | |
13785 | for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { | |
13786 | /* This is where to make the change */ | |
13787 | - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr | |
13788 | - + rel[i].r_offset; | |
13789 | + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset; | |
13790 | + location = (uint32_t)plocation; | |
13791 | + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR) | |
13792 | + plocation = ktla_ktva((void *)plocation); | |
13793 | /* This is the symbol it is referring to. Note that all | |
13794 | undefined symbols have been resolved. */ | |
13795 | sym = (Elf32_Sym *)sechdrs[symindex].sh_addr | |
13796 | @@ -86,11 +133,15 @@ int apply_relocate(Elf32_Shdr *sechdrs, | |
13797 | switch (ELF32_R_TYPE(rel[i].r_info)) { | |
13798 | case R_386_32: | |
13799 | /* We add the value into the location given */ | |
13800 | - *location += sym->st_value; | |
13801 | + pax_open_kernel(); | |
13802 | + *plocation += sym->st_value; | |
13803 | + pax_close_kernel(); | |
13804 | break; | |
13805 | case R_386_PC32: | |
13806 | /* Add the value, subtract its postition */ | |
13807 | - *location += sym->st_value - (uint32_t)location; | |
13808 | + pax_open_kernel(); | |
13809 | + *plocation += sym->st_value - location; | |
13810 | + pax_close_kernel(); | |
13811 | break; | |
13812 | default: | |
13813 | printk(KERN_ERR "module %s: Unknown relocation: %u\n", | |
13814 | @@ -146,21 +197,30 @@ int apply_relocate_add(Elf64_Shdr *sechd | |
13815 | case R_X86_64_NONE: | |
13816 | break; | |
13817 | case R_X86_64_64: | |
13818 | + pax_open_kernel(); | |
13819 | *(u64 *)loc = val; | |
13820 | + pax_close_kernel(); | |
13821 | break; | |
13822 | case R_X86_64_32: | |
13823 | + pax_open_kernel(); | |
13824 | *(u32 *)loc = val; | |
13825 | + pax_close_kernel(); | |
13826 | if (val != *(u32 *)loc) | |
13827 | goto overflow; | |
13828 | break; | |
13829 | case R_X86_64_32S: | |
13830 | + pax_open_kernel(); | |
13831 | *(s32 *)loc = val; | |
13832 | + pax_close_kernel(); | |
13833 | if ((s64)val != *(s32 *)loc) | |
13834 | goto overflow; | |
13835 | break; | |
13836 | case R_X86_64_PC32: | |
13837 | val -= (u64)loc; | |
13838 | + pax_open_kernel(); | |
13839 | *(u32 *)loc = val; | |
13840 | + pax_close_kernel(); | |
13841 | + | |
13842 | #if 0 | |
13843 | if ((s64)val != *(s32 *)loc) | |
13844 | goto overflow; | |
13845 | diff -urNp linux-3.0.3/arch/x86/kernel/paravirt.c linux-3.0.3/arch/x86/kernel/paravirt.c | |
13846 | --- linux-3.0.3/arch/x86/kernel/paravirt.c 2011-07-21 22:17:23.000000000 -0400 | |
13847 | +++ linux-3.0.3/arch/x86/kernel/paravirt.c 2011-08-23 21:48:14.000000000 -0400 | |
13848 | @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x) | |
13849 | { | |
13850 | return x; | |
13851 | } | |
13852 | +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE) | |
13853 | +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64); | |
13854 | +#endif | |
13855 | ||
13856 | void __init default_banner(void) | |
13857 | { | |
13858 | @@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu | |
13859 | * corresponding structure. */ | |
13860 | static void *get_call_destination(u8 type) | |
13861 | { | |
13862 | - struct paravirt_patch_template tmpl = { | |
13863 | + const struct paravirt_patch_template tmpl = { | |
13864 | .pv_init_ops = pv_init_ops, | |
13865 | .pv_time_ops = pv_time_ops, | |
13866 | .pv_cpu_ops = pv_cpu_ops, | |
13867 | @@ -133,6 +136,9 @@ static void *get_call_destination(u8 typ | |
13868 | .pv_lock_ops = pv_lock_ops, | |
13869 | #endif | |
13870 | }; | |
13871 | + | |
13872 | + pax_track_stack(); | |
13873 | + | |
13874 | return *((void **)&tmpl + type); | |
13875 | } | |
13876 | ||
13877 | @@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type, | |
13878 | if (opfunc == NULL) | |
13879 | /* If there's no function, patch it with a ud2a (BUG) */ | |
13880 | ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a)); | |
13881 | - else if (opfunc == _paravirt_nop) | |
13882 | + else if (opfunc == (void *)_paravirt_nop) | |
13883 | /* If the operation is a nop, then nop the callsite */ | |
13884 | ret = paravirt_patch_nop(); | |
13885 | ||
13886 | /* identity functions just return their single argument */ | |
13887 | - else if (opfunc == _paravirt_ident_32) | |
13888 | + else if (opfunc == (void *)_paravirt_ident_32) | |
13889 | ret = paravirt_patch_ident_32(insnbuf, len); | |
13890 | - else if (opfunc == _paravirt_ident_64) | |
13891 | + else if (opfunc == (void *)_paravirt_ident_64) | |
13892 | ret = paravirt_patch_ident_64(insnbuf, len); | |
13893 | +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE) | |
13894 | + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64) | |
13895 | + ret = paravirt_patch_ident_64(insnbuf, len); | |
13896 | +#endif | |
13897 | ||
13898 | else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) || | |
13899 | type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) || | |
13900 | @@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insn | |
13901 | if (insn_len > len || start == NULL) | |
13902 | insn_len = len; | |
13903 | else | |
13904 | - memcpy(insnbuf, start, insn_len); | |
13905 | + memcpy(insnbuf, ktla_ktva(start), insn_len); | |
13906 | ||
13907 | return insn_len; | |
13908 | } | |
13909 | @@ -294,22 +304,22 @@ void arch_flush_lazy_mmu_mode(void) | |
13910 | preempt_enable(); | |
13911 | } | |
13912 | ||
13913 | -struct pv_info pv_info = { | |
13914 | +struct pv_info pv_info __read_only = { | |
13915 | .name = "bare hardware", | |
13916 | .paravirt_enabled = 0, | |
13917 | .kernel_rpl = 0, | |
13918 | .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */ | |
13919 | }; | |
13920 | ||
13921 | -struct pv_init_ops pv_init_ops = { | |
13922 | +struct pv_init_ops pv_init_ops __read_only = { | |
13923 | .patch = native_patch, | |
13924 | }; | |
13925 | ||
13926 | -struct pv_time_ops pv_time_ops = { | |
13927 | +struct pv_time_ops pv_time_ops __read_only = { | |
13928 | .sched_clock = native_sched_clock, | |
13929 | }; | |
13930 | ||
13931 | -struct pv_irq_ops pv_irq_ops = { | |
13932 | +struct pv_irq_ops pv_irq_ops __read_only = { | |
13933 | .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl), | |
13934 | .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl), | |
13935 | .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable), | |
13936 | @@ -321,7 +331,7 @@ struct pv_irq_ops pv_irq_ops = { | |
13937 | #endif | |
13938 | }; | |
13939 | ||
13940 | -struct pv_cpu_ops pv_cpu_ops = { | |
13941 | +struct pv_cpu_ops pv_cpu_ops __read_only = { | |
13942 | .cpuid = native_cpuid, | |
13943 | .get_debugreg = native_get_debugreg, | |
13944 | .set_debugreg = native_set_debugreg, | |
13945 | @@ -382,21 +392,26 @@ struct pv_cpu_ops pv_cpu_ops = { | |
13946 | .end_context_switch = paravirt_nop, | |
13947 | }; | |
13948 | ||
13949 | -struct pv_apic_ops pv_apic_ops = { | |
13950 | +struct pv_apic_ops pv_apic_ops __read_only = { | |
13951 | #ifdef CONFIG_X86_LOCAL_APIC | |
13952 | .startup_ipi_hook = paravirt_nop, | |
13953 | #endif | |
13954 | }; | |
13955 | ||
13956 | -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE) | |
13957 | +#ifdef CONFIG_X86_32 | |
13958 | +#ifdef CONFIG_X86_PAE | |
13959 | +/* 64-bit pagetable entries */ | |
13960 | +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64) | |
13961 | +#else | |
13962 | /* 32-bit pagetable entries */ | |
13963 | #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32) | |
13964 | +#endif | |
13965 | #else | |
13966 | /* 64-bit pagetable entries */ | |
13967 | #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64) | |
13968 | #endif | |
13969 | ||
13970 | -struct pv_mmu_ops pv_mmu_ops = { | |
13971 | +struct pv_mmu_ops pv_mmu_ops __read_only = { | |
13972 | ||
13973 | .read_cr2 = native_read_cr2, | |
13974 | .write_cr2 = native_write_cr2, | |
13975 | @@ -446,6 +461,7 @@ struct pv_mmu_ops pv_mmu_ops = { | |
13976 | .make_pud = PTE_IDENT, | |
13977 | ||
13978 | .set_pgd = native_set_pgd, | |
13979 | + .set_pgd_batched = native_set_pgd_batched, | |
13980 | #endif | |
13981 | #endif /* PAGETABLE_LEVELS >= 3 */ | |
13982 | ||
13983 | @@ -465,6 +481,12 @@ struct pv_mmu_ops pv_mmu_ops = { | |
13984 | }, | |
13985 | ||
13986 | .set_fixmap = native_set_fixmap, | |
13987 | + | |
13988 | +#ifdef CONFIG_PAX_KERNEXEC | |
13989 | + .pax_open_kernel = native_pax_open_kernel, | |
13990 | + .pax_close_kernel = native_pax_close_kernel, | |
13991 | +#endif | |
13992 | + | |
13993 | }; | |
13994 | ||
13995 | EXPORT_SYMBOL_GPL(pv_time_ops); | |
13996 | diff -urNp linux-3.0.3/arch/x86/kernel/paravirt-spinlocks.c linux-3.0.3/arch/x86/kernel/paravirt-spinlocks.c | |
13997 | --- linux-3.0.3/arch/x86/kernel/paravirt-spinlocks.c 2011-07-21 22:17:23.000000000 -0400 | |
13998 | +++ linux-3.0.3/arch/x86/kernel/paravirt-spinlocks.c 2011-08-23 21:47:55.000000000 -0400 | |
13999 | @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t | |
14000 | arch_spin_lock(lock); | |
14001 | } | |
14002 | ||
14003 | -struct pv_lock_ops pv_lock_ops = { | |
14004 | +struct pv_lock_ops pv_lock_ops __read_only = { | |
14005 | #ifdef CONFIG_SMP | |
14006 | .spin_is_locked = __ticket_spin_is_locked, | |
14007 | .spin_is_contended = __ticket_spin_is_contended, | |
14008 | diff -urNp linux-3.0.3/arch/x86/kernel/pci-iommu_table.c linux-3.0.3/arch/x86/kernel/pci-iommu_table.c | |
14009 | --- linux-3.0.3/arch/x86/kernel/pci-iommu_table.c 2011-07-21 22:17:23.000000000 -0400 | |
14010 | +++ linux-3.0.3/arch/x86/kernel/pci-iommu_table.c 2011-08-23 21:48:14.000000000 -0400 | |
14011 | @@ -2,7 +2,7 @@ | |
14012 | #include <asm/iommu_table.h> | |
14013 | #include <linux/string.h> | |
14014 | #include <linux/kallsyms.h> | |
14015 | - | |
14016 | +#include <linux/sched.h> | |
14017 | ||
14018 | #define DEBUG 1 | |
14019 | ||
14020 | @@ -51,6 +51,8 @@ void __init check_iommu_entries(struct i | |
14021 | { | |
14022 | struct iommu_table_entry *p, *q, *x; | |
14023 | ||
14024 | + pax_track_stack(); | |
14025 | + | |
14026 | /* Simple cyclic dependency checker. */ | |
14027 | for (p = start; p < finish; p++) { | |
14028 | q = find_dependents_of(start, finish, p); | |
14029 | diff -urNp linux-3.0.3/arch/x86/kernel/process_32.c linux-3.0.3/arch/x86/kernel/process_32.c | |
14030 | --- linux-3.0.3/arch/x86/kernel/process_32.c 2011-07-21 22:17:23.000000000 -0400 | |
14031 | +++ linux-3.0.3/arch/x86/kernel/process_32.c 2011-08-23 21:47:55.000000000 -0400 | |
14032 | @@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as | |
14033 | unsigned long thread_saved_pc(struct task_struct *tsk) | |
14034 | { | |
14035 | return ((unsigned long *)tsk->thread.sp)[3]; | |
14036 | +//XXX return tsk->thread.eip; | |
14037 | } | |
14038 | ||
14039 | #ifndef CONFIG_SMP | |
14040 | @@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i | |
14041 | unsigned long sp; | |
14042 | unsigned short ss, gs; | |
14043 | ||
14044 | - if (user_mode_vm(regs)) { | |
14045 | + if (user_mode(regs)) { | |
14046 | sp = regs->sp; | |
14047 | ss = regs->ss & 0xffff; | |
14048 | - gs = get_user_gs(regs); | |
14049 | } else { | |
14050 | sp = kernel_stack_pointer(regs); | |
14051 | savesegment(ss, ss); | |
14052 | - savesegment(gs, gs); | |
14053 | } | |
14054 | + gs = get_user_gs(regs); | |
14055 | ||
14056 | show_regs_common(); | |
14057 | ||
14058 | @@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag | |
14059 | struct task_struct *tsk; | |
14060 | int err; | |
14061 | ||
14062 | - childregs = task_pt_regs(p); | |
14063 | + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8; | |
14064 | *childregs = *regs; | |
14065 | childregs->ax = 0; | |
14066 | childregs->sp = sp; | |
14067 | ||
14068 | p->thread.sp = (unsigned long) childregs; | |
14069 | p->thread.sp0 = (unsigned long) (childregs+1); | |
14070 | + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p); | |
14071 | ||
14072 | p->thread.ip = (unsigned long) ret_from_fork; | |
14073 | ||
14074 | @@ -292,7 +293,7 @@ __switch_to(struct task_struct *prev_p, | |
14075 | struct thread_struct *prev = &prev_p->thread, | |
14076 | *next = &next_p->thread; | |
14077 | int cpu = smp_processor_id(); | |
14078 | - struct tss_struct *tss = &per_cpu(init_tss, cpu); | |
14079 | + struct tss_struct *tss = init_tss + cpu; | |
14080 | bool preload_fpu; | |
14081 | ||
14082 | /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */ | |
14083 | @@ -327,6 +328,10 @@ __switch_to(struct task_struct *prev_p, | |
14084 | */ | |
14085 | lazy_save_gs(prev->gs); | |
14086 | ||
14087 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
14088 | + __set_fs(task_thread_info(next_p)->addr_limit); | |
14089 | +#endif | |
14090 | + | |
14091 | /* | |
14092 | * Load the per-thread Thread-Local Storage descriptor. | |
14093 | */ | |
14094 | @@ -362,6 +367,9 @@ __switch_to(struct task_struct *prev_p, | |
14095 | */ | |
14096 | arch_end_context_switch(next_p); | |
14097 | ||
14098 | + percpu_write(current_task, next_p); | |
14099 | + percpu_write(current_tinfo, &next_p->tinfo); | |
14100 | + | |
14101 | if (preload_fpu) | |
14102 | __math_state_restore(); | |
14103 | ||
14104 | @@ -371,8 +379,6 @@ __switch_to(struct task_struct *prev_p, | |
14105 | if (prev->gs | next->gs) | |
14106 | lazy_load_gs(next->gs); | |
14107 | ||
14108 | - percpu_write(current_task, next_p); | |
14109 | - | |
14110 | return prev_p; | |
14111 | } | |
14112 | ||
14113 | @@ -402,4 +408,3 @@ unsigned long get_wchan(struct task_stru | |
14114 | } while (count++ < 16); | |
14115 | return 0; | |
14116 | } | |
14117 | - | |
14118 | diff -urNp linux-3.0.3/arch/x86/kernel/process_64.c linux-3.0.3/arch/x86/kernel/process_64.c | |
14119 | --- linux-3.0.3/arch/x86/kernel/process_64.c 2011-07-21 22:17:23.000000000 -0400 | |
14120 | +++ linux-3.0.3/arch/x86/kernel/process_64.c 2011-08-23 21:47:55.000000000 -0400 | |
14121 | @@ -87,7 +87,7 @@ static void __exit_idle(void) | |
14122 | void exit_idle(void) | |
14123 | { | |
14124 | /* idle loop has pid 0 */ | |
14125 | - if (current->pid) | |
14126 | + if (task_pid_nr(current)) | |
14127 | return; | |
14128 | __exit_idle(); | |
14129 | } | |
14130 | @@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag | |
14131 | struct pt_regs *childregs; | |
14132 | struct task_struct *me = current; | |
14133 | ||
14134 | - childregs = ((struct pt_regs *) | |
14135 | - (THREAD_SIZE + task_stack_page(p))) - 1; | |
14136 | + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16; | |
14137 | *childregs = *regs; | |
14138 | ||
14139 | childregs->ax = 0; | |
14140 | @@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag | |
14141 | p->thread.sp = (unsigned long) childregs; | |
14142 | p->thread.sp0 = (unsigned long) (childregs+1); | |
14143 | p->thread.usersp = me->thread.usersp; | |
14144 | + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p); | |
14145 | ||
14146 | set_tsk_thread_flag(p, TIF_FORK); | |
14147 | ||
14148 | @@ -375,7 +375,7 @@ __switch_to(struct task_struct *prev_p, | |
14149 | struct thread_struct *prev = &prev_p->thread; | |
14150 | struct thread_struct *next = &next_p->thread; | |
14151 | int cpu = smp_processor_id(); | |
14152 | - struct tss_struct *tss = &per_cpu(init_tss, cpu); | |
14153 | + struct tss_struct *tss = init_tss + cpu; | |
14154 | unsigned fsindex, gsindex; | |
14155 | bool preload_fpu; | |
14156 | ||
14157 | @@ -471,10 +471,9 @@ __switch_to(struct task_struct *prev_p, | |
14158 | prev->usersp = percpu_read(old_rsp); | |
14159 | percpu_write(old_rsp, next->usersp); | |
14160 | percpu_write(current_task, next_p); | |
14161 | + percpu_write(current_tinfo, &next_p->tinfo); | |
14162 | ||
14163 | - percpu_write(kernel_stack, | |
14164 | - (unsigned long)task_stack_page(next_p) + | |
14165 | - THREAD_SIZE - KERNEL_STACK_OFFSET); | |
14166 | + percpu_write(kernel_stack, next->sp0); | |
14167 | ||
14168 | /* | |
14169 | * Now maybe reload the debug registers and handle I/O bitmaps | |
14170 | @@ -536,12 +535,11 @@ unsigned long get_wchan(struct task_stru | |
14171 | if (!p || p == current || p->state == TASK_RUNNING) | |
14172 | return 0; | |
14173 | stack = (unsigned long)task_stack_page(p); | |
14174 | - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE) | |
14175 | + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64)) | |
14176 | return 0; | |
14177 | fp = *(u64 *)(p->thread.sp); | |
14178 | do { | |
14179 | - if (fp < (unsigned long)stack || | |
14180 | - fp >= (unsigned long)stack+THREAD_SIZE) | |
14181 | + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64)) | |
14182 | return 0; | |
14183 | ip = *(u64 *)(fp+8); | |
14184 | if (!in_sched_functions(ip)) | |
14185 | diff -urNp linux-3.0.3/arch/x86/kernel/process.c linux-3.0.3/arch/x86/kernel/process.c | |
14186 | --- linux-3.0.3/arch/x86/kernel/process.c 2011-07-21 22:17:23.000000000 -0400 | |
14187 | +++ linux-3.0.3/arch/x86/kernel/process.c 2011-08-23 21:47:55.000000000 -0400 | |
14188 | @@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru | |
14189 | ||
14190 | void free_thread_info(struct thread_info *ti) | |
14191 | { | |
14192 | - free_thread_xstate(ti->task); | |
14193 | free_pages((unsigned long)ti, get_order(THREAD_SIZE)); | |
14194 | } | |
14195 | ||
14196 | +static struct kmem_cache *task_struct_cachep; | |
14197 | + | |
14198 | void arch_task_cache_init(void) | |
14199 | { | |
14200 | - task_xstate_cachep = | |
14201 | - kmem_cache_create("task_xstate", xstate_size, | |
14202 | + /* create a slab on which task_structs can be allocated */ | |
14203 | + task_struct_cachep = | |
14204 | + kmem_cache_create("task_struct", sizeof(struct task_struct), | |
14205 | + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL); | |
14206 | + | |
14207 | + task_xstate_cachep = | |
14208 | + kmem_cache_create("task_xstate", xstate_size, | |
14209 | __alignof__(union thread_xstate), | |
14210 | - SLAB_PANIC | SLAB_NOTRACK, NULL); | |
14211 | + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL); | |
14212 | +} | |
14213 | + | |
14214 | +struct task_struct *alloc_task_struct_node(int node) | |
14215 | +{ | |
14216 | + return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node); | |
14217 | +} | |
14218 | + | |
14219 | +void free_task_struct(struct task_struct *task) | |
14220 | +{ | |
14221 | + free_thread_xstate(task); | |
14222 | + kmem_cache_free(task_struct_cachep, task); | |
14223 | } | |
14224 | ||
14225 | /* | |
14226 | @@ -70,7 +87,7 @@ void exit_thread(void) | |
14227 | unsigned long *bp = t->io_bitmap_ptr; | |
14228 | ||
14229 | if (bp) { | |
14230 | - struct tss_struct *tss = &per_cpu(init_tss, get_cpu()); | |
14231 | + struct tss_struct *tss = init_tss + get_cpu(); | |
14232 | ||
14233 | t->io_bitmap_ptr = NULL; | |
14234 | clear_thread_flag(TIF_IO_BITMAP); | |
14235 | @@ -106,7 +123,7 @@ void show_regs_common(void) | |
14236 | ||
14237 | printk(KERN_CONT "\n"); | |
14238 | printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s", | |
14239 | - current->pid, current->comm, print_tainted(), | |
14240 | + task_pid_nr(current), current->comm, print_tainted(), | |
14241 | init_utsname()->release, | |
14242 | (int)strcspn(init_utsname()->version, " "), | |
14243 | init_utsname()->version); | |
14244 | @@ -120,6 +137,9 @@ void flush_thread(void) | |
14245 | { | |
14246 | struct task_struct *tsk = current; | |
14247 | ||
14248 | +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF) | |
14249 | + loadsegment(gs, 0); | |
14250 | +#endif | |
14251 | flush_ptrace_hw_breakpoint(tsk); | |
14252 | memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array)); | |
14253 | /* | |
14254 | @@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi | |
14255 | regs.di = (unsigned long) arg; | |
14256 | ||
14257 | #ifdef CONFIG_X86_32 | |
14258 | - regs.ds = __USER_DS; | |
14259 | - regs.es = __USER_DS; | |
14260 | + regs.ds = __KERNEL_DS; | |
14261 | + regs.es = __KERNEL_DS; | |
14262 | regs.fs = __KERNEL_PERCPU; | |
14263 | - regs.gs = __KERNEL_STACK_CANARY; | |
14264 | + savesegment(gs, regs.gs); | |
14265 | #else | |
14266 | regs.ss = __KERNEL_DS; | |
14267 | #endif | |
14268 | @@ -403,7 +423,7 @@ void default_idle(void) | |
14269 | EXPORT_SYMBOL(default_idle); | |
14270 | #endif | |
14271 | ||
14272 | -void stop_this_cpu(void *dummy) | |
14273 | +__noreturn void stop_this_cpu(void *dummy) | |
14274 | { | |
14275 | local_irq_disable(); | |
14276 | /* | |
14277 | @@ -668,16 +688,34 @@ static int __init idle_setup(char *str) | |
14278 | } | |
14279 | early_param("idle", idle_setup); | |
14280 | ||
14281 | -unsigned long arch_align_stack(unsigned long sp) | |
14282 | +#ifdef CONFIG_PAX_RANDKSTACK | |
14283 | +asmlinkage void pax_randomize_kstack(void) | |
14284 | { | |
14285 | - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) | |
14286 | - sp -= get_random_int() % 8192; | |
14287 | - return sp & ~0xf; | |
14288 | -} | |
14289 | + struct thread_struct *thread = ¤t->thread; | |
14290 | + unsigned long time; | |
14291 | ||
14292 | -unsigned long arch_randomize_brk(struct mm_struct *mm) | |
14293 | -{ | |
14294 | - unsigned long range_end = mm->brk + 0x02000000; | |
14295 | - return randomize_range(mm->brk, range_end, 0) ? : mm->brk; | |
14296 | -} | |
14297 | + if (!randomize_va_space) | |
14298 | + return; | |
14299 | + | |
14300 | + rdtscl(time); | |
14301 | + | |
14302 | + /* P4 seems to return a 0 LSB, ignore it */ | |
14303 | +#ifdef CONFIG_MPENTIUM4 | |
14304 | + time &= 0x3EUL; | |
14305 | + time <<= 2; | |
14306 | +#elif defined(CONFIG_X86_64) | |
14307 | + time &= 0xFUL; | |
14308 | + time <<= 4; | |
14309 | +#else | |
14310 | + time &= 0x1FUL; | |
14311 | + time <<= 3; | |
14312 | +#endif | |
14313 | + | |
14314 | + thread->sp0 ^= time; | |
14315 | + load_sp0(init_tss + smp_processor_id(), thread); | |
14316 | ||
14317 | +#ifdef CONFIG_X86_64 | |
14318 | + percpu_write(kernel_stack, thread->sp0); | |
14319 | +#endif | |
14320 | +} | |
14321 | +#endif | |
14322 | diff -urNp linux-3.0.3/arch/x86/kernel/ptrace.c linux-3.0.3/arch/x86/kernel/ptrace.c | |
14323 | --- linux-3.0.3/arch/x86/kernel/ptrace.c 2011-07-21 22:17:23.000000000 -0400 | |
14324 | +++ linux-3.0.3/arch/x86/kernel/ptrace.c 2011-08-23 21:47:55.000000000 -0400 | |
14325 | @@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi | |
14326 | unsigned long addr, unsigned long data) | |
14327 | { | |
14328 | int ret; | |
14329 | - unsigned long __user *datap = (unsigned long __user *)data; | |
14330 | + unsigned long __user *datap = (__force unsigned long __user *)data; | |
14331 | ||
14332 | switch (request) { | |
14333 | /* read the word at location addr in the USER area. */ | |
14334 | @@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi | |
14335 | if ((int) addr < 0) | |
14336 | return -EIO; | |
14337 | ret = do_get_thread_area(child, addr, | |
14338 | - (struct user_desc __user *)data); | |
14339 | + (__force struct user_desc __user *) data); | |
14340 | break; | |
14341 | ||
14342 | case PTRACE_SET_THREAD_AREA: | |
14343 | if ((int) addr < 0) | |
14344 | return -EIO; | |
14345 | ret = do_set_thread_area(child, addr, | |
14346 | - (struct user_desc __user *)data, 0); | |
14347 | + (__force struct user_desc __user *) data, 0); | |
14348 | break; | |
14349 | #endif | |
14350 | ||
14351 | @@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas | |
14352 | memset(info, 0, sizeof(*info)); | |
14353 | info->si_signo = SIGTRAP; | |
14354 | info->si_code = si_code; | |
14355 | - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL; | |
14356 | + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL; | |
14357 | } | |
14358 | ||
14359 | void user_single_step_siginfo(struct task_struct *tsk, | |
14360 | diff -urNp linux-3.0.3/arch/x86/kernel/pvclock.c linux-3.0.3/arch/x86/kernel/pvclock.c | |
14361 | --- linux-3.0.3/arch/x86/kernel/pvclock.c 2011-07-21 22:17:23.000000000 -0400 | |
14362 | +++ linux-3.0.3/arch/x86/kernel/pvclock.c 2011-08-23 21:47:55.000000000 -0400 | |
14363 | @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc | |
14364 | return pv_tsc_khz; | |
14365 | } | |
14366 | ||
14367 | -static atomic64_t last_value = ATOMIC64_INIT(0); | |
14368 | +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0); | |
14369 | ||
14370 | void pvclock_resume(void) | |
14371 | { | |
14372 | - atomic64_set(&last_value, 0); | |
14373 | + atomic64_set_unchecked(&last_value, 0); | |
14374 | } | |
14375 | ||
14376 | cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) | |
14377 | @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct | |
14378 | * updating at the same time, and one of them could be slightly behind, | |
14379 | * making the assumption that last_value always go forward fail to hold. | |
14380 | */ | |
14381 | - last = atomic64_read(&last_value); | |
14382 | + last = atomic64_read_unchecked(&last_value); | |
14383 | do { | |
14384 | if (ret < last) | |
14385 | return last; | |
14386 | - last = atomic64_cmpxchg(&last_value, last, ret); | |
14387 | + last = atomic64_cmpxchg_unchecked(&last_value, last, ret); | |
14388 | } while (unlikely(last != ret)); | |
14389 | ||
14390 | return ret; | |
14391 | diff -urNp linux-3.0.3/arch/x86/kernel/reboot.c linux-3.0.3/arch/x86/kernel/reboot.c | |
14392 | --- linux-3.0.3/arch/x86/kernel/reboot.c 2011-07-21 22:17:23.000000000 -0400 | |
14393 | +++ linux-3.0.3/arch/x86/kernel/reboot.c 2011-08-23 21:47:55.000000000 -0400 | |
14394 | @@ -35,7 +35,7 @@ void (*pm_power_off)(void); | |
14395 | EXPORT_SYMBOL(pm_power_off); | |
14396 | ||
14397 | static const struct desc_ptr no_idt = {}; | |
14398 | -static int reboot_mode; | |
14399 | +static unsigned short reboot_mode; | |
14400 | enum reboot_type reboot_type = BOOT_ACPI; | |
14401 | int reboot_force; | |
14402 | ||
14403 | @@ -315,13 +315,17 @@ core_initcall(reboot_init); | |
14404 | extern const unsigned char machine_real_restart_asm[]; | |
14405 | extern const u64 machine_real_restart_gdt[3]; | |
14406 | ||
14407 | -void machine_real_restart(unsigned int type) | |
14408 | +__noreturn void machine_real_restart(unsigned int type) | |
14409 | { | |
14410 | void *restart_va; | |
14411 | unsigned long restart_pa; | |
14412 | - void (*restart_lowmem)(unsigned int); | |
14413 | + void (* __noreturn restart_lowmem)(unsigned int); | |
14414 | u64 *lowmem_gdt; | |
14415 | ||
14416 | +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)) | |
14417 | + struct desc_struct *gdt; | |
14418 | +#endif | |
14419 | + | |
14420 | local_irq_disable(); | |
14421 | ||
14422 | /* Write zero to CMOS register number 0x0f, which the BIOS POST | |
14423 | @@ -347,14 +351,14 @@ void machine_real_restart(unsigned int t | |
14424 | boot)". This seems like a fairly standard thing that gets set by | |
14425 | REBOOT.COM programs, and the previous reset routine did this | |
14426 | too. */ | |
14427 | - *((unsigned short *)0x472) = reboot_mode; | |
14428 | + *(unsigned short *)(__va(0x472)) = reboot_mode; | |
14429 | ||
14430 | /* Patch the GDT in the low memory trampoline */ | |
14431 | lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt); | |
14432 | ||
14433 | restart_va = TRAMPOLINE_SYM(machine_real_restart_asm); | |
14434 | restart_pa = virt_to_phys(restart_va); | |
14435 | - restart_lowmem = (void (*)(unsigned int))restart_pa; | |
14436 | + restart_lowmem = (void *)restart_pa; | |
14437 | ||
14438 | /* GDT[0]: GDT self-pointer */ | |
14439 | lowmem_gdt[0] = | |
14440 | @@ -365,7 +369,33 @@ void machine_real_restart(unsigned int t | |
14441 | GDT_ENTRY(0x009b, restart_pa, 0xffff); | |
14442 | ||
14443 | /* Jump to the identity-mapped low memory code */ | |
14444 | + | |
14445 | +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)) | |
14446 | + gdt = get_cpu_gdt_table(smp_processor_id()); | |
14447 | + pax_open_kernel(); | |
14448 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
14449 | + gdt[GDT_ENTRY_KERNEL_DS].type = 3; | |
14450 | + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf; | |
14451 | + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory"); | |
14452 | +#endif | |
14453 | +#ifdef CONFIG_PAX_KERNEXEC | |
14454 | + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0; | |
14455 | + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0; | |
14456 | + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0; | |
14457 | + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff; | |
14458 | + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf; | |
14459 | + gdt[GDT_ENTRY_KERNEL_CS].g = 1; | |
14460 | +#endif | |
14461 | + pax_close_kernel(); | |
14462 | +#endif | |
14463 | + | |
14464 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
14465 | + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type)); | |
14466 | + unreachable(); | |
14467 | +#else | |
14468 | restart_lowmem(type); | |
14469 | +#endif | |
14470 | + | |
14471 | } | |
14472 | #ifdef CONFIG_APM_MODULE | |
14473 | EXPORT_SYMBOL(machine_real_restart); | |
14474 | @@ -523,7 +553,7 @@ void __attribute__((weak)) mach_reboot_f | |
14475 | * try to force a triple fault and then cycle between hitting the keyboard | |
14476 | * controller and doing that | |
14477 | */ | |
14478 | -static void native_machine_emergency_restart(void) | |
14479 | +__noreturn static void native_machine_emergency_restart(void) | |
14480 | { | |
14481 | int i; | |
14482 | int attempt = 0; | |
14483 | @@ -647,13 +677,13 @@ void native_machine_shutdown(void) | |
14484 | #endif | |
14485 | } | |
14486 | ||
14487 | -static void __machine_emergency_restart(int emergency) | |
14488 | +static __noreturn void __machine_emergency_restart(int emergency) | |
14489 | { | |
14490 | reboot_emergency = emergency; | |
14491 | machine_ops.emergency_restart(); | |
14492 | } | |
14493 | ||
14494 | -static void native_machine_restart(char *__unused) | |
14495 | +static __noreturn void native_machine_restart(char *__unused) | |
14496 | { | |
14497 | printk("machine restart\n"); | |
14498 | ||
14499 | @@ -662,7 +692,7 @@ static void native_machine_restart(char | |
14500 | __machine_emergency_restart(0); | |
14501 | } | |
14502 | ||
14503 | -static void native_machine_halt(void) | |
14504 | +static __noreturn void native_machine_halt(void) | |
14505 | { | |
14506 | /* stop other cpus and apics */ | |
14507 | machine_shutdown(); | |
14508 | @@ -673,7 +703,7 @@ static void native_machine_halt(void) | |
14509 | stop_this_cpu(NULL); | |
14510 | } | |
14511 | ||
14512 | -static void native_machine_power_off(void) | |
14513 | +__noreturn static void native_machine_power_off(void) | |
14514 | { | |
14515 | if (pm_power_off) { | |
14516 | if (!reboot_force) | |
14517 | @@ -682,6 +712,7 @@ static void native_machine_power_off(voi | |
14518 | } | |
14519 | /* a fallback in case there is no PM info available */ | |
14520 | tboot_shutdown(TB_SHUTDOWN_HALT); | |
14521 | + unreachable(); | |
14522 | } | |
14523 | ||
14524 | struct machine_ops machine_ops = { | |
14525 | diff -urNp linux-3.0.3/arch/x86/kernel/setup.c linux-3.0.3/arch/x86/kernel/setup.c | |
14526 | --- linux-3.0.3/arch/x86/kernel/setup.c 2011-07-21 22:17:23.000000000 -0400 | |
14527 | +++ linux-3.0.3/arch/x86/kernel/setup.c 2011-08-23 21:47:55.000000000 -0400 | |
14528 | @@ -650,7 +650,7 @@ static void __init trim_bios_range(void) | |
14529 | * area (640->1Mb) as ram even though it is not. | |
14530 | * take them out. | |
14531 | */ | |
14532 | - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1); | |
14533 | + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1); | |
14534 | sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map); | |
14535 | } | |
14536 | ||
14537 | @@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p) | |
14538 | ||
14539 | if (!boot_params.hdr.root_flags) | |
14540 | root_mountflags &= ~MS_RDONLY; | |
14541 | - init_mm.start_code = (unsigned long) _text; | |
14542 | - init_mm.end_code = (unsigned long) _etext; | |
14543 | + init_mm.start_code = ktla_ktva((unsigned long) _text); | |
14544 | + init_mm.end_code = ktla_ktva((unsigned long) _etext); | |
14545 | init_mm.end_data = (unsigned long) _edata; | |
14546 | init_mm.brk = _brk_end; | |
14547 | ||
14548 | - code_resource.start = virt_to_phys(_text); | |
14549 | - code_resource.end = virt_to_phys(_etext)-1; | |
14550 | - data_resource.start = virt_to_phys(_etext); | |
14551 | + code_resource.start = virt_to_phys(ktla_ktva(_text)); | |
14552 | + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1; | |
14553 | + data_resource.start = virt_to_phys(_sdata); | |
14554 | data_resource.end = virt_to_phys(_edata)-1; | |
14555 | bss_resource.start = virt_to_phys(&__bss_start); | |
14556 | bss_resource.end = virt_to_phys(&__bss_stop)-1; | |
14557 | diff -urNp linux-3.0.3/arch/x86/kernel/setup_percpu.c linux-3.0.3/arch/x86/kernel/setup_percpu.c | |
14558 | --- linux-3.0.3/arch/x86/kernel/setup_percpu.c 2011-07-21 22:17:23.000000000 -0400 | |
14559 | +++ linux-3.0.3/arch/x86/kernel/setup_percpu.c 2011-08-23 21:47:55.000000000 -0400 | |
14560 | @@ -21,19 +21,17 @@ | |
14561 | #include <asm/cpu.h> | |
14562 | #include <asm/stackprotector.h> | |
14563 | ||
14564 | -DEFINE_PER_CPU(int, cpu_number); | |
14565 | +#ifdef CONFIG_SMP | |
14566 | +DEFINE_PER_CPU(unsigned int, cpu_number); | |
14567 | EXPORT_PER_CPU_SYMBOL(cpu_number); | |
14568 | +#endif | |
14569 | ||
14570 | -#ifdef CONFIG_X86_64 | |
14571 | #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load) | |
14572 | -#else | |
14573 | -#define BOOT_PERCPU_OFFSET 0 | |
14574 | -#endif | |
14575 | ||
14576 | DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET; | |
14577 | EXPORT_PER_CPU_SYMBOL(this_cpu_off); | |
14578 | ||
14579 | -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = { | |
14580 | +unsigned long __per_cpu_offset[NR_CPUS] __read_only = { | |
14581 | [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET, | |
14582 | }; | |
14583 | EXPORT_SYMBOL(__per_cpu_offset); | |
14584 | @@ -155,10 +153,10 @@ static inline void setup_percpu_segment( | |
14585 | { | |
14586 | #ifdef CONFIG_X86_32 | |
14587 | struct desc_struct gdt; | |
14588 | + unsigned long base = per_cpu_offset(cpu); | |
14589 | ||
14590 | - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF, | |
14591 | - 0x2 | DESCTYPE_S, 0x8); | |
14592 | - gdt.s = 1; | |
14593 | + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT, | |
14594 | + 0x83 | DESCTYPE_S, 0xC); | |
14595 | write_gdt_entry(get_cpu_gdt_table(cpu), | |
14596 | GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S); | |
14597 | #endif | |
14598 | @@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void) | |
14599 | /* alrighty, percpu areas up and running */ | |
14600 | delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start; | |
14601 | for_each_possible_cpu(cpu) { | |
14602 | +#ifdef CONFIG_CC_STACKPROTECTOR | |
14603 | +#ifdef CONFIG_X86_32 | |
14604 | + unsigned long canary = per_cpu(stack_canary.canary, cpu); | |
14605 | +#endif | |
14606 | +#endif | |
14607 | per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu]; | |
14608 | per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu); | |
14609 | per_cpu(cpu_number, cpu) = cpu; | |
14610 | @@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void) | |
14611 | */ | |
14612 | set_cpu_numa_node(cpu, early_cpu_to_node(cpu)); | |
14613 | #endif | |
14614 | +#ifdef CONFIG_CC_STACKPROTECTOR | |
14615 | +#ifdef CONFIG_X86_32 | |
14616 | + if (!cpu) | |
14617 | + per_cpu(stack_canary.canary, cpu) = canary; | |
14618 | +#endif | |
14619 | +#endif | |
14620 | /* | |
14621 | * Up to this point, the boot CPU has been using .init.data | |
14622 | * area. Reload any changed state for the boot CPU. | |
14623 | diff -urNp linux-3.0.3/arch/x86/kernel/signal.c linux-3.0.3/arch/x86/kernel/signal.c | |
14624 | --- linux-3.0.3/arch/x86/kernel/signal.c 2011-07-21 22:17:23.000000000 -0400 | |
14625 | +++ linux-3.0.3/arch/x86/kernel/signal.c 2011-08-23 21:48:14.000000000 -0400 | |
14626 | @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi | |
14627 | * Align the stack pointer according to the i386 ABI, | |
14628 | * i.e. so that on function entry ((sp + 4) & 15) == 0. | |
14629 | */ | |
14630 | - sp = ((sp + 4) & -16ul) - 4; | |
14631 | + sp = ((sp - 12) & -16ul) - 4; | |
14632 | #else /* !CONFIG_X86_32 */ | |
14633 | sp = round_down(sp, 16) - 8; | |
14634 | #endif | |
14635 | @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str | |
14636 | * Return an always-bogus address instead so we will die with SIGSEGV. | |
14637 | */ | |
14638 | if (onsigstack && !likely(on_sig_stack(sp))) | |
14639 | - return (void __user *)-1L; | |
14640 | + return (__force void __user *)-1L; | |
14641 | ||
14642 | /* save i387 state */ | |
14643 | if (used_math() && save_i387_xstate(*fpstate) < 0) | |
14644 | - return (void __user *)-1L; | |
14645 | + return (__force void __user *)-1L; | |
14646 | ||
14647 | return (void __user *)sp; | |
14648 | } | |
14649 | @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio | |
14650 | } | |
14651 | ||
14652 | if (current->mm->context.vdso) | |
14653 | - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn); | |
14654 | + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn); | |
14655 | else | |
14656 | - restorer = &frame->retcode; | |
14657 | + restorer = (void __user *)&frame->retcode; | |
14658 | if (ka->sa.sa_flags & SA_RESTORER) | |
14659 | restorer = ka->sa.sa_restorer; | |
14660 | ||
14661 | @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio | |
14662 | * reasons and because gdb uses it as a signature to notice | |
14663 | * signal handler stack frames. | |
14664 | */ | |
14665 | - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode); | |
14666 | + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode); | |
14667 | ||
14668 | if (err) | |
14669 | return -EFAULT; | |
14670 | @@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str | |
14671 | err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); | |
14672 | ||
14673 | /* Set up to return from userspace. */ | |
14674 | - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); | |
14675 | + if (current->mm->context.vdso) | |
14676 | + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); | |
14677 | + else | |
14678 | + restorer = (void __user *)&frame->retcode; | |
14679 | if (ka->sa.sa_flags & SA_RESTORER) | |
14680 | restorer = ka->sa.sa_restorer; | |
14681 | put_user_ex(restorer, &frame->pretcode); | |
14682 | @@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str | |
14683 | * reasons and because gdb uses it as a signature to notice | |
14684 | * signal handler stack frames. | |
14685 | */ | |
14686 | - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode); | |
14687 | + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode); | |
14688 | } put_user_catch(err); | |
14689 | ||
14690 | if (err) | |
14691 | @@ -769,6 +772,8 @@ static void do_signal(struct pt_regs *re | |
14692 | int signr; | |
14693 | sigset_t *oldset; | |
14694 | ||
14695 | + pax_track_stack(); | |
14696 | + | |
14697 | /* | |
14698 | * We want the common case to go fast, which is why we may in certain | |
14699 | * cases get here from kernel mode. Just return without doing anything | |
14700 | @@ -776,7 +781,7 @@ static void do_signal(struct pt_regs *re | |
14701 | * X86_32: vm86 regs switched out by assembly code before reaching | |
14702 | * here, so testing against kernel CS suffices. | |
14703 | */ | |
14704 | - if (!user_mode(regs)) | |
14705 | + if (!user_mode_novm(regs)) | |
14706 | return; | |
14707 | ||
14708 | if (current_thread_info()->status & TS_RESTORE_SIGMASK) | |
14709 | diff -urNp linux-3.0.3/arch/x86/kernel/smpboot.c linux-3.0.3/arch/x86/kernel/smpboot.c | |
14710 | --- linux-3.0.3/arch/x86/kernel/smpboot.c 2011-07-21 22:17:23.000000000 -0400 | |
14711 | +++ linux-3.0.3/arch/x86/kernel/smpboot.c 2011-08-23 21:47:55.000000000 -0400 | |
14712 | @@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int api | |
14713 | set_idle_for_cpu(cpu, c_idle.idle); | |
14714 | do_rest: | |
14715 | per_cpu(current_task, cpu) = c_idle.idle; | |
14716 | + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo; | |
14717 | #ifdef CONFIG_X86_32 | |
14718 | /* Stack for startup_32 can be just as for start_secondary onwards */ | |
14719 | irq_ctx_init(cpu); | |
14720 | #else | |
14721 | clear_tsk_thread_flag(c_idle.idle, TIF_FORK); | |
14722 | initial_gs = per_cpu_offset(cpu); | |
14723 | - per_cpu(kernel_stack, cpu) = | |
14724 | - (unsigned long)task_stack_page(c_idle.idle) - | |
14725 | - KERNEL_STACK_OFFSET + THREAD_SIZE; | |
14726 | + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE; | |
14727 | #endif | |
14728 | + | |
14729 | + pax_open_kernel(); | |
14730 | early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu); | |
14731 | + pax_close_kernel(); | |
14732 | + | |
14733 | initial_code = (unsigned long)start_secondary; | |
14734 | stack_start = c_idle.idle->thread.sp; | |
14735 | ||
14736 | @@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int | |
14737 | ||
14738 | per_cpu(cpu_state, cpu) = CPU_UP_PREPARE; | |
14739 | ||
14740 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
14741 | + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY, | |
14742 | + swapper_pg_dir + KERNEL_PGD_BOUNDARY, | |
14743 | + KERNEL_PGD_PTRS); | |
14744 | +#endif | |
14745 | + | |
14746 | err = do_boot_cpu(apicid, cpu); | |
14747 | if (err) { | |
14748 | pr_debug("do_boot_cpu failed %d\n", err); | |
14749 | diff -urNp linux-3.0.3/arch/x86/kernel/step.c linux-3.0.3/arch/x86/kernel/step.c | |
14750 | --- linux-3.0.3/arch/x86/kernel/step.c 2011-07-21 22:17:23.000000000 -0400 | |
14751 | +++ linux-3.0.3/arch/x86/kernel/step.c 2011-08-23 21:47:55.000000000 -0400 | |
14752 | @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc | |
14753 | struct desc_struct *desc; | |
14754 | unsigned long base; | |
14755 | ||
14756 | - seg &= ~7UL; | |
14757 | + seg >>= 3; | |
14758 | ||
14759 | mutex_lock(&child->mm->context.lock); | |
14760 | - if (unlikely((seg >> 3) >= child->mm->context.size)) | |
14761 | + if (unlikely(seg >= child->mm->context.size)) | |
14762 | addr = -1L; /* bogus selector, access would fault */ | |
14763 | else { | |
14764 | desc = child->mm->context.ldt + seg; | |
14765 | @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc | |
14766 | addr += base; | |
14767 | } | |
14768 | mutex_unlock(&child->mm->context.lock); | |
14769 | - } | |
14770 | + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS) | |
14771 | + addr = ktla_ktva(addr); | |
14772 | ||
14773 | return addr; | |
14774 | } | |
14775 | @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t | |
14776 | unsigned char opcode[15]; | |
14777 | unsigned long addr = convert_ip_to_linear(child, regs); | |
14778 | ||
14779 | + if (addr == -EINVAL) | |
14780 | + return 0; | |
14781 | + | |
14782 | copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0); | |
14783 | for (i = 0; i < copied; i++) { | |
14784 | switch (opcode[i]) { | |
14785 | @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t | |
14786 | ||
14787 | #ifdef CONFIG_X86_64 | |
14788 | case 0x40 ... 0x4f: | |
14789 | - if (regs->cs != __USER_CS) | |
14790 | + if ((regs->cs & 0xffff) != __USER_CS) | |
14791 | /* 32-bit mode: register increment */ | |
14792 | return 0; | |
14793 | /* 64-bit mode: REX prefix */ | |
14794 | diff -urNp linux-3.0.3/arch/x86/kernel/syscall_table_32.S linux-3.0.3/arch/x86/kernel/syscall_table_32.S | |
14795 | --- linux-3.0.3/arch/x86/kernel/syscall_table_32.S 2011-07-21 22:17:23.000000000 -0400 | |
14796 | +++ linux-3.0.3/arch/x86/kernel/syscall_table_32.S 2011-08-23 21:47:55.000000000 -0400 | |
14797 | @@ -1,3 +1,4 @@ | |
14798 | +.section .rodata,"a",@progbits | |
14799 | ENTRY(sys_call_table) | |
14800 | .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */ | |
14801 | .long sys_exit | |
14802 | diff -urNp linux-3.0.3/arch/x86/kernel/sys_i386_32.c linux-3.0.3/arch/x86/kernel/sys_i386_32.c | |
14803 | --- linux-3.0.3/arch/x86/kernel/sys_i386_32.c 2011-07-21 22:17:23.000000000 -0400 | |
14804 | +++ linux-3.0.3/arch/x86/kernel/sys_i386_32.c 2011-08-23 21:47:55.000000000 -0400 | |
14805 | @@ -24,17 +24,224 @@ | |
14806 | ||
14807 | #include <asm/syscalls.h> | |
14808 | ||
14809 | -/* | |
14810 | - * Do a system call from kernel instead of calling sys_execve so we | |
14811 | - * end up with proper pt_regs. | |
14812 | - */ | |
14813 | -int kernel_execve(const char *filename, | |
14814 | - const char *const argv[], | |
14815 | - const char *const envp[]) | |
14816 | +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags) | |
14817 | { | |
14818 | - long __res; | |
14819 | - asm volatile ("int $0x80" | |
14820 | - : "=a" (__res) | |
14821 | - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory"); | |
14822 | - return __res; | |
14823 | + unsigned long pax_task_size = TASK_SIZE; | |
14824 | + | |
14825 | +#ifdef CONFIG_PAX_SEGMEXEC | |
14826 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) | |
14827 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
14828 | +#endif | |
14829 | + | |
14830 | + if (len > pax_task_size || addr > pax_task_size - len) | |
14831 | + return -EINVAL; | |
14832 | + | |
14833 | + return 0; | |
14834 | +} | |
14835 | + | |
14836 | +unsigned long | |
14837 | +arch_get_unmapped_area(struct file *filp, unsigned long addr, | |
14838 | + unsigned long len, unsigned long pgoff, unsigned long flags) | |
14839 | +{ | |
14840 | + struct mm_struct *mm = current->mm; | |
14841 | + struct vm_area_struct *vma; | |
14842 | + unsigned long start_addr, pax_task_size = TASK_SIZE; | |
14843 | + | |
14844 | +#ifdef CONFIG_PAX_SEGMEXEC | |
14845 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
14846 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
14847 | +#endif | |
14848 | + | |
14849 | + pax_task_size -= PAGE_SIZE; | |
14850 | + | |
14851 | + if (len > pax_task_size) | |
14852 | + return -ENOMEM; | |
14853 | + | |
14854 | + if (flags & MAP_FIXED) | |
14855 | + return addr; | |
14856 | + | |
14857 | +#ifdef CONFIG_PAX_RANDMMAP | |
14858 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
14859 | +#endif | |
14860 | + | |
14861 | + if (addr) { | |
14862 | + addr = PAGE_ALIGN(addr); | |
14863 | + if (pax_task_size - len >= addr) { | |
14864 | + vma = find_vma(mm, addr); | |
14865 | + if (check_heap_stack_gap(vma, addr, len)) | |
14866 | + return addr; | |
14867 | + } | |
14868 | + } | |
14869 | + if (len > mm->cached_hole_size) { | |
14870 | + start_addr = addr = mm->free_area_cache; | |
14871 | + } else { | |
14872 | + start_addr = addr = mm->mmap_base; | |
14873 | + mm->cached_hole_size = 0; | |
14874 | + } | |
14875 | + | |
14876 | +#ifdef CONFIG_PAX_PAGEEXEC | |
14877 | + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) { | |
14878 | + start_addr = 0x00110000UL; | |
14879 | + | |
14880 | +#ifdef CONFIG_PAX_RANDMMAP | |
14881 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
14882 | + start_addr += mm->delta_mmap & 0x03FFF000UL; | |
14883 | +#endif | |
14884 | + | |
14885 | + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base) | |
14886 | + start_addr = addr = mm->mmap_base; | |
14887 | + else | |
14888 | + addr = start_addr; | |
14889 | + } | |
14890 | +#endif | |
14891 | + | |
14892 | +full_search: | |
14893 | + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) { | |
14894 | + /* At this point: (!vma || addr < vma->vm_end). */ | |
14895 | + if (pax_task_size - len < addr) { | |
14896 | + /* | |
14897 | + * Start a new search - just in case we missed | |
14898 | + * some holes. | |
14899 | + */ | |
14900 | + if (start_addr != mm->mmap_base) { | |
14901 | + start_addr = addr = mm->mmap_base; | |
14902 | + mm->cached_hole_size = 0; | |
14903 | + goto full_search; | |
14904 | + } | |
14905 | + return -ENOMEM; | |
14906 | + } | |
14907 | + if (check_heap_stack_gap(vma, addr, len)) | |
14908 | + break; | |
14909 | + if (addr + mm->cached_hole_size < vma->vm_start) | |
14910 | + mm->cached_hole_size = vma->vm_start - addr; | |
14911 | + addr = vma->vm_end; | |
14912 | + if (mm->start_brk <= addr && addr < mm->mmap_base) { | |
14913 | + start_addr = addr = mm->mmap_base; | |
14914 | + mm->cached_hole_size = 0; | |
14915 | + goto full_search; | |
14916 | + } | |
14917 | + } | |
14918 | + | |
14919 | + /* | |
14920 | + * Remember the place where we stopped the search: | |
14921 | + */ | |
14922 | + mm->free_area_cache = addr + len; | |
14923 | + return addr; | |
14924 | +} | |
14925 | + | |
14926 | +unsigned long | |
14927 | +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, | |
14928 | + const unsigned long len, const unsigned long pgoff, | |
14929 | + const unsigned long flags) | |
14930 | +{ | |
14931 | + struct vm_area_struct *vma; | |
14932 | + struct mm_struct *mm = current->mm; | |
14933 | + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE; | |
14934 | + | |
14935 | +#ifdef CONFIG_PAX_SEGMEXEC | |
14936 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
14937 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
14938 | +#endif | |
14939 | + | |
14940 | + pax_task_size -= PAGE_SIZE; | |
14941 | + | |
14942 | + /* requested length too big for entire address space */ | |
14943 | + if (len > pax_task_size) | |
14944 | + return -ENOMEM; | |
14945 | + | |
14946 | + if (flags & MAP_FIXED) | |
14947 | + return addr; | |
14948 | + | |
14949 | +#ifdef CONFIG_PAX_PAGEEXEC | |
14950 | + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE)) | |
14951 | + goto bottomup; | |
14952 | +#endif | |
14953 | + | |
14954 | +#ifdef CONFIG_PAX_RANDMMAP | |
14955 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
14956 | +#endif | |
14957 | + | |
14958 | + /* requesting a specific address */ | |
14959 | + if (addr) { | |
14960 | + addr = PAGE_ALIGN(addr); | |
14961 | + if (pax_task_size - len >= addr) { | |
14962 | + vma = find_vma(mm, addr); | |
14963 | + if (check_heap_stack_gap(vma, addr, len)) | |
14964 | + return addr; | |
14965 | + } | |
14966 | + } | |
14967 | + | |
14968 | + /* check if free_area_cache is useful for us */ | |
14969 | + if (len <= mm->cached_hole_size) { | |
14970 | + mm->cached_hole_size = 0; | |
14971 | + mm->free_area_cache = mm->mmap_base; | |
14972 | + } | |
14973 | + | |
14974 | + /* either no address requested or can't fit in requested address hole */ | |
14975 | + addr = mm->free_area_cache; | |
14976 | + | |
14977 | + /* make sure it can fit in the remaining address space */ | |
14978 | + if (addr > len) { | |
14979 | + vma = find_vma(mm, addr-len); | |
14980 | + if (check_heap_stack_gap(vma, addr - len, len)) | |
14981 | + /* remember the address as a hint for next time */ | |
14982 | + return (mm->free_area_cache = addr-len); | |
14983 | + } | |
14984 | + | |
14985 | + if (mm->mmap_base < len) | |
14986 | + goto bottomup; | |
14987 | + | |
14988 | + addr = mm->mmap_base-len; | |
14989 | + | |
14990 | + do { | |
14991 | + /* | |
14992 | + * Lookup failure means no vma is above this address, | |
14993 | + * else if new region fits below vma->vm_start, | |
14994 | + * return with success: | |
14995 | + */ | |
14996 | + vma = find_vma(mm, addr); | |
14997 | + if (check_heap_stack_gap(vma, addr, len)) | |
14998 | + /* remember the address as a hint for next time */ | |
14999 | + return (mm->free_area_cache = addr); | |
15000 | + | |
15001 | + /* remember the largest hole we saw so far */ | |
15002 | + if (addr + mm->cached_hole_size < vma->vm_start) | |
15003 | + mm->cached_hole_size = vma->vm_start - addr; | |
15004 | + | |
15005 | + /* try just below the current vma->vm_start */ | |
15006 | + addr = skip_heap_stack_gap(vma, len); | |
15007 | + } while (!IS_ERR_VALUE(addr)); | |
15008 | + | |
15009 | +bottomup: | |
15010 | + /* | |
15011 | + * A failed mmap() very likely causes application failure, | |
15012 | + * so fall back to the bottom-up function here. This scenario | |
15013 | + * can happen with large stack limits and large mmap() | |
15014 | + * allocations. | |
15015 | + */ | |
15016 | + | |
15017 | +#ifdef CONFIG_PAX_SEGMEXEC | |
15018 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
15019 | + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE; | |
15020 | + else | |
15021 | +#endif | |
15022 | + | |
15023 | + mm->mmap_base = TASK_UNMAPPED_BASE; | |
15024 | + | |
15025 | +#ifdef CONFIG_PAX_RANDMMAP | |
15026 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
15027 | + mm->mmap_base += mm->delta_mmap; | |
15028 | +#endif | |
15029 | + | |
15030 | + mm->free_area_cache = mm->mmap_base; | |
15031 | + mm->cached_hole_size = ~0UL; | |
15032 | + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags); | |
15033 | + /* | |
15034 | + * Restore the topdown base: | |
15035 | + */ | |
15036 | + mm->mmap_base = base; | |
15037 | + mm->free_area_cache = base; | |
15038 | + mm->cached_hole_size = ~0UL; | |
15039 | + | |
15040 | + return addr; | |
15041 | } | |
15042 | diff -urNp linux-3.0.3/arch/x86/kernel/sys_x86_64.c linux-3.0.3/arch/x86/kernel/sys_x86_64.c | |
15043 | --- linux-3.0.3/arch/x86/kernel/sys_x86_64.c 2011-07-21 22:17:23.000000000 -0400 | |
15044 | +++ linux-3.0.3/arch/x86/kernel/sys_x86_64.c 2011-08-23 21:47:55.000000000 -0400 | |
15045 | @@ -32,8 +32,8 @@ out: | |
15046 | return error; | |
15047 | } | |
15048 | ||
15049 | -static void find_start_end(unsigned long flags, unsigned long *begin, | |
15050 | - unsigned long *end) | |
15051 | +static void find_start_end(struct mm_struct *mm, unsigned long flags, | |
15052 | + unsigned long *begin, unsigned long *end) | |
15053 | { | |
15054 | if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) { | |
15055 | unsigned long new_begin; | |
15056 | @@ -52,7 +52,7 @@ static void find_start_end(unsigned long | |
15057 | *begin = new_begin; | |
15058 | } | |
15059 | } else { | |
15060 | - *begin = TASK_UNMAPPED_BASE; | |
15061 | + *begin = mm->mmap_base; | |
15062 | *end = TASK_SIZE; | |
15063 | } | |
15064 | } | |
15065 | @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp | |
15066 | if (flags & MAP_FIXED) | |
15067 | return addr; | |
15068 | ||
15069 | - find_start_end(flags, &begin, &end); | |
15070 | + find_start_end(mm, flags, &begin, &end); | |
15071 | ||
15072 | if (len > end) | |
15073 | return -ENOMEM; | |
15074 | ||
15075 | +#ifdef CONFIG_PAX_RANDMMAP | |
15076 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
15077 | +#endif | |
15078 | + | |
15079 | if (addr) { | |
15080 | addr = PAGE_ALIGN(addr); | |
15081 | vma = find_vma(mm, addr); | |
15082 | - if (end - len >= addr && | |
15083 | - (!vma || addr + len <= vma->vm_start)) | |
15084 | + if (end - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
15085 | return addr; | |
15086 | } | |
15087 | if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32)) | |
15088 | @@ -106,7 +109,7 @@ full_search: | |
15089 | } | |
15090 | return -ENOMEM; | |
15091 | } | |
15092 | - if (!vma || addr + len <= vma->vm_start) { | |
15093 | + if (check_heap_stack_gap(vma, addr, len)) { | |
15094 | /* | |
15095 | * Remember the place where we stopped the search: | |
15096 | */ | |
15097 | @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi | |
15098 | { | |
15099 | struct vm_area_struct *vma; | |
15100 | struct mm_struct *mm = current->mm; | |
15101 | - unsigned long addr = addr0; | |
15102 | + unsigned long base = mm->mmap_base, addr = addr0; | |
15103 | ||
15104 | /* requested length too big for entire address space */ | |
15105 | if (len > TASK_SIZE) | |
15106 | @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi | |
15107 | if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) | |
15108 | goto bottomup; | |
15109 | ||
15110 | +#ifdef CONFIG_PAX_RANDMMAP | |
15111 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
15112 | +#endif | |
15113 | + | |
15114 | /* requesting a specific address */ | |
15115 | if (addr) { | |
15116 | addr = PAGE_ALIGN(addr); | |
15117 | - vma = find_vma(mm, addr); | |
15118 | - if (TASK_SIZE - len >= addr && | |
15119 | - (!vma || addr + len <= vma->vm_start)) | |
15120 | - return addr; | |
15121 | + if (TASK_SIZE - len >= addr) { | |
15122 | + vma = find_vma(mm, addr); | |
15123 | + if (check_heap_stack_gap(vma, addr, len)) | |
15124 | + return addr; | |
15125 | + } | |
15126 | } | |
15127 | ||
15128 | /* check if free_area_cache is useful for us */ | |
15129 | @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi | |
15130 | /* make sure it can fit in the remaining address space */ | |
15131 | if (addr > len) { | |
15132 | vma = find_vma(mm, addr-len); | |
15133 | - if (!vma || addr <= vma->vm_start) | |
15134 | + if (check_heap_stack_gap(vma, addr - len, len)) | |
15135 | /* remember the address as a hint for next time */ | |
15136 | return mm->free_area_cache = addr-len; | |
15137 | } | |
15138 | @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi | |
15139 | * return with success: | |
15140 | */ | |
15141 | vma = find_vma(mm, addr); | |
15142 | - if (!vma || addr+len <= vma->vm_start) | |
15143 | + if (check_heap_stack_gap(vma, addr, len)) | |
15144 | /* remember the address as a hint for next time */ | |
15145 | return mm->free_area_cache = addr; | |
15146 | ||
15147 | @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi | |
15148 | mm->cached_hole_size = vma->vm_start - addr; | |
15149 | ||
15150 | /* try just below the current vma->vm_start */ | |
15151 | - addr = vma->vm_start-len; | |
15152 | - } while (len < vma->vm_start); | |
15153 | + addr = skip_heap_stack_gap(vma, len); | |
15154 | + } while (!IS_ERR_VALUE(addr)); | |
15155 | ||
15156 | bottomup: | |
15157 | /* | |
15158 | @@ -198,13 +206,21 @@ bottomup: | |
15159 | * can happen with large stack limits and large mmap() | |
15160 | * allocations. | |
15161 | */ | |
15162 | + mm->mmap_base = TASK_UNMAPPED_BASE; | |
15163 | + | |
15164 | +#ifdef CONFIG_PAX_RANDMMAP | |
15165 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
15166 | + mm->mmap_base += mm->delta_mmap; | |
15167 | +#endif | |
15168 | + | |
15169 | + mm->free_area_cache = mm->mmap_base; | |
15170 | mm->cached_hole_size = ~0UL; | |
15171 | - mm->free_area_cache = TASK_UNMAPPED_BASE; | |
15172 | addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags); | |
15173 | /* | |
15174 | * Restore the topdown base: | |
15175 | */ | |
15176 | - mm->free_area_cache = mm->mmap_base; | |
15177 | + mm->mmap_base = base; | |
15178 | + mm->free_area_cache = base; | |
15179 | mm->cached_hole_size = ~0UL; | |
15180 | ||
15181 | return addr; | |
15182 | diff -urNp linux-3.0.3/arch/x86/kernel/tboot.c linux-3.0.3/arch/x86/kernel/tboot.c | |
15183 | --- linux-3.0.3/arch/x86/kernel/tboot.c 2011-07-21 22:17:23.000000000 -0400 | |
15184 | +++ linux-3.0.3/arch/x86/kernel/tboot.c 2011-08-23 21:47:55.000000000 -0400 | |
15185 | @@ -217,7 +217,7 @@ static int tboot_setup_sleep(void) | |
15186 | ||
15187 | void tboot_shutdown(u32 shutdown_type) | |
15188 | { | |
15189 | - void (*shutdown)(void); | |
15190 | + void (* __noreturn shutdown)(void); | |
15191 | ||
15192 | if (!tboot_enabled()) | |
15193 | return; | |
15194 | @@ -239,7 +239,7 @@ void tboot_shutdown(u32 shutdown_type) | |
15195 | ||
15196 | switch_to_tboot_pt(); | |
15197 | ||
15198 | - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry; | |
15199 | + shutdown = (void *)tboot->shutdown_entry; | |
15200 | shutdown(); | |
15201 | ||
15202 | /* should not reach here */ | |
15203 | @@ -296,7 +296,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1 | |
15204 | tboot_shutdown(acpi_shutdown_map[sleep_state]); | |
15205 | } | |
15206 | ||
15207 | -static atomic_t ap_wfs_count; | |
15208 | +static atomic_unchecked_t ap_wfs_count; | |
15209 | ||
15210 | static int tboot_wait_for_aps(int num_aps) | |
15211 | { | |
15212 | @@ -320,9 +320,9 @@ static int __cpuinit tboot_cpu_callback( | |
15213 | { | |
15214 | switch (action) { | |
15215 | case CPU_DYING: | |
15216 | - atomic_inc(&ap_wfs_count); | |
15217 | + atomic_inc_unchecked(&ap_wfs_count); | |
15218 | if (num_online_cpus() == 1) | |
15219 | - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count))) | |
15220 | + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count))) | |
15221 | return NOTIFY_BAD; | |
15222 | break; | |
15223 | } | |
15224 | @@ -341,7 +341,7 @@ static __init int tboot_late_init(void) | |
15225 | ||
15226 | tboot_create_trampoline(); | |
15227 | ||
15228 | - atomic_set(&ap_wfs_count, 0); | |
15229 | + atomic_set_unchecked(&ap_wfs_count, 0); | |
15230 | register_hotcpu_notifier(&tboot_cpu_notifier); | |
15231 | return 0; | |
15232 | } | |
15233 | diff -urNp linux-3.0.3/arch/x86/kernel/time.c linux-3.0.3/arch/x86/kernel/time.c | |
15234 | --- linux-3.0.3/arch/x86/kernel/time.c 2011-07-21 22:17:23.000000000 -0400 | |
15235 | +++ linux-3.0.3/arch/x86/kernel/time.c 2011-08-23 21:47:55.000000000 -0400 | |
15236 | @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs | |
15237 | { | |
15238 | unsigned long pc = instruction_pointer(regs); | |
15239 | ||
15240 | - if (!user_mode_vm(regs) && in_lock_functions(pc)) { | |
15241 | + if (!user_mode(regs) && in_lock_functions(pc)) { | |
15242 | #ifdef CONFIG_FRAME_POINTER | |
15243 | - return *(unsigned long *)(regs->bp + sizeof(long)); | |
15244 | + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long))); | |
15245 | #else | |
15246 | unsigned long *sp = | |
15247 | (unsigned long *)kernel_stack_pointer(regs); | |
15248 | @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs | |
15249 | * or above a saved flags. Eflags has bits 22-31 zero, | |
15250 | * kernel addresses don't. | |
15251 | */ | |
15252 | + | |
15253 | +#ifdef CONFIG_PAX_KERNEXEC | |
15254 | + return ktla_ktva(sp[0]); | |
15255 | +#else | |
15256 | if (sp[0] >> 22) | |
15257 | return sp[0]; | |
15258 | if (sp[1] >> 22) | |
15259 | return sp[1]; | |
15260 | #endif | |
15261 | + | |
15262 | +#endif | |
15263 | } | |
15264 | return pc; | |
15265 | } | |
15266 | diff -urNp linux-3.0.3/arch/x86/kernel/tls.c linux-3.0.3/arch/x86/kernel/tls.c | |
15267 | --- linux-3.0.3/arch/x86/kernel/tls.c 2011-07-21 22:17:23.000000000 -0400 | |
15268 | +++ linux-3.0.3/arch/x86/kernel/tls.c 2011-08-23 21:47:55.000000000 -0400 | |
15269 | @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc | |
15270 | if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX) | |
15271 | return -EINVAL; | |
15272 | ||
15273 | +#ifdef CONFIG_PAX_SEGMEXEC | |
15274 | + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE)) | |
15275 | + return -EINVAL; | |
15276 | +#endif | |
15277 | + | |
15278 | set_tls_desc(p, idx, &info, 1); | |
15279 | ||
15280 | return 0; | |
15281 | diff -urNp linux-3.0.3/arch/x86/kernel/trampoline_32.S linux-3.0.3/arch/x86/kernel/trampoline_32.S | |
15282 | --- linux-3.0.3/arch/x86/kernel/trampoline_32.S 2011-07-21 22:17:23.000000000 -0400 | |
15283 | +++ linux-3.0.3/arch/x86/kernel/trampoline_32.S 2011-08-23 21:47:55.000000000 -0400 | |
15284 | @@ -32,6 +32,12 @@ | |
15285 | #include <asm/segment.h> | |
15286 | #include <asm/page_types.h> | |
15287 | ||
15288 | +#ifdef CONFIG_PAX_KERNEXEC | |
15289 | +#define ta(X) (X) | |
15290 | +#else | |
15291 | +#define ta(X) ((X) - __PAGE_OFFSET) | |
15292 | +#endif | |
15293 | + | |
15294 | #ifdef CONFIG_SMP | |
15295 | ||
15296 | .section ".x86_trampoline","a" | |
15297 | @@ -62,7 +68,7 @@ r_base = . | |
15298 | inc %ax # protected mode (PE) bit | |
15299 | lmsw %ax # into protected mode | |
15300 | # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S | |
15301 | - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET) | |
15302 | + ljmpl $__BOOT_CS, $ta(startup_32_smp) | |
15303 | ||
15304 | # These need to be in the same 64K segment as the above; | |
15305 | # hence we don't use the boot_gdt_descr defined in head.S | |
15306 | diff -urNp linux-3.0.3/arch/x86/kernel/trampoline_64.S linux-3.0.3/arch/x86/kernel/trampoline_64.S | |
15307 | --- linux-3.0.3/arch/x86/kernel/trampoline_64.S 2011-07-21 22:17:23.000000000 -0400 | |
15308 | +++ linux-3.0.3/arch/x86/kernel/trampoline_64.S 2011-08-23 21:47:55.000000000 -0400 | |
15309 | @@ -90,7 +90,7 @@ startup_32: | |
15310 | movl $__KERNEL_DS, %eax # Initialize the %ds segment register | |
15311 | movl %eax, %ds | |
15312 | ||
15313 | - movl $X86_CR4_PAE, %eax | |
15314 | + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax | |
15315 | movl %eax, %cr4 # Enable PAE mode | |
15316 | ||
15317 | # Setup trampoline 4 level pagetables | |
15318 | @@ -138,7 +138,7 @@ tidt: | |
15319 | # so the kernel can live anywhere | |
15320 | .balign 4 | |
15321 | tgdt: | |
15322 | - .short tgdt_end - tgdt # gdt limit | |
15323 | + .short tgdt_end - tgdt - 1 # gdt limit | |
15324 | .long tgdt - r_base | |
15325 | .short 0 | |
15326 | .quad 0x00cf9b000000ffff # __KERNEL32_CS | |
15327 | diff -urNp linux-3.0.3/arch/x86/kernel/traps.c linux-3.0.3/arch/x86/kernel/traps.c | |
15328 | --- linux-3.0.3/arch/x86/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400 | |
15329 | +++ linux-3.0.3/arch/x86/kernel/traps.c 2011-08-23 21:47:55.000000000 -0400 | |
15330 | @@ -70,12 +70,6 @@ asmlinkage int system_call(void); | |
15331 | ||
15332 | /* Do we ignore FPU interrupts ? */ | |
15333 | char ignore_fpu_irq; | |
15334 | - | |
15335 | -/* | |
15336 | - * The IDT has to be page-aligned to simplify the Pentium | |
15337 | - * F0 0F bug workaround. | |
15338 | - */ | |
15339 | -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, }; | |
15340 | #endif | |
15341 | ||
15342 | DECLARE_BITMAP(used_vectors, NR_VECTORS); | |
15343 | @@ -117,13 +111,13 @@ static inline void preempt_conditional_c | |
15344 | } | |
15345 | ||
15346 | static void __kprobes | |
15347 | -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs, | |
15348 | +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs, | |
15349 | long error_code, siginfo_t *info) | |
15350 | { | |
15351 | struct task_struct *tsk = current; | |
15352 | ||
15353 | #ifdef CONFIG_X86_32 | |
15354 | - if (regs->flags & X86_VM_MASK) { | |
15355 | + if (v8086_mode(regs)) { | |
15356 | /* | |
15357 | * traps 0, 1, 3, 4, and 5 should be forwarded to vm86. | |
15358 | * On nmi (interrupt 2), do_trap should not be called. | |
15359 | @@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str | |
15360 | } | |
15361 | #endif | |
15362 | ||
15363 | - if (!user_mode(regs)) | |
15364 | + if (!user_mode_novm(regs)) | |
15365 | goto kernel_trap; | |
15366 | ||
15367 | #ifdef CONFIG_X86_32 | |
15368 | @@ -157,7 +151,7 @@ trap_signal: | |
15369 | printk_ratelimit()) { | |
15370 | printk(KERN_INFO | |
15371 | "%s[%d] trap %s ip:%lx sp:%lx error:%lx", | |
15372 | - tsk->comm, tsk->pid, str, | |
15373 | + tsk->comm, task_pid_nr(tsk), str, | |
15374 | regs->ip, regs->sp, error_code); | |
15375 | print_vma_addr(" in ", regs->ip); | |
15376 | printk("\n"); | |
15377 | @@ -174,8 +168,20 @@ kernel_trap: | |
15378 | if (!fixup_exception(regs)) { | |
15379 | tsk->thread.error_code = error_code; | |
15380 | tsk->thread.trap_no = trapnr; | |
15381 | + | |
15382 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
15383 | + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)) | |
15384 | + str = "PAX: suspicious stack segment fault"; | |
15385 | +#endif | |
15386 | + | |
15387 | die(str, regs, error_code); | |
15388 | } | |
15389 | + | |
15390 | +#ifdef CONFIG_PAX_REFCOUNT | |
15391 | + if (trapnr == 4) | |
15392 | + pax_report_refcount_overflow(regs); | |
15393 | +#endif | |
15394 | + | |
15395 | return; | |
15396 | ||
15397 | #ifdef CONFIG_X86_32 | |
15398 | @@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re | |
15399 | conditional_sti(regs); | |
15400 | ||
15401 | #ifdef CONFIG_X86_32 | |
15402 | - if (regs->flags & X86_VM_MASK) | |
15403 | + if (v8086_mode(regs)) | |
15404 | goto gp_in_vm86; | |
15405 | #endif | |
15406 | ||
15407 | tsk = current; | |
15408 | - if (!user_mode(regs)) | |
15409 | + if (!user_mode_novm(regs)) | |
15410 | goto gp_in_kernel; | |
15411 | ||
15412 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) | |
15413 | + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) { | |
15414 | + struct mm_struct *mm = tsk->mm; | |
15415 | + unsigned long limit; | |
15416 | + | |
15417 | + down_write(&mm->mmap_sem); | |
15418 | + limit = mm->context.user_cs_limit; | |
15419 | + if (limit < TASK_SIZE) { | |
15420 | + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC); | |
15421 | + up_write(&mm->mmap_sem); | |
15422 | + return; | |
15423 | + } | |
15424 | + up_write(&mm->mmap_sem); | |
15425 | + } | |
15426 | +#endif | |
15427 | + | |
15428 | tsk->thread.error_code = error_code; | |
15429 | tsk->thread.trap_no = 13; | |
15430 | ||
15431 | @@ -304,6 +326,13 @@ gp_in_kernel: | |
15432 | if (notify_die(DIE_GPF, "general protection fault", regs, | |
15433 | error_code, 13, SIGSEGV) == NOTIFY_STOP) | |
15434 | return; | |
15435 | + | |
15436 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
15437 | + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS) | |
15438 | + die("PAX: suspicious general protection fault", regs, error_code); | |
15439 | + else | |
15440 | +#endif | |
15441 | + | |
15442 | die("general protection fault", regs, error_code); | |
15443 | } | |
15444 | ||
15445 | @@ -433,6 +462,17 @@ static notrace __kprobes void default_do | |
15446 | dotraplinkage notrace __kprobes void | |
15447 | do_nmi(struct pt_regs *regs, long error_code) | |
15448 | { | |
15449 | + | |
15450 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
15451 | + if (!user_mode(regs)) { | |
15452 | + unsigned long cs = regs->cs & 0xFFFF; | |
15453 | + unsigned long ip = ktva_ktla(regs->ip); | |
15454 | + | |
15455 | + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext) | |
15456 | + regs->ip = ip; | |
15457 | + } | |
15458 | +#endif | |
15459 | + | |
15460 | nmi_enter(); | |
15461 | ||
15462 | inc_irq_stat(__nmi_count); | |
15463 | @@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(st | |
15464 | /* It's safe to allow irq's after DR6 has been saved */ | |
15465 | preempt_conditional_sti(regs); | |
15466 | ||
15467 | - if (regs->flags & X86_VM_MASK) { | |
15468 | + if (v8086_mode(regs)) { | |
15469 | handle_vm86_trap((struct kernel_vm86_regs *) regs, | |
15470 | error_code, 1); | |
15471 | preempt_conditional_cli(regs); | |
15472 | @@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(st | |
15473 | * We already checked v86 mode above, so we can check for kernel mode | |
15474 | * by just checking the CPL of CS. | |
15475 | */ | |
15476 | - if ((dr6 & DR_STEP) && !user_mode(regs)) { | |
15477 | + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) { | |
15478 | tsk->thread.debugreg6 &= ~DR_STEP; | |
15479 | set_tsk_thread_flag(tsk, TIF_SINGLESTEP); | |
15480 | regs->flags &= ~X86_EFLAGS_TF; | |
15481 | @@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, in | |
15482 | return; | |
15483 | conditional_sti(regs); | |
15484 | ||
15485 | - if (!user_mode_vm(regs)) | |
15486 | + if (!user_mode(regs)) | |
15487 | { | |
15488 | if (!fixup_exception(regs)) { | |
15489 | task->thread.error_code = error_code; | |
15490 | @@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) sm | |
15491 | void __math_state_restore(void) | |
15492 | { | |
15493 | struct thread_info *thread = current_thread_info(); | |
15494 | - struct task_struct *tsk = thread->task; | |
15495 | + struct task_struct *tsk = current; | |
15496 | ||
15497 | /* | |
15498 | * Paranoid restore. send a SIGSEGV if we fail to restore the state. | |
15499 | @@ -750,8 +790,7 @@ void __math_state_restore(void) | |
15500 | */ | |
15501 | asmlinkage void math_state_restore(void) | |
15502 | { | |
15503 | - struct thread_info *thread = current_thread_info(); | |
15504 | - struct task_struct *tsk = thread->task; | |
15505 | + struct task_struct *tsk = current; | |
15506 | ||
15507 | if (!tsk_used_math(tsk)) { | |
15508 | local_irq_enable(); | |
15509 | diff -urNp linux-3.0.3/arch/x86/kernel/verify_cpu.S linux-3.0.3/arch/x86/kernel/verify_cpu.S | |
15510 | --- linux-3.0.3/arch/x86/kernel/verify_cpu.S 2011-07-21 22:17:23.000000000 -0400 | |
15511 | +++ linux-3.0.3/arch/x86/kernel/verify_cpu.S 2011-08-23 21:48:14.000000000 -0400 | |
15512 | @@ -20,6 +20,7 @@ | |
15513 | * arch/x86/boot/compressed/head_64.S: Boot cpu verification | |
15514 | * arch/x86/kernel/trampoline_64.S: secondary processor verification | |
15515 | * arch/x86/kernel/head_32.S: processor startup | |
15516 | + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume | |
15517 | * | |
15518 | * verify_cpu, returns the status of longmode and SSE in register %eax. | |
15519 | * 0: Success 1: Failure | |
15520 | diff -urNp linux-3.0.3/arch/x86/kernel/vm86_32.c linux-3.0.3/arch/x86/kernel/vm86_32.c | |
15521 | --- linux-3.0.3/arch/x86/kernel/vm86_32.c 2011-07-21 22:17:23.000000000 -0400 | |
15522 | +++ linux-3.0.3/arch/x86/kernel/vm86_32.c 2011-08-23 21:48:14.000000000 -0400 | |
15523 | @@ -41,6 +41,7 @@ | |
15524 | #include <linux/ptrace.h> | |
15525 | #include <linux/audit.h> | |
15526 | #include <linux/stddef.h> | |
15527 | +#include <linux/grsecurity.h> | |
15528 | ||
15529 | #include <asm/uaccess.h> | |
15530 | #include <asm/io.h> | |
15531 | @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke | |
15532 | do_exit(SIGSEGV); | |
15533 | } | |
15534 | ||
15535 | - tss = &per_cpu(init_tss, get_cpu()); | |
15536 | + tss = init_tss + get_cpu(); | |
15537 | current->thread.sp0 = current->thread.saved_sp0; | |
15538 | current->thread.sysenter_cs = __KERNEL_CS; | |
15539 | load_sp0(tss, ¤t->thread); | |
15540 | @@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use | |
15541 | struct task_struct *tsk; | |
15542 | int tmp, ret = -EPERM; | |
15543 | ||
15544 | +#ifdef CONFIG_GRKERNSEC_VM86 | |
15545 | + if (!capable(CAP_SYS_RAWIO)) { | |
15546 | + gr_handle_vm86(); | |
15547 | + goto out; | |
15548 | + } | |
15549 | +#endif | |
15550 | + | |
15551 | tsk = current; | |
15552 | if (tsk->thread.saved_sp0) | |
15553 | goto out; | |
15554 | @@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned | |
15555 | int tmp, ret; | |
15556 | struct vm86plus_struct __user *v86; | |
15557 | ||
15558 | +#ifdef CONFIG_GRKERNSEC_VM86 | |
15559 | + if (!capable(CAP_SYS_RAWIO)) { | |
15560 | + gr_handle_vm86(); | |
15561 | + ret = -EPERM; | |
15562 | + goto out; | |
15563 | + } | |
15564 | +#endif | |
15565 | + | |
15566 | tsk = current; | |
15567 | switch (cmd) { | |
15568 | case VM86_REQUEST_IRQ: | |
15569 | @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm | |
15570 | tsk->thread.saved_fs = info->regs32->fs; | |
15571 | tsk->thread.saved_gs = get_user_gs(info->regs32); | |
15572 | ||
15573 | - tss = &per_cpu(init_tss, get_cpu()); | |
15574 | + tss = init_tss + get_cpu(); | |
15575 | tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0; | |
15576 | if (cpu_has_sep) | |
15577 | tsk->thread.sysenter_cs = 0; | |
15578 | @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re | |
15579 | goto cannot_handle; | |
15580 | if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored)) | |
15581 | goto cannot_handle; | |
15582 | - intr_ptr = (unsigned long __user *) (i << 2); | |
15583 | + intr_ptr = (__force unsigned long __user *) (i << 2); | |
15584 | if (get_user(segoffs, intr_ptr)) | |
15585 | goto cannot_handle; | |
15586 | if ((segoffs >> 16) == BIOSSEG) | |
15587 | diff -urNp linux-3.0.3/arch/x86/kernel/vmlinux.lds.S linux-3.0.3/arch/x86/kernel/vmlinux.lds.S | |
15588 | --- linux-3.0.3/arch/x86/kernel/vmlinux.lds.S 2011-07-21 22:17:23.000000000 -0400 | |
15589 | +++ linux-3.0.3/arch/x86/kernel/vmlinux.lds.S 2011-08-23 21:47:55.000000000 -0400 | |
15590 | @@ -26,6 +26,13 @@ | |
15591 | #include <asm/page_types.h> | |
15592 | #include <asm/cache.h> | |
15593 | #include <asm/boot.h> | |
15594 | +#include <asm/segment.h> | |
15595 | + | |
15596 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
15597 | +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR) | |
15598 | +#else | |
15599 | +#define __KERNEL_TEXT_OFFSET 0 | |
15600 | +#endif | |
15601 | ||
15602 | #undef i386 /* in case the preprocessor is a 32bit one */ | |
15603 | ||
15604 | @@ -69,31 +76,46 @@ jiffies_64 = jiffies; | |
15605 | ||
15606 | PHDRS { | |
15607 | text PT_LOAD FLAGS(5); /* R_E */ | |
15608 | +#ifdef CONFIG_X86_32 | |
15609 | + module PT_LOAD FLAGS(5); /* R_E */ | |
15610 | +#endif | |
15611 | +#ifdef CONFIG_XEN | |
15612 | + rodata PT_LOAD FLAGS(5); /* R_E */ | |
15613 | +#else | |
15614 | + rodata PT_LOAD FLAGS(4); /* R__ */ | |
15615 | +#endif | |
15616 | data PT_LOAD FLAGS(6); /* RW_ */ | |
15617 | #ifdef CONFIG_X86_64 | |
15618 | user PT_LOAD FLAGS(5); /* R_E */ | |
15619 | +#endif | |
15620 | + init.begin PT_LOAD FLAGS(6); /* RW_ */ | |
15621 | #ifdef CONFIG_SMP | |
15622 | percpu PT_LOAD FLAGS(6); /* RW_ */ | |
15623 | #endif | |
15624 | + text.init PT_LOAD FLAGS(5); /* R_E */ | |
15625 | + text.exit PT_LOAD FLAGS(5); /* R_E */ | |
15626 | init PT_LOAD FLAGS(7); /* RWE */ | |
15627 | -#endif | |
15628 | note PT_NOTE FLAGS(0); /* ___ */ | |
15629 | } | |
15630 | ||
15631 | SECTIONS | |
15632 | { | |
15633 | #ifdef CONFIG_X86_32 | |
15634 | - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR; | |
15635 | - phys_startup_32 = startup_32 - LOAD_OFFSET; | |
15636 | + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR; | |
15637 | #else | |
15638 | - . = __START_KERNEL; | |
15639 | - phys_startup_64 = startup_64 - LOAD_OFFSET; | |
15640 | + . = __START_KERNEL; | |
15641 | #endif | |
15642 | ||
15643 | /* Text and read-only data */ | |
15644 | - .text : AT(ADDR(.text) - LOAD_OFFSET) { | |
15645 | - _text = .; | |
15646 | + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) { | |
15647 | /* bootstrapping code */ | |
15648 | +#ifdef CONFIG_X86_32 | |
15649 | + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET; | |
15650 | +#else | |
15651 | + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET; | |
15652 | +#endif | |
15653 | + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET; | |
15654 | + _text = .; | |
15655 | HEAD_TEXT | |
15656 | #ifdef CONFIG_X86_32 | |
15657 | . = ALIGN(PAGE_SIZE); | |
15658 | @@ -109,13 +131,47 @@ SECTIONS | |
15659 | IRQENTRY_TEXT | |
15660 | *(.fixup) | |
15661 | *(.gnu.warning) | |
15662 | - /* End of text section */ | |
15663 | - _etext = .; | |
15664 | } :text = 0x9090 | |
15665 | ||
15666 | - NOTES :text :note | |
15667 | + . += __KERNEL_TEXT_OFFSET; | |
15668 | + | |
15669 | +#ifdef CONFIG_X86_32 | |
15670 | + . = ALIGN(PAGE_SIZE); | |
15671 | + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) { | |
15672 | + | |
15673 | +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES) | |
15674 | + MODULES_EXEC_VADDR = .; | |
15675 | + BYTE(0) | |
15676 | + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024); | |
15677 | + . = ALIGN(HPAGE_SIZE); | |
15678 | + MODULES_EXEC_END = . - 1; | |
15679 | +#endif | |
15680 | + | |
15681 | + } :module | |
15682 | +#endif | |
15683 | + | |
15684 | + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) { | |
15685 | + /* End of text section */ | |
15686 | + _etext = . - __KERNEL_TEXT_OFFSET; | |
15687 | + } | |
15688 | + | |
15689 | +#ifdef CONFIG_X86_32 | |
15690 | + . = ALIGN(PAGE_SIZE); | |
15691 | + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) { | |
15692 | + *(.idt) | |
15693 | + . = ALIGN(PAGE_SIZE); | |
15694 | + *(.empty_zero_page) | |
15695 | + *(.initial_pg_fixmap) | |
15696 | + *(.initial_pg_pmd) | |
15697 | + *(.initial_page_table) | |
15698 | + *(.swapper_pg_dir) | |
15699 | + } :rodata | |
15700 | +#endif | |
15701 | + | |
15702 | + . = ALIGN(PAGE_SIZE); | |
15703 | + NOTES :rodata :note | |
15704 | ||
15705 | - EXCEPTION_TABLE(16) :text = 0x9090 | |
15706 | + EXCEPTION_TABLE(16) :rodata | |
15707 | ||
15708 | #if defined(CONFIG_DEBUG_RODATA) | |
15709 | /* .text should occupy whole number of pages */ | |
15710 | @@ -127,16 +183,20 @@ SECTIONS | |
15711 | ||
15712 | /* Data */ | |
15713 | .data : AT(ADDR(.data) - LOAD_OFFSET) { | |
15714 | + | |
15715 | +#ifdef CONFIG_PAX_KERNEXEC | |
15716 | + . = ALIGN(HPAGE_SIZE); | |
15717 | +#else | |
15718 | + . = ALIGN(PAGE_SIZE); | |
15719 | +#endif | |
15720 | + | |
15721 | /* Start of data section */ | |
15722 | _sdata = .; | |
15723 | ||
15724 | /* init_task */ | |
15725 | INIT_TASK_DATA(THREAD_SIZE) | |
15726 | ||
15727 | -#ifdef CONFIG_X86_32 | |
15728 | - /* 32 bit has nosave before _edata */ | |
15729 | NOSAVE_DATA | |
15730 | -#endif | |
15731 | ||
15732 | PAGE_ALIGNED_DATA(PAGE_SIZE) | |
15733 | ||
15734 | @@ -208,12 +268,19 @@ SECTIONS | |
15735 | #endif /* CONFIG_X86_64 */ | |
15736 | ||
15737 | /* Init code and data - will be freed after init */ | |
15738 | - . = ALIGN(PAGE_SIZE); | |
15739 | .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) { | |
15740 | + BYTE(0) | |
15741 | + | |
15742 | +#ifdef CONFIG_PAX_KERNEXEC | |
15743 | + . = ALIGN(HPAGE_SIZE); | |
15744 | +#else | |
15745 | + . = ALIGN(PAGE_SIZE); | |
15746 | +#endif | |
15747 | + | |
15748 | __init_begin = .; /* paired with __init_end */ | |
15749 | - } | |
15750 | + } :init.begin | |
15751 | ||
15752 | -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP) | |
15753 | +#ifdef CONFIG_SMP | |
15754 | /* | |
15755 | * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the | |
15756 | * output PHDR, so the next output section - .init.text - should | |
15757 | @@ -222,12 +289,27 @@ SECTIONS | |
15758 | PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu) | |
15759 | #endif | |
15760 | ||
15761 | - INIT_TEXT_SECTION(PAGE_SIZE) | |
15762 | -#ifdef CONFIG_X86_64 | |
15763 | - :init | |
15764 | -#endif | |
15765 | + . = ALIGN(PAGE_SIZE); | |
15766 | + init_begin = .; | |
15767 | + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) { | |
15768 | + VMLINUX_SYMBOL(_sinittext) = .; | |
15769 | + INIT_TEXT | |
15770 | + VMLINUX_SYMBOL(_einittext) = .; | |
15771 | + . = ALIGN(PAGE_SIZE); | |
15772 | + } :text.init | |
15773 | ||
15774 | - INIT_DATA_SECTION(16) | |
15775 | + /* | |
15776 | + * .exit.text is discard at runtime, not link time, to deal with | |
15777 | + * references from .altinstructions and .eh_frame | |
15778 | + */ | |
15779 | + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) { | |
15780 | + EXIT_TEXT | |
15781 | + . = ALIGN(16); | |
15782 | + } :text.exit | |
15783 | + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text); | |
15784 | + | |
15785 | + . = ALIGN(PAGE_SIZE); | |
15786 | + INIT_DATA_SECTION(16) :init | |
15787 | ||
15788 | /* | |
15789 | * Code and data for a variety of lowlevel trampolines, to be | |
15790 | @@ -301,19 +383,12 @@ SECTIONS | |
15791 | } | |
15792 | ||
15793 | . = ALIGN(8); | |
15794 | - /* | |
15795 | - * .exit.text is discard at runtime, not link time, to deal with | |
15796 | - * references from .altinstructions and .eh_frame | |
15797 | - */ | |
15798 | - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) { | |
15799 | - EXIT_TEXT | |
15800 | - } | |
15801 | ||
15802 | .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) { | |
15803 | EXIT_DATA | |
15804 | } | |
15805 | ||
15806 | -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP) | |
15807 | +#ifndef CONFIG_SMP | |
15808 | PERCPU_SECTION(INTERNODE_CACHE_BYTES) | |
15809 | #endif | |
15810 | ||
15811 | @@ -332,16 +407,10 @@ SECTIONS | |
15812 | .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) { | |
15813 | __smp_locks = .; | |
15814 | *(.smp_locks) | |
15815 | - . = ALIGN(PAGE_SIZE); | |
15816 | __smp_locks_end = .; | |
15817 | + . = ALIGN(PAGE_SIZE); | |
15818 | } | |
15819 | ||
15820 | -#ifdef CONFIG_X86_64 | |
15821 | - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) { | |
15822 | - NOSAVE_DATA | |
15823 | - } | |
15824 | -#endif | |
15825 | - | |
15826 | /* BSS */ | |
15827 | . = ALIGN(PAGE_SIZE); | |
15828 | .bss : AT(ADDR(.bss) - LOAD_OFFSET) { | |
15829 | @@ -357,6 +426,7 @@ SECTIONS | |
15830 | __brk_base = .; | |
15831 | . += 64 * 1024; /* 64k alignment slop space */ | |
15832 | *(.brk_reservation) /* areas brk users have reserved */ | |
15833 | + . = ALIGN(HPAGE_SIZE); | |
15834 | __brk_limit = .; | |
15835 | } | |
15836 | ||
15837 | @@ -383,13 +453,12 @@ SECTIONS | |
15838 | * for the boot processor. | |
15839 | */ | |
15840 | #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load | |
15841 | -INIT_PER_CPU(gdt_page); | |
15842 | INIT_PER_CPU(irq_stack_union); | |
15843 | ||
15844 | /* | |
15845 | * Build-time check on the image size: | |
15846 | */ | |
15847 | -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE), | |
15848 | +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE), | |
15849 | "kernel image bigger than KERNEL_IMAGE_SIZE"); | |
15850 | ||
15851 | #ifdef CONFIG_SMP | |
15852 | diff -urNp linux-3.0.3/arch/x86/kernel/vsyscall_64.c linux-3.0.3/arch/x86/kernel/vsyscall_64.c | |
15853 | --- linux-3.0.3/arch/x86/kernel/vsyscall_64.c 2011-07-21 22:17:23.000000000 -0400 | |
15854 | +++ linux-3.0.3/arch/x86/kernel/vsyscall_64.c 2011-08-23 21:47:55.000000000 -0400 | |
15855 | @@ -53,7 +53,7 @@ DEFINE_VVAR(int, vgetcpu_mode); | |
15856 | DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) = | |
15857 | { | |
15858 | .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock), | |
15859 | - .sysctl_enabled = 1, | |
15860 | + .sysctl_enabled = 0, | |
15861 | }; | |
15862 | ||
15863 | void update_vsyscall_tz(void) | |
15864 | @@ -231,7 +231,7 @@ static long __vsyscall(3) venosys_1(void | |
15865 | static ctl_table kernel_table2[] = { | |
15866 | { .procname = "vsyscall64", | |
15867 | .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int), | |
15868 | - .mode = 0644, | |
15869 | + .mode = 0444, | |
15870 | .proc_handler = proc_dointvec }, | |
15871 | {} | |
15872 | }; | |
15873 | diff -urNp linux-3.0.3/arch/x86/kernel/x8664_ksyms_64.c linux-3.0.3/arch/x86/kernel/x8664_ksyms_64.c | |
15874 | --- linux-3.0.3/arch/x86/kernel/x8664_ksyms_64.c 2011-07-21 22:17:23.000000000 -0400 | |
15875 | +++ linux-3.0.3/arch/x86/kernel/x8664_ksyms_64.c 2011-08-23 21:47:55.000000000 -0400 | |
15876 | @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8); | |
15877 | EXPORT_SYMBOL(copy_user_generic_string); | |
15878 | EXPORT_SYMBOL(copy_user_generic_unrolled); | |
15879 | EXPORT_SYMBOL(__copy_user_nocache); | |
15880 | -EXPORT_SYMBOL(_copy_from_user); | |
15881 | -EXPORT_SYMBOL(_copy_to_user); | |
15882 | ||
15883 | EXPORT_SYMBOL(copy_page); | |
15884 | EXPORT_SYMBOL(clear_page); | |
15885 | diff -urNp linux-3.0.3/arch/x86/kernel/xsave.c linux-3.0.3/arch/x86/kernel/xsave.c | |
15886 | --- linux-3.0.3/arch/x86/kernel/xsave.c 2011-07-21 22:17:23.000000000 -0400 | |
15887 | +++ linux-3.0.3/arch/x86/kernel/xsave.c 2011-08-23 21:47:55.000000000 -0400 | |
15888 | @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_ | |
15889 | fx_sw_user->xstate_size > fx_sw_user->extended_size) | |
15890 | return -EINVAL; | |
15891 | ||
15892 | - err = __get_user(magic2, (__u32 *) (((void *)fpstate) + | |
15893 | + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) + | |
15894 | fx_sw_user->extended_size - | |
15895 | FP_XSTATE_MAGIC2_SIZE)); | |
15896 | if (err) | |
15897 | @@ -267,7 +267,7 @@ fx_only: | |
15898 | * the other extended state. | |
15899 | */ | |
15900 | xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE); | |
15901 | - return fxrstor_checking((__force struct i387_fxsave_struct *)buf); | |
15902 | + return fxrstor_checking((struct i387_fxsave_struct __user *)buf); | |
15903 | } | |
15904 | ||
15905 | /* | |
15906 | @@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf | |
15907 | if (use_xsave()) | |
15908 | err = restore_user_xstate(buf); | |
15909 | else | |
15910 | - err = fxrstor_checking((__force struct i387_fxsave_struct *) | |
15911 | + err = fxrstor_checking((struct i387_fxsave_struct __user *) | |
15912 | buf); | |
15913 | if (unlikely(err)) { | |
15914 | /* | |
15915 | diff -urNp linux-3.0.3/arch/x86/kvm/emulate.c linux-3.0.3/arch/x86/kvm/emulate.c | |
15916 | --- linux-3.0.3/arch/x86/kvm/emulate.c 2011-07-21 22:17:23.000000000 -0400 | |
15917 | +++ linux-3.0.3/arch/x86/kvm/emulate.c 2011-08-23 21:47:55.000000000 -0400 | |
15918 | @@ -96,7 +96,7 @@ | |
15919 | #define Src2ImmByte (2<<29) | |
15920 | #define Src2One (3<<29) | |
15921 | #define Src2Imm (4<<29) | |
15922 | -#define Src2Mask (7<<29) | |
15923 | +#define Src2Mask (7U<<29) | |
15924 | ||
15925 | #define X2(x...) x, x | |
15926 | #define X3(x...) X2(x), x | |
15927 | @@ -207,6 +207,7 @@ struct gprefix { | |
15928 | ||
15929 | #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \ | |
15930 | do { \ | |
15931 | + unsigned long _tmp; \ | |
15932 | __asm__ __volatile__ ( \ | |
15933 | _PRE_EFLAGS("0", "4", "2") \ | |
15934 | _op _suffix " %"_x"3,%1; " \ | |
15935 | @@ -220,8 +221,6 @@ struct gprefix { | |
15936 | /* Raw emulation: instruction has two explicit operands. */ | |
15937 | #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \ | |
15938 | do { \ | |
15939 | - unsigned long _tmp; \ | |
15940 | - \ | |
15941 | switch ((_dst).bytes) { \ | |
15942 | case 2: \ | |
15943 | ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\ | |
15944 | @@ -237,7 +236,6 @@ struct gprefix { | |
15945 | ||
15946 | #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \ | |
15947 | do { \ | |
15948 | - unsigned long _tmp; \ | |
15949 | switch ((_dst).bytes) { \ | |
15950 | case 1: \ | |
15951 | ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \ | |
15952 | diff -urNp linux-3.0.3/arch/x86/kvm/lapic.c linux-3.0.3/arch/x86/kvm/lapic.c | |
15953 | --- linux-3.0.3/arch/x86/kvm/lapic.c 2011-07-21 22:17:23.000000000 -0400 | |
15954 | +++ linux-3.0.3/arch/x86/kvm/lapic.c 2011-08-23 21:47:55.000000000 -0400 | |
15955 | @@ -53,7 +53,7 @@ | |
15956 | #define APIC_BUS_CYCLE_NS 1 | |
15957 | ||
15958 | /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */ | |
15959 | -#define apic_debug(fmt, arg...) | |
15960 | +#define apic_debug(fmt, arg...) do {} while (0) | |
15961 | ||
15962 | #define APIC_LVT_NUM 6 | |
15963 | /* 14 is the version for Xeon and Pentium 8.4.8*/ | |
15964 | diff -urNp linux-3.0.3/arch/x86/kvm/mmu.c linux-3.0.3/arch/x86/kvm/mmu.c | |
15965 | --- linux-3.0.3/arch/x86/kvm/mmu.c 2011-07-21 22:17:23.000000000 -0400 | |
15966 | +++ linux-3.0.3/arch/x86/kvm/mmu.c 2011-08-23 21:47:55.000000000 -0400 | |
15967 | @@ -3238,7 +3238,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu * | |
15968 | ||
15969 | pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes); | |
15970 | ||
15971 | - invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter); | |
15972 | + invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter); | |
15973 | ||
15974 | /* | |
15975 | * Assume that the pte write on a page table of the same type | |
15976 | @@ -3270,7 +3270,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu * | |
15977 | } | |
15978 | ||
15979 | spin_lock(&vcpu->kvm->mmu_lock); | |
15980 | - if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter) | |
15981 | + if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter) | |
15982 | gentry = 0; | |
15983 | kvm_mmu_free_some_pages(vcpu); | |
15984 | ++vcpu->kvm->stat.mmu_pte_write; | |
15985 | diff -urNp linux-3.0.3/arch/x86/kvm/paging_tmpl.h linux-3.0.3/arch/x86/kvm/paging_tmpl.h | |
15986 | --- linux-3.0.3/arch/x86/kvm/paging_tmpl.h 2011-07-21 22:17:23.000000000 -0400 | |
15987 | +++ linux-3.0.3/arch/x86/kvm/paging_tmpl.h 2011-08-23 21:48:14.000000000 -0400 | |
15988 | @@ -583,6 +583,8 @@ static int FNAME(page_fault)(struct kvm_ | |
15989 | unsigned long mmu_seq; | |
15990 | bool map_writable; | |
15991 | ||
15992 | + pax_track_stack(); | |
15993 | + | |
15994 | pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code); | |
15995 | ||
15996 | r = mmu_topup_memory_caches(vcpu); | |
15997 | @@ -703,7 +705,7 @@ static void FNAME(invlpg)(struct kvm_vcp | |
15998 | if (need_flush) | |
15999 | kvm_flush_remote_tlbs(vcpu->kvm); | |
16000 | ||
16001 | - atomic_inc(&vcpu->kvm->arch.invlpg_counter); | |
16002 | + atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter); | |
16003 | ||
16004 | spin_unlock(&vcpu->kvm->mmu_lock); | |
16005 | ||
16006 | diff -urNp linux-3.0.3/arch/x86/kvm/svm.c linux-3.0.3/arch/x86/kvm/svm.c | |
16007 | --- linux-3.0.3/arch/x86/kvm/svm.c 2011-07-21 22:17:23.000000000 -0400 | |
16008 | +++ linux-3.0.3/arch/x86/kvm/svm.c 2011-08-23 21:47:55.000000000 -0400 | |
16009 | @@ -3377,7 +3377,11 @@ static void reload_tss(struct kvm_vcpu * | |
16010 | int cpu = raw_smp_processor_id(); | |
16011 | ||
16012 | struct svm_cpu_data *sd = per_cpu(svm_data, cpu); | |
16013 | + | |
16014 | + pax_open_kernel(); | |
16015 | sd->tss_desc->type = 9; /* available 32/64-bit TSS */ | |
16016 | + pax_close_kernel(); | |
16017 | + | |
16018 | load_TR_desc(); | |
16019 | } | |
16020 | ||
16021 | @@ -3755,6 +3759,10 @@ static void svm_vcpu_run(struct kvm_vcpu | |
16022 | #endif | |
16023 | #endif | |
16024 | ||
16025 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
16026 | + __set_fs(current_thread_info()->addr_limit); | |
16027 | +#endif | |
16028 | + | |
16029 | reload_tss(vcpu); | |
16030 | ||
16031 | local_irq_disable(); | |
16032 | diff -urNp linux-3.0.3/arch/x86/kvm/vmx.c linux-3.0.3/arch/x86/kvm/vmx.c | |
16033 | --- linux-3.0.3/arch/x86/kvm/vmx.c 2011-07-21 22:17:23.000000000 -0400 | |
16034 | +++ linux-3.0.3/arch/x86/kvm/vmx.c 2011-08-23 21:47:55.000000000 -0400 | |
16035 | @@ -797,7 +797,11 @@ static void reload_tss(void) | |
16036 | struct desc_struct *descs; | |
16037 | ||
16038 | descs = (void *)gdt->address; | |
16039 | + | |
16040 | + pax_open_kernel(); | |
16041 | descs[GDT_ENTRY_TSS].type = 9; /* available TSS */ | |
16042 | + pax_close_kernel(); | |
16043 | + | |
16044 | load_TR_desc(); | |
16045 | } | |
16046 | ||
16047 | @@ -1747,8 +1751,11 @@ static __init int hardware_setup(void) | |
16048 | if (!cpu_has_vmx_flexpriority()) | |
16049 | flexpriority_enabled = 0; | |
16050 | ||
16051 | - if (!cpu_has_vmx_tpr_shadow()) | |
16052 | - kvm_x86_ops->update_cr8_intercept = NULL; | |
16053 | + if (!cpu_has_vmx_tpr_shadow()) { | |
16054 | + pax_open_kernel(); | |
16055 | + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL; | |
16056 | + pax_close_kernel(); | |
16057 | + } | |
16058 | ||
16059 | if (enable_ept && !cpu_has_vmx_ept_2m_page()) | |
16060 | kvm_disable_largepages(); | |
16061 | @@ -2814,7 +2821,7 @@ static int vmx_vcpu_setup(struct vcpu_vm | |
16062 | vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */ | |
16063 | ||
16064 | asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return)); | |
16065 | - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */ | |
16066 | + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */ | |
16067 | vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0); | |
16068 | vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0); | |
16069 | vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host)); | |
16070 | @@ -4211,6 +4218,12 @@ static void __noclone vmx_vcpu_run(struc | |
16071 | "jmp .Lkvm_vmx_return \n\t" | |
16072 | ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t" | |
16073 | ".Lkvm_vmx_return: " | |
16074 | + | |
16075 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
16076 | + "ljmp %[cs],$.Lkvm_vmx_return2\n\t" | |
16077 | + ".Lkvm_vmx_return2: " | |
16078 | +#endif | |
16079 | + | |
16080 | /* Save guest registers, load host registers, keep flags */ | |
16081 | "mov %0, %c[wordsize](%%"R"sp) \n\t" | |
16082 | "pop %0 \n\t" | |
16083 | @@ -4259,6 +4272,11 @@ static void __noclone vmx_vcpu_run(struc | |
16084 | #endif | |
16085 | [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)), | |
16086 | [wordsize]"i"(sizeof(ulong)) | |
16087 | + | |
16088 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
16089 | + ,[cs]"i"(__KERNEL_CS) | |
16090 | +#endif | |
16091 | + | |
16092 | : "cc", "memory" | |
16093 | , R"ax", R"bx", R"di", R"si" | |
16094 | #ifdef CONFIG_X86_64 | |
16095 | @@ -4276,7 +4294,16 @@ static void __noclone vmx_vcpu_run(struc | |
16096 | ||
16097 | vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD); | |
16098 | ||
16099 | - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS)); | |
16100 | + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS)); | |
16101 | + | |
16102 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
16103 | + loadsegment(fs, __KERNEL_PERCPU); | |
16104 | +#endif | |
16105 | + | |
16106 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
16107 | + __set_fs(current_thread_info()->addr_limit); | |
16108 | +#endif | |
16109 | + | |
16110 | vmx->launched = 1; | |
16111 | ||
16112 | vmx->exit_reason = vmcs_read32(VM_EXIT_REASON); | |
16113 | diff -urNp linux-3.0.3/arch/x86/kvm/x86.c linux-3.0.3/arch/x86/kvm/x86.c | |
16114 | --- linux-3.0.3/arch/x86/kvm/x86.c 2011-07-21 22:17:23.000000000 -0400 | |
16115 | +++ linux-3.0.3/arch/x86/kvm/x86.c 2011-08-23 21:47:55.000000000 -0400 | |
16116 | @@ -2057,6 +2057,8 @@ long kvm_arch_dev_ioctl(struct file *fil | |
16117 | if (n < msr_list.nmsrs) | |
16118 | goto out; | |
16119 | r = -EFAULT; | |
16120 | + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save)) | |
16121 | + goto out; | |
16122 | if (copy_to_user(user_msr_list->indices, &msrs_to_save, | |
16123 | num_msrs_to_save * sizeof(u32))) | |
16124 | goto out; | |
16125 | @@ -2229,15 +2231,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str | |
16126 | struct kvm_cpuid2 *cpuid, | |
16127 | struct kvm_cpuid_entry2 __user *entries) | |
16128 | { | |
16129 | - int r; | |
16130 | + int r, i; | |
16131 | ||
16132 | r = -E2BIG; | |
16133 | if (cpuid->nent > KVM_MAX_CPUID_ENTRIES) | |
16134 | goto out; | |
16135 | r = -EFAULT; | |
16136 | - if (copy_from_user(&vcpu->arch.cpuid_entries, entries, | |
16137 | - cpuid->nent * sizeof(struct kvm_cpuid_entry2))) | |
16138 | + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2))) | |
16139 | goto out; | |
16140 | + for (i = 0; i < cpuid->nent; ++i) { | |
16141 | + struct kvm_cpuid_entry2 cpuid_entry; | |
16142 | + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry))) | |
16143 | + goto out; | |
16144 | + vcpu->arch.cpuid_entries[i] = cpuid_entry; | |
16145 | + } | |
16146 | vcpu->arch.cpuid_nent = cpuid->nent; | |
16147 | kvm_apic_set_version(vcpu); | |
16148 | kvm_x86_ops->cpuid_update(vcpu); | |
16149 | @@ -2252,15 +2259,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str | |
16150 | struct kvm_cpuid2 *cpuid, | |
16151 | struct kvm_cpuid_entry2 __user *entries) | |
16152 | { | |
16153 | - int r; | |
16154 | + int r, i; | |
16155 | ||
16156 | r = -E2BIG; | |
16157 | if (cpuid->nent < vcpu->arch.cpuid_nent) | |
16158 | goto out; | |
16159 | r = -EFAULT; | |
16160 | - if (copy_to_user(entries, &vcpu->arch.cpuid_entries, | |
16161 | - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2))) | |
16162 | + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2))) | |
16163 | goto out; | |
16164 | + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) { | |
16165 | + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i]; | |
16166 | + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry))) | |
16167 | + goto out; | |
16168 | + } | |
16169 | return 0; | |
16170 | ||
16171 | out: | |
16172 | @@ -2579,7 +2590,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru | |
16173 | static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, | |
16174 | struct kvm_interrupt *irq) | |
16175 | { | |
16176 | - if (irq->irq < 0 || irq->irq >= 256) | |
16177 | + if (irq->irq >= 256) | |
16178 | return -EINVAL; | |
16179 | if (irqchip_in_kernel(vcpu->kvm)) | |
16180 | return -ENXIO; | |
16181 | @@ -4878,7 +4889,7 @@ void kvm_after_handle_nmi(struct kvm_vcp | |
16182 | } | |
16183 | EXPORT_SYMBOL_GPL(kvm_after_handle_nmi); | |
16184 | ||
16185 | -int kvm_arch_init(void *opaque) | |
16186 | +int kvm_arch_init(const void *opaque) | |
16187 | { | |
16188 | int r; | |
16189 | struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque; | |
16190 | diff -urNp linux-3.0.3/arch/x86/lguest/boot.c linux-3.0.3/arch/x86/lguest/boot.c | |
16191 | --- linux-3.0.3/arch/x86/lguest/boot.c 2011-07-21 22:17:23.000000000 -0400 | |
16192 | +++ linux-3.0.3/arch/x86/lguest/boot.c 2011-08-23 21:47:55.000000000 -0400 | |
16193 | @@ -1176,9 +1176,10 @@ static __init int early_put_chars(u32 vt | |
16194 | * Rebooting also tells the Host we're finished, but the RESTART flag tells the | |
16195 | * Launcher to reboot us. | |
16196 | */ | |
16197 | -static void lguest_restart(char *reason) | |
16198 | +static __noreturn void lguest_restart(char *reason) | |
16199 | { | |
16200 | hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0); | |
16201 | + BUG(); | |
16202 | } | |
16203 | ||
16204 | /*G:050 | |
16205 | diff -urNp linux-3.0.3/arch/x86/lib/atomic64_32.c linux-3.0.3/arch/x86/lib/atomic64_32.c | |
16206 | --- linux-3.0.3/arch/x86/lib/atomic64_32.c 2011-07-21 22:17:23.000000000 -0400 | |
16207 | +++ linux-3.0.3/arch/x86/lib/atomic64_32.c 2011-08-23 21:47:55.000000000 -0400 | |
16208 | @@ -8,18 +8,30 @@ | |
16209 | ||
16210 | long long atomic64_read_cx8(long long, const atomic64_t *v); | |
16211 | EXPORT_SYMBOL(atomic64_read_cx8); | |
16212 | +long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v); | |
16213 | +EXPORT_SYMBOL(atomic64_read_unchecked_cx8); | |
16214 | long long atomic64_set_cx8(long long, const atomic64_t *v); | |
16215 | EXPORT_SYMBOL(atomic64_set_cx8); | |
16216 | +long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v); | |
16217 | +EXPORT_SYMBOL(atomic64_set_unchecked_cx8); | |
16218 | long long atomic64_xchg_cx8(long long, unsigned high); | |
16219 | EXPORT_SYMBOL(atomic64_xchg_cx8); | |
16220 | long long atomic64_add_return_cx8(long long a, atomic64_t *v); | |
16221 | EXPORT_SYMBOL(atomic64_add_return_cx8); | |
16222 | +long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v); | |
16223 | +EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8); | |
16224 | long long atomic64_sub_return_cx8(long long a, atomic64_t *v); | |
16225 | EXPORT_SYMBOL(atomic64_sub_return_cx8); | |
16226 | +long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v); | |
16227 | +EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8); | |
16228 | long long atomic64_inc_return_cx8(long long a, atomic64_t *v); | |
16229 | EXPORT_SYMBOL(atomic64_inc_return_cx8); | |
16230 | +long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v); | |
16231 | +EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8); | |
16232 | long long atomic64_dec_return_cx8(long long a, atomic64_t *v); | |
16233 | EXPORT_SYMBOL(atomic64_dec_return_cx8); | |
16234 | +long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v); | |
16235 | +EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8); | |
16236 | long long atomic64_dec_if_positive_cx8(atomic64_t *v); | |
16237 | EXPORT_SYMBOL(atomic64_dec_if_positive_cx8); | |
16238 | int atomic64_inc_not_zero_cx8(atomic64_t *v); | |
16239 | @@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8); | |
16240 | #ifndef CONFIG_X86_CMPXCHG64 | |
16241 | long long atomic64_read_386(long long, const atomic64_t *v); | |
16242 | EXPORT_SYMBOL(atomic64_read_386); | |
16243 | +long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v); | |
16244 | +EXPORT_SYMBOL(atomic64_read_unchecked_386); | |
16245 | long long atomic64_set_386(long long, const atomic64_t *v); | |
16246 | EXPORT_SYMBOL(atomic64_set_386); | |
16247 | +long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v); | |
16248 | +EXPORT_SYMBOL(atomic64_set_unchecked_386); | |
16249 | long long atomic64_xchg_386(long long, unsigned high); | |
16250 | EXPORT_SYMBOL(atomic64_xchg_386); | |
16251 | long long atomic64_add_return_386(long long a, atomic64_t *v); | |
16252 | EXPORT_SYMBOL(atomic64_add_return_386); | |
16253 | +long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16254 | +EXPORT_SYMBOL(atomic64_add_return_unchecked_386); | |
16255 | long long atomic64_sub_return_386(long long a, atomic64_t *v); | |
16256 | EXPORT_SYMBOL(atomic64_sub_return_386); | |
16257 | +long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16258 | +EXPORT_SYMBOL(atomic64_sub_return_unchecked_386); | |
16259 | long long atomic64_inc_return_386(long long a, atomic64_t *v); | |
16260 | EXPORT_SYMBOL(atomic64_inc_return_386); | |
16261 | +long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16262 | +EXPORT_SYMBOL(atomic64_inc_return_unchecked_386); | |
16263 | long long atomic64_dec_return_386(long long a, atomic64_t *v); | |
16264 | EXPORT_SYMBOL(atomic64_dec_return_386); | |
16265 | +long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16266 | +EXPORT_SYMBOL(atomic64_dec_return_unchecked_386); | |
16267 | long long atomic64_add_386(long long a, atomic64_t *v); | |
16268 | EXPORT_SYMBOL(atomic64_add_386); | |
16269 | +long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16270 | +EXPORT_SYMBOL(atomic64_add_unchecked_386); | |
16271 | long long atomic64_sub_386(long long a, atomic64_t *v); | |
16272 | EXPORT_SYMBOL(atomic64_sub_386); | |
16273 | +long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16274 | +EXPORT_SYMBOL(atomic64_sub_unchecked_386); | |
16275 | long long atomic64_inc_386(long long a, atomic64_t *v); | |
16276 | EXPORT_SYMBOL(atomic64_inc_386); | |
16277 | +long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16278 | +EXPORT_SYMBOL(atomic64_inc_unchecked_386); | |
16279 | long long atomic64_dec_386(long long a, atomic64_t *v); | |
16280 | EXPORT_SYMBOL(atomic64_dec_386); | |
16281 | +long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v); | |
16282 | +EXPORT_SYMBOL(atomic64_dec_unchecked_386); | |
16283 | long long atomic64_dec_if_positive_386(atomic64_t *v); | |
16284 | EXPORT_SYMBOL(atomic64_dec_if_positive_386); | |
16285 | int atomic64_inc_not_zero_386(atomic64_t *v); | |
16286 | diff -urNp linux-3.0.3/arch/x86/lib/atomic64_386_32.S linux-3.0.3/arch/x86/lib/atomic64_386_32.S | |
16287 | --- linux-3.0.3/arch/x86/lib/atomic64_386_32.S 2011-07-21 22:17:23.000000000 -0400 | |
16288 | +++ linux-3.0.3/arch/x86/lib/atomic64_386_32.S 2011-08-23 21:47:55.000000000 -0400 | |
16289 | @@ -48,6 +48,10 @@ BEGIN(read) | |
16290 | movl (v), %eax | |
16291 | movl 4(v), %edx | |
16292 | RET_ENDP | |
16293 | +BEGIN(read_unchecked) | |
16294 | + movl (v), %eax | |
16295 | + movl 4(v), %edx | |
16296 | +RET_ENDP | |
16297 | #undef v | |
16298 | ||
16299 | #define v %esi | |
16300 | @@ -55,6 +59,10 @@ BEGIN(set) | |
16301 | movl %ebx, (v) | |
16302 | movl %ecx, 4(v) | |
16303 | RET_ENDP | |
16304 | +BEGIN(set_unchecked) | |
16305 | + movl %ebx, (v) | |
16306 | + movl %ecx, 4(v) | |
16307 | +RET_ENDP | |
16308 | #undef v | |
16309 | ||
16310 | #define v %esi | |
16311 | @@ -70,6 +78,20 @@ RET_ENDP | |
16312 | BEGIN(add) | |
16313 | addl %eax, (v) | |
16314 | adcl %edx, 4(v) | |
16315 | + | |
16316 | +#ifdef CONFIG_PAX_REFCOUNT | |
16317 | + jno 0f | |
16318 | + subl %eax, (v) | |
16319 | + sbbl %edx, 4(v) | |
16320 | + int $4 | |
16321 | +0: | |
16322 | + _ASM_EXTABLE(0b, 0b) | |
16323 | +#endif | |
16324 | + | |
16325 | +RET_ENDP | |
16326 | +BEGIN(add_unchecked) | |
16327 | + addl %eax, (v) | |
16328 | + adcl %edx, 4(v) | |
16329 | RET_ENDP | |
16330 | #undef v | |
16331 | ||
16332 | @@ -77,6 +99,24 @@ RET_ENDP | |
16333 | BEGIN(add_return) | |
16334 | addl (v), %eax | |
16335 | adcl 4(v), %edx | |
16336 | + | |
16337 | +#ifdef CONFIG_PAX_REFCOUNT | |
16338 | + into | |
16339 | +1234: | |
16340 | + _ASM_EXTABLE(1234b, 2f) | |
16341 | +#endif | |
16342 | + | |
16343 | + movl %eax, (v) | |
16344 | + movl %edx, 4(v) | |
16345 | + | |
16346 | +#ifdef CONFIG_PAX_REFCOUNT | |
16347 | +2: | |
16348 | +#endif | |
16349 | + | |
16350 | +RET_ENDP | |
16351 | +BEGIN(add_return_unchecked) | |
16352 | + addl (v), %eax | |
16353 | + adcl 4(v), %edx | |
16354 | movl %eax, (v) | |
16355 | movl %edx, 4(v) | |
16356 | RET_ENDP | |
16357 | @@ -86,6 +126,20 @@ RET_ENDP | |
16358 | BEGIN(sub) | |
16359 | subl %eax, (v) | |
16360 | sbbl %edx, 4(v) | |
16361 | + | |
16362 | +#ifdef CONFIG_PAX_REFCOUNT | |
16363 | + jno 0f | |
16364 | + addl %eax, (v) | |
16365 | + adcl %edx, 4(v) | |
16366 | + int $4 | |
16367 | +0: | |
16368 | + _ASM_EXTABLE(0b, 0b) | |
16369 | +#endif | |
16370 | + | |
16371 | +RET_ENDP | |
16372 | +BEGIN(sub_unchecked) | |
16373 | + subl %eax, (v) | |
16374 | + sbbl %edx, 4(v) | |
16375 | RET_ENDP | |
16376 | #undef v | |
16377 | ||
16378 | @@ -96,6 +150,27 @@ BEGIN(sub_return) | |
16379 | sbbl $0, %edx | |
16380 | addl (v), %eax | |
16381 | adcl 4(v), %edx | |
16382 | + | |
16383 | +#ifdef CONFIG_PAX_REFCOUNT | |
16384 | + into | |
16385 | +1234: | |
16386 | + _ASM_EXTABLE(1234b, 2f) | |
16387 | +#endif | |
16388 | + | |
16389 | + movl %eax, (v) | |
16390 | + movl %edx, 4(v) | |
16391 | + | |
16392 | +#ifdef CONFIG_PAX_REFCOUNT | |
16393 | +2: | |
16394 | +#endif | |
16395 | + | |
16396 | +RET_ENDP | |
16397 | +BEGIN(sub_return_unchecked) | |
16398 | + negl %edx | |
16399 | + negl %eax | |
16400 | + sbbl $0, %edx | |
16401 | + addl (v), %eax | |
16402 | + adcl 4(v), %edx | |
16403 | movl %eax, (v) | |
16404 | movl %edx, 4(v) | |
16405 | RET_ENDP | |
16406 | @@ -105,6 +180,20 @@ RET_ENDP | |
16407 | BEGIN(inc) | |
16408 | addl $1, (v) | |
16409 | adcl $0, 4(v) | |
16410 | + | |
16411 | +#ifdef CONFIG_PAX_REFCOUNT | |
16412 | + jno 0f | |
16413 | + subl $1, (v) | |
16414 | + sbbl $0, 4(v) | |
16415 | + int $4 | |
16416 | +0: | |
16417 | + _ASM_EXTABLE(0b, 0b) | |
16418 | +#endif | |
16419 | + | |
16420 | +RET_ENDP | |
16421 | +BEGIN(inc_unchecked) | |
16422 | + addl $1, (v) | |
16423 | + adcl $0, 4(v) | |
16424 | RET_ENDP | |
16425 | #undef v | |
16426 | ||
16427 | @@ -114,6 +203,26 @@ BEGIN(inc_return) | |
16428 | movl 4(v), %edx | |
16429 | addl $1, %eax | |
16430 | adcl $0, %edx | |
16431 | + | |
16432 | +#ifdef CONFIG_PAX_REFCOUNT | |
16433 | + into | |
16434 | +1234: | |
16435 | + _ASM_EXTABLE(1234b, 2f) | |
16436 | +#endif | |
16437 | + | |
16438 | + movl %eax, (v) | |
16439 | + movl %edx, 4(v) | |
16440 | + | |
16441 | +#ifdef CONFIG_PAX_REFCOUNT | |
16442 | +2: | |
16443 | +#endif | |
16444 | + | |
16445 | +RET_ENDP | |
16446 | +BEGIN(inc_return_unchecked) | |
16447 | + movl (v), %eax | |
16448 | + movl 4(v), %edx | |
16449 | + addl $1, %eax | |
16450 | + adcl $0, %edx | |
16451 | movl %eax, (v) | |
16452 | movl %edx, 4(v) | |
16453 | RET_ENDP | |
16454 | @@ -123,6 +232,20 @@ RET_ENDP | |
16455 | BEGIN(dec) | |
16456 | subl $1, (v) | |
16457 | sbbl $0, 4(v) | |
16458 | + | |
16459 | +#ifdef CONFIG_PAX_REFCOUNT | |
16460 | + jno 0f | |
16461 | + addl $1, (v) | |
16462 | + adcl $0, 4(v) | |
16463 | + int $4 | |
16464 | +0: | |
16465 | + _ASM_EXTABLE(0b, 0b) | |
16466 | +#endif | |
16467 | + | |
16468 | +RET_ENDP | |
16469 | +BEGIN(dec_unchecked) | |
16470 | + subl $1, (v) | |
16471 | + sbbl $0, 4(v) | |
16472 | RET_ENDP | |
16473 | #undef v | |
16474 | ||
16475 | @@ -132,6 +255,26 @@ BEGIN(dec_return) | |
16476 | movl 4(v), %edx | |
16477 | subl $1, %eax | |
16478 | sbbl $0, %edx | |
16479 | + | |
16480 | +#ifdef CONFIG_PAX_REFCOUNT | |
16481 | + into | |
16482 | +1234: | |
16483 | + _ASM_EXTABLE(1234b, 2f) | |
16484 | +#endif | |
16485 | + | |
16486 | + movl %eax, (v) | |
16487 | + movl %edx, 4(v) | |
16488 | + | |
16489 | +#ifdef CONFIG_PAX_REFCOUNT | |
16490 | +2: | |
16491 | +#endif | |
16492 | + | |
16493 | +RET_ENDP | |
16494 | +BEGIN(dec_return_unchecked) | |
16495 | + movl (v), %eax | |
16496 | + movl 4(v), %edx | |
16497 | + subl $1, %eax | |
16498 | + sbbl $0, %edx | |
16499 | movl %eax, (v) | |
16500 | movl %edx, 4(v) | |
16501 | RET_ENDP | |
16502 | @@ -143,6 +286,13 @@ BEGIN(add_unless) | |
16503 | adcl %edx, %edi | |
16504 | addl (v), %eax | |
16505 | adcl 4(v), %edx | |
16506 | + | |
16507 | +#ifdef CONFIG_PAX_REFCOUNT | |
16508 | + into | |
16509 | +1234: | |
16510 | + _ASM_EXTABLE(1234b, 2f) | |
16511 | +#endif | |
16512 | + | |
16513 | cmpl %eax, %esi | |
16514 | je 3f | |
16515 | 1: | |
16516 | @@ -168,6 +318,13 @@ BEGIN(inc_not_zero) | |
16517 | 1: | |
16518 | addl $1, %eax | |
16519 | adcl $0, %edx | |
16520 | + | |
16521 | +#ifdef CONFIG_PAX_REFCOUNT | |
16522 | + into | |
16523 | +1234: | |
16524 | + _ASM_EXTABLE(1234b, 2f) | |
16525 | +#endif | |
16526 | + | |
16527 | movl %eax, (v) | |
16528 | movl %edx, 4(v) | |
16529 | movl $1, %eax | |
16530 | @@ -186,6 +343,13 @@ BEGIN(dec_if_positive) | |
16531 | movl 4(v), %edx | |
16532 | subl $1, %eax | |
16533 | sbbl $0, %edx | |
16534 | + | |
16535 | +#ifdef CONFIG_PAX_REFCOUNT | |
16536 | + into | |
16537 | +1234: | |
16538 | + _ASM_EXTABLE(1234b, 1f) | |
16539 | +#endif | |
16540 | + | |
16541 | js 1f | |
16542 | movl %eax, (v) | |
16543 | movl %edx, 4(v) | |
16544 | diff -urNp linux-3.0.3/arch/x86/lib/atomic64_cx8_32.S linux-3.0.3/arch/x86/lib/atomic64_cx8_32.S | |
16545 | --- linux-3.0.3/arch/x86/lib/atomic64_cx8_32.S 2011-07-21 22:17:23.000000000 -0400 | |
16546 | +++ linux-3.0.3/arch/x86/lib/atomic64_cx8_32.S 2011-08-23 21:47:55.000000000 -0400 | |
16547 | @@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8) | |
16548 | CFI_ENDPROC | |
16549 | ENDPROC(atomic64_read_cx8) | |
16550 | ||
16551 | +ENTRY(atomic64_read_unchecked_cx8) | |
16552 | + CFI_STARTPROC | |
16553 | + | |
16554 | + read64 %ecx | |
16555 | + ret | |
16556 | + CFI_ENDPROC | |
16557 | +ENDPROC(atomic64_read_unchecked_cx8) | |
16558 | + | |
16559 | ENTRY(atomic64_set_cx8) | |
16560 | CFI_STARTPROC | |
16561 | ||
16562 | @@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8) | |
16563 | CFI_ENDPROC | |
16564 | ENDPROC(atomic64_set_cx8) | |
16565 | ||
16566 | +ENTRY(atomic64_set_unchecked_cx8) | |
16567 | + CFI_STARTPROC | |
16568 | + | |
16569 | +1: | |
16570 | +/* we don't need LOCK_PREFIX since aligned 64-bit writes | |
16571 | + * are atomic on 586 and newer */ | |
16572 | + cmpxchg8b (%esi) | |
16573 | + jne 1b | |
16574 | + | |
16575 | + ret | |
16576 | + CFI_ENDPROC | |
16577 | +ENDPROC(atomic64_set_unchecked_cx8) | |
16578 | + | |
16579 | ENTRY(atomic64_xchg_cx8) | |
16580 | CFI_STARTPROC | |
16581 | ||
16582 | @@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8) | |
16583 | CFI_ENDPROC | |
16584 | ENDPROC(atomic64_xchg_cx8) | |
16585 | ||
16586 | -.macro addsub_return func ins insc | |
16587 | -ENTRY(atomic64_\func\()_return_cx8) | |
16588 | +.macro addsub_return func ins insc unchecked="" | |
16589 | +ENTRY(atomic64_\func\()_return\unchecked\()_cx8) | |
16590 | CFI_STARTPROC | |
16591 | SAVE ebp | |
16592 | SAVE ebx | |
16593 | @@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8) | |
16594 | movl %edx, %ecx | |
16595 | \ins\()l %esi, %ebx | |
16596 | \insc\()l %edi, %ecx | |
16597 | + | |
16598 | +.ifb \unchecked | |
16599 | +#ifdef CONFIG_PAX_REFCOUNT | |
16600 | + into | |
16601 | +2: | |
16602 | + _ASM_EXTABLE(2b, 3f) | |
16603 | +#endif | |
16604 | +.endif | |
16605 | + | |
16606 | LOCK_PREFIX | |
16607 | cmpxchg8b (%ebp) | |
16608 | jne 1b | |
16609 | - | |
16610 | -10: | |
16611 | movl %ebx, %eax | |
16612 | movl %ecx, %edx | |
16613 | + | |
16614 | +.ifb \unchecked | |
16615 | +#ifdef CONFIG_PAX_REFCOUNT | |
16616 | +3: | |
16617 | +#endif | |
16618 | +.endif | |
16619 | + | |
16620 | RESTORE edi | |
16621 | RESTORE esi | |
16622 | RESTORE ebx | |
16623 | RESTORE ebp | |
16624 | ret | |
16625 | CFI_ENDPROC | |
16626 | -ENDPROC(atomic64_\func\()_return_cx8) | |
16627 | +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8) | |
16628 | .endm | |
16629 | ||
16630 | addsub_return add add adc | |
16631 | addsub_return sub sub sbb | |
16632 | +addsub_return add add adc _unchecked | |
16633 | +addsub_return sub sub sbb _unchecked | |
16634 | ||
16635 | -.macro incdec_return func ins insc | |
16636 | -ENTRY(atomic64_\func\()_return_cx8) | |
16637 | +.macro incdec_return func ins insc unchecked | |
16638 | +ENTRY(atomic64_\func\()_return\unchecked\()_cx8) | |
16639 | CFI_STARTPROC | |
16640 | SAVE ebx | |
16641 | ||
16642 | @@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8) | |
16643 | movl %edx, %ecx | |
16644 | \ins\()l $1, %ebx | |
16645 | \insc\()l $0, %ecx | |
16646 | + | |
16647 | +.ifb \unchecked | |
16648 | +#ifdef CONFIG_PAX_REFCOUNT | |
16649 | + into | |
16650 | +2: | |
16651 | + _ASM_EXTABLE(2b, 3f) | |
16652 | +#endif | |
16653 | +.endif | |
16654 | + | |
16655 | LOCK_PREFIX | |
16656 | cmpxchg8b (%esi) | |
16657 | jne 1b | |
16658 | ||
16659 | -10: | |
16660 | movl %ebx, %eax | |
16661 | movl %ecx, %edx | |
16662 | + | |
16663 | +.ifb \unchecked | |
16664 | +#ifdef CONFIG_PAX_REFCOUNT | |
16665 | +3: | |
16666 | +#endif | |
16667 | +.endif | |
16668 | + | |
16669 | RESTORE ebx | |
16670 | ret | |
16671 | CFI_ENDPROC | |
16672 | -ENDPROC(atomic64_\func\()_return_cx8) | |
16673 | +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8) | |
16674 | .endm | |
16675 | ||
16676 | incdec_return inc add adc | |
16677 | incdec_return dec sub sbb | |
16678 | +incdec_return inc add adc _unchecked | |
16679 | +incdec_return dec sub sbb _unchecked | |
16680 | ||
16681 | ENTRY(atomic64_dec_if_positive_cx8) | |
16682 | CFI_STARTPROC | |
16683 | @@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8) | |
16684 | movl %edx, %ecx | |
16685 | subl $1, %ebx | |
16686 | sbb $0, %ecx | |
16687 | + | |
16688 | +#ifdef CONFIG_PAX_REFCOUNT | |
16689 | + into | |
16690 | +1234: | |
16691 | + _ASM_EXTABLE(1234b, 2f) | |
16692 | +#endif | |
16693 | + | |
16694 | js 2f | |
16695 | LOCK_PREFIX | |
16696 | cmpxchg8b (%esi) | |
16697 | @@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8) | |
16698 | movl %edx, %ecx | |
16699 | addl %esi, %ebx | |
16700 | adcl %edi, %ecx | |
16701 | + | |
16702 | +#ifdef CONFIG_PAX_REFCOUNT | |
16703 | + into | |
16704 | +1234: | |
16705 | + _ASM_EXTABLE(1234b, 3f) | |
16706 | +#endif | |
16707 | + | |
16708 | LOCK_PREFIX | |
16709 | cmpxchg8b (%ebp) | |
16710 | jne 1b | |
16711 | @@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8) | |
16712 | movl %edx, %ecx | |
16713 | addl $1, %ebx | |
16714 | adcl $0, %ecx | |
16715 | + | |
16716 | +#ifdef CONFIG_PAX_REFCOUNT | |
16717 | + into | |
16718 | +1234: | |
16719 | + _ASM_EXTABLE(1234b, 3f) | |
16720 | +#endif | |
16721 | + | |
16722 | LOCK_PREFIX | |
16723 | cmpxchg8b (%esi) | |
16724 | jne 1b | |
16725 | diff -urNp linux-3.0.3/arch/x86/lib/checksum_32.S linux-3.0.3/arch/x86/lib/checksum_32.S | |
16726 | --- linux-3.0.3/arch/x86/lib/checksum_32.S 2011-07-21 22:17:23.000000000 -0400 | |
16727 | +++ linux-3.0.3/arch/x86/lib/checksum_32.S 2011-08-23 21:47:55.000000000 -0400 | |
16728 | @@ -28,7 +28,8 @@ | |
16729 | #include <linux/linkage.h> | |
16730 | #include <asm/dwarf2.h> | |
16731 | #include <asm/errno.h> | |
16732 | - | |
16733 | +#include <asm/segment.h> | |
16734 | + | |
16735 | /* | |
16736 | * computes a partial checksum, e.g. for TCP/UDP fragments | |
16737 | */ | |
16738 | @@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic ( | |
16739 | ||
16740 | #define ARGBASE 16 | |
16741 | #define FP 12 | |
16742 | - | |
16743 | -ENTRY(csum_partial_copy_generic) | |
16744 | + | |
16745 | +ENTRY(csum_partial_copy_generic_to_user) | |
16746 | CFI_STARTPROC | |
16747 | + | |
16748 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
16749 | + pushl_cfi %gs | |
16750 | + popl_cfi %es | |
16751 | + jmp csum_partial_copy_generic | |
16752 | +#endif | |
16753 | + | |
16754 | +ENTRY(csum_partial_copy_generic_from_user) | |
16755 | + | |
16756 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
16757 | + pushl_cfi %gs | |
16758 | + popl_cfi %ds | |
16759 | +#endif | |
16760 | + | |
16761 | +ENTRY(csum_partial_copy_generic) | |
16762 | subl $4,%esp | |
16763 | CFI_ADJUST_CFA_OFFSET 4 | |
16764 | pushl_cfi %edi | |
16765 | @@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic) | |
16766 | jmp 4f | |
16767 | SRC(1: movw (%esi), %bx ) | |
16768 | addl $2, %esi | |
16769 | -DST( movw %bx, (%edi) ) | |
16770 | +DST( movw %bx, %es:(%edi) ) | |
16771 | addl $2, %edi | |
16772 | addw %bx, %ax | |
16773 | adcl $0, %eax | |
16774 | @@ -332,30 +348,30 @@ DST( movw %bx, (%edi) ) | |
16775 | SRC(1: movl (%esi), %ebx ) | |
16776 | SRC( movl 4(%esi), %edx ) | |
16777 | adcl %ebx, %eax | |
16778 | -DST( movl %ebx, (%edi) ) | |
16779 | +DST( movl %ebx, %es:(%edi) ) | |
16780 | adcl %edx, %eax | |
16781 | -DST( movl %edx, 4(%edi) ) | |
16782 | +DST( movl %edx, %es:4(%edi) ) | |
16783 | ||
16784 | SRC( movl 8(%esi), %ebx ) | |
16785 | SRC( movl 12(%esi), %edx ) | |
16786 | adcl %ebx, %eax | |
16787 | -DST( movl %ebx, 8(%edi) ) | |
16788 | +DST( movl %ebx, %es:8(%edi) ) | |
16789 | adcl %edx, %eax | |
16790 | -DST( movl %edx, 12(%edi) ) | |
16791 | +DST( movl %edx, %es:12(%edi) ) | |
16792 | ||
16793 | SRC( movl 16(%esi), %ebx ) | |
16794 | SRC( movl 20(%esi), %edx ) | |
16795 | adcl %ebx, %eax | |
16796 | -DST( movl %ebx, 16(%edi) ) | |
16797 | +DST( movl %ebx, %es:16(%edi) ) | |
16798 | adcl %edx, %eax | |
16799 | -DST( movl %edx, 20(%edi) ) | |
16800 | +DST( movl %edx, %es:20(%edi) ) | |
16801 | ||
16802 | SRC( movl 24(%esi), %ebx ) | |
16803 | SRC( movl 28(%esi), %edx ) | |
16804 | adcl %ebx, %eax | |
16805 | -DST( movl %ebx, 24(%edi) ) | |
16806 | +DST( movl %ebx, %es:24(%edi) ) | |
16807 | adcl %edx, %eax | |
16808 | -DST( movl %edx, 28(%edi) ) | |
16809 | +DST( movl %edx, %es:28(%edi) ) | |
16810 | ||
16811 | lea 32(%esi), %esi | |
16812 | lea 32(%edi), %edi | |
16813 | @@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) ) | |
16814 | shrl $2, %edx # This clears CF | |
16815 | SRC(3: movl (%esi), %ebx ) | |
16816 | adcl %ebx, %eax | |
16817 | -DST( movl %ebx, (%edi) ) | |
16818 | +DST( movl %ebx, %es:(%edi) ) | |
16819 | lea 4(%esi), %esi | |
16820 | lea 4(%edi), %edi | |
16821 | dec %edx | |
16822 | @@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) ) | |
16823 | jb 5f | |
16824 | SRC( movw (%esi), %cx ) | |
16825 | leal 2(%esi), %esi | |
16826 | -DST( movw %cx, (%edi) ) | |
16827 | +DST( movw %cx, %es:(%edi) ) | |
16828 | leal 2(%edi), %edi | |
16829 | je 6f | |
16830 | shll $16,%ecx | |
16831 | SRC(5: movb (%esi), %cl ) | |
16832 | -DST( movb %cl, (%edi) ) | |
16833 | +DST( movb %cl, %es:(%edi) ) | |
16834 | 6: addl %ecx, %eax | |
16835 | adcl $0, %eax | |
16836 | 7: | |
16837 | @@ -397,7 +413,7 @@ DST( movb %cl, (%edi) ) | |
16838 | ||
16839 | 6001: | |
16840 | movl ARGBASE+20(%esp), %ebx # src_err_ptr | |
16841 | - movl $-EFAULT, (%ebx) | |
16842 | + movl $-EFAULT, %ss:(%ebx) | |
16843 | ||
16844 | # zero the complete destination - computing the rest | |
16845 | # is too much work | |
16846 | @@ -410,11 +426,15 @@ DST( movb %cl, (%edi) ) | |
16847 | ||
16848 | 6002: | |
16849 | movl ARGBASE+24(%esp), %ebx # dst_err_ptr | |
16850 | - movl $-EFAULT,(%ebx) | |
16851 | + movl $-EFAULT,%ss:(%ebx) | |
16852 | jmp 5000b | |
16853 | ||
16854 | .previous | |
16855 | ||
16856 | + pushl_cfi %ss | |
16857 | + popl_cfi %ds | |
16858 | + pushl_cfi %ss | |
16859 | + popl_cfi %es | |
16860 | popl_cfi %ebx | |
16861 | CFI_RESTORE ebx | |
16862 | popl_cfi %esi | |
16863 | @@ -424,26 +444,43 @@ DST( movb %cl, (%edi) ) | |
16864 | popl_cfi %ecx # equivalent to addl $4,%esp | |
16865 | ret | |
16866 | CFI_ENDPROC | |
16867 | -ENDPROC(csum_partial_copy_generic) | |
16868 | +ENDPROC(csum_partial_copy_generic_to_user) | |
16869 | ||
16870 | #else | |
16871 | ||
16872 | /* Version for PentiumII/PPro */ | |
16873 | ||
16874 | #define ROUND1(x) \ | |
16875 | + nop; nop; nop; \ | |
16876 | SRC(movl x(%esi), %ebx ) ; \ | |
16877 | addl %ebx, %eax ; \ | |
16878 | - DST(movl %ebx, x(%edi) ) ; | |
16879 | + DST(movl %ebx, %es:x(%edi)) ; | |
16880 | ||
16881 | #define ROUND(x) \ | |
16882 | + nop; nop; nop; \ | |
16883 | SRC(movl x(%esi), %ebx ) ; \ | |
16884 | adcl %ebx, %eax ; \ | |
16885 | - DST(movl %ebx, x(%edi) ) ; | |
16886 | + DST(movl %ebx, %es:x(%edi)) ; | |
16887 | ||
16888 | #define ARGBASE 12 | |
16889 | - | |
16890 | -ENTRY(csum_partial_copy_generic) | |
16891 | + | |
16892 | +ENTRY(csum_partial_copy_generic_to_user) | |
16893 | CFI_STARTPROC | |
16894 | + | |
16895 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
16896 | + pushl_cfi %gs | |
16897 | + popl_cfi %es | |
16898 | + jmp csum_partial_copy_generic | |
16899 | +#endif | |
16900 | + | |
16901 | +ENTRY(csum_partial_copy_generic_from_user) | |
16902 | + | |
16903 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
16904 | + pushl_cfi %gs | |
16905 | + popl_cfi %ds | |
16906 | +#endif | |
16907 | + | |
16908 | +ENTRY(csum_partial_copy_generic) | |
16909 | pushl_cfi %ebx | |
16910 | CFI_REL_OFFSET ebx, 0 | |
16911 | pushl_cfi %edi | |
16912 | @@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic) | |
16913 | subl %ebx, %edi | |
16914 | lea -1(%esi),%edx | |
16915 | andl $-32,%edx | |
16916 | - lea 3f(%ebx,%ebx), %ebx | |
16917 | + lea 3f(%ebx,%ebx,2), %ebx | |
16918 | testl %esi, %esi | |
16919 | jmp *%ebx | |
16920 | 1: addl $64,%esi | |
16921 | @@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic) | |
16922 | jb 5f | |
16923 | SRC( movw (%esi), %dx ) | |
16924 | leal 2(%esi), %esi | |
16925 | -DST( movw %dx, (%edi) ) | |
16926 | +DST( movw %dx, %es:(%edi) ) | |
16927 | leal 2(%edi), %edi | |
16928 | je 6f | |
16929 | shll $16,%edx | |
16930 | 5: | |
16931 | SRC( movb (%esi), %dl ) | |
16932 | -DST( movb %dl, (%edi) ) | |
16933 | +DST( movb %dl, %es:(%edi) ) | |
16934 | 6: addl %edx, %eax | |
16935 | adcl $0, %eax | |
16936 | 7: | |
16937 | .section .fixup, "ax" | |
16938 | 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr | |
16939 | - movl $-EFAULT, (%ebx) | |
16940 | + movl $-EFAULT, %ss:(%ebx) | |
16941 | # zero the complete destination (computing the rest is too much work) | |
16942 | movl ARGBASE+8(%esp),%edi # dst | |
16943 | movl ARGBASE+12(%esp),%ecx # len | |
16944 | @@ -505,10 +542,17 @@ DST( movb %dl, (%edi) ) | |
16945 | rep; stosb | |
16946 | jmp 7b | |
16947 | 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr | |
16948 | - movl $-EFAULT, (%ebx) | |
16949 | + movl $-EFAULT, %ss:(%ebx) | |
16950 | jmp 7b | |
16951 | .previous | |
16952 | ||
16953 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
16954 | + pushl_cfi %ss | |
16955 | + popl_cfi %ds | |
16956 | + pushl_cfi %ss | |
16957 | + popl_cfi %es | |
16958 | +#endif | |
16959 | + | |
16960 | popl_cfi %esi | |
16961 | CFI_RESTORE esi | |
16962 | popl_cfi %edi | |
16963 | @@ -517,7 +561,7 @@ DST( movb %dl, (%edi) ) | |
16964 | CFI_RESTORE ebx | |
16965 | ret | |
16966 | CFI_ENDPROC | |
16967 | -ENDPROC(csum_partial_copy_generic) | |
16968 | +ENDPROC(csum_partial_copy_generic_to_user) | |
16969 | ||
16970 | #undef ROUND | |
16971 | #undef ROUND1 | |
16972 | diff -urNp linux-3.0.3/arch/x86/lib/clear_page_64.S linux-3.0.3/arch/x86/lib/clear_page_64.S | |
16973 | --- linux-3.0.3/arch/x86/lib/clear_page_64.S 2011-07-21 22:17:23.000000000 -0400 | |
16974 | +++ linux-3.0.3/arch/x86/lib/clear_page_64.S 2011-08-23 21:47:55.000000000 -0400 | |
16975 | @@ -58,7 +58,7 @@ ENDPROC(clear_page) | |
16976 | ||
16977 | #include <asm/cpufeature.h> | |
16978 | ||
16979 | - .section .altinstr_replacement,"ax" | |
16980 | + .section .altinstr_replacement,"a" | |
16981 | 1: .byte 0xeb /* jmp <disp8> */ | |
16982 | .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */ | |
16983 | 2: .byte 0xeb /* jmp <disp8> */ | |
16984 | diff -urNp linux-3.0.3/arch/x86/lib/copy_page_64.S linux-3.0.3/arch/x86/lib/copy_page_64.S | |
16985 | --- linux-3.0.3/arch/x86/lib/copy_page_64.S 2011-07-21 22:17:23.000000000 -0400 | |
16986 | +++ linux-3.0.3/arch/x86/lib/copy_page_64.S 2011-08-23 21:47:55.000000000 -0400 | |
16987 | @@ -104,7 +104,7 @@ ENDPROC(copy_page) | |
16988 | ||
16989 | #include <asm/cpufeature.h> | |
16990 | ||
16991 | - .section .altinstr_replacement,"ax" | |
16992 | + .section .altinstr_replacement,"a" | |
16993 | 1: .byte 0xeb /* jmp <disp8> */ | |
16994 | .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */ | |
16995 | 2: | |
16996 | diff -urNp linux-3.0.3/arch/x86/lib/copy_user_64.S linux-3.0.3/arch/x86/lib/copy_user_64.S | |
16997 | --- linux-3.0.3/arch/x86/lib/copy_user_64.S 2011-07-21 22:17:23.000000000 -0400 | |
16998 | +++ linux-3.0.3/arch/x86/lib/copy_user_64.S 2011-08-23 21:47:55.000000000 -0400 | |
16999 | @@ -16,6 +16,7 @@ | |
17000 | #include <asm/thread_info.h> | |
17001 | #include <asm/cpufeature.h> | |
17002 | #include <asm/alternative-asm.h> | |
17003 | +#include <asm/pgtable.h> | |
17004 | ||
17005 | /* | |
17006 | * By placing feature2 after feature1 in altinstructions section, we logically | |
17007 | @@ -29,7 +30,7 @@ | |
17008 | .byte 0xe9 /* 32bit jump */ | |
17009 | .long \orig-1f /* by default jump to orig */ | |
17010 | 1: | |
17011 | - .section .altinstr_replacement,"ax" | |
17012 | + .section .altinstr_replacement,"a" | |
17013 | 2: .byte 0xe9 /* near jump with 32bit immediate */ | |
17014 | .long \alt1-1b /* offset */ /* or alternatively to alt1 */ | |
17015 | 3: .byte 0xe9 /* near jump with 32bit immediate */ | |
17016 | @@ -71,41 +72,13 @@ | |
17017 | #endif | |
17018 | .endm | |
17019 | ||
17020 | -/* Standard copy_to_user with segment limit checking */ | |
17021 | -ENTRY(_copy_to_user) | |
17022 | - CFI_STARTPROC | |
17023 | - GET_THREAD_INFO(%rax) | |
17024 | - movq %rdi,%rcx | |
17025 | - addq %rdx,%rcx | |
17026 | - jc bad_to_user | |
17027 | - cmpq TI_addr_limit(%rax),%rcx | |
17028 | - ja bad_to_user | |
17029 | - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \ | |
17030 | - copy_user_generic_unrolled,copy_user_generic_string, \ | |
17031 | - copy_user_enhanced_fast_string | |
17032 | - CFI_ENDPROC | |
17033 | -ENDPROC(_copy_to_user) | |
17034 | - | |
17035 | -/* Standard copy_from_user with segment limit checking */ | |
17036 | -ENTRY(_copy_from_user) | |
17037 | - CFI_STARTPROC | |
17038 | - GET_THREAD_INFO(%rax) | |
17039 | - movq %rsi,%rcx | |
17040 | - addq %rdx,%rcx | |
17041 | - jc bad_from_user | |
17042 | - cmpq TI_addr_limit(%rax),%rcx | |
17043 | - ja bad_from_user | |
17044 | - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \ | |
17045 | - copy_user_generic_unrolled,copy_user_generic_string, \ | |
17046 | - copy_user_enhanced_fast_string | |
17047 | - CFI_ENDPROC | |
17048 | -ENDPROC(_copy_from_user) | |
17049 | - | |
17050 | .section .fixup,"ax" | |
17051 | /* must zero dest */ | |
17052 | ENTRY(bad_from_user) | |
17053 | bad_from_user: | |
17054 | CFI_STARTPROC | |
17055 | + testl %edx,%edx | |
17056 | + js bad_to_user | |
17057 | movl %edx,%ecx | |
17058 | xorl %eax,%eax | |
17059 | rep | |
17060 | diff -urNp linux-3.0.3/arch/x86/lib/copy_user_nocache_64.S linux-3.0.3/arch/x86/lib/copy_user_nocache_64.S | |
17061 | --- linux-3.0.3/arch/x86/lib/copy_user_nocache_64.S 2011-07-21 22:17:23.000000000 -0400 | |
17062 | +++ linux-3.0.3/arch/x86/lib/copy_user_nocache_64.S 2011-08-23 21:47:55.000000000 -0400 | |
17063 | @@ -14,6 +14,7 @@ | |
17064 | #include <asm/current.h> | |
17065 | #include <asm/asm-offsets.h> | |
17066 | #include <asm/thread_info.h> | |
17067 | +#include <asm/pgtable.h> | |
17068 | ||
17069 | .macro ALIGN_DESTINATION | |
17070 | #ifdef FIX_ALIGNMENT | |
17071 | @@ -50,6 +51,15 @@ | |
17072 | */ | |
17073 | ENTRY(__copy_user_nocache) | |
17074 | CFI_STARTPROC | |
17075 | + | |
17076 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
17077 | + mov $PAX_USER_SHADOW_BASE,%rcx | |
17078 | + cmp %rcx,%rsi | |
17079 | + jae 1f | |
17080 | + add %rcx,%rsi | |
17081 | +1: | |
17082 | +#endif | |
17083 | + | |
17084 | cmpl $8,%edx | |
17085 | jb 20f /* less then 8 bytes, go to byte copy loop */ | |
17086 | ALIGN_DESTINATION | |
17087 | diff -urNp linux-3.0.3/arch/x86/lib/csum-wrappers_64.c linux-3.0.3/arch/x86/lib/csum-wrappers_64.c | |
17088 | --- linux-3.0.3/arch/x86/lib/csum-wrappers_64.c 2011-07-21 22:17:23.000000000 -0400 | |
17089 | +++ linux-3.0.3/arch/x86/lib/csum-wrappers_64.c 2011-08-23 21:47:55.000000000 -0400 | |
17090 | @@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _ | |
17091 | len -= 2; | |
17092 | } | |
17093 | } | |
17094 | + | |
17095 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
17096 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
17097 | + src += PAX_USER_SHADOW_BASE; | |
17098 | +#endif | |
17099 | + | |
17100 | isum = csum_partial_copy_generic((__force const void *)src, | |
17101 | dst, len, isum, errp, NULL); | |
17102 | if (unlikely(*errp)) | |
17103 | @@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr | |
17104 | } | |
17105 | ||
17106 | *errp = 0; | |
17107 | + | |
17108 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
17109 | + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) | |
17110 | + dst += PAX_USER_SHADOW_BASE; | |
17111 | +#endif | |
17112 | + | |
17113 | return csum_partial_copy_generic(src, (void __force *)dst, | |
17114 | len, isum, NULL, errp); | |
17115 | } | |
17116 | diff -urNp linux-3.0.3/arch/x86/lib/getuser.S linux-3.0.3/arch/x86/lib/getuser.S | |
17117 | --- linux-3.0.3/arch/x86/lib/getuser.S 2011-07-21 22:17:23.000000000 -0400 | |
17118 | +++ linux-3.0.3/arch/x86/lib/getuser.S 2011-08-23 21:47:55.000000000 -0400 | |
17119 | @@ -33,14 +33,35 @@ | |
17120 | #include <asm/asm-offsets.h> | |
17121 | #include <asm/thread_info.h> | |
17122 | #include <asm/asm.h> | |
17123 | +#include <asm/segment.h> | |
17124 | +#include <asm/pgtable.h> | |
17125 | + | |
17126 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17127 | +#define __copyuser_seg gs; | |
17128 | +#else | |
17129 | +#define __copyuser_seg | |
17130 | +#endif | |
17131 | ||
17132 | .text | |
17133 | ENTRY(__get_user_1) | |
17134 | CFI_STARTPROC | |
17135 | + | |
17136 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17137 | GET_THREAD_INFO(%_ASM_DX) | |
17138 | cmp TI_addr_limit(%_ASM_DX),%_ASM_AX | |
17139 | jae bad_get_user | |
17140 | -1: movzb (%_ASM_AX),%edx | |
17141 | + | |
17142 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17143 | + mov $PAX_USER_SHADOW_BASE,%_ASM_DX | |
17144 | + cmp %_ASM_DX,%_ASM_AX | |
17145 | + jae 1234f | |
17146 | + add %_ASM_DX,%_ASM_AX | |
17147 | +1234: | |
17148 | +#endif | |
17149 | + | |
17150 | +#endif | |
17151 | + | |
17152 | +1: __copyuser_seg movzb (%_ASM_AX),%edx | |
17153 | xor %eax,%eax | |
17154 | ret | |
17155 | CFI_ENDPROC | |
17156 | @@ -49,11 +70,24 @@ ENDPROC(__get_user_1) | |
17157 | ENTRY(__get_user_2) | |
17158 | CFI_STARTPROC | |
17159 | add $1,%_ASM_AX | |
17160 | + | |
17161 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17162 | jc bad_get_user | |
17163 | GET_THREAD_INFO(%_ASM_DX) | |
17164 | cmp TI_addr_limit(%_ASM_DX),%_ASM_AX | |
17165 | jae bad_get_user | |
17166 | -2: movzwl -1(%_ASM_AX),%edx | |
17167 | + | |
17168 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17169 | + mov $PAX_USER_SHADOW_BASE,%_ASM_DX | |
17170 | + cmp %_ASM_DX,%_ASM_AX | |
17171 | + jae 1234f | |
17172 | + add %_ASM_DX,%_ASM_AX | |
17173 | +1234: | |
17174 | +#endif | |
17175 | + | |
17176 | +#endif | |
17177 | + | |
17178 | +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx | |
17179 | xor %eax,%eax | |
17180 | ret | |
17181 | CFI_ENDPROC | |
17182 | @@ -62,11 +96,24 @@ ENDPROC(__get_user_2) | |
17183 | ENTRY(__get_user_4) | |
17184 | CFI_STARTPROC | |
17185 | add $3,%_ASM_AX | |
17186 | + | |
17187 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17188 | jc bad_get_user | |
17189 | GET_THREAD_INFO(%_ASM_DX) | |
17190 | cmp TI_addr_limit(%_ASM_DX),%_ASM_AX | |
17191 | jae bad_get_user | |
17192 | -3: mov -3(%_ASM_AX),%edx | |
17193 | + | |
17194 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17195 | + mov $PAX_USER_SHADOW_BASE,%_ASM_DX | |
17196 | + cmp %_ASM_DX,%_ASM_AX | |
17197 | + jae 1234f | |
17198 | + add %_ASM_DX,%_ASM_AX | |
17199 | +1234: | |
17200 | +#endif | |
17201 | + | |
17202 | +#endif | |
17203 | + | |
17204 | +3: __copyuser_seg mov -3(%_ASM_AX),%edx | |
17205 | xor %eax,%eax | |
17206 | ret | |
17207 | CFI_ENDPROC | |
17208 | @@ -80,6 +127,15 @@ ENTRY(__get_user_8) | |
17209 | GET_THREAD_INFO(%_ASM_DX) | |
17210 | cmp TI_addr_limit(%_ASM_DX),%_ASM_AX | |
17211 | jae bad_get_user | |
17212 | + | |
17213 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
17214 | + mov $PAX_USER_SHADOW_BASE,%_ASM_DX | |
17215 | + cmp %_ASM_DX,%_ASM_AX | |
17216 | + jae 1234f | |
17217 | + add %_ASM_DX,%_ASM_AX | |
17218 | +1234: | |
17219 | +#endif | |
17220 | + | |
17221 | 4: movq -7(%_ASM_AX),%_ASM_DX | |
17222 | xor %eax,%eax | |
17223 | ret | |
17224 | diff -urNp linux-3.0.3/arch/x86/lib/insn.c linux-3.0.3/arch/x86/lib/insn.c | |
17225 | --- linux-3.0.3/arch/x86/lib/insn.c 2011-07-21 22:17:23.000000000 -0400 | |
17226 | +++ linux-3.0.3/arch/x86/lib/insn.c 2011-08-23 21:47:55.000000000 -0400 | |
17227 | @@ -21,6 +21,11 @@ | |
17228 | #include <linux/string.h> | |
17229 | #include <asm/inat.h> | |
17230 | #include <asm/insn.h> | |
17231 | +#ifdef __KERNEL__ | |
17232 | +#include <asm/pgtable_types.h> | |
17233 | +#else | |
17234 | +#define ktla_ktva(addr) addr | |
17235 | +#endif | |
17236 | ||
17237 | #define get_next(t, insn) \ | |
17238 | ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; }) | |
17239 | @@ -40,8 +45,8 @@ | |
17240 | void insn_init(struct insn *insn, const void *kaddr, int x86_64) | |
17241 | { | |
17242 | memset(insn, 0, sizeof(*insn)); | |
17243 | - insn->kaddr = kaddr; | |
17244 | - insn->next_byte = kaddr; | |
17245 | + insn->kaddr = ktla_ktva(kaddr); | |
17246 | + insn->next_byte = ktla_ktva(kaddr); | |
17247 | insn->x86_64 = x86_64 ? 1 : 0; | |
17248 | insn->opnd_bytes = 4; | |
17249 | if (x86_64) | |
17250 | diff -urNp linux-3.0.3/arch/x86/lib/mmx_32.c linux-3.0.3/arch/x86/lib/mmx_32.c | |
17251 | --- linux-3.0.3/arch/x86/lib/mmx_32.c 2011-07-21 22:17:23.000000000 -0400 | |
17252 | +++ linux-3.0.3/arch/x86/lib/mmx_32.c 2011-08-23 21:47:55.000000000 -0400 | |
17253 | @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void * | |
17254 | { | |
17255 | void *p; | |
17256 | int i; | |
17257 | + unsigned long cr0; | |
17258 | ||
17259 | if (unlikely(in_interrupt())) | |
17260 | return __memcpy(to, from, len); | |
17261 | @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void * | |
17262 | kernel_fpu_begin(); | |
17263 | ||
17264 | __asm__ __volatile__ ( | |
17265 | - "1: prefetch (%0)\n" /* This set is 28 bytes */ | |
17266 | - " prefetch 64(%0)\n" | |
17267 | - " prefetch 128(%0)\n" | |
17268 | - " prefetch 192(%0)\n" | |
17269 | - " prefetch 256(%0)\n" | |
17270 | + "1: prefetch (%1)\n" /* This set is 28 bytes */ | |
17271 | + " prefetch 64(%1)\n" | |
17272 | + " prefetch 128(%1)\n" | |
17273 | + " prefetch 192(%1)\n" | |
17274 | + " prefetch 256(%1)\n" | |
17275 | "2: \n" | |
17276 | ".section .fixup, \"ax\"\n" | |
17277 | - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17278 | + "3: \n" | |
17279 | + | |
17280 | +#ifdef CONFIG_PAX_KERNEXEC | |
17281 | + " movl %%cr0, %0\n" | |
17282 | + " movl %0, %%eax\n" | |
17283 | + " andl $0xFFFEFFFF, %%eax\n" | |
17284 | + " movl %%eax, %%cr0\n" | |
17285 | +#endif | |
17286 | + | |
17287 | + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17288 | + | |
17289 | +#ifdef CONFIG_PAX_KERNEXEC | |
17290 | + " movl %0, %%cr0\n" | |
17291 | +#endif | |
17292 | + | |
17293 | " jmp 2b\n" | |
17294 | ".previous\n" | |
17295 | _ASM_EXTABLE(1b, 3b) | |
17296 | - : : "r" (from)); | |
17297 | + : "=&r" (cr0) : "r" (from) : "ax"); | |
17298 | ||
17299 | for ( ; i > 5; i--) { | |
17300 | __asm__ __volatile__ ( | |
17301 | - "1: prefetch 320(%0)\n" | |
17302 | - "2: movq (%0), %%mm0\n" | |
17303 | - " movq 8(%0), %%mm1\n" | |
17304 | - " movq 16(%0), %%mm2\n" | |
17305 | - " movq 24(%0), %%mm3\n" | |
17306 | - " movq %%mm0, (%1)\n" | |
17307 | - " movq %%mm1, 8(%1)\n" | |
17308 | - " movq %%mm2, 16(%1)\n" | |
17309 | - " movq %%mm3, 24(%1)\n" | |
17310 | - " movq 32(%0), %%mm0\n" | |
17311 | - " movq 40(%0), %%mm1\n" | |
17312 | - " movq 48(%0), %%mm2\n" | |
17313 | - " movq 56(%0), %%mm3\n" | |
17314 | - " movq %%mm0, 32(%1)\n" | |
17315 | - " movq %%mm1, 40(%1)\n" | |
17316 | - " movq %%mm2, 48(%1)\n" | |
17317 | - " movq %%mm3, 56(%1)\n" | |
17318 | + "1: prefetch 320(%1)\n" | |
17319 | + "2: movq (%1), %%mm0\n" | |
17320 | + " movq 8(%1), %%mm1\n" | |
17321 | + " movq 16(%1), %%mm2\n" | |
17322 | + " movq 24(%1), %%mm3\n" | |
17323 | + " movq %%mm0, (%2)\n" | |
17324 | + " movq %%mm1, 8(%2)\n" | |
17325 | + " movq %%mm2, 16(%2)\n" | |
17326 | + " movq %%mm3, 24(%2)\n" | |
17327 | + " movq 32(%1), %%mm0\n" | |
17328 | + " movq 40(%1), %%mm1\n" | |
17329 | + " movq 48(%1), %%mm2\n" | |
17330 | + " movq 56(%1), %%mm3\n" | |
17331 | + " movq %%mm0, 32(%2)\n" | |
17332 | + " movq %%mm1, 40(%2)\n" | |
17333 | + " movq %%mm2, 48(%2)\n" | |
17334 | + " movq %%mm3, 56(%2)\n" | |
17335 | ".section .fixup, \"ax\"\n" | |
17336 | - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17337 | + "3:\n" | |
17338 | + | |
17339 | +#ifdef CONFIG_PAX_KERNEXEC | |
17340 | + " movl %%cr0, %0\n" | |
17341 | + " movl %0, %%eax\n" | |
17342 | + " andl $0xFFFEFFFF, %%eax\n" | |
17343 | + " movl %%eax, %%cr0\n" | |
17344 | +#endif | |
17345 | + | |
17346 | + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17347 | + | |
17348 | +#ifdef CONFIG_PAX_KERNEXEC | |
17349 | + " movl %0, %%cr0\n" | |
17350 | +#endif | |
17351 | + | |
17352 | " jmp 2b\n" | |
17353 | ".previous\n" | |
17354 | _ASM_EXTABLE(1b, 3b) | |
17355 | - : : "r" (from), "r" (to) : "memory"); | |
17356 | + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax"); | |
17357 | ||
17358 | from += 64; | |
17359 | to += 64; | |
17360 | @@ -158,6 +187,7 @@ static void fast_clear_page(void *page) | |
17361 | static void fast_copy_page(void *to, void *from) | |
17362 | { | |
17363 | int i; | |
17364 | + unsigned long cr0; | |
17365 | ||
17366 | kernel_fpu_begin(); | |
17367 | ||
17368 | @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi | |
17369 | * but that is for later. -AV | |
17370 | */ | |
17371 | __asm__ __volatile__( | |
17372 | - "1: prefetch (%0)\n" | |
17373 | - " prefetch 64(%0)\n" | |
17374 | - " prefetch 128(%0)\n" | |
17375 | - " prefetch 192(%0)\n" | |
17376 | - " prefetch 256(%0)\n" | |
17377 | + "1: prefetch (%1)\n" | |
17378 | + " prefetch 64(%1)\n" | |
17379 | + " prefetch 128(%1)\n" | |
17380 | + " prefetch 192(%1)\n" | |
17381 | + " prefetch 256(%1)\n" | |
17382 | "2: \n" | |
17383 | ".section .fixup, \"ax\"\n" | |
17384 | - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17385 | + "3: \n" | |
17386 | + | |
17387 | +#ifdef CONFIG_PAX_KERNEXEC | |
17388 | + " movl %%cr0, %0\n" | |
17389 | + " movl %0, %%eax\n" | |
17390 | + " andl $0xFFFEFFFF, %%eax\n" | |
17391 | + " movl %%eax, %%cr0\n" | |
17392 | +#endif | |
17393 | + | |
17394 | + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17395 | + | |
17396 | +#ifdef CONFIG_PAX_KERNEXEC | |
17397 | + " movl %0, %%cr0\n" | |
17398 | +#endif | |
17399 | + | |
17400 | " jmp 2b\n" | |
17401 | ".previous\n" | |
17402 | - _ASM_EXTABLE(1b, 3b) : : "r" (from)); | |
17403 | + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax"); | |
17404 | ||
17405 | for (i = 0; i < (4096-320)/64; i++) { | |
17406 | __asm__ __volatile__ ( | |
17407 | - "1: prefetch 320(%0)\n" | |
17408 | - "2: movq (%0), %%mm0\n" | |
17409 | - " movntq %%mm0, (%1)\n" | |
17410 | - " movq 8(%0), %%mm1\n" | |
17411 | - " movntq %%mm1, 8(%1)\n" | |
17412 | - " movq 16(%0), %%mm2\n" | |
17413 | - " movntq %%mm2, 16(%1)\n" | |
17414 | - " movq 24(%0), %%mm3\n" | |
17415 | - " movntq %%mm3, 24(%1)\n" | |
17416 | - " movq 32(%0), %%mm4\n" | |
17417 | - " movntq %%mm4, 32(%1)\n" | |
17418 | - " movq 40(%0), %%mm5\n" | |
17419 | - " movntq %%mm5, 40(%1)\n" | |
17420 | - " movq 48(%0), %%mm6\n" | |
17421 | - " movntq %%mm6, 48(%1)\n" | |
17422 | - " movq 56(%0), %%mm7\n" | |
17423 | - " movntq %%mm7, 56(%1)\n" | |
17424 | + "1: prefetch 320(%1)\n" | |
17425 | + "2: movq (%1), %%mm0\n" | |
17426 | + " movntq %%mm0, (%2)\n" | |
17427 | + " movq 8(%1), %%mm1\n" | |
17428 | + " movntq %%mm1, 8(%2)\n" | |
17429 | + " movq 16(%1), %%mm2\n" | |
17430 | + " movntq %%mm2, 16(%2)\n" | |
17431 | + " movq 24(%1), %%mm3\n" | |
17432 | + " movntq %%mm3, 24(%2)\n" | |
17433 | + " movq 32(%1), %%mm4\n" | |
17434 | + " movntq %%mm4, 32(%2)\n" | |
17435 | + " movq 40(%1), %%mm5\n" | |
17436 | + " movntq %%mm5, 40(%2)\n" | |
17437 | + " movq 48(%1), %%mm6\n" | |
17438 | + " movntq %%mm6, 48(%2)\n" | |
17439 | + " movq 56(%1), %%mm7\n" | |
17440 | + " movntq %%mm7, 56(%2)\n" | |
17441 | ".section .fixup, \"ax\"\n" | |
17442 | - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17443 | + "3:\n" | |
17444 | + | |
17445 | +#ifdef CONFIG_PAX_KERNEXEC | |
17446 | + " movl %%cr0, %0\n" | |
17447 | + " movl %0, %%eax\n" | |
17448 | + " andl $0xFFFEFFFF, %%eax\n" | |
17449 | + " movl %%eax, %%cr0\n" | |
17450 | +#endif | |
17451 | + | |
17452 | + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17453 | + | |
17454 | +#ifdef CONFIG_PAX_KERNEXEC | |
17455 | + " movl %0, %%cr0\n" | |
17456 | +#endif | |
17457 | + | |
17458 | " jmp 2b\n" | |
17459 | ".previous\n" | |
17460 | - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory"); | |
17461 | + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax"); | |
17462 | ||
17463 | from += 64; | |
17464 | to += 64; | |
17465 | @@ -280,47 +338,76 @@ static void fast_clear_page(void *page) | |
17466 | static void fast_copy_page(void *to, void *from) | |
17467 | { | |
17468 | int i; | |
17469 | + unsigned long cr0; | |
17470 | ||
17471 | kernel_fpu_begin(); | |
17472 | ||
17473 | __asm__ __volatile__ ( | |
17474 | - "1: prefetch (%0)\n" | |
17475 | - " prefetch 64(%0)\n" | |
17476 | - " prefetch 128(%0)\n" | |
17477 | - " prefetch 192(%0)\n" | |
17478 | - " prefetch 256(%0)\n" | |
17479 | + "1: prefetch (%1)\n" | |
17480 | + " prefetch 64(%1)\n" | |
17481 | + " prefetch 128(%1)\n" | |
17482 | + " prefetch 192(%1)\n" | |
17483 | + " prefetch 256(%1)\n" | |
17484 | "2: \n" | |
17485 | ".section .fixup, \"ax\"\n" | |
17486 | - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17487 | + "3: \n" | |
17488 | + | |
17489 | +#ifdef CONFIG_PAX_KERNEXEC | |
17490 | + " movl %%cr0, %0\n" | |
17491 | + " movl %0, %%eax\n" | |
17492 | + " andl $0xFFFEFFFF, %%eax\n" | |
17493 | + " movl %%eax, %%cr0\n" | |
17494 | +#endif | |
17495 | + | |
17496 | + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */ | |
17497 | + | |
17498 | +#ifdef CONFIG_PAX_KERNEXEC | |
17499 | + " movl %0, %%cr0\n" | |
17500 | +#endif | |
17501 | + | |
17502 | " jmp 2b\n" | |
17503 | ".previous\n" | |
17504 | - _ASM_EXTABLE(1b, 3b) : : "r" (from)); | |
17505 | + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax"); | |
17506 | ||
17507 | for (i = 0; i < 4096/64; i++) { | |
17508 | __asm__ __volatile__ ( | |
17509 | - "1: prefetch 320(%0)\n" | |
17510 | - "2: movq (%0), %%mm0\n" | |
17511 | - " movq 8(%0), %%mm1\n" | |
17512 | - " movq 16(%0), %%mm2\n" | |
17513 | - " movq 24(%0), %%mm3\n" | |
17514 | - " movq %%mm0, (%1)\n" | |
17515 | - " movq %%mm1, 8(%1)\n" | |
17516 | - " movq %%mm2, 16(%1)\n" | |
17517 | - " movq %%mm3, 24(%1)\n" | |
17518 | - " movq 32(%0), %%mm0\n" | |
17519 | - " movq 40(%0), %%mm1\n" | |
17520 | - " movq 48(%0), %%mm2\n" | |
17521 | - " movq 56(%0), %%mm3\n" | |
17522 | - " movq %%mm0, 32(%1)\n" | |
17523 | - " movq %%mm1, 40(%1)\n" | |
17524 | - " movq %%mm2, 48(%1)\n" | |
17525 | - " movq %%mm3, 56(%1)\n" | |
17526 | + "1: prefetch 320(%1)\n" | |
17527 | + "2: movq (%1), %%mm0\n" | |
17528 | + " movq 8(%1), %%mm1\n" | |
17529 | + " movq 16(%1), %%mm2\n" | |
17530 | + " movq 24(%1), %%mm3\n" | |
17531 | + " movq %%mm0, (%2)\n" | |
17532 | + " movq %%mm1, 8(%2)\n" | |
17533 | + " movq %%mm2, 16(%2)\n" | |
17534 | + " movq %%mm3, 24(%2)\n" | |
17535 | + " movq 32(%1), %%mm0\n" | |
17536 | + " movq 40(%1), %%mm1\n" | |
17537 | + " movq 48(%1), %%mm2\n" | |
17538 | + " movq 56(%1), %%mm3\n" | |
17539 | + " movq %%mm0, 32(%2)\n" | |
17540 | + " movq %%mm1, 40(%2)\n" | |
17541 | + " movq %%mm2, 48(%2)\n" | |
17542 | + " movq %%mm3, 56(%2)\n" | |
17543 | ".section .fixup, \"ax\"\n" | |
17544 | - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17545 | + "3:\n" | |
17546 | + | |
17547 | +#ifdef CONFIG_PAX_KERNEXEC | |
17548 | + " movl %%cr0, %0\n" | |
17549 | + " movl %0, %%eax\n" | |
17550 | + " andl $0xFFFEFFFF, %%eax\n" | |
17551 | + " movl %%eax, %%cr0\n" | |
17552 | +#endif | |
17553 | + | |
17554 | + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */ | |
17555 | + | |
17556 | +#ifdef CONFIG_PAX_KERNEXEC | |
17557 | + " movl %0, %%cr0\n" | |
17558 | +#endif | |
17559 | + | |
17560 | " jmp 2b\n" | |
17561 | ".previous\n" | |
17562 | _ASM_EXTABLE(1b, 3b) | |
17563 | - : : "r" (from), "r" (to) : "memory"); | |
17564 | + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax"); | |
17565 | ||
17566 | from += 64; | |
17567 | to += 64; | |
17568 | diff -urNp linux-3.0.3/arch/x86/lib/putuser.S linux-3.0.3/arch/x86/lib/putuser.S | |
17569 | --- linux-3.0.3/arch/x86/lib/putuser.S 2011-07-21 22:17:23.000000000 -0400 | |
17570 | +++ linux-3.0.3/arch/x86/lib/putuser.S 2011-08-23 21:47:55.000000000 -0400 | |
17571 | @@ -15,7 +15,8 @@ | |
17572 | #include <asm/thread_info.h> | |
17573 | #include <asm/errno.h> | |
17574 | #include <asm/asm.h> | |
17575 | - | |
17576 | +#include <asm/segment.h> | |
17577 | +#include <asm/pgtable.h> | |
17578 | ||
17579 | /* | |
17580 | * __put_user_X | |
17581 | @@ -29,52 +30,119 @@ | |
17582 | * as they get called from within inline assembly. | |
17583 | */ | |
17584 | ||
17585 | -#define ENTER CFI_STARTPROC ; \ | |
17586 | - GET_THREAD_INFO(%_ASM_BX) | |
17587 | +#define ENTER CFI_STARTPROC | |
17588 | #define EXIT ret ; \ | |
17589 | CFI_ENDPROC | |
17590 | ||
17591 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17592 | +#define _DEST %_ASM_CX,%_ASM_BX | |
17593 | +#else | |
17594 | +#define _DEST %_ASM_CX | |
17595 | +#endif | |
17596 | + | |
17597 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17598 | +#define __copyuser_seg gs; | |
17599 | +#else | |
17600 | +#define __copyuser_seg | |
17601 | +#endif | |
17602 | + | |
17603 | .text | |
17604 | ENTRY(__put_user_1) | |
17605 | ENTER | |
17606 | + | |
17607 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17608 | + GET_THREAD_INFO(%_ASM_BX) | |
17609 | cmp TI_addr_limit(%_ASM_BX),%_ASM_CX | |
17610 | jae bad_put_user | |
17611 | -1: movb %al,(%_ASM_CX) | |
17612 | + | |
17613 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17614 | + mov $PAX_USER_SHADOW_BASE,%_ASM_BX | |
17615 | + cmp %_ASM_BX,%_ASM_CX | |
17616 | + jb 1234f | |
17617 | + xor %ebx,%ebx | |
17618 | +1234: | |
17619 | +#endif | |
17620 | + | |
17621 | +#endif | |
17622 | + | |
17623 | +1: __copyuser_seg movb %al,(_DEST) | |
17624 | xor %eax,%eax | |
17625 | EXIT | |
17626 | ENDPROC(__put_user_1) | |
17627 | ||
17628 | ENTRY(__put_user_2) | |
17629 | ENTER | |
17630 | + | |
17631 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17632 | + GET_THREAD_INFO(%_ASM_BX) | |
17633 | mov TI_addr_limit(%_ASM_BX),%_ASM_BX | |
17634 | sub $1,%_ASM_BX | |
17635 | cmp %_ASM_BX,%_ASM_CX | |
17636 | jae bad_put_user | |
17637 | -2: movw %ax,(%_ASM_CX) | |
17638 | + | |
17639 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17640 | + mov $PAX_USER_SHADOW_BASE,%_ASM_BX | |
17641 | + cmp %_ASM_BX,%_ASM_CX | |
17642 | + jb 1234f | |
17643 | + xor %ebx,%ebx | |
17644 | +1234: | |
17645 | +#endif | |
17646 | + | |
17647 | +#endif | |
17648 | + | |
17649 | +2: __copyuser_seg movw %ax,(_DEST) | |
17650 | xor %eax,%eax | |
17651 | EXIT | |
17652 | ENDPROC(__put_user_2) | |
17653 | ||
17654 | ENTRY(__put_user_4) | |
17655 | ENTER | |
17656 | + | |
17657 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17658 | + GET_THREAD_INFO(%_ASM_BX) | |
17659 | mov TI_addr_limit(%_ASM_BX),%_ASM_BX | |
17660 | sub $3,%_ASM_BX | |
17661 | cmp %_ASM_BX,%_ASM_CX | |
17662 | jae bad_put_user | |
17663 | -3: movl %eax,(%_ASM_CX) | |
17664 | + | |
17665 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17666 | + mov $PAX_USER_SHADOW_BASE,%_ASM_BX | |
17667 | + cmp %_ASM_BX,%_ASM_CX | |
17668 | + jb 1234f | |
17669 | + xor %ebx,%ebx | |
17670 | +1234: | |
17671 | +#endif | |
17672 | + | |
17673 | +#endif | |
17674 | + | |
17675 | +3: __copyuser_seg movl %eax,(_DEST) | |
17676 | xor %eax,%eax | |
17677 | EXIT | |
17678 | ENDPROC(__put_user_4) | |
17679 | ||
17680 | ENTRY(__put_user_8) | |
17681 | ENTER | |
17682 | + | |
17683 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF) | |
17684 | + GET_THREAD_INFO(%_ASM_BX) | |
17685 | mov TI_addr_limit(%_ASM_BX),%_ASM_BX | |
17686 | sub $7,%_ASM_BX | |
17687 | cmp %_ASM_BX,%_ASM_CX | |
17688 | jae bad_put_user | |
17689 | -4: mov %_ASM_AX,(%_ASM_CX) | |
17690 | + | |
17691 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
17692 | + mov $PAX_USER_SHADOW_BASE,%_ASM_BX | |
17693 | + cmp %_ASM_BX,%_ASM_CX | |
17694 | + jb 1234f | |
17695 | + xor %ebx,%ebx | |
17696 | +1234: | |
17697 | +#endif | |
17698 | + | |
17699 | +#endif | |
17700 | + | |
17701 | +4: __copyuser_seg mov %_ASM_AX,(_DEST) | |
17702 | #ifdef CONFIG_X86_32 | |
17703 | -5: movl %edx,4(%_ASM_CX) | |
17704 | +5: __copyuser_seg movl %edx,4(_DEST) | |
17705 | #endif | |
17706 | xor %eax,%eax | |
17707 | EXIT | |
17708 | diff -urNp linux-3.0.3/arch/x86/lib/usercopy_32.c linux-3.0.3/arch/x86/lib/usercopy_32.c | |
17709 | --- linux-3.0.3/arch/x86/lib/usercopy_32.c 2011-07-21 22:17:23.000000000 -0400 | |
17710 | +++ linux-3.0.3/arch/x86/lib/usercopy_32.c 2011-08-23 21:47:55.000000000 -0400 | |
17711 | @@ -43,7 +43,7 @@ do { \ | |
17712 | __asm__ __volatile__( \ | |
17713 | " testl %1,%1\n" \ | |
17714 | " jz 2f\n" \ | |
17715 | - "0: lodsb\n" \ | |
17716 | + "0: "__copyuser_seg"lodsb\n" \ | |
17717 | " stosb\n" \ | |
17718 | " testb %%al,%%al\n" \ | |
17719 | " jz 1f\n" \ | |
17720 | @@ -128,10 +128,12 @@ do { \ | |
17721 | int __d0; \ | |
17722 | might_fault(); \ | |
17723 | __asm__ __volatile__( \ | |
17724 | + __COPYUSER_SET_ES \ | |
17725 | "0: rep; stosl\n" \ | |
17726 | " movl %2,%0\n" \ | |
17727 | "1: rep; stosb\n" \ | |
17728 | "2:\n" \ | |
17729 | + __COPYUSER_RESTORE_ES \ | |
17730 | ".section .fixup,\"ax\"\n" \ | |
17731 | "3: lea 0(%2,%0,4),%0\n" \ | |
17732 | " jmp 2b\n" \ | |
17733 | @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, | |
17734 | might_fault(); | |
17735 | ||
17736 | __asm__ __volatile__( | |
17737 | + __COPYUSER_SET_ES | |
17738 | " testl %0, %0\n" | |
17739 | " jz 3f\n" | |
17740 | " andl %0,%%ecx\n" | |
17741 | @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, | |
17742 | " subl %%ecx,%0\n" | |
17743 | " addl %0,%%eax\n" | |
17744 | "1:\n" | |
17745 | + __COPYUSER_RESTORE_ES | |
17746 | ".section .fixup,\"ax\"\n" | |
17747 | "2: xorl %%eax,%%eax\n" | |
17748 | " jmp 1b\n" | |
17749 | @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user); | |
17750 | ||
17751 | #ifdef CONFIG_X86_INTEL_USERCOPY | |
17752 | static unsigned long | |
17753 | -__copy_user_intel(void __user *to, const void *from, unsigned long size) | |
17754 | +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size) | |
17755 | { | |
17756 | int d0, d1; | |
17757 | __asm__ __volatile__( | |
17758 | @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const | |
17759 | " .align 2,0x90\n" | |
17760 | "3: movl 0(%4), %%eax\n" | |
17761 | "4: movl 4(%4), %%edx\n" | |
17762 | - "5: movl %%eax, 0(%3)\n" | |
17763 | - "6: movl %%edx, 4(%3)\n" | |
17764 | + "5: "__copyuser_seg" movl %%eax, 0(%3)\n" | |
17765 | + "6: "__copyuser_seg" movl %%edx, 4(%3)\n" | |
17766 | "7: movl 8(%4), %%eax\n" | |
17767 | "8: movl 12(%4),%%edx\n" | |
17768 | - "9: movl %%eax, 8(%3)\n" | |
17769 | - "10: movl %%edx, 12(%3)\n" | |
17770 | + "9: "__copyuser_seg" movl %%eax, 8(%3)\n" | |
17771 | + "10: "__copyuser_seg" movl %%edx, 12(%3)\n" | |
17772 | "11: movl 16(%4), %%eax\n" | |
17773 | "12: movl 20(%4), %%edx\n" | |
17774 | - "13: movl %%eax, 16(%3)\n" | |
17775 | - "14: movl %%edx, 20(%3)\n" | |
17776 | + "13: "__copyuser_seg" movl %%eax, 16(%3)\n" | |
17777 | + "14: "__copyuser_seg" movl %%edx, 20(%3)\n" | |
17778 | "15: movl 24(%4), %%eax\n" | |
17779 | "16: movl 28(%4), %%edx\n" | |
17780 | - "17: movl %%eax, 24(%3)\n" | |
17781 | - "18: movl %%edx, 28(%3)\n" | |
17782 | + "17: "__copyuser_seg" movl %%eax, 24(%3)\n" | |
17783 | + "18: "__copyuser_seg" movl %%edx, 28(%3)\n" | |
17784 | "19: movl 32(%4), %%eax\n" | |
17785 | "20: movl 36(%4), %%edx\n" | |
17786 | - "21: movl %%eax, 32(%3)\n" | |
17787 | - "22: movl %%edx, 36(%3)\n" | |
17788 | + "21: "__copyuser_seg" movl %%eax, 32(%3)\n" | |
17789 | + "22: "__copyuser_seg" movl %%edx, 36(%3)\n" | |
17790 | "23: movl 40(%4), %%eax\n" | |
17791 | "24: movl 44(%4), %%edx\n" | |
17792 | - "25: movl %%eax, 40(%3)\n" | |
17793 | - "26: movl %%edx, 44(%3)\n" | |
17794 | + "25: "__copyuser_seg" movl %%eax, 40(%3)\n" | |
17795 | + "26: "__copyuser_seg" movl %%edx, 44(%3)\n" | |
17796 | "27: movl 48(%4), %%eax\n" | |
17797 | "28: movl 52(%4), %%edx\n" | |
17798 | - "29: movl %%eax, 48(%3)\n" | |
17799 | - "30: movl %%edx, 52(%3)\n" | |
17800 | + "29: "__copyuser_seg" movl %%eax, 48(%3)\n" | |
17801 | + "30: "__copyuser_seg" movl %%edx, 52(%3)\n" | |
17802 | "31: movl 56(%4), %%eax\n" | |
17803 | "32: movl 60(%4), %%edx\n" | |
17804 | - "33: movl %%eax, 56(%3)\n" | |
17805 | - "34: movl %%edx, 60(%3)\n" | |
17806 | + "33: "__copyuser_seg" movl %%eax, 56(%3)\n" | |
17807 | + "34: "__copyuser_seg" movl %%edx, 60(%3)\n" | |
17808 | " addl $-64, %0\n" | |
17809 | " addl $64, %4\n" | |
17810 | " addl $64, %3\n" | |
17811 | @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const | |
17812 | " shrl $2, %0\n" | |
17813 | " andl $3, %%eax\n" | |
17814 | " cld\n" | |
17815 | + __COPYUSER_SET_ES | |
17816 | "99: rep; movsl\n" | |
17817 | "36: movl %%eax, %0\n" | |
17818 | "37: rep; movsb\n" | |
17819 | "100:\n" | |
17820 | + __COPYUSER_RESTORE_ES | |
17821 | + ".section .fixup,\"ax\"\n" | |
17822 | + "101: lea 0(%%eax,%0,4),%0\n" | |
17823 | + " jmp 100b\n" | |
17824 | + ".previous\n" | |
17825 | + ".section __ex_table,\"a\"\n" | |
17826 | + " .align 4\n" | |
17827 | + " .long 1b,100b\n" | |
17828 | + " .long 2b,100b\n" | |
17829 | + " .long 3b,100b\n" | |
17830 | + " .long 4b,100b\n" | |
17831 | + " .long 5b,100b\n" | |
17832 | + " .long 6b,100b\n" | |
17833 | + " .long 7b,100b\n" | |
17834 | + " .long 8b,100b\n" | |
17835 | + " .long 9b,100b\n" | |
17836 | + " .long 10b,100b\n" | |
17837 | + " .long 11b,100b\n" | |
17838 | + " .long 12b,100b\n" | |
17839 | + " .long 13b,100b\n" | |
17840 | + " .long 14b,100b\n" | |
17841 | + " .long 15b,100b\n" | |
17842 | + " .long 16b,100b\n" | |
17843 | + " .long 17b,100b\n" | |
17844 | + " .long 18b,100b\n" | |
17845 | + " .long 19b,100b\n" | |
17846 | + " .long 20b,100b\n" | |
17847 | + " .long 21b,100b\n" | |
17848 | + " .long 22b,100b\n" | |
17849 | + " .long 23b,100b\n" | |
17850 | + " .long 24b,100b\n" | |
17851 | + " .long 25b,100b\n" | |
17852 | + " .long 26b,100b\n" | |
17853 | + " .long 27b,100b\n" | |
17854 | + " .long 28b,100b\n" | |
17855 | + " .long 29b,100b\n" | |
17856 | + " .long 30b,100b\n" | |
17857 | + " .long 31b,100b\n" | |
17858 | + " .long 32b,100b\n" | |
17859 | + " .long 33b,100b\n" | |
17860 | + " .long 34b,100b\n" | |
17861 | + " .long 35b,100b\n" | |
17862 | + " .long 36b,100b\n" | |
17863 | + " .long 37b,100b\n" | |
17864 | + " .long 99b,101b\n" | |
17865 | + ".previous" | |
17866 | + : "=&c"(size), "=&D" (d0), "=&S" (d1) | |
17867 | + : "1"(to), "2"(from), "0"(size) | |
17868 | + : "eax", "edx", "memory"); | |
17869 | + return size; | |
17870 | +} | |
17871 | + | |
17872 | +static unsigned long | |
17873 | +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size) | |
17874 | +{ | |
17875 | + int d0, d1; | |
17876 | + __asm__ __volatile__( | |
17877 | + " .align 2,0x90\n" | |
17878 | + "1: "__copyuser_seg" movl 32(%4), %%eax\n" | |
17879 | + " cmpl $67, %0\n" | |
17880 | + " jbe 3f\n" | |
17881 | + "2: "__copyuser_seg" movl 64(%4), %%eax\n" | |
17882 | + " .align 2,0x90\n" | |
17883 | + "3: "__copyuser_seg" movl 0(%4), %%eax\n" | |
17884 | + "4: "__copyuser_seg" movl 4(%4), %%edx\n" | |
17885 | + "5: movl %%eax, 0(%3)\n" | |
17886 | + "6: movl %%edx, 4(%3)\n" | |
17887 | + "7: "__copyuser_seg" movl 8(%4), %%eax\n" | |
17888 | + "8: "__copyuser_seg" movl 12(%4),%%edx\n" | |
17889 | + "9: movl %%eax, 8(%3)\n" | |
17890 | + "10: movl %%edx, 12(%3)\n" | |
17891 | + "11: "__copyuser_seg" movl 16(%4), %%eax\n" | |
17892 | + "12: "__copyuser_seg" movl 20(%4), %%edx\n" | |
17893 | + "13: movl %%eax, 16(%3)\n" | |
17894 | + "14: movl %%edx, 20(%3)\n" | |
17895 | + "15: "__copyuser_seg" movl 24(%4), %%eax\n" | |
17896 | + "16: "__copyuser_seg" movl 28(%4), %%edx\n" | |
17897 | + "17: movl %%eax, 24(%3)\n" | |
17898 | + "18: movl %%edx, 28(%3)\n" | |
17899 | + "19: "__copyuser_seg" movl 32(%4), %%eax\n" | |
17900 | + "20: "__copyuser_seg" movl 36(%4), %%edx\n" | |
17901 | + "21: movl %%eax, 32(%3)\n" | |
17902 | + "22: movl %%edx, 36(%3)\n" | |
17903 | + "23: "__copyuser_seg" movl 40(%4), %%eax\n" | |
17904 | + "24: "__copyuser_seg" movl 44(%4), %%edx\n" | |
17905 | + "25: movl %%eax, 40(%3)\n" | |
17906 | + "26: movl %%edx, 44(%3)\n" | |
17907 | + "27: "__copyuser_seg" movl 48(%4), %%eax\n" | |
17908 | + "28: "__copyuser_seg" movl 52(%4), %%edx\n" | |
17909 | + "29: movl %%eax, 48(%3)\n" | |
17910 | + "30: movl %%edx, 52(%3)\n" | |
17911 | + "31: "__copyuser_seg" movl 56(%4), %%eax\n" | |
17912 | + "32: "__copyuser_seg" movl 60(%4), %%edx\n" | |
17913 | + "33: movl %%eax, 56(%3)\n" | |
17914 | + "34: movl %%edx, 60(%3)\n" | |
17915 | + " addl $-64, %0\n" | |
17916 | + " addl $64, %4\n" | |
17917 | + " addl $64, %3\n" | |
17918 | + " cmpl $63, %0\n" | |
17919 | + " ja 1b\n" | |
17920 | + "35: movl %0, %%eax\n" | |
17921 | + " shrl $2, %0\n" | |
17922 | + " andl $3, %%eax\n" | |
17923 | + " cld\n" | |
17924 | + "99: rep; "__copyuser_seg" movsl\n" | |
17925 | + "36: movl %%eax, %0\n" | |
17926 | + "37: rep; "__copyuser_seg" movsb\n" | |
17927 | + "100:\n" | |
17928 | ".section .fixup,\"ax\"\n" | |
17929 | "101: lea 0(%%eax,%0,4),%0\n" | |
17930 | " jmp 100b\n" | |
17931 | @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons | |
17932 | int d0, d1; | |
17933 | __asm__ __volatile__( | |
17934 | " .align 2,0x90\n" | |
17935 | - "0: movl 32(%4), %%eax\n" | |
17936 | + "0: "__copyuser_seg" movl 32(%4), %%eax\n" | |
17937 | " cmpl $67, %0\n" | |
17938 | " jbe 2f\n" | |
17939 | - "1: movl 64(%4), %%eax\n" | |
17940 | + "1: "__copyuser_seg" movl 64(%4), %%eax\n" | |
17941 | " .align 2,0x90\n" | |
17942 | - "2: movl 0(%4), %%eax\n" | |
17943 | - "21: movl 4(%4), %%edx\n" | |
17944 | + "2: "__copyuser_seg" movl 0(%4), %%eax\n" | |
17945 | + "21: "__copyuser_seg" movl 4(%4), %%edx\n" | |
17946 | " movl %%eax, 0(%3)\n" | |
17947 | " movl %%edx, 4(%3)\n" | |
17948 | - "3: movl 8(%4), %%eax\n" | |
17949 | - "31: movl 12(%4),%%edx\n" | |
17950 | + "3: "__copyuser_seg" movl 8(%4), %%eax\n" | |
17951 | + "31: "__copyuser_seg" movl 12(%4),%%edx\n" | |
17952 | " movl %%eax, 8(%3)\n" | |
17953 | " movl %%edx, 12(%3)\n" | |
17954 | - "4: movl 16(%4), %%eax\n" | |
17955 | - "41: movl 20(%4), %%edx\n" | |
17956 | + "4: "__copyuser_seg" movl 16(%4), %%eax\n" | |
17957 | + "41: "__copyuser_seg" movl 20(%4), %%edx\n" | |
17958 | " movl %%eax, 16(%3)\n" | |
17959 | " movl %%edx, 20(%3)\n" | |
17960 | - "10: movl 24(%4), %%eax\n" | |
17961 | - "51: movl 28(%4), %%edx\n" | |
17962 | + "10: "__copyuser_seg" movl 24(%4), %%eax\n" | |
17963 | + "51: "__copyuser_seg" movl 28(%4), %%edx\n" | |
17964 | " movl %%eax, 24(%3)\n" | |
17965 | " movl %%edx, 28(%3)\n" | |
17966 | - "11: movl 32(%4), %%eax\n" | |
17967 | - "61: movl 36(%4), %%edx\n" | |
17968 | + "11: "__copyuser_seg" movl 32(%4), %%eax\n" | |
17969 | + "61: "__copyuser_seg" movl 36(%4), %%edx\n" | |
17970 | " movl %%eax, 32(%3)\n" | |
17971 | " movl %%edx, 36(%3)\n" | |
17972 | - "12: movl 40(%4), %%eax\n" | |
17973 | - "71: movl 44(%4), %%edx\n" | |
17974 | + "12: "__copyuser_seg" movl 40(%4), %%eax\n" | |
17975 | + "71: "__copyuser_seg" movl 44(%4), %%edx\n" | |
17976 | " movl %%eax, 40(%3)\n" | |
17977 | " movl %%edx, 44(%3)\n" | |
17978 | - "13: movl 48(%4), %%eax\n" | |
17979 | - "81: movl 52(%4), %%edx\n" | |
17980 | + "13: "__copyuser_seg" movl 48(%4), %%eax\n" | |
17981 | + "81: "__copyuser_seg" movl 52(%4), %%edx\n" | |
17982 | " movl %%eax, 48(%3)\n" | |
17983 | " movl %%edx, 52(%3)\n" | |
17984 | - "14: movl 56(%4), %%eax\n" | |
17985 | - "91: movl 60(%4), %%edx\n" | |
17986 | + "14: "__copyuser_seg" movl 56(%4), %%eax\n" | |
17987 | + "91: "__copyuser_seg" movl 60(%4), %%edx\n" | |
17988 | " movl %%eax, 56(%3)\n" | |
17989 | " movl %%edx, 60(%3)\n" | |
17990 | " addl $-64, %0\n" | |
17991 | @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons | |
17992 | " shrl $2, %0\n" | |
17993 | " andl $3, %%eax\n" | |
17994 | " cld\n" | |
17995 | - "6: rep; movsl\n" | |
17996 | + "6: rep; "__copyuser_seg" movsl\n" | |
17997 | " movl %%eax,%0\n" | |
17998 | - "7: rep; movsb\n" | |
17999 | + "7: rep; "__copyuser_seg" movsb\n" | |
18000 | "8:\n" | |
18001 | ".section .fixup,\"ax\"\n" | |
18002 | "9: lea 0(%%eax,%0,4),%0\n" | |
18003 | @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing | |
18004 | ||
18005 | __asm__ __volatile__( | |
18006 | " .align 2,0x90\n" | |
18007 | - "0: movl 32(%4), %%eax\n" | |
18008 | + "0: "__copyuser_seg" movl 32(%4), %%eax\n" | |
18009 | " cmpl $67, %0\n" | |
18010 | " jbe 2f\n" | |
18011 | - "1: movl 64(%4), %%eax\n" | |
18012 | + "1: "__copyuser_seg" movl 64(%4), %%eax\n" | |
18013 | " .align 2,0x90\n" | |
18014 | - "2: movl 0(%4), %%eax\n" | |
18015 | - "21: movl 4(%4), %%edx\n" | |
18016 | + "2: "__copyuser_seg" movl 0(%4), %%eax\n" | |
18017 | + "21: "__copyuser_seg" movl 4(%4), %%edx\n" | |
18018 | " movnti %%eax, 0(%3)\n" | |
18019 | " movnti %%edx, 4(%3)\n" | |
18020 | - "3: movl 8(%4), %%eax\n" | |
18021 | - "31: movl 12(%4),%%edx\n" | |
18022 | + "3: "__copyuser_seg" movl 8(%4), %%eax\n" | |
18023 | + "31: "__copyuser_seg" movl 12(%4),%%edx\n" | |
18024 | " movnti %%eax, 8(%3)\n" | |
18025 | " movnti %%edx, 12(%3)\n" | |
18026 | - "4: movl 16(%4), %%eax\n" | |
18027 | - "41: movl 20(%4), %%edx\n" | |
18028 | + "4: "__copyuser_seg" movl 16(%4), %%eax\n" | |
18029 | + "41: "__copyuser_seg" movl 20(%4), %%edx\n" | |
18030 | " movnti %%eax, 16(%3)\n" | |
18031 | " movnti %%edx, 20(%3)\n" | |
18032 | - "10: movl 24(%4), %%eax\n" | |
18033 | - "51: movl 28(%4), %%edx\n" | |
18034 | + "10: "__copyuser_seg" movl 24(%4), %%eax\n" | |
18035 | + "51: "__copyuser_seg" movl 28(%4), %%edx\n" | |
18036 | " movnti %%eax, 24(%3)\n" | |
18037 | " movnti %%edx, 28(%3)\n" | |
18038 | - "11: movl 32(%4), %%eax\n" | |
18039 | - "61: movl 36(%4), %%edx\n" | |
18040 | + "11: "__copyuser_seg" movl 32(%4), %%eax\n" | |
18041 | + "61: "__copyuser_seg" movl 36(%4), %%edx\n" | |
18042 | " movnti %%eax, 32(%3)\n" | |
18043 | " movnti %%edx, 36(%3)\n" | |
18044 | - "12: movl 40(%4), %%eax\n" | |
18045 | - "71: movl 44(%4), %%edx\n" | |
18046 | + "12: "__copyuser_seg" movl 40(%4), %%eax\n" | |
18047 | + "71: "__copyuser_seg" movl 44(%4), %%edx\n" | |
18048 | " movnti %%eax, 40(%3)\n" | |
18049 | " movnti %%edx, 44(%3)\n" | |
18050 | - "13: movl 48(%4), %%eax\n" | |
18051 | - "81: movl 52(%4), %%edx\n" | |
18052 | + "13: "__copyuser_seg" movl 48(%4), %%eax\n" | |
18053 | + "81: "__copyuser_seg" movl 52(%4), %%edx\n" | |
18054 | " movnti %%eax, 48(%3)\n" | |
18055 | " movnti %%edx, 52(%3)\n" | |
18056 | - "14: movl 56(%4), %%eax\n" | |
18057 | - "91: movl 60(%4), %%edx\n" | |
18058 | + "14: "__copyuser_seg" movl 56(%4), %%eax\n" | |
18059 | + "91: "__copyuser_seg" movl 60(%4), %%edx\n" | |
18060 | " movnti %%eax, 56(%3)\n" | |
18061 | " movnti %%edx, 60(%3)\n" | |
18062 | " addl $-64, %0\n" | |
18063 | @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing | |
18064 | " shrl $2, %0\n" | |
18065 | " andl $3, %%eax\n" | |
18066 | " cld\n" | |
18067 | - "6: rep; movsl\n" | |
18068 | + "6: rep; "__copyuser_seg" movsl\n" | |
18069 | " movl %%eax,%0\n" | |
18070 | - "7: rep; movsb\n" | |
18071 | + "7: rep; "__copyuser_seg" movsb\n" | |
18072 | "8:\n" | |
18073 | ".section .fixup,\"ax\"\n" | |
18074 | "9: lea 0(%%eax,%0,4),%0\n" | |
18075 | @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n | |
18076 | ||
18077 | __asm__ __volatile__( | |
18078 | " .align 2,0x90\n" | |
18079 | - "0: movl 32(%4), %%eax\n" | |
18080 | + "0: "__copyuser_seg" movl 32(%4), %%eax\n" | |
18081 | " cmpl $67, %0\n" | |
18082 | " jbe 2f\n" | |
18083 | - "1: movl 64(%4), %%eax\n" | |
18084 | + "1: "__copyuser_seg" movl 64(%4), %%eax\n" | |
18085 | " .align 2,0x90\n" | |
18086 | - "2: movl 0(%4), %%eax\n" | |
18087 | - "21: movl 4(%4), %%edx\n" | |
18088 | + "2: "__copyuser_seg" movl 0(%4), %%eax\n" | |
18089 | + "21: "__copyuser_seg" movl 4(%4), %%edx\n" | |
18090 | " movnti %%eax, 0(%3)\n" | |
18091 | " movnti %%edx, 4(%3)\n" | |
18092 | - "3: movl 8(%4), %%eax\n" | |
18093 | - "31: movl 12(%4),%%edx\n" | |
18094 | + "3: "__copyuser_seg" movl 8(%4), %%eax\n" | |
18095 | + "31: "__copyuser_seg" movl 12(%4),%%edx\n" | |
18096 | " movnti %%eax, 8(%3)\n" | |
18097 | " movnti %%edx, 12(%3)\n" | |
18098 | - "4: movl 16(%4), %%eax\n" | |
18099 | - "41: movl 20(%4), %%edx\n" | |
18100 | + "4: "__copyuser_seg" movl 16(%4), %%eax\n" | |
18101 | + "41: "__copyuser_seg" movl 20(%4), %%edx\n" | |
18102 | " movnti %%eax, 16(%3)\n" | |
18103 | " movnti %%edx, 20(%3)\n" | |
18104 | - "10: movl 24(%4), %%eax\n" | |
18105 | - "51: movl 28(%4), %%edx\n" | |
18106 | + "10: "__copyuser_seg" movl 24(%4), %%eax\n" | |
18107 | + "51: "__copyuser_seg" movl 28(%4), %%edx\n" | |
18108 | " movnti %%eax, 24(%3)\n" | |
18109 | " movnti %%edx, 28(%3)\n" | |
18110 | - "11: movl 32(%4), %%eax\n" | |
18111 | - "61: movl 36(%4), %%edx\n" | |
18112 | + "11: "__copyuser_seg" movl 32(%4), %%eax\n" | |
18113 | + "61: "__copyuser_seg" movl 36(%4), %%edx\n" | |
18114 | " movnti %%eax, 32(%3)\n" | |
18115 | " movnti %%edx, 36(%3)\n" | |
18116 | - "12: movl 40(%4), %%eax\n" | |
18117 | - "71: movl 44(%4), %%edx\n" | |
18118 | + "12: "__copyuser_seg" movl 40(%4), %%eax\n" | |
18119 | + "71: "__copyuser_seg" movl 44(%4), %%edx\n" | |
18120 | " movnti %%eax, 40(%3)\n" | |
18121 | " movnti %%edx, 44(%3)\n" | |
18122 | - "13: movl 48(%4), %%eax\n" | |
18123 | - "81: movl 52(%4), %%edx\n" | |
18124 | + "13: "__copyuser_seg" movl 48(%4), %%eax\n" | |
18125 | + "81: "__copyuser_seg" movl 52(%4), %%edx\n" | |
18126 | " movnti %%eax, 48(%3)\n" | |
18127 | " movnti %%edx, 52(%3)\n" | |
18128 | - "14: movl 56(%4), %%eax\n" | |
18129 | - "91: movl 60(%4), %%edx\n" | |
18130 | + "14: "__copyuser_seg" movl 56(%4), %%eax\n" | |
18131 | + "91: "__copyuser_seg" movl 60(%4), %%edx\n" | |
18132 | " movnti %%eax, 56(%3)\n" | |
18133 | " movnti %%edx, 60(%3)\n" | |
18134 | " addl $-64, %0\n" | |
18135 | @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n | |
18136 | " shrl $2, %0\n" | |
18137 | " andl $3, %%eax\n" | |
18138 | " cld\n" | |
18139 | - "6: rep; movsl\n" | |
18140 | + "6: rep; "__copyuser_seg" movsl\n" | |
18141 | " movl %%eax,%0\n" | |
18142 | - "7: rep; movsb\n" | |
18143 | + "7: rep; "__copyuser_seg" movsb\n" | |
18144 | "8:\n" | |
18145 | ".section .fixup,\"ax\"\n" | |
18146 | "9: lea 0(%%eax,%0,4),%0\n" | |
18147 | @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n | |
18148 | */ | |
18149 | unsigned long __copy_user_zeroing_intel(void *to, const void __user *from, | |
18150 | unsigned long size); | |
18151 | -unsigned long __copy_user_intel(void __user *to, const void *from, | |
18152 | +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from, | |
18153 | + unsigned long size); | |
18154 | +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from, | |
18155 | unsigned long size); | |
18156 | unsigned long __copy_user_zeroing_intel_nocache(void *to, | |
18157 | const void __user *from, unsigned long size); | |
18158 | #endif /* CONFIG_X86_INTEL_USERCOPY */ | |
18159 | ||
18160 | /* Generic arbitrary sized copy. */ | |
18161 | -#define __copy_user(to, from, size) \ | |
18162 | +#define __copy_user(to, from, size, prefix, set, restore) \ | |
18163 | do { \ | |
18164 | int __d0, __d1, __d2; \ | |
18165 | __asm__ __volatile__( \ | |
18166 | + set \ | |
18167 | " cmp $7,%0\n" \ | |
18168 | " jbe 1f\n" \ | |
18169 | " movl %1,%0\n" \ | |
18170 | " negl %0\n" \ | |
18171 | " andl $7,%0\n" \ | |
18172 | " subl %0,%3\n" \ | |
18173 | - "4: rep; movsb\n" \ | |
18174 | + "4: rep; "prefix"movsb\n" \ | |
18175 | " movl %3,%0\n" \ | |
18176 | " shrl $2,%0\n" \ | |
18177 | " andl $3,%3\n" \ | |
18178 | " .align 2,0x90\n" \ | |
18179 | - "0: rep; movsl\n" \ | |
18180 | + "0: rep; "prefix"movsl\n" \ | |
18181 | " movl %3,%0\n" \ | |
18182 | - "1: rep; movsb\n" \ | |
18183 | + "1: rep; "prefix"movsb\n" \ | |
18184 | "2:\n" \ | |
18185 | + restore \ | |
18186 | ".section .fixup,\"ax\"\n" \ | |
18187 | "5: addl %3,%0\n" \ | |
18188 | " jmp 2b\n" \ | |
18189 | @@ -682,14 +799,14 @@ do { \ | |
18190 | " negl %0\n" \ | |
18191 | " andl $7,%0\n" \ | |
18192 | " subl %0,%3\n" \ | |
18193 | - "4: rep; movsb\n" \ | |
18194 | + "4: rep; "__copyuser_seg"movsb\n" \ | |
18195 | " movl %3,%0\n" \ | |
18196 | " shrl $2,%0\n" \ | |
18197 | " andl $3,%3\n" \ | |
18198 | " .align 2,0x90\n" \ | |
18199 | - "0: rep; movsl\n" \ | |
18200 | + "0: rep; "__copyuser_seg"movsl\n" \ | |
18201 | " movl %3,%0\n" \ | |
18202 | - "1: rep; movsb\n" \ | |
18203 | + "1: rep; "__copyuser_seg"movsb\n" \ | |
18204 | "2:\n" \ | |
18205 | ".section .fixup,\"ax\"\n" \ | |
18206 | "5: addl %3,%0\n" \ | |
18207 | @@ -775,9 +892,9 @@ survive: | |
18208 | } | |
18209 | #endif | |
18210 | if (movsl_is_ok(to, from, n)) | |
18211 | - __copy_user(to, from, n); | |
18212 | + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES); | |
18213 | else | |
18214 | - n = __copy_user_intel(to, from, n); | |
18215 | + n = __generic_copy_to_user_intel(to, from, n); | |
18216 | return n; | |
18217 | } | |
18218 | EXPORT_SYMBOL(__copy_to_user_ll); | |
18219 | @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero | |
18220 | unsigned long n) | |
18221 | { | |
18222 | if (movsl_is_ok(to, from, n)) | |
18223 | - __copy_user(to, from, n); | |
18224 | + __copy_user(to, from, n, __copyuser_seg, "", ""); | |
18225 | else | |
18226 | - n = __copy_user_intel((void __user *)to, | |
18227 | - (const void *)from, n); | |
18228 | + n = __generic_copy_from_user_intel(to, from, n); | |
18229 | return n; | |
18230 | } | |
18231 | EXPORT_SYMBOL(__copy_from_user_ll_nozero); | |
18232 | @@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach | |
18233 | if (n > 64 && cpu_has_xmm2) | |
18234 | n = __copy_user_intel_nocache(to, from, n); | |
18235 | else | |
18236 | - __copy_user(to, from, n); | |
18237 | + __copy_user(to, from, n, __copyuser_seg, "", ""); | |
18238 | #else | |
18239 | - __copy_user(to, from, n); | |
18240 | + __copy_user(to, from, n, __copyuser_seg, "", ""); | |
18241 | #endif | |
18242 | return n; | |
18243 | } | |
18244 | EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero); | |
18245 | ||
18246 | -/** | |
18247 | - * copy_to_user: - Copy a block of data into user space. | |
18248 | - * @to: Destination address, in user space. | |
18249 | - * @from: Source address, in kernel space. | |
18250 | - * @n: Number of bytes to copy. | |
18251 | - * | |
18252 | - * Context: User context only. This function may sleep. | |
18253 | - * | |
18254 | - * Copy data from kernel space to user space. | |
18255 | - * | |
18256 | - * Returns number of bytes that could not be copied. | |
18257 | - * On success, this will be zero. | |
18258 | - */ | |
18259 | -unsigned long | |
18260 | -copy_to_user(void __user *to, const void *from, unsigned long n) | |
18261 | +void copy_from_user_overflow(void) | |
18262 | { | |
18263 | - if (access_ok(VERIFY_WRITE, to, n)) | |
18264 | - n = __copy_to_user(to, from, n); | |
18265 | - return n; | |
18266 | + WARN(1, "Buffer overflow detected!\n"); | |
18267 | } | |
18268 | -EXPORT_SYMBOL(copy_to_user); | |
18269 | +EXPORT_SYMBOL(copy_from_user_overflow); | |
18270 | ||
18271 | -/** | |
18272 | - * copy_from_user: - Copy a block of data from user space. | |
18273 | - * @to: Destination address, in kernel space. | |
18274 | - * @from: Source address, in user space. | |
18275 | - * @n: Number of bytes to copy. | |
18276 | - * | |
18277 | - * Context: User context only. This function may sleep. | |
18278 | - * | |
18279 | - * Copy data from user space to kernel space. | |
18280 | - * | |
18281 | - * Returns number of bytes that could not be copied. | |
18282 | - * On success, this will be zero. | |
18283 | - * | |
18284 | - * If some data could not be copied, this function will pad the copied | |
18285 | - * data to the requested size using zero bytes. | |
18286 | - */ | |
18287 | -unsigned long | |
18288 | -_copy_from_user(void *to, const void __user *from, unsigned long n) | |
18289 | +void copy_to_user_overflow(void) | |
18290 | { | |
18291 | - if (access_ok(VERIFY_READ, from, n)) | |
18292 | - n = __copy_from_user(to, from, n); | |
18293 | - else | |
18294 | - memset(to, 0, n); | |
18295 | - return n; | |
18296 | + WARN(1, "Buffer overflow detected!\n"); | |
18297 | } | |
18298 | -EXPORT_SYMBOL(_copy_from_user); | |
18299 | +EXPORT_SYMBOL(copy_to_user_overflow); | |
18300 | ||
18301 | -void copy_from_user_overflow(void) | |
18302 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
18303 | +void __set_fs(mm_segment_t x) | |
18304 | { | |
18305 | - WARN(1, "Buffer overflow detected!\n"); | |
18306 | + switch (x.seg) { | |
18307 | + case 0: | |
18308 | + loadsegment(gs, 0); | |
18309 | + break; | |
18310 | + case TASK_SIZE_MAX: | |
18311 | + loadsegment(gs, __USER_DS); | |
18312 | + break; | |
18313 | + case -1UL: | |
18314 | + loadsegment(gs, __KERNEL_DS); | |
18315 | + break; | |
18316 | + default: | |
18317 | + BUG(); | |
18318 | + } | |
18319 | + return; | |
18320 | } | |
18321 | -EXPORT_SYMBOL(copy_from_user_overflow); | |
18322 | +EXPORT_SYMBOL(__set_fs); | |
18323 | + | |
18324 | +void set_fs(mm_segment_t x) | |
18325 | +{ | |
18326 | + current_thread_info()->addr_limit = x; | |
18327 | + __set_fs(x); | |
18328 | +} | |
18329 | +EXPORT_SYMBOL(set_fs); | |
18330 | +#endif | |
18331 | diff -urNp linux-3.0.3/arch/x86/lib/usercopy_64.c linux-3.0.3/arch/x86/lib/usercopy_64.c | |
18332 | --- linux-3.0.3/arch/x86/lib/usercopy_64.c 2011-07-21 22:17:23.000000000 -0400 | |
18333 | +++ linux-3.0.3/arch/x86/lib/usercopy_64.c 2011-08-23 21:47:55.000000000 -0400 | |
18334 | @@ -42,6 +42,12 @@ long | |
18335 | __strncpy_from_user(char *dst, const char __user *src, long count) | |
18336 | { | |
18337 | long res; | |
18338 | + | |
18339 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
18340 | + if ((unsigned long)src < PAX_USER_SHADOW_BASE) | |
18341 | + src += PAX_USER_SHADOW_BASE; | |
18342 | +#endif | |
18343 | + | |
18344 | __do_strncpy_from_user(dst, src, count, res); | |
18345 | return res; | |
18346 | } | |
18347 | @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user * | |
18348 | { | |
18349 | long __d0; | |
18350 | might_fault(); | |
18351 | + | |
18352 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
18353 | + if ((unsigned long)addr < PAX_USER_SHADOW_BASE) | |
18354 | + addr += PAX_USER_SHADOW_BASE; | |
18355 | +#endif | |
18356 | + | |
18357 | /* no memory constraint because it doesn't change any memory gcc knows | |
18358 | about */ | |
18359 | asm volatile( | |
18360 | @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user); | |
18361 | ||
18362 | unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len) | |
18363 | { | |
18364 | - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { | |
18365 | + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { | |
18366 | + | |
18367 | +#ifdef CONFIG_PAX_MEMORY_UDEREF | |
18368 | + if ((unsigned long)to < PAX_USER_SHADOW_BASE) | |
18369 | + to += PAX_USER_SHADOW_BASE; | |
18370 | + if ((unsigned long)from < PAX_USER_SHADOW_BASE) | |
18371 | + from += PAX_USER_SHADOW_BASE; | |
18372 | +#endif | |
18373 | + | |
18374 | return copy_user_generic((__force void *)to, (__force void *)from, len); | |
18375 | - } | |
18376 | - return len; | |
18377 | + } | |
18378 | + return len; | |
18379 | } | |
18380 | EXPORT_SYMBOL(copy_in_user); | |
18381 | ||
18382 | diff -urNp linux-3.0.3/arch/x86/Makefile linux-3.0.3/arch/x86/Makefile | |
18383 | --- linux-3.0.3/arch/x86/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
18384 | +++ linux-3.0.3/arch/x86/Makefile 2011-08-23 21:48:14.000000000 -0400 | |
18385 | @@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y) | |
18386 | else | |
18387 | BITS := 64 | |
18388 | UTS_MACHINE := x86_64 | |
18389 | + biarch := $(call cc-option,-m64) | |
18390 | CHECKFLAGS += -D__x86_64__ -m64 | |
18391 | ||
18392 | KBUILD_AFLAGS += -m64 | |
18393 | @@ -195,3 +196,12 @@ define archhelp | |
18394 | echo ' FDARGS="..." arguments for the booted kernel' | |
18395 | echo ' FDINITRD=file initrd for the booted kernel' | |
18396 | endef | |
18397 | + | |
18398 | +define OLD_LD | |
18399 | + | |
18400 | +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils. | |
18401 | +*** Please upgrade your binutils to 2.18 or newer | |
18402 | +endef | |
18403 | + | |
18404 | +archprepare: | |
18405 | + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD))) | |
18406 | diff -urNp linux-3.0.3/arch/x86/mm/extable.c linux-3.0.3/arch/x86/mm/extable.c | |
18407 | --- linux-3.0.3/arch/x86/mm/extable.c 2011-07-21 22:17:23.000000000 -0400 | |
18408 | +++ linux-3.0.3/arch/x86/mm/extable.c 2011-08-23 21:47:55.000000000 -0400 | |
18409 | @@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs | |
18410 | const struct exception_table_entry *fixup; | |
18411 | ||
18412 | #ifdef CONFIG_PNPBIOS | |
18413 | - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) { | |
18414 | + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) { | |
18415 | extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp; | |
18416 | extern u32 pnp_bios_is_utter_crap; | |
18417 | pnp_bios_is_utter_crap = 1; | |
18418 | diff -urNp linux-3.0.3/arch/x86/mm/fault.c linux-3.0.3/arch/x86/mm/fault.c | |
18419 | --- linux-3.0.3/arch/x86/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 | |
18420 | +++ linux-3.0.3/arch/x86/mm/fault.c 2011-08-23 21:48:14.000000000 -0400 | |
18421 | @@ -13,10 +13,18 @@ | |
18422 | #include <linux/perf_event.h> /* perf_sw_event */ | |
18423 | #include <linux/hugetlb.h> /* hstate_index_to_shift */ | |
18424 | #include <linux/prefetch.h> /* prefetchw */ | |
18425 | +#include <linux/unistd.h> | |
18426 | +#include <linux/compiler.h> | |
18427 | ||
18428 | #include <asm/traps.h> /* dotraplinkage, ... */ | |
18429 | #include <asm/pgalloc.h> /* pgd_*(), ... */ | |
18430 | #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */ | |
18431 | +#include <asm/vsyscall.h> | |
18432 | +#include <asm/tlbflush.h> | |
18433 | + | |
18434 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
18435 | +#include <asm/stacktrace.h> | |
18436 | +#endif | |
18437 | ||
18438 | /* | |
18439 | * Page fault error code bits: | |
18440 | @@ -54,7 +62,7 @@ static inline int __kprobes notify_page_ | |
18441 | int ret = 0; | |
18442 | ||
18443 | /* kprobe_running() needs smp_processor_id() */ | |
18444 | - if (kprobes_built_in() && !user_mode_vm(regs)) { | |
18445 | + if (kprobes_built_in() && !user_mode(regs)) { | |
18446 | preempt_disable(); | |
18447 | if (kprobe_running() && kprobe_fault_handler(regs, 14)) | |
18448 | ret = 1; | |
18449 | @@ -115,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *re | |
18450 | return !instr_lo || (instr_lo>>1) == 1; | |
18451 | case 0x00: | |
18452 | /* Prefetch instruction is 0x0F0D or 0x0F18 */ | |
18453 | - if (probe_kernel_address(instr, opcode)) | |
18454 | + if (user_mode(regs)) { | |
18455 | + if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) | |
18456 | + return 0; | |
18457 | + } else if (probe_kernel_address(instr, opcode)) | |
18458 | return 0; | |
18459 | ||
18460 | *prefetch = (instr_lo == 0xF) && | |
18461 | @@ -149,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsign | |
18462 | while (instr < max_instr) { | |
18463 | unsigned char opcode; | |
18464 | ||
18465 | - if (probe_kernel_address(instr, opcode)) | |
18466 | + if (user_mode(regs)) { | |
18467 | + if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) | |
18468 | + break; | |
18469 | + } else if (probe_kernel_address(instr, opcode)) | |
18470 | break; | |
18471 | ||
18472 | instr++; | |
18473 | @@ -180,6 +194,30 @@ force_sig_info_fault(int si_signo, int s | |
18474 | force_sig_info(si_signo, &info, tsk); | |
18475 | } | |
18476 | ||
18477 | +#ifdef CONFIG_PAX_EMUTRAMP | |
18478 | +static int pax_handle_fetch_fault(struct pt_regs *regs); | |
18479 | +#endif | |
18480 | + | |
18481 | +#ifdef CONFIG_PAX_PAGEEXEC | |
18482 | +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address) | |
18483 | +{ | |
18484 | + pgd_t *pgd; | |
18485 | + pud_t *pud; | |
18486 | + pmd_t *pmd; | |
18487 | + | |
18488 | + pgd = pgd_offset(mm, address); | |
18489 | + if (!pgd_present(*pgd)) | |
18490 | + return NULL; | |
18491 | + pud = pud_offset(pgd, address); | |
18492 | + if (!pud_present(*pud)) | |
18493 | + return NULL; | |
18494 | + pmd = pmd_offset(pud, address); | |
18495 | + if (!pmd_present(*pmd)) | |
18496 | + return NULL; | |
18497 | + return pmd; | |
18498 | +} | |
18499 | +#endif | |
18500 | + | |
18501 | DEFINE_SPINLOCK(pgd_lock); | |
18502 | LIST_HEAD(pgd_list); | |
18503 | ||
18504 | @@ -230,10 +268,22 @@ void vmalloc_sync_all(void) | |
18505 | for (address = VMALLOC_START & PMD_MASK; | |
18506 | address >= TASK_SIZE && address < FIXADDR_TOP; | |
18507 | address += PMD_SIZE) { | |
18508 | + | |
18509 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
18510 | + unsigned long cpu; | |
18511 | +#else | |
18512 | struct page *page; | |
18513 | +#endif | |
18514 | ||
18515 | spin_lock(&pgd_lock); | |
18516 | + | |
18517 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
18518 | + for (cpu = 0; cpu < NR_CPUS; ++cpu) { | |
18519 | + pgd_t *pgd = get_cpu_pgd(cpu); | |
18520 | + pmd_t *ret; | |
18521 | +#else | |
18522 | list_for_each_entry(page, &pgd_list, lru) { | |
18523 | + pgd_t *pgd = page_address(page); | |
18524 | spinlock_t *pgt_lock; | |
18525 | pmd_t *ret; | |
18526 | ||
18527 | @@ -241,8 +291,13 @@ void vmalloc_sync_all(void) | |
18528 | pgt_lock = &pgd_page_get_mm(page)->page_table_lock; | |
18529 | ||
18530 | spin_lock(pgt_lock); | |
18531 | - ret = vmalloc_sync_one(page_address(page), address); | |
18532 | +#endif | |
18533 | + | |
18534 | + ret = vmalloc_sync_one(pgd, address); | |
18535 | + | |
18536 | +#ifndef CONFIG_PAX_PER_CPU_PGD | |
18537 | spin_unlock(pgt_lock); | |
18538 | +#endif | |
18539 | ||
18540 | if (!ret) | |
18541 | break; | |
18542 | @@ -276,6 +331,11 @@ static noinline __kprobes int vmalloc_fa | |
18543 | * an interrupt in the middle of a task switch.. | |
18544 | */ | |
18545 | pgd_paddr = read_cr3(); | |
18546 | + | |
18547 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
18548 | + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK)); | |
18549 | +#endif | |
18550 | + | |
18551 | pmd_k = vmalloc_sync_one(__va(pgd_paddr), address); | |
18552 | if (!pmd_k) | |
18553 | return -1; | |
18554 | @@ -371,7 +431,14 @@ static noinline __kprobes int vmalloc_fa | |
18555 | * happen within a race in page table update. In the later | |
18556 | * case just flush: | |
18557 | */ | |
18558 | + | |
18559 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
18560 | + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK)); | |
18561 | + pgd = pgd_offset_cpu(smp_processor_id(), address); | |
18562 | +#else | |
18563 | pgd = pgd_offset(current->active_mm, address); | |
18564 | +#endif | |
18565 | + | |
18566 | pgd_ref = pgd_offset_k(address); | |
18567 | if (pgd_none(*pgd_ref)) | |
18568 | return -1; | |
18569 | @@ -533,7 +600,7 @@ static int is_errata93(struct pt_regs *r | |
18570 | static int is_errata100(struct pt_regs *regs, unsigned long address) | |
18571 | { | |
18572 | #ifdef CONFIG_X86_64 | |
18573 | - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32)) | |
18574 | + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32)) | |
18575 | return 1; | |
18576 | #endif | |
18577 | return 0; | |
18578 | @@ -560,7 +627,7 @@ static int is_f00f_bug(struct pt_regs *r | |
18579 | } | |
18580 | ||
18581 | static const char nx_warning[] = KERN_CRIT | |
18582 | -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n"; | |
18583 | +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n"; | |
18584 | ||
18585 | static void | |
18586 | show_fault_oops(struct pt_regs *regs, unsigned long error_code, | |
18587 | @@ -569,14 +636,25 @@ show_fault_oops(struct pt_regs *regs, un | |
18588 | if (!oops_may_print()) | |
18589 | return; | |
18590 | ||
18591 | - if (error_code & PF_INSTR) { | |
18592 | + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) { | |
18593 | unsigned int level; | |
18594 | ||
18595 | pte_t *pte = lookup_address(address, &level); | |
18596 | ||
18597 | if (pte && pte_present(*pte) && !pte_exec(*pte)) | |
18598 | - printk(nx_warning, current_uid()); | |
18599 | + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current)); | |
18600 | + } | |
18601 | + | |
18602 | +#ifdef CONFIG_PAX_KERNEXEC | |
18603 | + if (init_mm.start_code <= address && address < init_mm.end_code) { | |
18604 | + if (current->signal->curr_ip) | |
18605 | + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", | |
18606 | + ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid()); | |
18607 | + else | |
18608 | + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", | |
18609 | + current->comm, task_pid_nr(current), current_uid(), current_euid()); | |
18610 | } | |
18611 | +#endif | |
18612 | ||
18613 | printk(KERN_ALERT "BUG: unable to handle kernel "); | |
18614 | if (address < PAGE_SIZE) | |
18615 | @@ -702,6 +780,66 @@ __bad_area_nosemaphore(struct pt_regs *r | |
18616 | unsigned long address, int si_code) | |
18617 | { | |
18618 | struct task_struct *tsk = current; | |
18619 | +#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
18620 | + struct mm_struct *mm = tsk->mm; | |
18621 | +#endif | |
18622 | + | |
18623 | +#ifdef CONFIG_X86_64 | |
18624 | + if (mm && (error_code & PF_INSTR) && mm->context.vdso) { | |
18625 | + if (regs->ip == VSYSCALL_ADDR(__NR_vgettimeofday) || | |
18626 | + regs->ip == VSYSCALL_ADDR(__NR_vtime) || | |
18627 | + regs->ip == VSYSCALL_ADDR(__NR_vgetcpu)) { | |
18628 | + regs->ip += mm->context.vdso - PAGE_SIZE - VSYSCALL_START; | |
18629 | + return; | |
18630 | + } | |
18631 | + } | |
18632 | +#endif | |
18633 | + | |
18634 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
18635 | + if (mm && (error_code & PF_USER)) { | |
18636 | + unsigned long ip = regs->ip; | |
18637 | + | |
18638 | + if (v8086_mode(regs)) | |
18639 | + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff); | |
18640 | + | |
18641 | + /* | |
18642 | + * It's possible to have interrupts off here: | |
18643 | + */ | |
18644 | + local_irq_enable(); | |
18645 | + | |
18646 | +#ifdef CONFIG_PAX_PAGEEXEC | |
18647 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && | |
18648 | + (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) { | |
18649 | + | |
18650 | +#ifdef CONFIG_PAX_EMUTRAMP | |
18651 | + switch (pax_handle_fetch_fault(regs)) { | |
18652 | + case 2: | |
18653 | + return; | |
18654 | + } | |
18655 | +#endif | |
18656 | + | |
18657 | + pax_report_fault(regs, (void *)ip, (void *)regs->sp); | |
18658 | + do_group_exit(SIGKILL); | |
18659 | + } | |
18660 | +#endif | |
18661 | + | |
18662 | +#ifdef CONFIG_PAX_SEGMEXEC | |
18663 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) { | |
18664 | + | |
18665 | +#ifdef CONFIG_PAX_EMUTRAMP | |
18666 | + switch (pax_handle_fetch_fault(regs)) { | |
18667 | + case 2: | |
18668 | + return; | |
18669 | + } | |
18670 | +#endif | |
18671 | + | |
18672 | + pax_report_fault(regs, (void *)ip, (void *)regs->sp); | |
18673 | + do_group_exit(SIGKILL); | |
18674 | + } | |
18675 | +#endif | |
18676 | + | |
18677 | + } | |
18678 | +#endif | |
18679 | ||
18680 | /* User mode accesses just cause a SIGSEGV */ | |
18681 | if (error_code & PF_USER) { | |
18682 | @@ -871,6 +1009,99 @@ static int spurious_fault_check(unsigned | |
18683 | return 1; | |
18684 | } | |
18685 | ||
18686 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) | |
18687 | +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code) | |
18688 | +{ | |
18689 | + pte_t *pte; | |
18690 | + pmd_t *pmd; | |
18691 | + spinlock_t *ptl; | |
18692 | + unsigned char pte_mask; | |
18693 | + | |
18694 | + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) || | |
18695 | + !(mm->pax_flags & MF_PAX_PAGEEXEC)) | |
18696 | + return 0; | |
18697 | + | |
18698 | + /* PaX: it's our fault, let's handle it if we can */ | |
18699 | + | |
18700 | + /* PaX: take a look at read faults before acquiring any locks */ | |
18701 | + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) { | |
18702 | + /* instruction fetch attempt from a protected page in user mode */ | |
18703 | + up_read(&mm->mmap_sem); | |
18704 | + | |
18705 | +#ifdef CONFIG_PAX_EMUTRAMP | |
18706 | + switch (pax_handle_fetch_fault(regs)) { | |
18707 | + case 2: | |
18708 | + return 1; | |
18709 | + } | |
18710 | +#endif | |
18711 | + | |
18712 | + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp); | |
18713 | + do_group_exit(SIGKILL); | |
18714 | + } | |
18715 | + | |
18716 | + pmd = pax_get_pmd(mm, address); | |
18717 | + if (unlikely(!pmd)) | |
18718 | + return 0; | |
18719 | + | |
18720 | + pte = pte_offset_map_lock(mm, pmd, address, &ptl); | |
18721 | + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) { | |
18722 | + pte_unmap_unlock(pte, ptl); | |
18723 | + return 0; | |
18724 | + } | |
18725 | + | |
18726 | + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) { | |
18727 | + /* write attempt to a protected page in user mode */ | |
18728 | + pte_unmap_unlock(pte, ptl); | |
18729 | + return 0; | |
18730 | + } | |
18731 | + | |
18732 | +#ifdef CONFIG_SMP | |
18733 | + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask))) | |
18734 | +#else | |
18735 | + if (likely(address > get_limit(regs->cs))) | |
18736 | +#endif | |
18737 | + { | |
18738 | + set_pte(pte, pte_mkread(*pte)); | |
18739 | + __flush_tlb_one(address); | |
18740 | + pte_unmap_unlock(pte, ptl); | |
18741 | + up_read(&mm->mmap_sem); | |
18742 | + return 1; | |
18743 | + } | |
18744 | + | |
18745 | + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1)); | |
18746 | + | |
18747 | + /* | |
18748 | + * PaX: fill DTLB with user rights and retry | |
18749 | + */ | |
18750 | + __asm__ __volatile__ ( | |
18751 | + "orb %2,(%1)\n" | |
18752 | +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC) | |
18753 | +/* | |
18754 | + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's | |
18755 | + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any* | |
18756 | + * page fault when examined during a TLB load attempt. this is true not only | |
18757 | + * for PTEs holding a non-present entry but also present entries that will | |
18758 | + * raise a page fault (such as those set up by PaX, or the copy-on-write | |
18759 | + * mechanism). in effect it means that we do *not* need to flush the TLBs | |
18760 | + * for our target pages since their PTEs are simply not in the TLBs at all. | |
18761 | + | |
18762 | + * the best thing in omitting it is that we gain around 15-20% speed in the | |
18763 | + * fast path of the page fault handler and can get rid of tracing since we | |
18764 | + * can no longer flush unintended entries. | |
18765 | + */ | |
18766 | + "invlpg (%0)\n" | |
18767 | +#endif | |
18768 | + __copyuser_seg"testb $0,(%0)\n" | |
18769 | + "xorb %3,(%1)\n" | |
18770 | + : | |
18771 | + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER) | |
18772 | + : "memory", "cc"); | |
18773 | + pte_unmap_unlock(pte, ptl); | |
18774 | + up_read(&mm->mmap_sem); | |
18775 | + return 1; | |
18776 | +} | |
18777 | +#endif | |
18778 | + | |
18779 | /* | |
18780 | * Handle a spurious fault caused by a stale TLB entry. | |
18781 | * | |
18782 | @@ -943,6 +1174,9 @@ int show_unhandled_signals = 1; | |
18783 | static inline int | |
18784 | access_error(unsigned long error_code, struct vm_area_struct *vma) | |
18785 | { | |
18786 | + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC)) | |
18787 | + return 1; | |
18788 | + | |
18789 | if (error_code & PF_WRITE) { | |
18790 | /* write, present and write, not present: */ | |
18791 | if (unlikely(!(vma->vm_flags & VM_WRITE))) | |
18792 | @@ -976,19 +1210,33 @@ do_page_fault(struct pt_regs *regs, unsi | |
18793 | { | |
18794 | struct vm_area_struct *vma; | |
18795 | struct task_struct *tsk; | |
18796 | - unsigned long address; | |
18797 | struct mm_struct *mm; | |
18798 | int fault; | |
18799 | int write = error_code & PF_WRITE; | |
18800 | unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE | | |
18801 | (write ? FAULT_FLAG_WRITE : 0); | |
18802 | ||
18803 | + /* Get the faulting address: */ | |
18804 | + unsigned long address = read_cr2(); | |
18805 | + | |
18806 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
18807 | + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) { | |
18808 | + if (!search_exception_tables(regs->ip)) { | |
18809 | + bad_area_nosemaphore(regs, error_code, address); | |
18810 | + return; | |
18811 | + } | |
18812 | + if (address < PAX_USER_SHADOW_BASE) { | |
18813 | + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n"); | |
18814 | + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip); | |
18815 | + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR); | |
18816 | + } else | |
18817 | + address -= PAX_USER_SHADOW_BASE; | |
18818 | + } | |
18819 | +#endif | |
18820 | + | |
18821 | tsk = current; | |
18822 | mm = tsk->mm; | |
18823 | ||
18824 | - /* Get the faulting address: */ | |
18825 | - address = read_cr2(); | |
18826 | - | |
18827 | /* | |
18828 | * Detect and handle instructions that would cause a page fault for | |
18829 | * both a tracked kernel page and a userspace page. | |
18830 | @@ -1048,7 +1296,7 @@ do_page_fault(struct pt_regs *regs, unsi | |
18831 | * User-mode registers count as a user access even for any | |
18832 | * potential system fault or CPU buglet: | |
18833 | */ | |
18834 | - if (user_mode_vm(regs)) { | |
18835 | + if (user_mode(regs)) { | |
18836 | local_irq_enable(); | |
18837 | error_code |= PF_USER; | |
18838 | } else { | |
18839 | @@ -1103,6 +1351,11 @@ retry: | |
18840 | might_sleep(); | |
18841 | } | |
18842 | ||
18843 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) | |
18844 | + if (pax_handle_pageexec_fault(regs, mm, address, error_code)) | |
18845 | + return; | |
18846 | +#endif | |
18847 | + | |
18848 | vma = find_vma(mm, address); | |
18849 | if (unlikely(!vma)) { | |
18850 | bad_area(regs, error_code, address); | |
18851 | @@ -1114,18 +1367,24 @@ retry: | |
18852 | bad_area(regs, error_code, address); | |
18853 | return; | |
18854 | } | |
18855 | - if (error_code & PF_USER) { | |
18856 | - /* | |
18857 | - * Accessing the stack below %sp is always a bug. | |
18858 | - * The large cushion allows instructions like enter | |
18859 | - * and pusha to work. ("enter $65535, $31" pushes | |
18860 | - * 32 pointers and then decrements %sp by 65535.) | |
18861 | - */ | |
18862 | - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) { | |
18863 | - bad_area(regs, error_code, address); | |
18864 | - return; | |
18865 | - } | |
18866 | + /* | |
18867 | + * Accessing the stack below %sp is always a bug. | |
18868 | + * The large cushion allows instructions like enter | |
18869 | + * and pusha to work. ("enter $65535, $31" pushes | |
18870 | + * 32 pointers and then decrements %sp by 65535.) | |
18871 | + */ | |
18872 | + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) { | |
18873 | + bad_area(regs, error_code, address); | |
18874 | + return; | |
18875 | } | |
18876 | + | |
18877 | +#ifdef CONFIG_PAX_SEGMEXEC | |
18878 | + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) { | |
18879 | + bad_area(regs, error_code, address); | |
18880 | + return; | |
18881 | + } | |
18882 | +#endif | |
18883 | + | |
18884 | if (unlikely(expand_stack(vma, address))) { | |
18885 | bad_area(regs, error_code, address); | |
18886 | return; | |
18887 | @@ -1180,3 +1439,199 @@ good_area: | |
18888 | ||
18889 | up_read(&mm->mmap_sem); | |
18890 | } | |
18891 | + | |
18892 | +#ifdef CONFIG_PAX_EMUTRAMP | |
18893 | +static int pax_handle_fetch_fault_32(struct pt_regs *regs) | |
18894 | +{ | |
18895 | + int err; | |
18896 | + | |
18897 | + do { /* PaX: gcc trampoline emulation #1 */ | |
18898 | + unsigned char mov1, mov2; | |
18899 | + unsigned short jmp; | |
18900 | + unsigned int addr1, addr2; | |
18901 | + | |
18902 | +#ifdef CONFIG_X86_64 | |
18903 | + if ((regs->ip + 11) >> 32) | |
18904 | + break; | |
18905 | +#endif | |
18906 | + | |
18907 | + err = get_user(mov1, (unsigned char __user *)regs->ip); | |
18908 | + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1)); | |
18909 | + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5)); | |
18910 | + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6)); | |
18911 | + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10)); | |
18912 | + | |
18913 | + if (err) | |
18914 | + break; | |
18915 | + | |
18916 | + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) { | |
18917 | + regs->cx = addr1; | |
18918 | + regs->ax = addr2; | |
18919 | + regs->ip = addr2; | |
18920 | + return 2; | |
18921 | + } | |
18922 | + } while (0); | |
18923 | + | |
18924 | + do { /* PaX: gcc trampoline emulation #2 */ | |
18925 | + unsigned char mov, jmp; | |
18926 | + unsigned int addr1, addr2; | |
18927 | + | |
18928 | +#ifdef CONFIG_X86_64 | |
18929 | + if ((regs->ip + 9) >> 32) | |
18930 | + break; | |
18931 | +#endif | |
18932 | + | |
18933 | + err = get_user(mov, (unsigned char __user *)regs->ip); | |
18934 | + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1)); | |
18935 | + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5)); | |
18936 | + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6)); | |
18937 | + | |
18938 | + if (err) | |
18939 | + break; | |
18940 | + | |
18941 | + if (mov == 0xB9 && jmp == 0xE9) { | |
18942 | + regs->cx = addr1; | |
18943 | + regs->ip = (unsigned int)(regs->ip + addr2 + 10); | |
18944 | + return 2; | |
18945 | + } | |
18946 | + } while (0); | |
18947 | + | |
18948 | + return 1; /* PaX in action */ | |
18949 | +} | |
18950 | + | |
18951 | +#ifdef CONFIG_X86_64 | |
18952 | +static int pax_handle_fetch_fault_64(struct pt_regs *regs) | |
18953 | +{ | |
18954 | + int err; | |
18955 | + | |
18956 | + do { /* PaX: gcc trampoline emulation #1 */ | |
18957 | + unsigned short mov1, mov2, jmp1; | |
18958 | + unsigned char jmp2; | |
18959 | + unsigned int addr1; | |
18960 | + unsigned long addr2; | |
18961 | + | |
18962 | + err = get_user(mov1, (unsigned short __user *)regs->ip); | |
18963 | + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2)); | |
18964 | + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6)); | |
18965 | + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8)); | |
18966 | + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16)); | |
18967 | + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18)); | |
18968 | + | |
18969 | + if (err) | |
18970 | + break; | |
18971 | + | |
18972 | + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) { | |
18973 | + regs->r11 = addr1; | |
18974 | + regs->r10 = addr2; | |
18975 | + regs->ip = addr1; | |
18976 | + return 2; | |
18977 | + } | |
18978 | + } while (0); | |
18979 | + | |
18980 | + do { /* PaX: gcc trampoline emulation #2 */ | |
18981 | + unsigned short mov1, mov2, jmp1; | |
18982 | + unsigned char jmp2; | |
18983 | + unsigned long addr1, addr2; | |
18984 | + | |
18985 | + err = get_user(mov1, (unsigned short __user *)regs->ip); | |
18986 | + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2)); | |
18987 | + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10)); | |
18988 | + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12)); | |
18989 | + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20)); | |
18990 | + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22)); | |
18991 | + | |
18992 | + if (err) | |
18993 | + break; | |
18994 | + | |
18995 | + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) { | |
18996 | + regs->r11 = addr1; | |
18997 | + regs->r10 = addr2; | |
18998 | + regs->ip = addr1; | |
18999 | + return 2; | |
19000 | + } | |
19001 | + } while (0); | |
19002 | + | |
19003 | + return 1; /* PaX in action */ | |
19004 | +} | |
19005 | +#endif | |
19006 | + | |
19007 | +/* | |
19008 | + * PaX: decide what to do with offenders (regs->ip = fault address) | |
19009 | + * | |
19010 | + * returns 1 when task should be killed | |
19011 | + * 2 when gcc trampoline was detected | |
19012 | + */ | |
19013 | +static int pax_handle_fetch_fault(struct pt_regs *regs) | |
19014 | +{ | |
19015 | + if (v8086_mode(regs)) | |
19016 | + return 1; | |
19017 | + | |
19018 | + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP)) | |
19019 | + return 1; | |
19020 | + | |
19021 | +#ifdef CONFIG_X86_32 | |
19022 | + return pax_handle_fetch_fault_32(regs); | |
19023 | +#else | |
19024 | + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) | |
19025 | + return pax_handle_fetch_fault_32(regs); | |
19026 | + else | |
19027 | + return pax_handle_fetch_fault_64(regs); | |
19028 | +#endif | |
19029 | +} | |
19030 | +#endif | |
19031 | + | |
19032 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
19033 | +void pax_report_insns(void *pc, void *sp) | |
19034 | +{ | |
19035 | + long i; | |
19036 | + | |
19037 | + printk(KERN_ERR "PAX: bytes at PC: "); | |
19038 | + for (i = 0; i < 20; i++) { | |
19039 | + unsigned char c; | |
19040 | + if (get_user(c, (__force unsigned char __user *)pc+i)) | |
19041 | + printk(KERN_CONT "?? "); | |
19042 | + else | |
19043 | + printk(KERN_CONT "%02x ", c); | |
19044 | + } | |
19045 | + printk("\n"); | |
19046 | + | |
19047 | + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long)); | |
19048 | + for (i = -1; i < 80 / (long)sizeof(long); i++) { | |
19049 | + unsigned long c; | |
19050 | + if (get_user(c, (__force unsigned long __user *)sp+i)) | |
19051 | +#ifdef CONFIG_X86_32 | |
19052 | + printk(KERN_CONT "???????? "); | |
19053 | +#else | |
19054 | + printk(KERN_CONT "???????????????? "); | |
19055 | +#endif | |
19056 | + else | |
19057 | + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c); | |
19058 | + } | |
19059 | + printk("\n"); | |
19060 | +} | |
19061 | +#endif | |
19062 | + | |
19063 | +/** | |
19064 | + * probe_kernel_write(): safely attempt to write to a location | |
19065 | + * @dst: address to write to | |
19066 | + * @src: pointer to the data that shall be written | |
19067 | + * @size: size of the data chunk | |
19068 | + * | |
19069 | + * Safely write to address @dst from the buffer at @src. If a kernel fault | |
19070 | + * happens, handle that and return -EFAULT. | |
19071 | + */ | |
19072 | +long notrace probe_kernel_write(void *dst, const void *src, size_t size) | |
19073 | +{ | |
19074 | + long ret; | |
19075 | + mm_segment_t old_fs = get_fs(); | |
19076 | + | |
19077 | + set_fs(KERNEL_DS); | |
19078 | + pagefault_disable(); | |
19079 | + pax_open_kernel(); | |
19080 | + ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); | |
19081 | + pax_close_kernel(); | |
19082 | + pagefault_enable(); | |
19083 | + set_fs(old_fs); | |
19084 | + | |
19085 | + return ret ? -EFAULT : 0; | |
19086 | +} | |
19087 | diff -urNp linux-3.0.3/arch/x86/mm/gup.c linux-3.0.3/arch/x86/mm/gup.c | |
19088 | --- linux-3.0.3/arch/x86/mm/gup.c 2011-07-21 22:17:23.000000000 -0400 | |
19089 | +++ linux-3.0.3/arch/x86/mm/gup.c 2011-08-23 21:47:55.000000000 -0400 | |
19090 | @@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long | |
19091 | addr = start; | |
19092 | len = (unsigned long) nr_pages << PAGE_SHIFT; | |
19093 | end = start + len; | |
19094 | - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, | |
19095 | + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ, | |
19096 | (void __user *)start, len))) | |
19097 | return 0; | |
19098 | ||
19099 | diff -urNp linux-3.0.3/arch/x86/mm/highmem_32.c linux-3.0.3/arch/x86/mm/highmem_32.c | |
19100 | --- linux-3.0.3/arch/x86/mm/highmem_32.c 2011-07-21 22:17:23.000000000 -0400 | |
19101 | +++ linux-3.0.3/arch/x86/mm/highmem_32.c 2011-08-23 21:47:55.000000000 -0400 | |
19102 | @@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page | |
19103 | idx = type + KM_TYPE_NR*smp_processor_id(); | |
19104 | vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx); | |
19105 | BUG_ON(!pte_none(*(kmap_pte-idx))); | |
19106 | + | |
19107 | + pax_open_kernel(); | |
19108 | set_pte(kmap_pte-idx, mk_pte(page, prot)); | |
19109 | + pax_close_kernel(); | |
19110 | ||
19111 | return (void *)vaddr; | |
19112 | } | |
19113 | diff -urNp linux-3.0.3/arch/x86/mm/hugetlbpage.c linux-3.0.3/arch/x86/mm/hugetlbpage.c | |
19114 | --- linux-3.0.3/arch/x86/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400 | |
19115 | +++ linux-3.0.3/arch/x86/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400 | |
19116 | @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe | |
19117 | struct hstate *h = hstate_file(file); | |
19118 | struct mm_struct *mm = current->mm; | |
19119 | struct vm_area_struct *vma; | |
19120 | - unsigned long start_addr; | |
19121 | + unsigned long start_addr, pax_task_size = TASK_SIZE; | |
19122 | + | |
19123 | +#ifdef CONFIG_PAX_SEGMEXEC | |
19124 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
19125 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
19126 | +#endif | |
19127 | + | |
19128 | + pax_task_size -= PAGE_SIZE; | |
19129 | ||
19130 | if (len > mm->cached_hole_size) { | |
19131 | - start_addr = mm->free_area_cache; | |
19132 | + start_addr = mm->free_area_cache; | |
19133 | } else { | |
19134 | - start_addr = TASK_UNMAPPED_BASE; | |
19135 | - mm->cached_hole_size = 0; | |
19136 | + start_addr = mm->mmap_base; | |
19137 | + mm->cached_hole_size = 0; | |
19138 | } | |
19139 | ||
19140 | full_search: | |
19141 | @@ -280,26 +287,27 @@ full_search: | |
19142 | ||
19143 | for (vma = find_vma(mm, addr); ; vma = vma->vm_next) { | |
19144 | /* At this point: (!vma || addr < vma->vm_end). */ | |
19145 | - if (TASK_SIZE - len < addr) { | |
19146 | + if (pax_task_size - len < addr) { | |
19147 | /* | |
19148 | * Start a new search - just in case we missed | |
19149 | * some holes. | |
19150 | */ | |
19151 | - if (start_addr != TASK_UNMAPPED_BASE) { | |
19152 | - start_addr = TASK_UNMAPPED_BASE; | |
19153 | + if (start_addr != mm->mmap_base) { | |
19154 | + start_addr = mm->mmap_base; | |
19155 | mm->cached_hole_size = 0; | |
19156 | goto full_search; | |
19157 | } | |
19158 | return -ENOMEM; | |
19159 | } | |
19160 | - if (!vma || addr + len <= vma->vm_start) { | |
19161 | - mm->free_area_cache = addr + len; | |
19162 | - return addr; | |
19163 | - } | |
19164 | + if (check_heap_stack_gap(vma, addr, len)) | |
19165 | + break; | |
19166 | if (addr + mm->cached_hole_size < vma->vm_start) | |
19167 | mm->cached_hole_size = vma->vm_start - addr; | |
19168 | addr = ALIGN(vma->vm_end, huge_page_size(h)); | |
19169 | } | |
19170 | + | |
19171 | + mm->free_area_cache = addr + len; | |
19172 | + return addr; | |
19173 | } | |
19174 | ||
19175 | static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, | |
19176 | @@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe | |
19177 | { | |
19178 | struct hstate *h = hstate_file(file); | |
19179 | struct mm_struct *mm = current->mm; | |
19180 | - struct vm_area_struct *vma, *prev_vma; | |
19181 | - unsigned long base = mm->mmap_base, addr = addr0; | |
19182 | + struct vm_area_struct *vma; | |
19183 | + unsigned long base = mm->mmap_base, addr; | |
19184 | unsigned long largest_hole = mm->cached_hole_size; | |
19185 | - int first_time = 1; | |
19186 | ||
19187 | /* don't allow allocations above current base */ | |
19188 | if (mm->free_area_cache > base) | |
19189 | @@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe | |
19190 | largest_hole = 0; | |
19191 | mm->free_area_cache = base; | |
19192 | } | |
19193 | -try_again: | |
19194 | + | |
19195 | /* make sure it can fit in the remaining address space */ | |
19196 | if (mm->free_area_cache < len) | |
19197 | goto fail; | |
19198 | ||
19199 | /* either no address requested or can't fit in requested address hole */ | |
19200 | - addr = (mm->free_area_cache - len) & huge_page_mask(h); | |
19201 | + addr = (mm->free_area_cache - len); | |
19202 | do { | |
19203 | + addr &= huge_page_mask(h); | |
19204 | + vma = find_vma(mm, addr); | |
19205 | /* | |
19206 | * Lookup failure means no vma is above this address, | |
19207 | * i.e. return with success: | |
19208 | - */ | |
19209 | - if (!(vma = find_vma_prev(mm, addr, &prev_vma))) | |
19210 | - return addr; | |
19211 | - | |
19212 | - /* | |
19213 | * new region fits between prev_vma->vm_end and | |
19214 | * vma->vm_start, use it: | |
19215 | */ | |
19216 | - if (addr + len <= vma->vm_start && | |
19217 | - (!prev_vma || (addr >= prev_vma->vm_end))) { | |
19218 | + if (check_heap_stack_gap(vma, addr, len)) { | |
19219 | /* remember the address as a hint for next time */ | |
19220 | - mm->cached_hole_size = largest_hole; | |
19221 | - return (mm->free_area_cache = addr); | |
19222 | - } else { | |
19223 | - /* pull free_area_cache down to the first hole */ | |
19224 | - if (mm->free_area_cache == vma->vm_end) { | |
19225 | - mm->free_area_cache = vma->vm_start; | |
19226 | - mm->cached_hole_size = largest_hole; | |
19227 | - } | |
19228 | + mm->cached_hole_size = largest_hole; | |
19229 | + return (mm->free_area_cache = addr); | |
19230 | + } | |
19231 | + /* pull free_area_cache down to the first hole */ | |
19232 | + if (mm->free_area_cache == vma->vm_end) { | |
19233 | + mm->free_area_cache = vma->vm_start; | |
19234 | + mm->cached_hole_size = largest_hole; | |
19235 | } | |
19236 | ||
19237 | /* remember the largest hole we saw so far */ | |
19238 | if (addr + largest_hole < vma->vm_start) | |
19239 | - largest_hole = vma->vm_start - addr; | |
19240 | + largest_hole = vma->vm_start - addr; | |
19241 | ||
19242 | /* try just below the current vma->vm_start */ | |
19243 | - addr = (vma->vm_start - len) & huge_page_mask(h); | |
19244 | - } while (len <= vma->vm_start); | |
19245 | + addr = skip_heap_stack_gap(vma, len); | |
19246 | + } while (!IS_ERR_VALUE(addr)); | |
19247 | ||
19248 | fail: | |
19249 | /* | |
19250 | - * if hint left us with no space for the requested | |
19251 | - * mapping then try again: | |
19252 | - */ | |
19253 | - if (first_time) { | |
19254 | - mm->free_area_cache = base; | |
19255 | - largest_hole = 0; | |
19256 | - first_time = 0; | |
19257 | - goto try_again; | |
19258 | - } | |
19259 | - /* | |
19260 | * A failed mmap() very likely causes application failure, | |
19261 | * so fall back to the bottom-up function here. This scenario | |
19262 | * can happen with large stack limits and large mmap() | |
19263 | * allocations. | |
19264 | */ | |
19265 | - mm->free_area_cache = TASK_UNMAPPED_BASE; | |
19266 | + | |
19267 | +#ifdef CONFIG_PAX_SEGMEXEC | |
19268 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
19269 | + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE; | |
19270 | + else | |
19271 | +#endif | |
19272 | + | |
19273 | + mm->mmap_base = TASK_UNMAPPED_BASE; | |
19274 | + | |
19275 | +#ifdef CONFIG_PAX_RANDMMAP | |
19276 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
19277 | + mm->mmap_base += mm->delta_mmap; | |
19278 | +#endif | |
19279 | + | |
19280 | + mm->free_area_cache = mm->mmap_base; | |
19281 | mm->cached_hole_size = ~0UL; | |
19282 | addr = hugetlb_get_unmapped_area_bottomup(file, addr0, | |
19283 | len, pgoff, flags); | |
19284 | @@ -386,6 +392,7 @@ fail: | |
19285 | /* | |
19286 | * Restore the topdown base: | |
19287 | */ | |
19288 | + mm->mmap_base = base; | |
19289 | mm->free_area_cache = base; | |
19290 | mm->cached_hole_size = ~0UL; | |
19291 | ||
19292 | @@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f | |
19293 | struct hstate *h = hstate_file(file); | |
19294 | struct mm_struct *mm = current->mm; | |
19295 | struct vm_area_struct *vma; | |
19296 | + unsigned long pax_task_size = TASK_SIZE; | |
19297 | ||
19298 | if (len & ~huge_page_mask(h)) | |
19299 | return -EINVAL; | |
19300 | - if (len > TASK_SIZE) | |
19301 | + | |
19302 | +#ifdef CONFIG_PAX_SEGMEXEC | |
19303 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
19304 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
19305 | +#endif | |
19306 | + | |
19307 | + pax_task_size -= PAGE_SIZE; | |
19308 | + | |
19309 | + if (len > pax_task_size) | |
19310 | return -ENOMEM; | |
19311 | ||
19312 | if (flags & MAP_FIXED) { | |
19313 | @@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f | |
19314 | if (addr) { | |
19315 | addr = ALIGN(addr, huge_page_size(h)); | |
19316 | vma = find_vma(mm, addr); | |
19317 | - if (TASK_SIZE - len >= addr && | |
19318 | - (!vma || addr + len <= vma->vm_start)) | |
19319 | + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len)) | |
19320 | return addr; | |
19321 | } | |
19322 | if (mm->get_unmapped_area == arch_get_unmapped_area) | |
19323 | diff -urNp linux-3.0.3/arch/x86/mm/init_32.c linux-3.0.3/arch/x86/mm/init_32.c | |
19324 | --- linux-3.0.3/arch/x86/mm/init_32.c 2011-07-21 22:17:23.000000000 -0400 | |
19325 | +++ linux-3.0.3/arch/x86/mm/init_32.c 2011-08-23 21:47:55.000000000 -0400 | |
19326 | @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void) | |
19327 | } | |
19328 | ||
19329 | /* | |
19330 | - * Creates a middle page table and puts a pointer to it in the | |
19331 | - * given global directory entry. This only returns the gd entry | |
19332 | - * in non-PAE compilation mode, since the middle layer is folded. | |
19333 | - */ | |
19334 | -static pmd_t * __init one_md_table_init(pgd_t *pgd) | |
19335 | -{ | |
19336 | - pud_t *pud; | |
19337 | - pmd_t *pmd_table; | |
19338 | - | |
19339 | -#ifdef CONFIG_X86_PAE | |
19340 | - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) { | |
19341 | - if (after_bootmem) | |
19342 | - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE); | |
19343 | - else | |
19344 | - pmd_table = (pmd_t *)alloc_low_page(); | |
19345 | - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT); | |
19346 | - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT)); | |
19347 | - pud = pud_offset(pgd, 0); | |
19348 | - BUG_ON(pmd_table != pmd_offset(pud, 0)); | |
19349 | - | |
19350 | - return pmd_table; | |
19351 | - } | |
19352 | -#endif | |
19353 | - pud = pud_offset(pgd, 0); | |
19354 | - pmd_table = pmd_offset(pud, 0); | |
19355 | - | |
19356 | - return pmd_table; | |
19357 | -} | |
19358 | - | |
19359 | -/* | |
19360 | * Create a page table and place a pointer to it in a middle page | |
19361 | * directory entry: | |
19362 | */ | |
19363 | @@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini | |
19364 | page_table = (pte_t *)alloc_low_page(); | |
19365 | ||
19366 | paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT); | |
19367 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
19368 | + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE)); | |
19369 | +#else | |
19370 | set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE)); | |
19371 | +#endif | |
19372 | BUG_ON(page_table != pte_offset_kernel(pmd, 0)); | |
19373 | } | |
19374 | ||
19375 | return pte_offset_kernel(pmd, 0); | |
19376 | } | |
19377 | ||
19378 | +static pmd_t * __init one_md_table_init(pgd_t *pgd) | |
19379 | +{ | |
19380 | + pud_t *pud; | |
19381 | + pmd_t *pmd_table; | |
19382 | + | |
19383 | + pud = pud_offset(pgd, 0); | |
19384 | + pmd_table = pmd_offset(pud, 0); | |
19385 | + | |
19386 | + return pmd_table; | |
19387 | +} | |
19388 | + | |
19389 | pmd_t * __init populate_extra_pmd(unsigned long vaddr) | |
19390 | { | |
19391 | int pgd_idx = pgd_index(vaddr); | |
19392 | @@ -203,6 +188,7 @@ page_table_range_init(unsigned long star | |
19393 | int pgd_idx, pmd_idx; | |
19394 | unsigned long vaddr; | |
19395 | pgd_t *pgd; | |
19396 | + pud_t *pud; | |
19397 | pmd_t *pmd; | |
19398 | pte_t *pte = NULL; | |
19399 | ||
19400 | @@ -212,8 +198,13 @@ page_table_range_init(unsigned long star | |
19401 | pgd = pgd_base + pgd_idx; | |
19402 | ||
19403 | for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) { | |
19404 | - pmd = one_md_table_init(pgd); | |
19405 | - pmd = pmd + pmd_index(vaddr); | |
19406 | + pud = pud_offset(pgd, vaddr); | |
19407 | + pmd = pmd_offset(pud, vaddr); | |
19408 | + | |
19409 | +#ifdef CONFIG_X86_PAE | |
19410 | + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT); | |
19411 | +#endif | |
19412 | + | |
19413 | for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end); | |
19414 | pmd++, pmd_idx++) { | |
19415 | pte = page_table_kmap_check(one_page_table_init(pmd), | |
19416 | @@ -225,11 +216,20 @@ page_table_range_init(unsigned long star | |
19417 | } | |
19418 | } | |
19419 | ||
19420 | -static inline int is_kernel_text(unsigned long addr) | |
19421 | +static inline int is_kernel_text(unsigned long start, unsigned long end) | |
19422 | { | |
19423 | - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end) | |
19424 | - return 1; | |
19425 | - return 0; | |
19426 | + if ((start > ktla_ktva((unsigned long)_etext) || | |
19427 | + end <= ktla_ktva((unsigned long)_stext)) && | |
19428 | + (start > ktla_ktva((unsigned long)_einittext) || | |
19429 | + end <= ktla_ktva((unsigned long)_sinittext)) && | |
19430 | + | |
19431 | +#ifdef CONFIG_ACPI_SLEEP | |
19432 | + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) && | |
19433 | +#endif | |
19434 | + | |
19435 | + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000))) | |
19436 | + return 0; | |
19437 | + return 1; | |
19438 | } | |
19439 | ||
19440 | /* | |
19441 | @@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo | |
19442 | unsigned long last_map_addr = end; | |
19443 | unsigned long start_pfn, end_pfn; | |
19444 | pgd_t *pgd_base = swapper_pg_dir; | |
19445 | - int pgd_idx, pmd_idx, pte_ofs; | |
19446 | + unsigned int pgd_idx, pmd_idx, pte_ofs; | |
19447 | unsigned long pfn; | |
19448 | pgd_t *pgd; | |
19449 | + pud_t *pud; | |
19450 | pmd_t *pmd; | |
19451 | pte_t *pte; | |
19452 | unsigned pages_2m, pages_4k; | |
19453 | @@ -281,8 +282,13 @@ repeat: | |
19454 | pfn = start_pfn; | |
19455 | pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET); | |
19456 | pgd = pgd_base + pgd_idx; | |
19457 | - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) { | |
19458 | - pmd = one_md_table_init(pgd); | |
19459 | + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) { | |
19460 | + pud = pud_offset(pgd, 0); | |
19461 | + pmd = pmd_offset(pud, 0); | |
19462 | + | |
19463 | +#ifdef CONFIG_X86_PAE | |
19464 | + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT); | |
19465 | +#endif | |
19466 | ||
19467 | if (pfn >= end_pfn) | |
19468 | continue; | |
19469 | @@ -294,14 +300,13 @@ repeat: | |
19470 | #endif | |
19471 | for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn; | |
19472 | pmd++, pmd_idx++) { | |
19473 | - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET; | |
19474 | + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET; | |
19475 | ||
19476 | /* | |
19477 | * Map with big pages if possible, otherwise | |
19478 | * create normal page tables: | |
19479 | */ | |
19480 | if (use_pse) { | |
19481 | - unsigned int addr2; | |
19482 | pgprot_t prot = PAGE_KERNEL_LARGE; | |
19483 | /* | |
19484 | * first pass will use the same initial | |
19485 | @@ -311,11 +316,7 @@ repeat: | |
19486 | __pgprot(PTE_IDENT_ATTR | | |
19487 | _PAGE_PSE); | |
19488 | ||
19489 | - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE + | |
19490 | - PAGE_OFFSET + PAGE_SIZE-1; | |
19491 | - | |
19492 | - if (is_kernel_text(addr) || | |
19493 | - is_kernel_text(addr2)) | |
19494 | + if (is_kernel_text(address, address + PMD_SIZE)) | |
19495 | prot = PAGE_KERNEL_LARGE_EXEC; | |
19496 | ||
19497 | pages_2m++; | |
19498 | @@ -332,7 +333,7 @@ repeat: | |
19499 | pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET); | |
19500 | pte += pte_ofs; | |
19501 | for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn; | |
19502 | - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) { | |
19503 | + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) { | |
19504 | pgprot_t prot = PAGE_KERNEL; | |
19505 | /* | |
19506 | * first pass will use the same initial | |
19507 | @@ -340,7 +341,7 @@ repeat: | |
19508 | */ | |
19509 | pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR); | |
19510 | ||
19511 | - if (is_kernel_text(addr)) | |
19512 | + if (is_kernel_text(address, address + PAGE_SIZE)) | |
19513 | prot = PAGE_KERNEL_EXEC; | |
19514 | ||
19515 | pages_4k++; | |
19516 | @@ -472,7 +473,7 @@ void __init native_pagetable_setup_start | |
19517 | ||
19518 | pud = pud_offset(pgd, va); | |
19519 | pmd = pmd_offset(pud, va); | |
19520 | - if (!pmd_present(*pmd)) | |
19521 | + if (!pmd_present(*pmd) || pmd_huge(*pmd)) | |
19522 | break; | |
19523 | ||
19524 | pte = pte_offset_kernel(pmd, va); | |
19525 | @@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran | |
19526 | ||
19527 | static void __init pagetable_init(void) | |
19528 | { | |
19529 | - pgd_t *pgd_base = swapper_pg_dir; | |
19530 | - | |
19531 | - permanent_kmaps_init(pgd_base); | |
19532 | + permanent_kmaps_init(swapper_pg_dir); | |
19533 | } | |
19534 | ||
19535 | -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP); | |
19536 | +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP); | |
19537 | EXPORT_SYMBOL_GPL(__supported_pte_mask); | |
19538 | ||
19539 | /* user-defined highmem size */ | |
19540 | @@ -757,6 +756,12 @@ void __init mem_init(void) | |
19541 | ||
19542 | pci_iommu_alloc(); | |
19543 | ||
19544 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
19545 | + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY, | |
19546 | + swapper_pg_dir + KERNEL_PGD_BOUNDARY, | |
19547 | + KERNEL_PGD_PTRS); | |
19548 | +#endif | |
19549 | + | |
19550 | #ifdef CONFIG_FLATMEM | |
19551 | BUG_ON(!mem_map); | |
19552 | #endif | |
19553 | @@ -774,7 +779,7 @@ void __init mem_init(void) | |
19554 | set_highmem_pages_init(); | |
19555 | ||
19556 | codesize = (unsigned long) &_etext - (unsigned long) &_text; | |
19557 | - datasize = (unsigned long) &_edata - (unsigned long) &_etext; | |
19558 | + datasize = (unsigned long) &_edata - (unsigned long) &_sdata; | |
19559 | initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin; | |
19560 | ||
19561 | printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, " | |
19562 | @@ -815,10 +820,10 @@ void __init mem_init(void) | |
19563 | ((unsigned long)&__init_end - | |
19564 | (unsigned long)&__init_begin) >> 10, | |
19565 | ||
19566 | - (unsigned long)&_etext, (unsigned long)&_edata, | |
19567 | - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10, | |
19568 | + (unsigned long)&_sdata, (unsigned long)&_edata, | |
19569 | + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10, | |
19570 | ||
19571 | - (unsigned long)&_text, (unsigned long)&_etext, | |
19572 | + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext), | |
19573 | ((unsigned long)&_etext - (unsigned long)&_text) >> 10); | |
19574 | ||
19575 | /* | |
19576 | @@ -896,6 +901,7 @@ void set_kernel_text_rw(void) | |
19577 | if (!kernel_set_to_readonly) | |
19578 | return; | |
19579 | ||
19580 | + start = ktla_ktva(start); | |
19581 | pr_debug("Set kernel text: %lx - %lx for read write\n", | |
19582 | start, start+size); | |
19583 | ||
19584 | @@ -910,6 +916,7 @@ void set_kernel_text_ro(void) | |
19585 | if (!kernel_set_to_readonly) | |
19586 | return; | |
19587 | ||
19588 | + start = ktla_ktva(start); | |
19589 | pr_debug("Set kernel text: %lx - %lx for read only\n", | |
19590 | start, start+size); | |
19591 | ||
19592 | @@ -938,6 +945,7 @@ void mark_rodata_ro(void) | |
19593 | unsigned long start = PFN_ALIGN(_text); | |
19594 | unsigned long size = PFN_ALIGN(_etext) - start; | |
19595 | ||
19596 | + start = ktla_ktva(start); | |
19597 | set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT); | |
19598 | printk(KERN_INFO "Write protecting the kernel text: %luk\n", | |
19599 | size >> 10); | |
19600 | diff -urNp linux-3.0.3/arch/x86/mm/init_64.c linux-3.0.3/arch/x86/mm/init_64.c | |
19601 | --- linux-3.0.3/arch/x86/mm/init_64.c 2011-07-21 22:17:23.000000000 -0400 | |
19602 | +++ linux-3.0.3/arch/x86/mm/init_64.c 2011-08-23 21:47:55.000000000 -0400 | |
19603 | @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpa | |
19604 | * around without checking the pgd every time. | |
19605 | */ | |
19606 | ||
19607 | -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP; | |
19608 | +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP); | |
19609 | EXPORT_SYMBOL_GPL(__supported_pte_mask); | |
19610 | ||
19611 | int force_personality32; | |
19612 | @@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long star | |
19613 | ||
19614 | for (address = start; address <= end; address += PGDIR_SIZE) { | |
19615 | const pgd_t *pgd_ref = pgd_offset_k(address); | |
19616 | + | |
19617 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
19618 | + unsigned long cpu; | |
19619 | +#else | |
19620 | struct page *page; | |
19621 | +#endif | |
19622 | ||
19623 | if (pgd_none(*pgd_ref)) | |
19624 | continue; | |
19625 | ||
19626 | spin_lock(&pgd_lock); | |
19627 | + | |
19628 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
19629 | + for (cpu = 0; cpu < NR_CPUS; ++cpu) { | |
19630 | + pgd_t *pgd = pgd_offset_cpu(cpu, address); | |
19631 | +#else | |
19632 | list_for_each_entry(page, &pgd_list, lru) { | |
19633 | pgd_t *pgd; | |
19634 | spinlock_t *pgt_lock; | |
19635 | @@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long star | |
19636 | /* the pgt_lock only for Xen */ | |
19637 | pgt_lock = &pgd_page_get_mm(page)->page_table_lock; | |
19638 | spin_lock(pgt_lock); | |
19639 | +#endif | |
19640 | ||
19641 | if (pgd_none(*pgd)) | |
19642 | set_pgd(pgd, *pgd_ref); | |
19643 | @@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long star | |
19644 | BUG_ON(pgd_page_vaddr(*pgd) | |
19645 | != pgd_page_vaddr(*pgd_ref)); | |
19646 | ||
19647 | +#ifndef CONFIG_PAX_PER_CPU_PGD | |
19648 | spin_unlock(pgt_lock); | |
19649 | +#endif | |
19650 | + | |
19651 | } | |
19652 | spin_unlock(&pgd_lock); | |
19653 | } | |
19654 | @@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, | |
19655 | pmd = fill_pmd(pud, vaddr); | |
19656 | pte = fill_pte(pmd, vaddr); | |
19657 | ||
19658 | + pax_open_kernel(); | |
19659 | set_pte(pte, new_pte); | |
19660 | + pax_close_kernel(); | |
19661 | ||
19662 | /* | |
19663 | * It's enough to flush this one mapping. | |
19664 | @@ -262,14 +278,12 @@ static void __init __init_extra_mapping( | |
19665 | pgd = pgd_offset_k((unsigned long)__va(phys)); | |
19666 | if (pgd_none(*pgd)) { | |
19667 | pud = (pud_t *) spp_getpage(); | |
19668 | - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE | | |
19669 | - _PAGE_USER)); | |
19670 | + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE)); | |
19671 | } | |
19672 | pud = pud_offset(pgd, (unsigned long)__va(phys)); | |
19673 | if (pud_none(*pud)) { | |
19674 | pmd = (pmd_t *) spp_getpage(); | |
19675 | - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE | | |
19676 | - _PAGE_USER)); | |
19677 | + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE)); | |
19678 | } | |
19679 | pmd = pmd_offset(pud, phys); | |
19680 | BUG_ON(!pmd_none(*pmd)); | |
19681 | @@ -693,6 +707,12 @@ void __init mem_init(void) | |
19682 | ||
19683 | pci_iommu_alloc(); | |
19684 | ||
19685 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
19686 | + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY, | |
19687 | + swapper_pg_dir + KERNEL_PGD_BOUNDARY, | |
19688 | + KERNEL_PGD_PTRS); | |
19689 | +#endif | |
19690 | + | |
19691 | /* clear_bss() already clear the empty_zero_page */ | |
19692 | ||
19693 | reservedpages = 0; | |
19694 | @@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr) | |
19695 | static struct vm_area_struct gate_vma = { | |
19696 | .vm_start = VSYSCALL_START, | |
19697 | .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE), | |
19698 | - .vm_page_prot = PAGE_READONLY_EXEC, | |
19699 | - .vm_flags = VM_READ | VM_EXEC | |
19700 | + .vm_page_prot = PAGE_READONLY, | |
19701 | + .vm_flags = VM_READ | |
19702 | }; | |
19703 | ||
19704 | struct vm_area_struct *get_gate_vma(struct mm_struct *mm) | |
19705 | @@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long add | |
19706 | ||
19707 | const char *arch_vma_name(struct vm_area_struct *vma) | |
19708 | { | |
19709 | - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso) | |
19710 | + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso) | |
19711 | return "[vdso]"; | |
19712 | if (vma == &gate_vma) | |
19713 | return "[vsyscall]"; | |
19714 | diff -urNp linux-3.0.3/arch/x86/mm/init.c linux-3.0.3/arch/x86/mm/init.c | |
19715 | --- linux-3.0.3/arch/x86/mm/init.c 2011-07-21 22:17:23.000000000 -0400 | |
19716 | +++ linux-3.0.3/arch/x86/mm/init.c 2011-08-23 21:48:14.000000000 -0400 | |
19717 | @@ -31,7 +31,7 @@ int direct_gbpages | |
19718 | static void __init find_early_table_space(unsigned long end, int use_pse, | |
19719 | int use_gbpages) | |
19720 | { | |
19721 | - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end; | |
19722 | + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end; | |
19723 | phys_addr_t base; | |
19724 | ||
19725 | puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; | |
19726 | @@ -313,12 +313,34 @@ unsigned long __init_refok init_memory_m | |
19727 | */ | |
19728 | int devmem_is_allowed(unsigned long pagenr) | |
19729 | { | |
19730 | - if (pagenr <= 256) | |
19731 | +#ifdef CONFIG_GRKERNSEC_KMEM | |
19732 | + /* allow BDA */ | |
19733 | + if (!pagenr) | |
19734 | + return 1; | |
19735 | + /* allow EBDA */ | |
19736 | + if ((0x9f000 >> PAGE_SHIFT) == pagenr) | |
19737 | + return 1; | |
19738 | +#else | |
19739 | + if (!pagenr) | |
19740 | + return 1; | |
19741 | +#ifdef CONFIG_VM86 | |
19742 | + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT)) | |
19743 | + return 1; | |
19744 | +#endif | |
19745 | +#endif | |
19746 | + | |
19747 | + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT)) | |
19748 | return 1; | |
19749 | +#ifdef CONFIG_GRKERNSEC_KMEM | |
19750 | + /* throw out everything else below 1MB */ | |
19751 | + if (pagenr <= 256) | |
19752 | + return 0; | |
19753 | +#endif | |
19754 | if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) | |
19755 | return 0; | |
19756 | if (!page_is_ram(pagenr)) | |
19757 | return 1; | |
19758 | + | |
19759 | return 0; | |
19760 | } | |
19761 | ||
19762 | @@ -373,6 +395,86 @@ void free_init_pages(char *what, unsigne | |
19763 | ||
19764 | void free_initmem(void) | |
19765 | { | |
19766 | + | |
19767 | +#ifdef CONFIG_PAX_KERNEXEC | |
19768 | +#ifdef CONFIG_X86_32 | |
19769 | + /* PaX: limit KERNEL_CS to actual size */ | |
19770 | + unsigned long addr, limit; | |
19771 | + struct desc_struct d; | |
19772 | + int cpu; | |
19773 | + | |
19774 | + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext; | |
19775 | + limit = (limit - 1UL) >> PAGE_SHIFT; | |
19776 | + | |
19777 | + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE); | |
19778 | + for (cpu = 0; cpu < NR_CPUS; cpu++) { | |
19779 | + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC); | |
19780 | + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S); | |
19781 | + } | |
19782 | + | |
19783 | + /* PaX: make KERNEL_CS read-only */ | |
19784 | + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text)); | |
19785 | + if (!paravirt_enabled()) | |
19786 | + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT); | |
19787 | +/* | |
19788 | + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) { | |
19789 | + pgd = pgd_offset_k(addr); | |
19790 | + pud = pud_offset(pgd, addr); | |
19791 | + pmd = pmd_offset(pud, addr); | |
19792 | + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW)); | |
19793 | + } | |
19794 | +*/ | |
19795 | +#ifdef CONFIG_X86_PAE | |
19796 | + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT); | |
19797 | +/* | |
19798 | + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) { | |
19799 | + pgd = pgd_offset_k(addr); | |
19800 | + pud = pud_offset(pgd, addr); | |
19801 | + pmd = pmd_offset(pud, addr); | |
19802 | + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask))); | |
19803 | + } | |
19804 | +*/ | |
19805 | +#endif | |
19806 | + | |
19807 | +#ifdef CONFIG_MODULES | |
19808 | + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT); | |
19809 | +#endif | |
19810 | + | |
19811 | +#else | |
19812 | + pgd_t *pgd; | |
19813 | + pud_t *pud; | |
19814 | + pmd_t *pmd; | |
19815 | + unsigned long addr, end; | |
19816 | + | |
19817 | + /* PaX: make kernel code/rodata read-only, rest non-executable */ | |
19818 | + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) { | |
19819 | + pgd = pgd_offset_k(addr); | |
19820 | + pud = pud_offset(pgd, addr); | |
19821 | + pmd = pmd_offset(pud, addr); | |
19822 | + if (!pmd_present(*pmd)) | |
19823 | + continue; | |
19824 | + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata) | |
19825 | + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW)); | |
19826 | + else | |
19827 | + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask))); | |
19828 | + } | |
19829 | + | |
19830 | + addr = (unsigned long)__va(__pa(__START_KERNEL_map)); | |
19831 | + end = addr + KERNEL_IMAGE_SIZE; | |
19832 | + for (; addr < end; addr += PMD_SIZE) { | |
19833 | + pgd = pgd_offset_k(addr); | |
19834 | + pud = pud_offset(pgd, addr); | |
19835 | + pmd = pmd_offset(pud, addr); | |
19836 | + if (!pmd_present(*pmd)) | |
19837 | + continue; | |
19838 | + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata))) | |
19839 | + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW)); | |
19840 | + } | |
19841 | +#endif | |
19842 | + | |
19843 | + flush_tlb_all(); | |
19844 | +#endif | |
19845 | + | |
19846 | free_init_pages("unused kernel memory", | |
19847 | (unsigned long)(&__init_begin), | |
19848 | (unsigned long)(&__init_end)); | |
19849 | diff -urNp linux-3.0.3/arch/x86/mm/iomap_32.c linux-3.0.3/arch/x86/mm/iomap_32.c | |
19850 | --- linux-3.0.3/arch/x86/mm/iomap_32.c 2011-07-21 22:17:23.000000000 -0400 | |
19851 | +++ linux-3.0.3/arch/x86/mm/iomap_32.c 2011-08-23 21:47:55.000000000 -0400 | |
19852 | @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long | |
19853 | type = kmap_atomic_idx_push(); | |
19854 | idx = type + KM_TYPE_NR * smp_processor_id(); | |
19855 | vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx); | |
19856 | + | |
19857 | + pax_open_kernel(); | |
19858 | set_pte(kmap_pte - idx, pfn_pte(pfn, prot)); | |
19859 | + pax_close_kernel(); | |
19860 | + | |
19861 | arch_flush_lazy_mmu_mode(); | |
19862 | ||
19863 | return (void *)vaddr; | |
19864 | diff -urNp linux-3.0.3/arch/x86/mm/ioremap.c linux-3.0.3/arch/x86/mm/ioremap.c | |
19865 | --- linux-3.0.3/arch/x86/mm/ioremap.c 2011-07-21 22:17:23.000000000 -0400 | |
19866 | +++ linux-3.0.3/arch/x86/mm/ioremap.c 2011-08-23 21:47:55.000000000 -0400 | |
19867 | @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(re | |
19868 | for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) { | |
19869 | int is_ram = page_is_ram(pfn); | |
19870 | ||
19871 | - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn))) | |
19872 | + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn)))) | |
19873 | return NULL; | |
19874 | WARN_ON_ONCE(is_ram); | |
19875 | } | |
19876 | @@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se | |
19877 | early_param("early_ioremap_debug", early_ioremap_debug_setup); | |
19878 | ||
19879 | static __initdata int after_paging_init; | |
19880 | -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss; | |
19881 | +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE); | |
19882 | ||
19883 | static inline pmd_t * __init early_ioremap_pmd(unsigned long addr) | |
19884 | { | |
19885 | @@ -381,8 +381,7 @@ void __init early_ioremap_init(void) | |
19886 | slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i); | |
19887 | ||
19888 | pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)); | |
19889 | - memset(bm_pte, 0, sizeof(bm_pte)); | |
19890 | - pmd_populate_kernel(&init_mm, pmd, bm_pte); | |
19891 | + pmd_populate_user(&init_mm, pmd, bm_pte); | |
19892 | ||
19893 | /* | |
19894 | * The boot-ioremap range spans multiple pmds, for which | |
19895 | diff -urNp linux-3.0.3/arch/x86/mm/kmemcheck/kmemcheck.c linux-3.0.3/arch/x86/mm/kmemcheck/kmemcheck.c | |
19896 | --- linux-3.0.3/arch/x86/mm/kmemcheck/kmemcheck.c 2011-07-21 22:17:23.000000000 -0400 | |
19897 | +++ linux-3.0.3/arch/x86/mm/kmemcheck/kmemcheck.c 2011-08-23 21:47:55.000000000 -0400 | |
19898 | @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg | |
19899 | * memory (e.g. tracked pages)? For now, we need this to avoid | |
19900 | * invoking kmemcheck for PnP BIOS calls. | |
19901 | */ | |
19902 | - if (regs->flags & X86_VM_MASK) | |
19903 | + if (v8086_mode(regs)) | |
19904 | return false; | |
19905 | - if (regs->cs != __KERNEL_CS) | |
19906 | + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS) | |
19907 | return false; | |
19908 | ||
19909 | pte = kmemcheck_pte_lookup(address); | |
19910 | diff -urNp linux-3.0.3/arch/x86/mm/mmap.c linux-3.0.3/arch/x86/mm/mmap.c | |
19911 | --- linux-3.0.3/arch/x86/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
19912 | +++ linux-3.0.3/arch/x86/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400 | |
19913 | @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size | |
19914 | * Leave an at least ~128 MB hole with possible stack randomization. | |
19915 | */ | |
19916 | #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size()) | |
19917 | -#define MAX_GAP (TASK_SIZE/6*5) | |
19918 | +#define MAX_GAP (pax_task_size/6*5) | |
19919 | ||
19920 | /* | |
19921 | * True on X86_32 or when emulating IA32 on X86_64 | |
19922 | @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void) | |
19923 | return rnd << PAGE_SHIFT; | |
19924 | } | |
19925 | ||
19926 | -static unsigned long mmap_base(void) | |
19927 | +static unsigned long mmap_base(struct mm_struct *mm) | |
19928 | { | |
19929 | unsigned long gap = rlimit(RLIMIT_STACK); | |
19930 | + unsigned long pax_task_size = TASK_SIZE; | |
19931 | + | |
19932 | +#ifdef CONFIG_PAX_SEGMEXEC | |
19933 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
19934 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
19935 | +#endif | |
19936 | ||
19937 | if (gap < MIN_GAP) | |
19938 | gap = MIN_GAP; | |
19939 | else if (gap > MAX_GAP) | |
19940 | gap = MAX_GAP; | |
19941 | ||
19942 | - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd()); | |
19943 | + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd()); | |
19944 | } | |
19945 | ||
19946 | /* | |
19947 | * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64 | |
19948 | * does, but not when emulating X86_32 | |
19949 | */ | |
19950 | -static unsigned long mmap_legacy_base(void) | |
19951 | +static unsigned long mmap_legacy_base(struct mm_struct *mm) | |
19952 | { | |
19953 | - if (mmap_is_ia32()) | |
19954 | + if (mmap_is_ia32()) { | |
19955 | + | |
19956 | +#ifdef CONFIG_PAX_SEGMEXEC | |
19957 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
19958 | + return SEGMEXEC_TASK_UNMAPPED_BASE; | |
19959 | + else | |
19960 | +#endif | |
19961 | + | |
19962 | return TASK_UNMAPPED_BASE; | |
19963 | - else | |
19964 | + } else | |
19965 | return TASK_UNMAPPED_BASE + mmap_rnd(); | |
19966 | } | |
19967 | ||
19968 | @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo | |
19969 | void arch_pick_mmap_layout(struct mm_struct *mm) | |
19970 | { | |
19971 | if (mmap_is_legacy()) { | |
19972 | - mm->mmap_base = mmap_legacy_base(); | |
19973 | + mm->mmap_base = mmap_legacy_base(mm); | |
19974 | + | |
19975 | +#ifdef CONFIG_PAX_RANDMMAP | |
19976 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
19977 | + mm->mmap_base += mm->delta_mmap; | |
19978 | +#endif | |
19979 | + | |
19980 | mm->get_unmapped_area = arch_get_unmapped_area; | |
19981 | mm->unmap_area = arch_unmap_area; | |
19982 | } else { | |
19983 | - mm->mmap_base = mmap_base(); | |
19984 | + mm->mmap_base = mmap_base(mm); | |
19985 | + | |
19986 | +#ifdef CONFIG_PAX_RANDMMAP | |
19987 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
19988 | + mm->mmap_base -= mm->delta_mmap + mm->delta_stack; | |
19989 | +#endif | |
19990 | + | |
19991 | mm->get_unmapped_area = arch_get_unmapped_area_topdown; | |
19992 | mm->unmap_area = arch_unmap_area_topdown; | |
19993 | } | |
19994 | diff -urNp linux-3.0.3/arch/x86/mm/mmio-mod.c linux-3.0.3/arch/x86/mm/mmio-mod.c | |
19995 | --- linux-3.0.3/arch/x86/mm/mmio-mod.c 2011-07-21 22:17:23.000000000 -0400 | |
19996 | +++ linux-3.0.3/arch/x86/mm/mmio-mod.c 2011-08-23 21:47:55.000000000 -0400 | |
19997 | @@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, s | |
19998 | break; | |
19999 | default: | |
20000 | { | |
20001 | - unsigned char *ip = (unsigned char *)instptr; | |
20002 | + unsigned char *ip = (unsigned char *)ktla_ktva(instptr); | |
20003 | my_trace->opcode = MMIO_UNKNOWN_OP; | |
20004 | my_trace->width = 0; | |
20005 | my_trace->value = (*ip) << 16 | *(ip + 1) << 8 | | |
20006 | @@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, | |
20007 | static void ioremap_trace_core(resource_size_t offset, unsigned long size, | |
20008 | void __iomem *addr) | |
20009 | { | |
20010 | - static atomic_t next_id; | |
20011 | + static atomic_unchecked_t next_id; | |
20012 | struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL); | |
20013 | /* These are page-unaligned. */ | |
20014 | struct mmiotrace_map map = { | |
20015 | @@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_ | |
20016 | .private = trace | |
20017 | }, | |
20018 | .phys = offset, | |
20019 | - .id = atomic_inc_return(&next_id) | |
20020 | + .id = atomic_inc_return_unchecked(&next_id) | |
20021 | }; | |
20022 | map.map_id = trace->id; | |
20023 | ||
20024 | diff -urNp linux-3.0.3/arch/x86/mm/pageattr.c linux-3.0.3/arch/x86/mm/pageattr.c | |
20025 | --- linux-3.0.3/arch/x86/mm/pageattr.c 2011-07-21 22:17:23.000000000 -0400 | |
20026 | +++ linux-3.0.3/arch/x86/mm/pageattr.c 2011-08-23 21:47:55.000000000 -0400 | |
20027 | @@ -261,7 +261,7 @@ static inline pgprot_t static_protection | |
20028 | */ | |
20029 | #ifdef CONFIG_PCI_BIOS | |
20030 | if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT)) | |
20031 | - pgprot_val(forbidden) |= _PAGE_NX; | |
20032 | + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask; | |
20033 | #endif | |
20034 | ||
20035 | /* | |
20036 | @@ -269,9 +269,10 @@ static inline pgprot_t static_protection | |
20037 | * Does not cover __inittext since that is gone later on. On | |
20038 | * 64bit we do not enforce !NX on the low mapping | |
20039 | */ | |
20040 | - if (within(address, (unsigned long)_text, (unsigned long)_etext)) | |
20041 | - pgprot_val(forbidden) |= _PAGE_NX; | |
20042 | + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext))) | |
20043 | + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask; | |
20044 | ||
20045 | +#ifdef CONFIG_DEBUG_RODATA | |
20046 | /* | |
20047 | * The .rodata section needs to be read-only. Using the pfn | |
20048 | * catches all aliases. | |
20049 | @@ -279,6 +280,7 @@ static inline pgprot_t static_protection | |
20050 | if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT, | |
20051 | __pa((unsigned long)__end_rodata) >> PAGE_SHIFT)) | |
20052 | pgprot_val(forbidden) |= _PAGE_RW; | |
20053 | +#endif | |
20054 | ||
20055 | #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA) | |
20056 | /* | |
20057 | @@ -317,6 +319,13 @@ static inline pgprot_t static_protection | |
20058 | } | |
20059 | #endif | |
20060 | ||
20061 | +#ifdef CONFIG_PAX_KERNEXEC | |
20062 | + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) { | |
20063 | + pgprot_val(forbidden) |= _PAGE_RW; | |
20064 | + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask; | |
20065 | + } | |
20066 | +#endif | |
20067 | + | |
20068 | prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden)); | |
20069 | ||
20070 | return prot; | |
20071 | @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address); | |
20072 | static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte) | |
20073 | { | |
20074 | /* change init_mm */ | |
20075 | + pax_open_kernel(); | |
20076 | set_pte_atomic(kpte, pte); | |
20077 | + | |
20078 | #ifdef CONFIG_X86_32 | |
20079 | if (!SHARED_KERNEL_PMD) { | |
20080 | + | |
20081 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
20082 | + unsigned long cpu; | |
20083 | +#else | |
20084 | struct page *page; | |
20085 | +#endif | |
20086 | ||
20087 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
20088 | + for (cpu = 0; cpu < NR_CPUS; ++cpu) { | |
20089 | + pgd_t *pgd = get_cpu_pgd(cpu); | |
20090 | +#else | |
20091 | list_for_each_entry(page, &pgd_list, lru) { | |
20092 | - pgd_t *pgd; | |
20093 | + pgd_t *pgd = (pgd_t *)page_address(page); | |
20094 | +#endif | |
20095 | + | |
20096 | pud_t *pud; | |
20097 | pmd_t *pmd; | |
20098 | ||
20099 | - pgd = (pgd_t *)page_address(page) + pgd_index(address); | |
20100 | + pgd += pgd_index(address); | |
20101 | pud = pud_offset(pgd, address); | |
20102 | pmd = pmd_offset(pud, address); | |
20103 | set_pte_atomic((pte_t *)pmd, pte); | |
20104 | } | |
20105 | } | |
20106 | #endif | |
20107 | + pax_close_kernel(); | |
20108 | } | |
20109 | ||
20110 | static int | |
20111 | diff -urNp linux-3.0.3/arch/x86/mm/pageattr-test.c linux-3.0.3/arch/x86/mm/pageattr-test.c | |
20112 | --- linux-3.0.3/arch/x86/mm/pageattr-test.c 2011-07-21 22:17:23.000000000 -0400 | |
20113 | +++ linux-3.0.3/arch/x86/mm/pageattr-test.c 2011-08-23 21:47:55.000000000 -0400 | |
20114 | @@ -36,7 +36,7 @@ enum { | |
20115 | ||
20116 | static int pte_testbit(pte_t pte) | |
20117 | { | |
20118 | - return pte_flags(pte) & _PAGE_UNUSED1; | |
20119 | + return pte_flags(pte) & _PAGE_CPA_TEST; | |
20120 | } | |
20121 | ||
20122 | struct split_state { | |
20123 | diff -urNp linux-3.0.3/arch/x86/mm/pat.c linux-3.0.3/arch/x86/mm/pat.c | |
20124 | --- linux-3.0.3/arch/x86/mm/pat.c 2011-07-21 22:17:23.000000000 -0400 | |
20125 | +++ linux-3.0.3/arch/x86/mm/pat.c 2011-08-23 21:47:55.000000000 -0400 | |
20126 | @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end) | |
20127 | ||
20128 | if (!entry) { | |
20129 | printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n", | |
20130 | - current->comm, current->pid, start, end); | |
20131 | + current->comm, task_pid_nr(current), start, end); | |
20132 | return -EINVAL; | |
20133 | } | |
20134 | ||
20135 | @@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig | |
20136 | while (cursor < to) { | |
20137 | if (!devmem_is_allowed(pfn)) { | |
20138 | printk(KERN_INFO | |
20139 | - "Program %s tried to access /dev/mem between %Lx->%Lx.\n", | |
20140 | - current->comm, from, to); | |
20141 | + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n", | |
20142 | + current->comm, from, to, cursor); | |
20143 | return 0; | |
20144 | } | |
20145 | cursor += PAGE_SIZE; | |
20146 | @@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un | |
20147 | printk(KERN_INFO | |
20148 | "%s:%d ioremap_change_attr failed %s " | |
20149 | "for %Lx-%Lx\n", | |
20150 | - current->comm, current->pid, | |
20151 | + current->comm, task_pid_nr(current), | |
20152 | cattr_name(flags), | |
20153 | base, (unsigned long long)(base + size)); | |
20154 | return -EINVAL; | |
20155 | @@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, | |
20156 | if (want_flags != flags) { | |
20157 | printk(KERN_WARNING | |
20158 | "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n", | |
20159 | - current->comm, current->pid, | |
20160 | + current->comm, task_pid_nr(current), | |
20161 | cattr_name(want_flags), | |
20162 | (unsigned long long)paddr, | |
20163 | (unsigned long long)(paddr + size), | |
20164 | @@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, | |
20165 | free_memtype(paddr, paddr + size); | |
20166 | printk(KERN_ERR "%s:%d map pfn expected mapping type %s" | |
20167 | " for %Lx-%Lx, got %s\n", | |
20168 | - current->comm, current->pid, | |
20169 | + current->comm, task_pid_nr(current), | |
20170 | cattr_name(want_flags), | |
20171 | (unsigned long long)paddr, | |
20172 | (unsigned long long)(paddr + size), | |
20173 | diff -urNp linux-3.0.3/arch/x86/mm/pf_in.c linux-3.0.3/arch/x86/mm/pf_in.c | |
20174 | --- linux-3.0.3/arch/x86/mm/pf_in.c 2011-07-21 22:17:23.000000000 -0400 | |
20175 | +++ linux-3.0.3/arch/x86/mm/pf_in.c 2011-08-23 21:47:55.000000000 -0400 | |
20176 | @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l | |
20177 | int i; | |
20178 | enum reason_type rv = OTHERS; | |
20179 | ||
20180 | - p = (unsigned char *)ins_addr; | |
20181 | + p = (unsigned char *)ktla_ktva(ins_addr); | |
20182 | p += skip_prefix(p, &prf); | |
20183 | p += get_opcode(p, &opcode); | |
20184 | ||
20185 | @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un | |
20186 | struct prefix_bits prf; | |
20187 | int i; | |
20188 | ||
20189 | - p = (unsigned char *)ins_addr; | |
20190 | + p = (unsigned char *)ktla_ktva(ins_addr); | |
20191 | p += skip_prefix(p, &prf); | |
20192 | p += get_opcode(p, &opcode); | |
20193 | ||
20194 | @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned | |
20195 | struct prefix_bits prf; | |
20196 | int i; | |
20197 | ||
20198 | - p = (unsigned char *)ins_addr; | |
20199 | + p = (unsigned char *)ktla_ktva(ins_addr); | |
20200 | p += skip_prefix(p, &prf); | |
20201 | p += get_opcode(p, &opcode); | |
20202 | ||
20203 | @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned l | |
20204 | struct prefix_bits prf; | |
20205 | int i; | |
20206 | ||
20207 | - p = (unsigned char *)ins_addr; | |
20208 | + p = (unsigned char *)ktla_ktva(ins_addr); | |
20209 | p += skip_prefix(p, &prf); | |
20210 | p += get_opcode(p, &opcode); | |
20211 | for (i = 0; i < ARRAY_SIZE(reg_rop); i++) | |
20212 | @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned l | |
20213 | struct prefix_bits prf; | |
20214 | int i; | |
20215 | ||
20216 | - p = (unsigned char *)ins_addr; | |
20217 | + p = (unsigned char *)ktla_ktva(ins_addr); | |
20218 | p += skip_prefix(p, &prf); | |
20219 | p += get_opcode(p, &opcode); | |
20220 | for (i = 0; i < ARRAY_SIZE(imm_wop); i++) | |
20221 | diff -urNp linux-3.0.3/arch/x86/mm/pgtable_32.c linux-3.0.3/arch/x86/mm/pgtable_32.c | |
20222 | --- linux-3.0.3/arch/x86/mm/pgtable_32.c 2011-07-21 22:17:23.000000000 -0400 | |
20223 | +++ linux-3.0.3/arch/x86/mm/pgtable_32.c 2011-08-23 21:47:55.000000000 -0400 | |
20224 | @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, | |
20225 | return; | |
20226 | } | |
20227 | pte = pte_offset_kernel(pmd, vaddr); | |
20228 | + | |
20229 | + pax_open_kernel(); | |
20230 | if (pte_val(pteval)) | |
20231 | set_pte_at(&init_mm, vaddr, pte, pteval); | |
20232 | else | |
20233 | pte_clear(&init_mm, vaddr, pte); | |
20234 | + pax_close_kernel(); | |
20235 | ||
20236 | /* | |
20237 | * It's enough to flush this one mapping. | |
20238 | diff -urNp linux-3.0.3/arch/x86/mm/pgtable.c linux-3.0.3/arch/x86/mm/pgtable.c | |
20239 | --- linux-3.0.3/arch/x86/mm/pgtable.c 2011-07-21 22:17:23.000000000 -0400 | |
20240 | +++ linux-3.0.3/arch/x86/mm/pgtable.c 2011-08-23 21:47:55.000000000 -0400 | |
20241 | @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p | |
20242 | list_del(&page->lru); | |
20243 | } | |
20244 | ||
20245 | -#define UNSHARED_PTRS_PER_PGD \ | |
20246 | - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD) | |
20247 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
20248 | +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT; | |
20249 | ||
20250 | +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) | |
20251 | +{ | |
20252 | + while (count--) | |
20253 | + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER); | |
20254 | +} | |
20255 | +#endif | |
20256 | + | |
20257 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
20258 | +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count) | |
20259 | +{ | |
20260 | + while (count--) | |
20261 | + | |
20262 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
20263 | + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask); | |
20264 | +#else | |
20265 | + *dst++ = *src++; | |
20266 | +#endif | |
20267 | ||
20268 | +} | |
20269 | +#endif | |
20270 | + | |
20271 | +#ifdef CONFIG_X86_64 | |
20272 | +#define pxd_t pud_t | |
20273 | +#define pyd_t pgd_t | |
20274 | +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn) | |
20275 | +#define pxd_free(mm, pud) pud_free((mm), (pud)) | |
20276 | +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud)) | |
20277 | +#define pyd_offset(mm ,address) pgd_offset((mm), (address)) | |
20278 | +#define PYD_SIZE PGDIR_SIZE | |
20279 | +#else | |
20280 | +#define pxd_t pmd_t | |
20281 | +#define pyd_t pud_t | |
20282 | +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn) | |
20283 | +#define pxd_free(mm, pud) pmd_free((mm), (pud)) | |
20284 | +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud)) | |
20285 | +#define pyd_offset(mm ,address) pud_offset((mm), (address)) | |
20286 | +#define PYD_SIZE PUD_SIZE | |
20287 | +#endif | |
20288 | + | |
20289 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
20290 | +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {} | |
20291 | +static inline void pgd_dtor(pgd_t *pgd) {} | |
20292 | +#else | |
20293 | static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm) | |
20294 | { | |
20295 | BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm)); | |
20296 | @@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd) | |
20297 | pgd_list_del(pgd); | |
20298 | spin_unlock(&pgd_lock); | |
20299 | } | |
20300 | +#endif | |
20301 | ||
20302 | /* | |
20303 | * List of all pgd's needed for non-PAE so it can invalidate entries | |
20304 | @@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd) | |
20305 | * -- wli | |
20306 | */ | |
20307 | ||
20308 | -#ifdef CONFIG_X86_PAE | |
20309 | +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE) | |
20310 | /* | |
20311 | * In PAE mode, we need to do a cr3 reload (=tlb flush) when | |
20312 | * updating the top-level pagetable entries to guarantee the | |
20313 | @@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd) | |
20314 | * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate | |
20315 | * and initialize the kernel pmds here. | |
20316 | */ | |
20317 | -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD | |
20318 | +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD) | |
20319 | ||
20320 | void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd) | |
20321 | { | |
20322 | @@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, | |
20323 | */ | |
20324 | flush_tlb_mm(mm); | |
20325 | } | |
20326 | +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD) | |
20327 | +#define PREALLOCATED_PXDS USER_PGD_PTRS | |
20328 | #else /* !CONFIG_X86_PAE */ | |
20329 | ||
20330 | /* No need to prepopulate any pagetable entries in non-PAE modes. */ | |
20331 | -#define PREALLOCATED_PMDS 0 | |
20332 | +#define PREALLOCATED_PXDS 0 | |
20333 | ||
20334 | #endif /* CONFIG_X86_PAE */ | |
20335 | ||
20336 | -static void free_pmds(pmd_t *pmds[]) | |
20337 | +static void free_pxds(pxd_t *pxds[]) | |
20338 | { | |
20339 | int i; | |
20340 | ||
20341 | - for(i = 0; i < PREALLOCATED_PMDS; i++) | |
20342 | - if (pmds[i]) | |
20343 | - free_page((unsigned long)pmds[i]); | |
20344 | + for(i = 0; i < PREALLOCATED_PXDS; i++) | |
20345 | + if (pxds[i]) | |
20346 | + free_page((unsigned long)pxds[i]); | |
20347 | } | |
20348 | ||
20349 | -static int preallocate_pmds(pmd_t *pmds[]) | |
20350 | +static int preallocate_pxds(pxd_t *pxds[]) | |
20351 | { | |
20352 | int i; | |
20353 | bool failed = false; | |
20354 | ||
20355 | - for(i = 0; i < PREALLOCATED_PMDS; i++) { | |
20356 | - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP); | |
20357 | - if (pmd == NULL) | |
20358 | + for(i = 0; i < PREALLOCATED_PXDS; i++) { | |
20359 | + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP); | |
20360 | + if (pxd == NULL) | |
20361 | failed = true; | |
20362 | - pmds[i] = pmd; | |
20363 | + pxds[i] = pxd; | |
20364 | } | |
20365 | ||
20366 | if (failed) { | |
20367 | - free_pmds(pmds); | |
20368 | + free_pxds(pxds); | |
20369 | return -ENOMEM; | |
20370 | } | |
20371 | ||
20372 | @@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[ | |
20373 | * preallocate which never got a corresponding vma will need to be | |
20374 | * freed manually. | |
20375 | */ | |
20376 | -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp) | |
20377 | +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp) | |
20378 | { | |
20379 | int i; | |
20380 | ||
20381 | - for(i = 0; i < PREALLOCATED_PMDS; i++) { | |
20382 | + for(i = 0; i < PREALLOCATED_PXDS; i++) { | |
20383 | pgd_t pgd = pgdp[i]; | |
20384 | ||
20385 | if (pgd_val(pgd) != 0) { | |
20386 | - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd); | |
20387 | + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd); | |
20388 | ||
20389 | - pgdp[i] = native_make_pgd(0); | |
20390 | + set_pgd(pgdp + i, native_make_pgd(0)); | |
20391 | ||
20392 | - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT); | |
20393 | - pmd_free(mm, pmd); | |
20394 | + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT); | |
20395 | + pxd_free(mm, pxd); | |
20396 | } | |
20397 | } | |
20398 | } | |
20399 | ||
20400 | -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[]) | |
20401 | +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[]) | |
20402 | { | |
20403 | - pud_t *pud; | |
20404 | + pyd_t *pyd; | |
20405 | unsigned long addr; | |
20406 | int i; | |
20407 | ||
20408 | - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */ | |
20409 | + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */ | |
20410 | return; | |
20411 | ||
20412 | - pud = pud_offset(pgd, 0); | |
20413 | +#ifdef CONFIG_X86_64 | |
20414 | + pyd = pyd_offset(mm, 0L); | |
20415 | +#else | |
20416 | + pyd = pyd_offset(pgd, 0L); | |
20417 | +#endif | |
20418 | ||
20419 | - for (addr = i = 0; i < PREALLOCATED_PMDS; | |
20420 | - i++, pud++, addr += PUD_SIZE) { | |
20421 | - pmd_t *pmd = pmds[i]; | |
20422 | + for (addr = i = 0; i < PREALLOCATED_PXDS; | |
20423 | + i++, pyd++, addr += PYD_SIZE) { | |
20424 | + pxd_t *pxd = pxds[i]; | |
20425 | ||
20426 | if (i >= KERNEL_PGD_BOUNDARY) | |
20427 | - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]), | |
20428 | - sizeof(pmd_t) * PTRS_PER_PMD); | |
20429 | + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]), | |
20430 | + sizeof(pxd_t) * PTRS_PER_PMD); | |
20431 | ||
20432 | - pud_populate(mm, pud, pmd); | |
20433 | + pyd_populate(mm, pyd, pxd); | |
20434 | } | |
20435 | } | |
20436 | ||
20437 | pgd_t *pgd_alloc(struct mm_struct *mm) | |
20438 | { | |
20439 | pgd_t *pgd; | |
20440 | - pmd_t *pmds[PREALLOCATED_PMDS]; | |
20441 | + pxd_t *pxds[PREALLOCATED_PXDS]; | |
20442 | ||
20443 | pgd = (pgd_t *)__get_free_page(PGALLOC_GFP); | |
20444 | ||
20445 | @@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm) | |
20446 | ||
20447 | mm->pgd = pgd; | |
20448 | ||
20449 | - if (preallocate_pmds(pmds) != 0) | |
20450 | + if (preallocate_pxds(pxds) != 0) | |
20451 | goto out_free_pgd; | |
20452 | ||
20453 | if (paravirt_pgd_alloc(mm) != 0) | |
20454 | - goto out_free_pmds; | |
20455 | + goto out_free_pxds; | |
20456 | ||
20457 | /* | |
20458 | * Make sure that pre-populating the pmds is atomic with | |
20459 | @@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm) | |
20460 | spin_lock(&pgd_lock); | |
20461 | ||
20462 | pgd_ctor(mm, pgd); | |
20463 | - pgd_prepopulate_pmd(mm, pgd, pmds); | |
20464 | + pgd_prepopulate_pxd(mm, pgd, pxds); | |
20465 | ||
20466 | spin_unlock(&pgd_lock); | |
20467 | ||
20468 | return pgd; | |
20469 | ||
20470 | -out_free_pmds: | |
20471 | - free_pmds(pmds); | |
20472 | +out_free_pxds: | |
20473 | + free_pxds(pxds); | |
20474 | out_free_pgd: | |
20475 | free_page((unsigned long)pgd); | |
20476 | out: | |
20477 | @@ -295,7 +344,7 @@ out: | |
20478 | ||
20479 | void pgd_free(struct mm_struct *mm, pgd_t *pgd) | |
20480 | { | |
20481 | - pgd_mop_up_pmds(mm, pgd); | |
20482 | + pgd_mop_up_pxds(mm, pgd); | |
20483 | pgd_dtor(pgd); | |
20484 | paravirt_pgd_free(mm, pgd); | |
20485 | free_page((unsigned long)pgd); | |
20486 | diff -urNp linux-3.0.3/arch/x86/mm/setup_nx.c linux-3.0.3/arch/x86/mm/setup_nx.c | |
20487 | --- linux-3.0.3/arch/x86/mm/setup_nx.c 2011-07-21 22:17:23.000000000 -0400 | |
20488 | +++ linux-3.0.3/arch/x86/mm/setup_nx.c 2011-08-23 21:47:55.000000000 -0400 | |
20489 | @@ -5,8 +5,10 @@ | |
20490 | #include <asm/pgtable.h> | |
20491 | #include <asm/proto.h> | |
20492 | ||
20493 | +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) | |
20494 | static int disable_nx __cpuinitdata; | |
20495 | ||
20496 | +#ifndef CONFIG_PAX_PAGEEXEC | |
20497 | /* | |
20498 | * noexec = on|off | |
20499 | * | |
20500 | @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str | |
20501 | return 0; | |
20502 | } | |
20503 | early_param("noexec", noexec_setup); | |
20504 | +#endif | |
20505 | + | |
20506 | +#endif | |
20507 | ||
20508 | void __cpuinit x86_configure_nx(void) | |
20509 | { | |
20510 | +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) | |
20511 | if (cpu_has_nx && !disable_nx) | |
20512 | __supported_pte_mask |= _PAGE_NX; | |
20513 | else | |
20514 | +#endif | |
20515 | __supported_pte_mask &= ~_PAGE_NX; | |
20516 | } | |
20517 | ||
20518 | diff -urNp linux-3.0.3/arch/x86/mm/tlb.c linux-3.0.3/arch/x86/mm/tlb.c | |
20519 | --- linux-3.0.3/arch/x86/mm/tlb.c 2011-07-21 22:17:23.000000000 -0400 | |
20520 | +++ linux-3.0.3/arch/x86/mm/tlb.c 2011-08-23 21:47:55.000000000 -0400 | |
20521 | @@ -65,7 +65,11 @@ void leave_mm(int cpu) | |
20522 | BUG(); | |
20523 | cpumask_clear_cpu(cpu, | |
20524 | mm_cpumask(percpu_read(cpu_tlbstate.active_mm))); | |
20525 | + | |
20526 | +#ifndef CONFIG_PAX_PER_CPU_PGD | |
20527 | load_cr3(swapper_pg_dir); | |
20528 | +#endif | |
20529 | + | |
20530 | } | |
20531 | EXPORT_SYMBOL_GPL(leave_mm); | |
20532 | ||
20533 | diff -urNp linux-3.0.3/arch/x86/net/bpf_jit_comp.c linux-3.0.3/arch/x86/net/bpf_jit_comp.c | |
20534 | --- linux-3.0.3/arch/x86/net/bpf_jit_comp.c 2011-07-21 22:17:23.000000000 -0400 | |
20535 | +++ linux-3.0.3/arch/x86/net/bpf_jit_comp.c 2011-08-23 21:47:55.000000000 -0400 | |
20536 | @@ -589,7 +589,9 @@ cond_branch: f_offset = addrs[i + filt | |
20537 | module_free(NULL, image); | |
20538 | return; | |
20539 | } | |
20540 | + pax_open_kernel(); | |
20541 | memcpy(image + proglen, temp, ilen); | |
20542 | + pax_close_kernel(); | |
20543 | } | |
20544 | proglen += ilen; | |
20545 | addrs[i] = proglen; | |
20546 | @@ -609,7 +611,7 @@ cond_branch: f_offset = addrs[i + filt | |
20547 | break; | |
20548 | } | |
20549 | if (proglen == oldproglen) { | |
20550 | - image = module_alloc(max_t(unsigned int, | |
20551 | + image = module_alloc_exec(max_t(unsigned int, | |
20552 | proglen, | |
20553 | sizeof(struct work_struct))); | |
20554 | if (!image) | |
20555 | diff -urNp linux-3.0.3/arch/x86/oprofile/backtrace.c linux-3.0.3/arch/x86/oprofile/backtrace.c | |
20556 | --- linux-3.0.3/arch/x86/oprofile/backtrace.c 2011-08-23 21:44:40.000000000 -0400 | |
20557 | +++ linux-3.0.3/arch/x86/oprofile/backtrace.c 2011-08-23 21:47:55.000000000 -0400 | |
20558 | @@ -148,7 +148,7 @@ x86_backtrace(struct pt_regs * const reg | |
20559 | { | |
20560 | struct stack_frame *head = (struct stack_frame *)frame_pointer(regs); | |
20561 | ||
20562 | - if (!user_mode_vm(regs)) { | |
20563 | + if (!user_mode(regs)) { | |
20564 | unsigned long stack = kernel_stack_pointer(regs); | |
20565 | if (depth) | |
20566 | dump_trace(NULL, regs, (unsigned long *)stack, 0, | |
20567 | diff -urNp linux-3.0.3/arch/x86/pci/mrst.c linux-3.0.3/arch/x86/pci/mrst.c | |
20568 | --- linux-3.0.3/arch/x86/pci/mrst.c 2011-07-21 22:17:23.000000000 -0400 | |
20569 | +++ linux-3.0.3/arch/x86/pci/mrst.c 2011-08-23 21:47:55.000000000 -0400 | |
20570 | @@ -234,7 +234,9 @@ int __init pci_mrst_init(void) | |
20571 | printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n"); | |
20572 | pci_mmcfg_late_init(); | |
20573 | pcibios_enable_irq = mrst_pci_irq_enable; | |
20574 | - pci_root_ops = pci_mrst_ops; | |
20575 | + pax_open_kernel(); | |
20576 | + memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops)); | |
20577 | + pax_close_kernel(); | |
20578 | /* Continue with standard init */ | |
20579 | return 1; | |
20580 | } | |
20581 | diff -urNp linux-3.0.3/arch/x86/pci/pcbios.c linux-3.0.3/arch/x86/pci/pcbios.c | |
20582 | --- linux-3.0.3/arch/x86/pci/pcbios.c 2011-07-21 22:17:23.000000000 -0400 | |
20583 | +++ linux-3.0.3/arch/x86/pci/pcbios.c 2011-08-23 21:47:55.000000000 -0400 | |
20584 | @@ -79,50 +79,93 @@ union bios32 { | |
20585 | static struct { | |
20586 | unsigned long address; | |
20587 | unsigned short segment; | |
20588 | -} bios32_indirect = { 0, __KERNEL_CS }; | |
20589 | +} bios32_indirect __read_only = { 0, __PCIBIOS_CS }; | |
20590 | ||
20591 | /* | |
20592 | * Returns the entry point for the given service, NULL on error | |
20593 | */ | |
20594 | ||
20595 | -static unsigned long bios32_service(unsigned long service) | |
20596 | +static unsigned long __devinit bios32_service(unsigned long service) | |
20597 | { | |
20598 | unsigned char return_code; /* %al */ | |
20599 | unsigned long address; /* %ebx */ | |
20600 | unsigned long length; /* %ecx */ | |
20601 | unsigned long entry; /* %edx */ | |
20602 | unsigned long flags; | |
20603 | + struct desc_struct d, *gdt; | |
20604 | ||
20605 | local_irq_save(flags); | |
20606 | - __asm__("lcall *(%%edi); cld" | |
20607 | + | |
20608 | + gdt = get_cpu_gdt_table(smp_processor_id()); | |
20609 | + | |
20610 | + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC); | |
20611 | + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S); | |
20612 | + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC); | |
20613 | + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S); | |
20614 | + | |
20615 | + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld" | |
20616 | : "=a" (return_code), | |
20617 | "=b" (address), | |
20618 | "=c" (length), | |
20619 | "=d" (entry) | |
20620 | : "0" (service), | |
20621 | "1" (0), | |
20622 | - "D" (&bios32_indirect)); | |
20623 | + "D" (&bios32_indirect), | |
20624 | + "r"(__PCIBIOS_DS) | |
20625 | + : "memory"); | |
20626 | + | |
20627 | + pax_open_kernel(); | |
20628 | + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0; | |
20629 | + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0; | |
20630 | + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0; | |
20631 | + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0; | |
20632 | + pax_close_kernel(); | |
20633 | + | |
20634 | local_irq_restore(flags); | |
20635 | ||
20636 | switch (return_code) { | |
20637 | - case 0: | |
20638 | - return address + entry; | |
20639 | - case 0x80: /* Not present */ | |
20640 | - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service); | |
20641 | - return 0; | |
20642 | - default: /* Shouldn't happen */ | |
20643 | - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n", | |
20644 | - service, return_code); | |
20645 | + case 0: { | |
20646 | + int cpu; | |
20647 | + unsigned char flags; | |
20648 | + | |
20649 | + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry); | |
20650 | + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) { | |
20651 | + printk(KERN_WARNING "bios32_service: not valid\n"); | |
20652 | return 0; | |
20653 | + } | |
20654 | + address = address + PAGE_OFFSET; | |
20655 | + length += 16UL; /* some BIOSs underreport this... */ | |
20656 | + flags = 4; | |
20657 | + if (length >= 64*1024*1024) { | |
20658 | + length >>= PAGE_SHIFT; | |
20659 | + flags |= 8; | |
20660 | + } | |
20661 | + | |
20662 | + for (cpu = 0; cpu < NR_CPUS; cpu++) { | |
20663 | + gdt = get_cpu_gdt_table(cpu); | |
20664 | + pack_descriptor(&d, address, length, 0x9b, flags); | |
20665 | + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S); | |
20666 | + pack_descriptor(&d, address, length, 0x93, flags); | |
20667 | + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S); | |
20668 | + } | |
20669 | + return entry; | |
20670 | + } | |
20671 | + case 0x80: /* Not present */ | |
20672 | + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service); | |
20673 | + return 0; | |
20674 | + default: /* Shouldn't happen */ | |
20675 | + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n", | |
20676 | + service, return_code); | |
20677 | + return 0; | |
20678 | } | |
20679 | } | |
20680 | ||
20681 | static struct { | |
20682 | unsigned long address; | |
20683 | unsigned short segment; | |
20684 | -} pci_indirect = { 0, __KERNEL_CS }; | |
20685 | +} pci_indirect __read_only = { 0, __PCIBIOS_CS }; | |
20686 | ||
20687 | -static int pci_bios_present; | |
20688 | +static int pci_bios_present __read_only; | |
20689 | ||
20690 | static int __devinit check_pcibios(void) | |
20691 | { | |
20692 | @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void) | |
20693 | unsigned long flags, pcibios_entry; | |
20694 | ||
20695 | if ((pcibios_entry = bios32_service(PCI_SERVICE))) { | |
20696 | - pci_indirect.address = pcibios_entry + PAGE_OFFSET; | |
20697 | + pci_indirect.address = pcibios_entry; | |
20698 | ||
20699 | local_irq_save(flags); | |
20700 | - __asm__( | |
20701 | - "lcall *(%%edi); cld\n\t" | |
20702 | + __asm__("movw %w6, %%ds\n\t" | |
20703 | + "lcall *%%ss:(%%edi); cld\n\t" | |
20704 | + "push %%ss\n\t" | |
20705 | + "pop %%ds\n\t" | |
20706 | "jc 1f\n\t" | |
20707 | "xor %%ah, %%ah\n" | |
20708 | "1:" | |
20709 | @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void) | |
20710 | "=b" (ebx), | |
20711 | "=c" (ecx) | |
20712 | : "1" (PCIBIOS_PCI_BIOS_PRESENT), | |
20713 | - "D" (&pci_indirect) | |
20714 | + "D" (&pci_indirect), | |
20715 | + "r" (__PCIBIOS_DS) | |
20716 | : "memory"); | |
20717 | local_irq_restore(flags); | |
20718 | ||
20719 | @@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se | |
20720 | ||
20721 | switch (len) { | |
20722 | case 1: | |
20723 | - __asm__("lcall *(%%esi); cld\n\t" | |
20724 | + __asm__("movw %w6, %%ds\n\t" | |
20725 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20726 | + "push %%ss\n\t" | |
20727 | + "pop %%ds\n\t" | |
20728 | "jc 1f\n\t" | |
20729 | "xor %%ah, %%ah\n" | |
20730 | "1:" | |
20731 | @@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se | |
20732 | : "1" (PCIBIOS_READ_CONFIG_BYTE), | |
20733 | "b" (bx), | |
20734 | "D" ((long)reg), | |
20735 | - "S" (&pci_indirect)); | |
20736 | + "S" (&pci_indirect), | |
20737 | + "r" (__PCIBIOS_DS)); | |
20738 | /* | |
20739 | * Zero-extend the result beyond 8 bits, do not trust the | |
20740 | * BIOS having done it: | |
20741 | @@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se | |
20742 | *value &= 0xff; | |
20743 | break; | |
20744 | case 2: | |
20745 | - __asm__("lcall *(%%esi); cld\n\t" | |
20746 | + __asm__("movw %w6, %%ds\n\t" | |
20747 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20748 | + "push %%ss\n\t" | |
20749 | + "pop %%ds\n\t" | |
20750 | "jc 1f\n\t" | |
20751 | "xor %%ah, %%ah\n" | |
20752 | "1:" | |
20753 | @@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se | |
20754 | : "1" (PCIBIOS_READ_CONFIG_WORD), | |
20755 | "b" (bx), | |
20756 | "D" ((long)reg), | |
20757 | - "S" (&pci_indirect)); | |
20758 | + "S" (&pci_indirect), | |
20759 | + "r" (__PCIBIOS_DS)); | |
20760 | /* | |
20761 | * Zero-extend the result beyond 16 bits, do not trust the | |
20762 | * BIOS having done it: | |
20763 | @@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se | |
20764 | *value &= 0xffff; | |
20765 | break; | |
20766 | case 4: | |
20767 | - __asm__("lcall *(%%esi); cld\n\t" | |
20768 | + __asm__("movw %w6, %%ds\n\t" | |
20769 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20770 | + "push %%ss\n\t" | |
20771 | + "pop %%ds\n\t" | |
20772 | "jc 1f\n\t" | |
20773 | "xor %%ah, %%ah\n" | |
20774 | "1:" | |
20775 | @@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se | |
20776 | : "1" (PCIBIOS_READ_CONFIG_DWORD), | |
20777 | "b" (bx), | |
20778 | "D" ((long)reg), | |
20779 | - "S" (&pci_indirect)); | |
20780 | + "S" (&pci_indirect), | |
20781 | + "r" (__PCIBIOS_DS)); | |
20782 | break; | |
20783 | } | |
20784 | ||
20785 | @@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s | |
20786 | ||
20787 | switch (len) { | |
20788 | case 1: | |
20789 | - __asm__("lcall *(%%esi); cld\n\t" | |
20790 | + __asm__("movw %w6, %%ds\n\t" | |
20791 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20792 | + "push %%ss\n\t" | |
20793 | + "pop %%ds\n\t" | |
20794 | "jc 1f\n\t" | |
20795 | "xor %%ah, %%ah\n" | |
20796 | "1:" | |
20797 | @@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s | |
20798 | "c" (value), | |
20799 | "b" (bx), | |
20800 | "D" ((long)reg), | |
20801 | - "S" (&pci_indirect)); | |
20802 | + "S" (&pci_indirect), | |
20803 | + "r" (__PCIBIOS_DS)); | |
20804 | break; | |
20805 | case 2: | |
20806 | - __asm__("lcall *(%%esi); cld\n\t" | |
20807 | + __asm__("movw %w6, %%ds\n\t" | |
20808 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20809 | + "push %%ss\n\t" | |
20810 | + "pop %%ds\n\t" | |
20811 | "jc 1f\n\t" | |
20812 | "xor %%ah, %%ah\n" | |
20813 | "1:" | |
20814 | @@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s | |
20815 | "c" (value), | |
20816 | "b" (bx), | |
20817 | "D" ((long)reg), | |
20818 | - "S" (&pci_indirect)); | |
20819 | + "S" (&pci_indirect), | |
20820 | + "r" (__PCIBIOS_DS)); | |
20821 | break; | |
20822 | case 4: | |
20823 | - __asm__("lcall *(%%esi); cld\n\t" | |
20824 | + __asm__("movw %w6, %%ds\n\t" | |
20825 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20826 | + "push %%ss\n\t" | |
20827 | + "pop %%ds\n\t" | |
20828 | "jc 1f\n\t" | |
20829 | "xor %%ah, %%ah\n" | |
20830 | "1:" | |
20831 | @@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s | |
20832 | "c" (value), | |
20833 | "b" (bx), | |
20834 | "D" ((long)reg), | |
20835 | - "S" (&pci_indirect)); | |
20836 | + "S" (&pci_indirect), | |
20837 | + "r" (__PCIBIOS_DS)); | |
20838 | break; | |
20839 | } | |
20840 | ||
20841 | @@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i | |
20842 | ||
20843 | DBG("PCI: Fetching IRQ routing table... "); | |
20844 | __asm__("push %%es\n\t" | |
20845 | + "movw %w8, %%ds\n\t" | |
20846 | "push %%ds\n\t" | |
20847 | "pop %%es\n\t" | |
20848 | - "lcall *(%%esi); cld\n\t" | |
20849 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20850 | "pop %%es\n\t" | |
20851 | + "push %%ss\n\t" | |
20852 | + "pop %%ds\n" | |
20853 | "jc 1f\n\t" | |
20854 | "xor %%ah, %%ah\n" | |
20855 | "1:" | |
20856 | @@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i | |
20857 | "1" (0), | |
20858 | "D" ((long) &opt), | |
20859 | "S" (&pci_indirect), | |
20860 | - "m" (opt) | |
20861 | + "m" (opt), | |
20862 | + "r" (__PCIBIOS_DS) | |
20863 | : "memory"); | |
20864 | DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map); | |
20865 | if (ret & 0xff00) | |
20866 | @@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d | |
20867 | { | |
20868 | int ret; | |
20869 | ||
20870 | - __asm__("lcall *(%%esi); cld\n\t" | |
20871 | + __asm__("movw %w5, %%ds\n\t" | |
20872 | + "lcall *%%ss:(%%esi); cld\n\t" | |
20873 | + "push %%ss\n\t" | |
20874 | + "pop %%ds\n" | |
20875 | "jc 1f\n\t" | |
20876 | "xor %%ah, %%ah\n" | |
20877 | "1:" | |
20878 | @@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d | |
20879 | : "0" (PCIBIOS_SET_PCI_HW_INT), | |
20880 | "b" ((dev->bus->number << 8) | dev->devfn), | |
20881 | "c" ((irq << 8) | (pin + 10)), | |
20882 | - "S" (&pci_indirect)); | |
20883 | + "S" (&pci_indirect), | |
20884 | + "r" (__PCIBIOS_DS)); | |
20885 | return !(ret & 0xff00); | |
20886 | } | |
20887 | EXPORT_SYMBOL(pcibios_set_irq_routing); | |
20888 | diff -urNp linux-3.0.3/arch/x86/platform/efi/efi_32.c linux-3.0.3/arch/x86/platform/efi/efi_32.c | |
20889 | --- linux-3.0.3/arch/x86/platform/efi/efi_32.c 2011-07-21 22:17:23.000000000 -0400 | |
20890 | +++ linux-3.0.3/arch/x86/platform/efi/efi_32.c 2011-08-23 21:47:55.000000000 -0400 | |
20891 | @@ -38,70 +38,37 @@ | |
20892 | */ | |
20893 | ||
20894 | static unsigned long efi_rt_eflags; | |
20895 | -static pgd_t efi_bak_pg_dir_pointer[2]; | |
20896 | +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS]; | |
20897 | ||
20898 | -void efi_call_phys_prelog(void) | |
20899 | +void __init efi_call_phys_prelog(void) | |
20900 | { | |
20901 | - unsigned long cr4; | |
20902 | - unsigned long temp; | |
20903 | struct desc_ptr gdt_descr; | |
20904 | ||
20905 | local_irq_save(efi_rt_eflags); | |
20906 | ||
20907 | - /* | |
20908 | - * If I don't have PAE, I should just duplicate two entries in page | |
20909 | - * directory. If I have PAE, I just need to duplicate one entry in | |
20910 | - * page directory. | |
20911 | - */ | |
20912 | - cr4 = read_cr4_safe(); | |
20913 | - | |
20914 | - if (cr4 & X86_CR4_PAE) { | |
20915 | - efi_bak_pg_dir_pointer[0].pgd = | |
20916 | - swapper_pg_dir[pgd_index(0)].pgd; | |
20917 | - swapper_pg_dir[0].pgd = | |
20918 | - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd; | |
20919 | - } else { | |
20920 | - efi_bak_pg_dir_pointer[0].pgd = | |
20921 | - swapper_pg_dir[pgd_index(0)].pgd; | |
20922 | - efi_bak_pg_dir_pointer[1].pgd = | |
20923 | - swapper_pg_dir[pgd_index(0x400000)].pgd; | |
20924 | - swapper_pg_dir[pgd_index(0)].pgd = | |
20925 | - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd; | |
20926 | - temp = PAGE_OFFSET + 0x400000; | |
20927 | - swapper_pg_dir[pgd_index(0x400000)].pgd = | |
20928 | - swapper_pg_dir[pgd_index(temp)].pgd; | |
20929 | - } | |
20930 | + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS); | |
20931 | + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY, | |
20932 | + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); | |
20933 | ||
20934 | /* | |
20935 | * After the lock is released, the original page table is restored. | |
20936 | */ | |
20937 | __flush_tlb_all(); | |
20938 | ||
20939 | - gdt_descr.address = __pa(get_cpu_gdt_table(0)); | |
20940 | + gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0)); | |
20941 | gdt_descr.size = GDT_SIZE - 1; | |
20942 | load_gdt(&gdt_descr); | |
20943 | } | |
20944 | ||
20945 | -void efi_call_phys_epilog(void) | |
20946 | +void __init efi_call_phys_epilog(void) | |
20947 | { | |
20948 | - unsigned long cr4; | |
20949 | struct desc_ptr gdt_descr; | |
20950 | ||
20951 | - gdt_descr.address = (unsigned long)get_cpu_gdt_table(0); | |
20952 | + gdt_descr.address = get_cpu_gdt_table(0); | |
20953 | gdt_descr.size = GDT_SIZE - 1; | |
20954 | load_gdt(&gdt_descr); | |
20955 | ||
20956 | - cr4 = read_cr4_safe(); | |
20957 | - | |
20958 | - if (cr4 & X86_CR4_PAE) { | |
20959 | - swapper_pg_dir[pgd_index(0)].pgd = | |
20960 | - efi_bak_pg_dir_pointer[0].pgd; | |
20961 | - } else { | |
20962 | - swapper_pg_dir[pgd_index(0)].pgd = | |
20963 | - efi_bak_pg_dir_pointer[0].pgd; | |
20964 | - swapper_pg_dir[pgd_index(0x400000)].pgd = | |
20965 | - efi_bak_pg_dir_pointer[1].pgd; | |
20966 | - } | |
20967 | + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS); | |
20968 | ||
20969 | /* | |
20970 | * After the lock is released, the original page table is restored. | |
20971 | diff -urNp linux-3.0.3/arch/x86/platform/efi/efi_stub_32.S linux-3.0.3/arch/x86/platform/efi/efi_stub_32.S | |
20972 | --- linux-3.0.3/arch/x86/platform/efi/efi_stub_32.S 2011-07-21 22:17:23.000000000 -0400 | |
20973 | +++ linux-3.0.3/arch/x86/platform/efi/efi_stub_32.S 2011-08-23 21:47:55.000000000 -0400 | |
20974 | @@ -6,6 +6,7 @@ | |
20975 | */ | |
20976 | ||
20977 | #include <linux/linkage.h> | |
20978 | +#include <linux/init.h> | |
20979 | #include <asm/page_types.h> | |
20980 | ||
20981 | /* | |
20982 | @@ -20,7 +21,7 @@ | |
20983 | * service functions will comply with gcc calling convention, too. | |
20984 | */ | |
20985 | ||
20986 | -.text | |
20987 | +__INIT | |
20988 | ENTRY(efi_call_phys) | |
20989 | /* | |
20990 | * 0. The function can only be called in Linux kernel. So CS has been | |
20991 | @@ -36,9 +37,7 @@ ENTRY(efi_call_phys) | |
20992 | * The mapping of lower virtual memory has been created in prelog and | |
20993 | * epilog. | |
20994 | */ | |
20995 | - movl $1f, %edx | |
20996 | - subl $__PAGE_OFFSET, %edx | |
20997 | - jmp *%edx | |
20998 | + jmp 1f-__PAGE_OFFSET | |
20999 | 1: | |
21000 | ||
21001 | /* | |
21002 | @@ -47,14 +46,8 @@ ENTRY(efi_call_phys) | |
21003 | * parameter 2, ..., param n. To make things easy, we save the return | |
21004 | * address of efi_call_phys in a global variable. | |
21005 | */ | |
21006 | - popl %edx | |
21007 | - movl %edx, saved_return_addr | |
21008 | - /* get the function pointer into ECX*/ | |
21009 | - popl %ecx | |
21010 | - movl %ecx, efi_rt_function_ptr | |
21011 | - movl $2f, %edx | |
21012 | - subl $__PAGE_OFFSET, %edx | |
21013 | - pushl %edx | |
21014 | + popl (saved_return_addr) | |
21015 | + popl (efi_rt_function_ptr) | |
21016 | ||
21017 | /* | |
21018 | * 3. Clear PG bit in %CR0. | |
21019 | @@ -73,9 +66,8 @@ ENTRY(efi_call_phys) | |
21020 | /* | |
21021 | * 5. Call the physical function. | |
21022 | */ | |
21023 | - jmp *%ecx | |
21024 | + call *(efi_rt_function_ptr-__PAGE_OFFSET) | |
21025 | ||
21026 | -2: | |
21027 | /* | |
21028 | * 6. After EFI runtime service returns, control will return to | |
21029 | * following instruction. We'd better readjust stack pointer first. | |
21030 | @@ -88,35 +80,28 @@ ENTRY(efi_call_phys) | |
21031 | movl %cr0, %edx | |
21032 | orl $0x80000000, %edx | |
21033 | movl %edx, %cr0 | |
21034 | - jmp 1f | |
21035 | -1: | |
21036 | + | |
21037 | /* | |
21038 | * 8. Now restore the virtual mode from flat mode by | |
21039 | * adding EIP with PAGE_OFFSET. | |
21040 | */ | |
21041 | - movl $1f, %edx | |
21042 | - jmp *%edx | |
21043 | + jmp 1f+__PAGE_OFFSET | |
21044 | 1: | |
21045 | ||
21046 | /* | |
21047 | * 9. Balance the stack. And because EAX contain the return value, | |
21048 | * we'd better not clobber it. | |
21049 | */ | |
21050 | - leal efi_rt_function_ptr, %edx | |
21051 | - movl (%edx), %ecx | |
21052 | - pushl %ecx | |
21053 | + pushl (efi_rt_function_ptr) | |
21054 | ||
21055 | /* | |
21056 | - * 10. Push the saved return address onto the stack and return. | |
21057 | + * 10. Return to the saved return address. | |
21058 | */ | |
21059 | - leal saved_return_addr, %edx | |
21060 | - movl (%edx), %ecx | |
21061 | - pushl %ecx | |
21062 | - ret | |
21063 | + jmpl *(saved_return_addr) | |
21064 | ENDPROC(efi_call_phys) | |
21065 | .previous | |
21066 | ||
21067 | -.data | |
21068 | +__INITDATA | |
21069 | saved_return_addr: | |
21070 | .long 0 | |
21071 | efi_rt_function_ptr: | |
21072 | diff -urNp linux-3.0.3/arch/x86/platform/mrst/mrst.c linux-3.0.3/arch/x86/platform/mrst/mrst.c | |
21073 | --- linux-3.0.3/arch/x86/platform/mrst/mrst.c 2011-07-21 22:17:23.000000000 -0400 | |
21074 | +++ linux-3.0.3/arch/x86/platform/mrst/mrst.c 2011-08-23 21:47:55.000000000 -0400 | |
21075 | @@ -239,14 +239,16 @@ static int mrst_i8042_detect(void) | |
21076 | } | |
21077 | ||
21078 | /* Reboot and power off are handled by the SCU on a MID device */ | |
21079 | -static void mrst_power_off(void) | |
21080 | +static __noreturn void mrst_power_off(void) | |
21081 | { | |
21082 | intel_scu_ipc_simple_command(0xf1, 1); | |
21083 | + BUG(); | |
21084 | } | |
21085 | ||
21086 | -static void mrst_reboot(void) | |
21087 | +static __noreturn void mrst_reboot(void) | |
21088 | { | |
21089 | intel_scu_ipc_simple_command(0xf1, 0); | |
21090 | + BUG(); | |
21091 | } | |
21092 | ||
21093 | /* | |
21094 | diff -urNp linux-3.0.3/arch/x86/platform/uv/tlb_uv.c linux-3.0.3/arch/x86/platform/uv/tlb_uv.c | |
21095 | --- linux-3.0.3/arch/x86/platform/uv/tlb_uv.c 2011-07-21 22:17:23.000000000 -0400 | |
21096 | +++ linux-3.0.3/arch/x86/platform/uv/tlb_uv.c 2011-08-23 21:48:14.000000000 -0400 | |
21097 | @@ -373,6 +373,8 @@ static void reset_with_ipi(struct bau_ta | |
21098 | cpumask_t mask; | |
21099 | struct reset_args reset_args; | |
21100 | ||
21101 | + pax_track_stack(); | |
21102 | + | |
21103 | reset_args.sender = sender; | |
21104 | cpus_clear(mask); | |
21105 | /* find a single cpu for each uvhub in this distribution mask */ | |
21106 | diff -urNp linux-3.0.3/arch/x86/power/cpu.c linux-3.0.3/arch/x86/power/cpu.c | |
21107 | --- linux-3.0.3/arch/x86/power/cpu.c 2011-07-21 22:17:23.000000000 -0400 | |
21108 | +++ linux-3.0.3/arch/x86/power/cpu.c 2011-08-23 21:47:55.000000000 -0400 | |
21109 | @@ -130,7 +130,7 @@ static void do_fpu_end(void) | |
21110 | static void fix_processor_context(void) | |
21111 | { | |
21112 | int cpu = smp_processor_id(); | |
21113 | - struct tss_struct *t = &per_cpu(init_tss, cpu); | |
21114 | + struct tss_struct *t = init_tss + cpu; | |
21115 | ||
21116 | set_tss_desc(cpu, t); /* | |
21117 | * This just modifies memory; should not be | |
21118 | @@ -140,7 +140,9 @@ static void fix_processor_context(void) | |
21119 | */ | |
21120 | ||
21121 | #ifdef CONFIG_X86_64 | |
21122 | + pax_open_kernel(); | |
21123 | get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9; | |
21124 | + pax_close_kernel(); | |
21125 | ||
21126 | syscall_init(); /* This sets MSR_*STAR and related */ | |
21127 | #endif | |
21128 | diff -urNp linux-3.0.3/arch/x86/vdso/Makefile linux-3.0.3/arch/x86/vdso/Makefile | |
21129 | --- linux-3.0.3/arch/x86/vdso/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
21130 | +++ linux-3.0.3/arch/x86/vdso/Makefile 2011-08-23 21:47:55.000000000 -0400 | |
21131 | @@ -136,7 +136,7 @@ quiet_cmd_vdso = VDSO $@ | |
21132 | -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \ | |
21133 | sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' | |
21134 | ||
21135 | -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) | |
21136 | +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) | |
21137 | GCOV_PROFILE := n | |
21138 | ||
21139 | # | |
21140 | diff -urNp linux-3.0.3/arch/x86/vdso/vdso32-setup.c linux-3.0.3/arch/x86/vdso/vdso32-setup.c | |
21141 | --- linux-3.0.3/arch/x86/vdso/vdso32-setup.c 2011-07-21 22:17:23.000000000 -0400 | |
21142 | +++ linux-3.0.3/arch/x86/vdso/vdso32-setup.c 2011-08-23 21:47:55.000000000 -0400 | |
21143 | @@ -25,6 +25,7 @@ | |
21144 | #include <asm/tlbflush.h> | |
21145 | #include <asm/vdso.h> | |
21146 | #include <asm/proto.h> | |
21147 | +#include <asm/mman.h> | |
21148 | ||
21149 | enum { | |
21150 | VDSO_DISABLED = 0, | |
21151 | @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m | |
21152 | void enable_sep_cpu(void) | |
21153 | { | |
21154 | int cpu = get_cpu(); | |
21155 | - struct tss_struct *tss = &per_cpu(init_tss, cpu); | |
21156 | + struct tss_struct *tss = init_tss + cpu; | |
21157 | ||
21158 | if (!boot_cpu_has(X86_FEATURE_SEP)) { | |
21159 | put_cpu(); | |
21160 | @@ -249,7 +250,7 @@ static int __init gate_vma_init(void) | |
21161 | gate_vma.vm_start = FIXADDR_USER_START; | |
21162 | gate_vma.vm_end = FIXADDR_USER_END; | |
21163 | gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC; | |
21164 | - gate_vma.vm_page_prot = __P101; | |
21165 | + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags); | |
21166 | /* | |
21167 | * Make sure the vDSO gets into every core dump. | |
21168 | * Dumping its contents makes post-mortem fully interpretable later | |
21169 | @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l | |
21170 | if (compat) | |
21171 | addr = VDSO_HIGH_BASE; | |
21172 | else { | |
21173 | - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0); | |
21174 | + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE); | |
21175 | if (IS_ERR_VALUE(addr)) { | |
21176 | ret = addr; | |
21177 | goto up_fail; | |
21178 | } | |
21179 | } | |
21180 | ||
21181 | - current->mm->context.vdso = (void *)addr; | |
21182 | + current->mm->context.vdso = addr; | |
21183 | ||
21184 | if (compat_uses_vma || !compat) { | |
21185 | /* | |
21186 | @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l | |
21187 | } | |
21188 | ||
21189 | current_thread_info()->sysenter_return = | |
21190 | - VDSO32_SYMBOL(addr, SYSENTER_RETURN); | |
21191 | + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN); | |
21192 | ||
21193 | up_fail: | |
21194 | if (ret) | |
21195 | - current->mm->context.vdso = NULL; | |
21196 | + current->mm->context.vdso = 0; | |
21197 | ||
21198 | up_write(&mm->mmap_sem); | |
21199 | ||
21200 | @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init); | |
21201 | ||
21202 | const char *arch_vma_name(struct vm_area_struct *vma) | |
21203 | { | |
21204 | - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso) | |
21205 | + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso) | |
21206 | return "[vdso]"; | |
21207 | + | |
21208 | +#ifdef CONFIG_PAX_SEGMEXEC | |
21209 | + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso) | |
21210 | + return "[vdso]"; | |
21211 | +#endif | |
21212 | + | |
21213 | return NULL; | |
21214 | } | |
21215 | ||
21216 | @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru | |
21217 | * Check to see if the corresponding task was created in compat vdso | |
21218 | * mode. | |
21219 | */ | |
21220 | - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE) | |
21221 | + if (mm && mm->context.vdso == VDSO_HIGH_BASE) | |
21222 | return &gate_vma; | |
21223 | return NULL; | |
21224 | } | |
21225 | diff -urNp linux-3.0.3/arch/x86/vdso/vma.c linux-3.0.3/arch/x86/vdso/vma.c | |
21226 | --- linux-3.0.3/arch/x86/vdso/vma.c 2011-07-21 22:17:23.000000000 -0400 | |
21227 | +++ linux-3.0.3/arch/x86/vdso/vma.c 2011-08-23 21:47:55.000000000 -0400 | |
21228 | @@ -15,18 +15,19 @@ | |
21229 | #include <asm/proto.h> | |
21230 | #include <asm/vdso.h> | |
21231 | ||
21232 | -unsigned int __read_mostly vdso_enabled = 1; | |
21233 | - | |
21234 | extern char vdso_start[], vdso_end[]; | |
21235 | extern unsigned short vdso_sync_cpuid; | |
21236 | +extern char __vsyscall_0; | |
21237 | ||
21238 | static struct page **vdso_pages; | |
21239 | +static struct page *vsyscall_page; | |
21240 | static unsigned vdso_size; | |
21241 | ||
21242 | static int __init init_vdso_vars(void) | |
21243 | { | |
21244 | - int npages = (vdso_end - vdso_start + PAGE_SIZE - 1) / PAGE_SIZE; | |
21245 | - int i; | |
21246 | + size_t nbytes = vdso_end - vdso_start; | |
21247 | + size_t npages = (nbytes + PAGE_SIZE - 1) / PAGE_SIZE; | |
21248 | + size_t i; | |
21249 | ||
21250 | vdso_size = npages << PAGE_SHIFT; | |
21251 | vdso_pages = kmalloc(sizeof(struct page *) * npages, GFP_KERNEL); | |
21252 | @@ -34,19 +35,19 @@ static int __init init_vdso_vars(void) | |
21253 | goto oom; | |
21254 | for (i = 0; i < npages; i++) { | |
21255 | struct page *p; | |
21256 | - p = alloc_page(GFP_KERNEL); | |
21257 | + p = alloc_page(GFP_KERNEL | __GFP_ZERO); | |
21258 | if (!p) | |
21259 | goto oom; | |
21260 | vdso_pages[i] = p; | |
21261 | - copy_page(page_address(p), vdso_start + i*PAGE_SIZE); | |
21262 | + memcpy(page_address(p), vdso_start + i*PAGE_SIZE, nbytes > PAGE_SIZE ? PAGE_SIZE : nbytes); | |
21263 | + nbytes -= PAGE_SIZE; | |
21264 | } | |
21265 | + vsyscall_page = pfn_to_page((__pa_symbol(&__vsyscall_0)) >> PAGE_SHIFT); | |
21266 | ||
21267 | return 0; | |
21268 | ||
21269 | oom: | |
21270 | - printk("Cannot allocate vdso\n"); | |
21271 | - vdso_enabled = 0; | |
21272 | - return -ENOMEM; | |
21273 | + panic("Cannot allocate vdso\n"); | |
21274 | } | |
21275 | subsys_initcall(init_vdso_vars); | |
21276 | ||
21277 | @@ -80,37 +81,35 @@ int arch_setup_additional_pages(struct l | |
21278 | unsigned long addr; | |
21279 | int ret; | |
21280 | ||
21281 | - if (!vdso_enabled) | |
21282 | - return 0; | |
21283 | - | |
21284 | down_write(&mm->mmap_sem); | |
21285 | - addr = vdso_addr(mm->start_stack, vdso_size); | |
21286 | - addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0); | |
21287 | + addr = vdso_addr(mm->start_stack, vdso_size + PAGE_SIZE); | |
21288 | + addr = get_unmapped_area(NULL, addr, vdso_size + PAGE_SIZE, 0, 0); | |
21289 | if (IS_ERR_VALUE(addr)) { | |
21290 | ret = addr; | |
21291 | goto up_fail; | |
21292 | } | |
21293 | ||
21294 | - current->mm->context.vdso = (void *)addr; | |
21295 | + mm->context.vdso = addr + PAGE_SIZE; | |
21296 | ||
21297 | - ret = install_special_mapping(mm, addr, vdso_size, | |
21298 | + ret = install_special_mapping(mm, addr, PAGE_SIZE, | |
21299 | VM_READ|VM_EXEC| | |
21300 | - VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC| | |
21301 | + VM_MAYREAD|VM_MAYEXEC| | |
21302 | VM_ALWAYSDUMP, | |
21303 | - vdso_pages); | |
21304 | + &vsyscall_page); | |
21305 | if (ret) { | |
21306 | - current->mm->context.vdso = NULL; | |
21307 | + mm->context.vdso = 0; | |
21308 | goto up_fail; | |
21309 | } | |
21310 | ||
21311 | + ret = install_special_mapping(mm, addr + PAGE_SIZE, vdso_size, | |
21312 | + VM_READ|VM_EXEC| | |
21313 | + VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC| | |
21314 | + VM_ALWAYSDUMP, | |
21315 | + vdso_pages); | |
21316 | + if (ret) | |
21317 | + mm->context.vdso = 0; | |
21318 | + | |
21319 | up_fail: | |
21320 | up_write(&mm->mmap_sem); | |
21321 | return ret; | |
21322 | } | |
21323 | - | |
21324 | -static __init int vdso_setup(char *s) | |
21325 | -{ | |
21326 | - vdso_enabled = simple_strtoul(s, NULL, 0); | |
21327 | - return 0; | |
21328 | -} | |
21329 | -__setup("vdso=", vdso_setup); | |
21330 | diff -urNp linux-3.0.3/arch/x86/xen/enlighten.c linux-3.0.3/arch/x86/xen/enlighten.c | |
21331 | --- linux-3.0.3/arch/x86/xen/enlighten.c 2011-08-23 21:44:40.000000000 -0400 | |
21332 | +++ linux-3.0.3/arch/x86/xen/enlighten.c 2011-08-23 21:47:55.000000000 -0400 | |
21333 | @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); | |
21334 | ||
21335 | struct shared_info xen_dummy_shared_info; | |
21336 | ||
21337 | -void *xen_initial_gdt; | |
21338 | - | |
21339 | RESERVE_BRK(shared_info_page_brk, PAGE_SIZE); | |
21340 | __read_mostly int xen_have_vector_callback; | |
21341 | EXPORT_SYMBOL_GPL(xen_have_vector_callback); | |
21342 | @@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic | |
21343 | #endif | |
21344 | }; | |
21345 | ||
21346 | -static void xen_reboot(int reason) | |
21347 | +static __noreturn void xen_reboot(int reason) | |
21348 | { | |
21349 | struct sched_shutdown r = { .reason = reason }; | |
21350 | ||
21351 | @@ -1018,17 +1016,17 @@ static void xen_reboot(int reason) | |
21352 | BUG(); | |
21353 | } | |
21354 | ||
21355 | -static void xen_restart(char *msg) | |
21356 | +static __noreturn void xen_restart(char *msg) | |
21357 | { | |
21358 | xen_reboot(SHUTDOWN_reboot); | |
21359 | } | |
21360 | ||
21361 | -static void xen_emergency_restart(void) | |
21362 | +static __noreturn void xen_emergency_restart(void) | |
21363 | { | |
21364 | xen_reboot(SHUTDOWN_reboot); | |
21365 | } | |
21366 | ||
21367 | -static void xen_machine_halt(void) | |
21368 | +static __noreturn void xen_machine_halt(void) | |
21369 | { | |
21370 | xen_reboot(SHUTDOWN_poweroff); | |
21371 | } | |
21372 | @@ -1134,7 +1132,17 @@ asmlinkage void __init xen_start_kernel( | |
21373 | __userpte_alloc_gfp &= ~__GFP_HIGHMEM; | |
21374 | ||
21375 | /* Work out if we support NX */ | |
21376 | - x86_configure_nx(); | |
21377 | +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) | |
21378 | + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 && | |
21379 | + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) { | |
21380 | + unsigned l, h; | |
21381 | + | |
21382 | + __supported_pte_mask |= _PAGE_NX; | |
21383 | + rdmsr(MSR_EFER, l, h); | |
21384 | + l |= EFER_NX; | |
21385 | + wrmsr(MSR_EFER, l, h); | |
21386 | + } | |
21387 | +#endif | |
21388 | ||
21389 | xen_setup_features(); | |
21390 | ||
21391 | @@ -1165,13 +1173,6 @@ asmlinkage void __init xen_start_kernel( | |
21392 | ||
21393 | machine_ops = xen_machine_ops; | |
21394 | ||
21395 | - /* | |
21396 | - * The only reliable way to retain the initial address of the | |
21397 | - * percpu gdt_page is to remember it here, so we can go and | |
21398 | - * mark it RW later, when the initial percpu area is freed. | |
21399 | - */ | |
21400 | - xen_initial_gdt = &per_cpu(gdt_page, 0); | |
21401 | - | |
21402 | xen_smp_init(); | |
21403 | ||
21404 | #ifdef CONFIG_ACPI_NUMA | |
21405 | diff -urNp linux-3.0.3/arch/x86/xen/mmu.c linux-3.0.3/arch/x86/xen/mmu.c | |
21406 | --- linux-3.0.3/arch/x86/xen/mmu.c 2011-07-21 22:17:23.000000000 -0400 | |
21407 | +++ linux-3.0.3/arch/x86/xen/mmu.c 2011-08-24 18:10:12.000000000 -0400 | |
21408 | @@ -1679,6 +1679,8 @@ pgd_t * __init xen_setup_kernel_pagetabl | |
21409 | convert_pfn_mfn(init_level4_pgt); | |
21410 | convert_pfn_mfn(level3_ident_pgt); | |
21411 | convert_pfn_mfn(level3_kernel_pgt); | |
21412 | + convert_pfn_mfn(level3_vmalloc_pgt); | |
21413 | + convert_pfn_mfn(level3_vmemmap_pgt); | |
21414 | ||
21415 | l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd); | |
21416 | l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud); | |
21417 | @@ -1697,7 +1699,10 @@ pgd_t * __init xen_setup_kernel_pagetabl | |
21418 | set_page_prot(init_level4_pgt, PAGE_KERNEL_RO); | |
21419 | set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO); | |
21420 | set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO); | |
21421 | + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO); | |
21422 | + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO); | |
21423 | set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO); | |
21424 | + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO); | |
21425 | set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO); | |
21426 | set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO); | |
21427 | ||
21428 | @@ -1909,6 +1914,7 @@ static void __init xen_post_allocator_in | |
21429 | pv_mmu_ops.set_pud = xen_set_pud; | |
21430 | #if PAGETABLE_LEVELS == 4 | |
21431 | pv_mmu_ops.set_pgd = xen_set_pgd; | |
21432 | + pv_mmu_ops.set_pgd_batched = xen_set_pgd; | |
21433 | #endif | |
21434 | ||
21435 | /* This will work as long as patching hasn't happened yet | |
21436 | @@ -1990,6 +1996,7 @@ static const struct pv_mmu_ops xen_mmu_o | |
21437 | .pud_val = PV_CALLEE_SAVE(xen_pud_val), | |
21438 | .make_pud = PV_CALLEE_SAVE(xen_make_pud), | |
21439 | .set_pgd = xen_set_pgd_hyper, | |
21440 | + .set_pgd_batched = xen_set_pgd_hyper, | |
21441 | ||
21442 | .alloc_pud = xen_alloc_pmd_init, | |
21443 | .release_pud = xen_release_pmd_init, | |
21444 | diff -urNp linux-3.0.3/arch/x86/xen/smp.c linux-3.0.3/arch/x86/xen/smp.c | |
21445 | --- linux-3.0.3/arch/x86/xen/smp.c 2011-07-21 22:17:23.000000000 -0400 | |
21446 | +++ linux-3.0.3/arch/x86/xen/smp.c 2011-08-23 21:47:55.000000000 -0400 | |
21447 | @@ -193,11 +193,6 @@ static void __init xen_smp_prepare_boot_ | |
21448 | { | |
21449 | BUG_ON(smp_processor_id() != 0); | |
21450 | native_smp_prepare_boot_cpu(); | |
21451 | - | |
21452 | - /* We've switched to the "real" per-cpu gdt, so make sure the | |
21453 | - old memory can be recycled */ | |
21454 | - make_lowmem_page_readwrite(xen_initial_gdt); | |
21455 | - | |
21456 | xen_filter_cpu_maps(); | |
21457 | xen_setup_vcpu_info_placement(); | |
21458 | } | |
21459 | @@ -265,12 +260,12 @@ cpu_initialize_context(unsigned int cpu, | |
21460 | gdt = get_cpu_gdt_table(cpu); | |
21461 | ||
21462 | ctxt->flags = VGCF_IN_KERNEL; | |
21463 | - ctxt->user_regs.ds = __USER_DS; | |
21464 | - ctxt->user_regs.es = __USER_DS; | |
21465 | + ctxt->user_regs.ds = __KERNEL_DS; | |
21466 | + ctxt->user_regs.es = __KERNEL_DS; | |
21467 | ctxt->user_regs.ss = __KERNEL_DS; | |
21468 | #ifdef CONFIG_X86_32 | |
21469 | ctxt->user_regs.fs = __KERNEL_PERCPU; | |
21470 | - ctxt->user_regs.gs = __KERNEL_STACK_CANARY; | |
21471 | + savesegment(gs, ctxt->user_regs.gs); | |
21472 | #else | |
21473 | ctxt->gs_base_kernel = per_cpu_offset(cpu); | |
21474 | #endif | |
21475 | @@ -321,13 +316,12 @@ static int __cpuinit xen_cpu_up(unsigned | |
21476 | int rc; | |
21477 | ||
21478 | per_cpu(current_task, cpu) = idle; | |
21479 | + per_cpu(current_tinfo, cpu) = &idle->tinfo; | |
21480 | #ifdef CONFIG_X86_32 | |
21481 | irq_ctx_init(cpu); | |
21482 | #else | |
21483 | clear_tsk_thread_flag(idle, TIF_FORK); | |
21484 | - per_cpu(kernel_stack, cpu) = | |
21485 | - (unsigned long)task_stack_page(idle) - | |
21486 | - KERNEL_STACK_OFFSET + THREAD_SIZE; | |
21487 | + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE; | |
21488 | #endif | |
21489 | xen_setup_runstate_info(cpu); | |
21490 | xen_setup_timer(cpu); | |
21491 | diff -urNp linux-3.0.3/arch/x86/xen/xen-asm_32.S linux-3.0.3/arch/x86/xen/xen-asm_32.S | |
21492 | --- linux-3.0.3/arch/x86/xen/xen-asm_32.S 2011-07-21 22:17:23.000000000 -0400 | |
21493 | +++ linux-3.0.3/arch/x86/xen/xen-asm_32.S 2011-08-23 21:47:55.000000000 -0400 | |
21494 | @@ -83,14 +83,14 @@ ENTRY(xen_iret) | |
21495 | ESP_OFFSET=4 # bytes pushed onto stack | |
21496 | ||
21497 | /* | |
21498 | - * Store vcpu_info pointer for easy access. Do it this way to | |
21499 | - * avoid having to reload %fs | |
21500 | + * Store vcpu_info pointer for easy access. | |
21501 | */ | |
21502 | #ifdef CONFIG_SMP | |
21503 | - GET_THREAD_INFO(%eax) | |
21504 | - movl TI_cpu(%eax), %eax | |
21505 | - movl __per_cpu_offset(,%eax,4), %eax | |
21506 | - mov xen_vcpu(%eax), %eax | |
21507 | + push %fs | |
21508 | + mov $(__KERNEL_PERCPU), %eax | |
21509 | + mov %eax, %fs | |
21510 | + mov PER_CPU_VAR(xen_vcpu), %eax | |
21511 | + pop %fs | |
21512 | #else | |
21513 | movl xen_vcpu, %eax | |
21514 | #endif | |
21515 | diff -urNp linux-3.0.3/arch/x86/xen/xen-head.S linux-3.0.3/arch/x86/xen/xen-head.S | |
21516 | --- linux-3.0.3/arch/x86/xen/xen-head.S 2011-07-21 22:17:23.000000000 -0400 | |
21517 | +++ linux-3.0.3/arch/x86/xen/xen-head.S 2011-08-23 21:47:55.000000000 -0400 | |
21518 | @@ -19,6 +19,17 @@ ENTRY(startup_xen) | |
21519 | #ifdef CONFIG_X86_32 | |
21520 | mov %esi,xen_start_info | |
21521 | mov $init_thread_union+THREAD_SIZE,%esp | |
21522 | +#ifdef CONFIG_SMP | |
21523 | + movl $cpu_gdt_table,%edi | |
21524 | + movl $__per_cpu_load,%eax | |
21525 | + movw %ax,__KERNEL_PERCPU + 2(%edi) | |
21526 | + rorl $16,%eax | |
21527 | + movb %al,__KERNEL_PERCPU + 4(%edi) | |
21528 | + movb %ah,__KERNEL_PERCPU + 7(%edi) | |
21529 | + movl $__per_cpu_end - 1,%eax | |
21530 | + subl $__per_cpu_start,%eax | |
21531 | + movw %ax,__KERNEL_PERCPU + 0(%edi) | |
21532 | +#endif | |
21533 | #else | |
21534 | mov %rsi,xen_start_info | |
21535 | mov $init_thread_union+THREAD_SIZE,%rsp | |
21536 | diff -urNp linux-3.0.3/arch/x86/xen/xen-ops.h linux-3.0.3/arch/x86/xen/xen-ops.h | |
21537 | --- linux-3.0.3/arch/x86/xen/xen-ops.h 2011-08-23 21:44:40.000000000 -0400 | |
21538 | +++ linux-3.0.3/arch/x86/xen/xen-ops.h 2011-08-23 21:47:55.000000000 -0400 | |
21539 | @@ -10,8 +10,6 @@ | |
21540 | extern const char xen_hypervisor_callback[]; | |
21541 | extern const char xen_failsafe_callback[]; | |
21542 | ||
21543 | -extern void *xen_initial_gdt; | |
21544 | - | |
21545 | struct trap_info; | |
21546 | void xen_copy_trap_info(struct trap_info *traps); | |
21547 | ||
21548 | diff -urNp linux-3.0.3/block/blk-iopoll.c linux-3.0.3/block/blk-iopoll.c | |
21549 | --- linux-3.0.3/block/blk-iopoll.c 2011-07-21 22:17:23.000000000 -0400 | |
21550 | +++ linux-3.0.3/block/blk-iopoll.c 2011-08-23 21:47:55.000000000 -0400 | |
21551 | @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo | |
21552 | } | |
21553 | EXPORT_SYMBOL(blk_iopoll_complete); | |
21554 | ||
21555 | -static void blk_iopoll_softirq(struct softirq_action *h) | |
21556 | +static void blk_iopoll_softirq(void) | |
21557 | { | |
21558 | struct list_head *list = &__get_cpu_var(blk_cpu_iopoll); | |
21559 | int rearm = 0, budget = blk_iopoll_budget; | |
21560 | diff -urNp linux-3.0.3/block/blk-map.c linux-3.0.3/block/blk-map.c | |
21561 | --- linux-3.0.3/block/blk-map.c 2011-07-21 22:17:23.000000000 -0400 | |
21562 | +++ linux-3.0.3/block/blk-map.c 2011-08-23 21:47:55.000000000 -0400 | |
21563 | @@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue | |
21564 | if (!len || !kbuf) | |
21565 | return -EINVAL; | |
21566 | ||
21567 | - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf); | |
21568 | + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf); | |
21569 | if (do_copy) | |
21570 | bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading); | |
21571 | else | |
21572 | diff -urNp linux-3.0.3/block/blk-softirq.c linux-3.0.3/block/blk-softirq.c | |
21573 | --- linux-3.0.3/block/blk-softirq.c 2011-07-21 22:17:23.000000000 -0400 | |
21574 | +++ linux-3.0.3/block/blk-softirq.c 2011-08-23 21:47:55.000000000 -0400 | |
21575 | @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, | |
21576 | * Softirq action handler - move entries to local list and loop over them | |
21577 | * while passing them to the queue registered handler. | |
21578 | */ | |
21579 | -static void blk_done_softirq(struct softirq_action *h) | |
21580 | +static void blk_done_softirq(void) | |
21581 | { | |
21582 | struct list_head *cpu_list, local_list; | |
21583 | ||
21584 | diff -urNp linux-3.0.3/block/bsg.c linux-3.0.3/block/bsg.c | |
21585 | --- linux-3.0.3/block/bsg.c 2011-07-21 22:17:23.000000000 -0400 | |
21586 | +++ linux-3.0.3/block/bsg.c 2011-08-23 21:47:55.000000000 -0400 | |
21587 | @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r | |
21588 | struct sg_io_v4 *hdr, struct bsg_device *bd, | |
21589 | fmode_t has_write_perm) | |
21590 | { | |
21591 | + unsigned char tmpcmd[sizeof(rq->__cmd)]; | |
21592 | + unsigned char *cmdptr; | |
21593 | + | |
21594 | if (hdr->request_len > BLK_MAX_CDB) { | |
21595 | rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL); | |
21596 | if (!rq->cmd) | |
21597 | return -ENOMEM; | |
21598 | - } | |
21599 | + cmdptr = rq->cmd; | |
21600 | + } else | |
21601 | + cmdptr = tmpcmd; | |
21602 | ||
21603 | - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request, | |
21604 | + if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request, | |
21605 | hdr->request_len)) | |
21606 | return -EFAULT; | |
21607 | ||
21608 | + if (cmdptr != rq->cmd) | |
21609 | + memcpy(rq->cmd, cmdptr, hdr->request_len); | |
21610 | + | |
21611 | if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) { | |
21612 | if (blk_verify_command(rq->cmd, has_write_perm)) | |
21613 | return -EPERM; | |
21614 | diff -urNp linux-3.0.3/block/scsi_ioctl.c linux-3.0.3/block/scsi_ioctl.c | |
21615 | --- linux-3.0.3/block/scsi_ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
21616 | +++ linux-3.0.3/block/scsi_ioctl.c 2011-08-23 21:47:55.000000000 -0400 | |
21617 | @@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command); | |
21618 | static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq, | |
21619 | struct sg_io_hdr *hdr, fmode_t mode) | |
21620 | { | |
21621 | - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) | |
21622 | + unsigned char tmpcmd[sizeof(rq->__cmd)]; | |
21623 | + unsigned char *cmdptr; | |
21624 | + | |
21625 | + if (rq->cmd != rq->__cmd) | |
21626 | + cmdptr = rq->cmd; | |
21627 | + else | |
21628 | + cmdptr = tmpcmd; | |
21629 | + | |
21630 | + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len)) | |
21631 | return -EFAULT; | |
21632 | + | |
21633 | + if (cmdptr != rq->cmd) | |
21634 | + memcpy(rq->cmd, cmdptr, hdr->cmd_len); | |
21635 | + | |
21636 | if (blk_verify_command(rq->cmd, mode & FMODE_WRITE)) | |
21637 | return -EPERM; | |
21638 | ||
21639 | @@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue * | |
21640 | int err; | |
21641 | unsigned int in_len, out_len, bytes, opcode, cmdlen; | |
21642 | char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE]; | |
21643 | + unsigned char tmpcmd[sizeof(rq->__cmd)]; | |
21644 | + unsigned char *cmdptr; | |
21645 | ||
21646 | if (!sic) | |
21647 | return -EINVAL; | |
21648 | @@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue * | |
21649 | */ | |
21650 | err = -EFAULT; | |
21651 | rq->cmd_len = cmdlen; | |
21652 | - if (copy_from_user(rq->cmd, sic->data, cmdlen)) | |
21653 | + | |
21654 | + if (rq->cmd != rq->__cmd) | |
21655 | + cmdptr = rq->cmd; | |
21656 | + else | |
21657 | + cmdptr = tmpcmd; | |
21658 | + | |
21659 | + if (copy_from_user(cmdptr, sic->data, cmdlen)) | |
21660 | goto error; | |
21661 | ||
21662 | + if (rq->cmd != cmdptr) | |
21663 | + memcpy(rq->cmd, cmdptr, cmdlen); | |
21664 | + | |
21665 | if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len)) | |
21666 | goto error; | |
21667 | ||
21668 | diff -urNp linux-3.0.3/crypto/cryptd.c linux-3.0.3/crypto/cryptd.c | |
21669 | --- linux-3.0.3/crypto/cryptd.c 2011-07-21 22:17:23.000000000 -0400 | |
21670 | +++ linux-3.0.3/crypto/cryptd.c 2011-08-23 21:47:55.000000000 -0400 | |
21671 | @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx { | |
21672 | ||
21673 | struct cryptd_blkcipher_request_ctx { | |
21674 | crypto_completion_t complete; | |
21675 | -}; | |
21676 | +} __no_const; | |
21677 | ||
21678 | struct cryptd_hash_ctx { | |
21679 | struct crypto_shash *child; | |
21680 | @@ -80,7 +80,7 @@ struct cryptd_aead_ctx { | |
21681 | ||
21682 | struct cryptd_aead_request_ctx { | |
21683 | crypto_completion_t complete; | |
21684 | -}; | |
21685 | +} __no_const; | |
21686 | ||
21687 | static void cryptd_queue_worker(struct work_struct *work); | |
21688 | ||
21689 | diff -urNp linux-3.0.3/crypto/gf128mul.c linux-3.0.3/crypto/gf128mul.c | |
21690 | --- linux-3.0.3/crypto/gf128mul.c 2011-07-21 22:17:23.000000000 -0400 | |
21691 | +++ linux-3.0.3/crypto/gf128mul.c 2011-08-23 21:47:55.000000000 -0400 | |
21692 | @@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128 | |
21693 | for (i = 0; i < 7; ++i) | |
21694 | gf128mul_x_lle(&p[i + 1], &p[i]); | |
21695 | ||
21696 | - memset(r, 0, sizeof(r)); | |
21697 | + memset(r, 0, sizeof(*r)); | |
21698 | for (i = 0;;) { | |
21699 | u8 ch = ((u8 *)b)[15 - i]; | |
21700 | ||
21701 | @@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128 | |
21702 | for (i = 0; i < 7; ++i) | |
21703 | gf128mul_x_bbe(&p[i + 1], &p[i]); | |
21704 | ||
21705 | - memset(r, 0, sizeof(r)); | |
21706 | + memset(r, 0, sizeof(*r)); | |
21707 | for (i = 0;;) { | |
21708 | u8 ch = ((u8 *)b)[i]; | |
21709 | ||
21710 | diff -urNp linux-3.0.3/crypto/serpent.c linux-3.0.3/crypto/serpent.c | |
21711 | --- linux-3.0.3/crypto/serpent.c 2011-07-21 22:17:23.000000000 -0400 | |
21712 | +++ linux-3.0.3/crypto/serpent.c 2011-08-23 21:48:14.000000000 -0400 | |
21713 | @@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_ | |
21714 | u32 r0,r1,r2,r3,r4; | |
21715 | int i; | |
21716 | ||
21717 | + pax_track_stack(); | |
21718 | + | |
21719 | /* Copy key, add padding */ | |
21720 | ||
21721 | for (i = 0; i < keylen; ++i) | |
21722 | diff -urNp linux-3.0.3/Documentation/dontdiff linux-3.0.3/Documentation/dontdiff | |
21723 | --- linux-3.0.3/Documentation/dontdiff 2011-07-21 22:17:23.000000000 -0400 | |
21724 | +++ linux-3.0.3/Documentation/dontdiff 2011-08-23 21:47:55.000000000 -0400 | |
21725 | @@ -5,6 +5,7 @@ | |
21726 | *.cis | |
21727 | *.cpio | |
21728 | *.csp | |
21729 | +*.dbg | |
21730 | *.dsp | |
21731 | *.dvi | |
21732 | *.elf | |
21733 | @@ -48,9 +49,11 @@ | |
21734 | *.tab.h | |
21735 | *.tex | |
21736 | *.ver | |
21737 | +*.vim | |
21738 | *.xml | |
21739 | *.xz | |
21740 | *_MODULES | |
21741 | +*_reg_safe.h | |
21742 | *_vga16.c | |
21743 | *~ | |
21744 | \#*# | |
21745 | @@ -70,6 +73,7 @@ Kerntypes | |
21746 | Module.markers | |
21747 | Module.symvers | |
21748 | PENDING | |
21749 | +PERF* | |
21750 | SCCS | |
21751 | System.map* | |
21752 | TAGS | |
21753 | @@ -98,6 +102,8 @@ bzImage* | |
21754 | capability_names.h | |
21755 | capflags.c | |
21756 | classlist.h* | |
21757 | +clut_vga16.c | |
21758 | +common-cmds.h | |
21759 | comp*.log | |
21760 | compile.h* | |
21761 | conf | |
21762 | @@ -126,12 +132,14 @@ fore200e_pca_fw.c* | |
21763 | gconf | |
21764 | gconf.glade.h | |
21765 | gen-devlist | |
21766 | +gen-kdb_cmds.c | |
21767 | gen_crc32table | |
21768 | gen_init_cpio | |
21769 | generated | |
21770 | genheaders | |
21771 | genksyms | |
21772 | *_gray256.c | |
21773 | +hash | |
21774 | hpet_example | |
21775 | hugepage-mmap | |
21776 | hugepage-shm | |
21777 | @@ -146,7 +154,6 @@ int32.c | |
21778 | int4.c | |
21779 | int8.c | |
21780 | kallsyms | |
21781 | -kconfig | |
21782 | keywords.c | |
21783 | ksym.c* | |
21784 | ksym.h* | |
21785 | @@ -154,7 +161,6 @@ kxgettext | |
21786 | lkc_defs.h | |
21787 | lex.c | |
21788 | lex.*.c | |
21789 | -linux | |
21790 | logo_*.c | |
21791 | logo_*_clut224.c | |
21792 | logo_*_mono.c | |
21793 | @@ -174,6 +180,7 @@ mkboot | |
21794 | mkbugboot | |
21795 | mkcpustr | |
21796 | mkdep | |
21797 | +mkpiggy | |
21798 | mkprep | |
21799 | mkregtable | |
21800 | mktables | |
21801 | @@ -209,6 +216,7 @@ r300_reg_safe.h | |
21802 | r420_reg_safe.h | |
21803 | r600_reg_safe.h | |
21804 | recordmcount | |
21805 | +regdb.c | |
21806 | relocs | |
21807 | rlim_names.h | |
21808 | rn50_reg_safe.h | |
21809 | @@ -219,6 +227,7 @@ setup | |
21810 | setup.bin | |
21811 | setup.elf | |
21812 | sImage | |
21813 | +slabinfo | |
21814 | sm_tbl* | |
21815 | split-include | |
21816 | syscalltab.h | |
21817 | @@ -246,7 +255,9 @@ vmlinux | |
21818 | vmlinux-* | |
21819 | vmlinux.aout | |
21820 | vmlinux.bin.all | |
21821 | +vmlinux.bin.bz2 | |
21822 | vmlinux.lds | |
21823 | +vmlinux.relocs | |
21824 | vmlinuz | |
21825 | voffset.h | |
21826 | vsyscall.lds | |
21827 | @@ -254,6 +265,7 @@ vsyscall_32.lds | |
21828 | wanxlfw.inc | |
21829 | uImage | |
21830 | unifdef | |
21831 | +utsrelease.h | |
21832 | wakeup.bin | |
21833 | wakeup.elf | |
21834 | wakeup.lds | |
21835 | diff -urNp linux-3.0.3/Documentation/kernel-parameters.txt linux-3.0.3/Documentation/kernel-parameters.txt | |
21836 | --- linux-3.0.3/Documentation/kernel-parameters.txt 2011-07-21 22:17:23.000000000 -0400 | |
21837 | +++ linux-3.0.3/Documentation/kernel-parameters.txt 2011-08-23 21:47:55.000000000 -0400 | |
21838 | @@ -1883,6 +1883,13 @@ bytes respectively. Such letter suffixes | |
21839 | the specified number of seconds. This is to be used if | |
21840 | your oopses keep scrolling off the screen. | |
21841 | ||
21842 | + pax_nouderef [X86] disables UDEREF. Most likely needed under certain | |
21843 | + virtualization environments that don't cope well with the | |
21844 | + expand down segment used by UDEREF on X86-32 or the frequent | |
21845 | + page table updates on X86-64. | |
21846 | + | |
21847 | + pax_softmode= 0/1 to disable/enable PaX softmode on boot already. | |
21848 | + | |
21849 | pcbit= [HW,ISDN] | |
21850 | ||
21851 | pcd. [PARIDE] | |
21852 | diff -urNp linux-3.0.3/drivers/acpi/apei/cper.c linux-3.0.3/drivers/acpi/apei/cper.c | |
21853 | --- linux-3.0.3/drivers/acpi/apei/cper.c 2011-07-21 22:17:23.000000000 -0400 | |
21854 | +++ linux-3.0.3/drivers/acpi/apei/cper.c 2011-08-23 21:47:55.000000000 -0400 | |
21855 | @@ -38,12 +38,12 @@ | |
21856 | */ | |
21857 | u64 cper_next_record_id(void) | |
21858 | { | |
21859 | - static atomic64_t seq; | |
21860 | + static atomic64_unchecked_t seq; | |
21861 | ||
21862 | - if (!atomic64_read(&seq)) | |
21863 | - atomic64_set(&seq, ((u64)get_seconds()) << 32); | |
21864 | + if (!atomic64_read_unchecked(&seq)) | |
21865 | + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32); | |
21866 | ||
21867 | - return atomic64_inc_return(&seq); | |
21868 | + return atomic64_inc_return_unchecked(&seq); | |
21869 | } | |
21870 | EXPORT_SYMBOL_GPL(cper_next_record_id); | |
21871 | ||
21872 | diff -urNp linux-3.0.3/drivers/acpi/ec_sys.c linux-3.0.3/drivers/acpi/ec_sys.c | |
21873 | --- linux-3.0.3/drivers/acpi/ec_sys.c 2011-07-21 22:17:23.000000000 -0400 | |
21874 | +++ linux-3.0.3/drivers/acpi/ec_sys.c 2011-08-24 19:06:55.000000000 -0400 | |
21875 | @@ -11,6 +11,7 @@ | |
21876 | #include <linux/kernel.h> | |
21877 | #include <linux/acpi.h> | |
21878 | #include <linux/debugfs.h> | |
21879 | +#include <asm/uaccess.h> | |
21880 | #include "internal.h" | |
21881 | ||
21882 | MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>"); | |
21883 | @@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct fi | |
21884 | * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private; | |
21885 | */ | |
21886 | unsigned int size = EC_SPACE_SIZE; | |
21887 | - u8 *data = (u8 *) buf; | |
21888 | + u8 data; | |
21889 | loff_t init_off = *off; | |
21890 | int err = 0; | |
21891 | ||
21892 | @@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct fi | |
21893 | size = count; | |
21894 | ||
21895 | while (size) { | |
21896 | - err = ec_read(*off, &data[*off - init_off]); | |
21897 | + err = ec_read(*off, &data); | |
21898 | if (err) | |
21899 | return err; | |
21900 | + if (put_user(data, &buf[*off - init_off])) | |
21901 | + return -EFAULT; | |
21902 | *off += 1; | |
21903 | size--; | |
21904 | } | |
21905 | @@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct f | |
21906 | ||
21907 | unsigned int size = count; | |
21908 | loff_t init_off = *off; | |
21909 | - u8 *data = (u8 *) buf; | |
21910 | int err = 0; | |
21911 | ||
21912 | if (*off >= EC_SPACE_SIZE) | |
21913 | @@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct f | |
21914 | } | |
21915 | ||
21916 | while (size) { | |
21917 | - u8 byte_write = data[*off - init_off]; | |
21918 | + u8 byte_write; | |
21919 | + if (get_user(byte_write, &buf[*off - init_off])) | |
21920 | + return -EFAULT; | |
21921 | err = ec_write(*off, byte_write); | |
21922 | if (err) | |
21923 | return err; | |
21924 | diff -urNp linux-3.0.3/drivers/acpi/proc.c linux-3.0.3/drivers/acpi/proc.c | |
21925 | --- linux-3.0.3/drivers/acpi/proc.c 2011-07-21 22:17:23.000000000 -0400 | |
21926 | +++ linux-3.0.3/drivers/acpi/proc.c 2011-08-23 21:47:55.000000000 -0400 | |
21927 | @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f | |
21928 | size_t count, loff_t * ppos) | |
21929 | { | |
21930 | struct list_head *node, *next; | |
21931 | - char strbuf[5]; | |
21932 | - char str[5] = ""; | |
21933 | - unsigned int len = count; | |
21934 | - | |
21935 | - if (len > 4) | |
21936 | - len = 4; | |
21937 | - if (len < 0) | |
21938 | - return -EFAULT; | |
21939 | + char strbuf[5] = {0}; | |
21940 | ||
21941 | - if (copy_from_user(strbuf, buffer, len)) | |
21942 | + if (count > 4) | |
21943 | + count = 4; | |
21944 | + if (copy_from_user(strbuf, buffer, count)) | |
21945 | return -EFAULT; | |
21946 | - strbuf[len] = '\0'; | |
21947 | - sscanf(strbuf, "%s", str); | |
21948 | + strbuf[count] = '\0'; | |
21949 | ||
21950 | mutex_lock(&acpi_device_lock); | |
21951 | list_for_each_safe(node, next, &acpi_wakeup_device_list) { | |
21952 | @@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f | |
21953 | if (!dev->wakeup.flags.valid) | |
21954 | continue; | |
21955 | ||
21956 | - if (!strncmp(dev->pnp.bus_id, str, 4)) { | |
21957 | + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) { | |
21958 | if (device_can_wakeup(&dev->dev)) { | |
21959 | bool enable = !device_may_wakeup(&dev->dev); | |
21960 | device_set_wakeup_enable(&dev->dev, enable); | |
21961 | diff -urNp linux-3.0.3/drivers/acpi/processor_driver.c linux-3.0.3/drivers/acpi/processor_driver.c | |
21962 | --- linux-3.0.3/drivers/acpi/processor_driver.c 2011-07-21 22:17:23.000000000 -0400 | |
21963 | +++ linux-3.0.3/drivers/acpi/processor_driver.c 2011-08-23 21:47:55.000000000 -0400 | |
21964 | @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add( | |
21965 | return 0; | |
21966 | #endif | |
21967 | ||
21968 | - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0)); | |
21969 | + BUG_ON(pr->id >= nr_cpu_ids); | |
21970 | ||
21971 | /* | |
21972 | * Buggy BIOS check | |
21973 | diff -urNp linux-3.0.3/drivers/ata/libata-core.c linux-3.0.3/drivers/ata/libata-core.c | |
21974 | --- linux-3.0.3/drivers/ata/libata-core.c 2011-07-21 22:17:23.000000000 -0400 | |
21975 | +++ linux-3.0.3/drivers/ata/libata-core.c 2011-08-23 21:47:55.000000000 -0400 | |
21976 | @@ -4753,7 +4753,7 @@ void ata_qc_free(struct ata_queued_cmd * | |
21977 | struct ata_port *ap; | |
21978 | unsigned int tag; | |
21979 | ||
21980 | - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ | |
21981 | + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ | |
21982 | ap = qc->ap; | |
21983 | ||
21984 | qc->flags = 0; | |
21985 | @@ -4769,7 +4769,7 @@ void __ata_qc_complete(struct ata_queued | |
21986 | struct ata_port *ap; | |
21987 | struct ata_link *link; | |
21988 | ||
21989 | - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ | |
21990 | + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */ | |
21991 | WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); | |
21992 | ap = qc->ap; | |
21993 | link = qc->dev->link; | |
21994 | @@ -5774,6 +5774,7 @@ static void ata_finalize_port_ops(struct | |
21995 | return; | |
21996 | ||
21997 | spin_lock(&lock); | |
21998 | + pax_open_kernel(); | |
21999 | ||
22000 | for (cur = ops->inherits; cur; cur = cur->inherits) { | |
22001 | void **inherit = (void **)cur; | |
22002 | @@ -5787,8 +5788,9 @@ static void ata_finalize_port_ops(struct | |
22003 | if (IS_ERR(*pp)) | |
22004 | *pp = NULL; | |
22005 | ||
22006 | - ops->inherits = NULL; | |
22007 | + *(struct ata_port_operations **)&ops->inherits = NULL; | |
22008 | ||
22009 | + pax_close_kernel(); | |
22010 | spin_unlock(&lock); | |
22011 | } | |
22012 | ||
22013 | diff -urNp linux-3.0.3/drivers/ata/libata-eh.c linux-3.0.3/drivers/ata/libata-eh.c | |
22014 | --- linux-3.0.3/drivers/ata/libata-eh.c 2011-07-21 22:17:23.000000000 -0400 | |
22015 | +++ linux-3.0.3/drivers/ata/libata-eh.c 2011-08-23 21:48:14.000000000 -0400 | |
22016 | @@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap) | |
22017 | { | |
22018 | struct ata_link *link; | |
22019 | ||
22020 | + pax_track_stack(); | |
22021 | + | |
22022 | ata_for_each_link(link, ap, HOST_FIRST) | |
22023 | ata_eh_link_report(link); | |
22024 | } | |
22025 | diff -urNp linux-3.0.3/drivers/ata/pata_arasan_cf.c linux-3.0.3/drivers/ata/pata_arasan_cf.c | |
22026 | --- linux-3.0.3/drivers/ata/pata_arasan_cf.c 2011-07-21 22:17:23.000000000 -0400 | |
22027 | +++ linux-3.0.3/drivers/ata/pata_arasan_cf.c 2011-08-23 21:47:55.000000000 -0400 | |
22028 | @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str | |
22029 | /* Handle platform specific quirks */ | |
22030 | if (pdata->quirk) { | |
22031 | if (pdata->quirk & CF_BROKEN_PIO) { | |
22032 | - ap->ops->set_piomode = NULL; | |
22033 | + pax_open_kernel(); | |
22034 | + *(void **)&ap->ops->set_piomode = NULL; | |
22035 | + pax_close_kernel(); | |
22036 | ap->pio_mask = 0; | |
22037 | } | |
22038 | if (pdata->quirk & CF_BROKEN_MWDMA) | |
22039 | diff -urNp linux-3.0.3/drivers/atm/adummy.c linux-3.0.3/drivers/atm/adummy.c | |
22040 | --- linux-3.0.3/drivers/atm/adummy.c 2011-07-21 22:17:23.000000000 -0400 | |
22041 | +++ linux-3.0.3/drivers/atm/adummy.c 2011-08-23 21:47:55.000000000 -0400 | |
22042 | @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct | |
22043 | vcc->pop(vcc, skb); | |
22044 | else | |
22045 | dev_kfree_skb_any(skb); | |
22046 | - atomic_inc(&vcc->stats->tx); | |
22047 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22048 | ||
22049 | return 0; | |
22050 | } | |
22051 | diff -urNp linux-3.0.3/drivers/atm/ambassador.c linux-3.0.3/drivers/atm/ambassador.c | |
22052 | --- linux-3.0.3/drivers/atm/ambassador.c 2011-07-21 22:17:23.000000000 -0400 | |
22053 | +++ linux-3.0.3/drivers/atm/ambassador.c 2011-08-23 21:47:55.000000000 -0400 | |
22054 | @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, | |
22055 | PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx); | |
22056 | ||
22057 | // VC layer stats | |
22058 | - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx); | |
22059 | + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx); | |
22060 | ||
22061 | // free the descriptor | |
22062 | kfree (tx_descr); | |
22063 | @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, | |
22064 | dump_skb ("<<<", vc, skb); | |
22065 | ||
22066 | // VC layer stats | |
22067 | - atomic_inc(&atm_vcc->stats->rx); | |
22068 | + atomic_inc_unchecked(&atm_vcc->stats->rx); | |
22069 | __net_timestamp(skb); | |
22070 | // end of our responsibility | |
22071 | atm_vcc->push (atm_vcc, skb); | |
22072 | @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, | |
22073 | } else { | |
22074 | PRINTK (KERN_INFO, "dropped over-size frame"); | |
22075 | // should we count this? | |
22076 | - atomic_inc(&atm_vcc->stats->rx_drop); | |
22077 | + atomic_inc_unchecked(&atm_vcc->stats->rx_drop); | |
22078 | } | |
22079 | ||
22080 | } else { | |
22081 | @@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at | |
22082 | } | |
22083 | ||
22084 | if (check_area (skb->data, skb->len)) { | |
22085 | - atomic_inc(&atm_vcc->stats->tx_err); | |
22086 | + atomic_inc_unchecked(&atm_vcc->stats->tx_err); | |
22087 | return -ENOMEM; // ? | |
22088 | } | |
22089 | ||
22090 | diff -urNp linux-3.0.3/drivers/atm/atmtcp.c linux-3.0.3/drivers/atm/atmtcp.c | |
22091 | --- linux-3.0.3/drivers/atm/atmtcp.c 2011-07-21 22:17:23.000000000 -0400 | |
22092 | +++ linux-3.0.3/drivers/atm/atmtcp.c 2011-08-23 21:47:55.000000000 -0400 | |
22093 | @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc | |
22094 | if (vcc->pop) vcc->pop(vcc,skb); | |
22095 | else dev_kfree_skb(skb); | |
22096 | if (dev_data) return 0; | |
22097 | - atomic_inc(&vcc->stats->tx_err); | |
22098 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22099 | return -ENOLINK; | |
22100 | } | |
22101 | size = skb->len+sizeof(struct atmtcp_hdr); | |
22102 | @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc | |
22103 | if (!new_skb) { | |
22104 | if (vcc->pop) vcc->pop(vcc,skb); | |
22105 | else dev_kfree_skb(skb); | |
22106 | - atomic_inc(&vcc->stats->tx_err); | |
22107 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22108 | return -ENOBUFS; | |
22109 | } | |
22110 | hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr)); | |
22111 | @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc | |
22112 | if (vcc->pop) vcc->pop(vcc,skb); | |
22113 | else dev_kfree_skb(skb); | |
22114 | out_vcc->push(out_vcc,new_skb); | |
22115 | - atomic_inc(&vcc->stats->tx); | |
22116 | - atomic_inc(&out_vcc->stats->rx); | |
22117 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22118 | + atomic_inc_unchecked(&out_vcc->stats->rx); | |
22119 | return 0; | |
22120 | } | |
22121 | ||
22122 | @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc | |
22123 | out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci)); | |
22124 | read_unlock(&vcc_sklist_lock); | |
22125 | if (!out_vcc) { | |
22126 | - atomic_inc(&vcc->stats->tx_err); | |
22127 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22128 | goto done; | |
22129 | } | |
22130 | skb_pull(skb,sizeof(struct atmtcp_hdr)); | |
22131 | @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc | |
22132 | __net_timestamp(new_skb); | |
22133 | skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len); | |
22134 | out_vcc->push(out_vcc,new_skb); | |
22135 | - atomic_inc(&vcc->stats->tx); | |
22136 | - atomic_inc(&out_vcc->stats->rx); | |
22137 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22138 | + atomic_inc_unchecked(&out_vcc->stats->rx); | |
22139 | done: | |
22140 | if (vcc->pop) vcc->pop(vcc,skb); | |
22141 | else dev_kfree_skb(skb); | |
22142 | diff -urNp linux-3.0.3/drivers/atm/eni.c linux-3.0.3/drivers/atm/eni.c | |
22143 | --- linux-3.0.3/drivers/atm/eni.c 2011-07-21 22:17:23.000000000 -0400 | |
22144 | +++ linux-3.0.3/drivers/atm/eni.c 2011-08-23 21:47:55.000000000 -0400 | |
22145 | @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc) | |
22146 | DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n", | |
22147 | vcc->dev->number); | |
22148 | length = 0; | |
22149 | - atomic_inc(&vcc->stats->rx_err); | |
22150 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22151 | } | |
22152 | else { | |
22153 | length = ATM_CELL_SIZE-1; /* no HEC */ | |
22154 | @@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc) | |
22155 | size); | |
22156 | } | |
22157 | eff = length = 0; | |
22158 | - atomic_inc(&vcc->stats->rx_err); | |
22159 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22160 | } | |
22161 | else { | |
22162 | size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2); | |
22163 | @@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc) | |
22164 | "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n", | |
22165 | vcc->dev->number,vcc->vci,length,size << 2,descr); | |
22166 | length = eff = 0; | |
22167 | - atomic_inc(&vcc->stats->rx_err); | |
22168 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22169 | } | |
22170 | } | |
22171 | skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL; | |
22172 | @@ -771,7 +771,7 @@ rx_dequeued++; | |
22173 | vcc->push(vcc,skb); | |
22174 | pushed++; | |
22175 | } | |
22176 | - atomic_inc(&vcc->stats->rx); | |
22177 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22178 | } | |
22179 | wake_up(&eni_dev->rx_wait); | |
22180 | } | |
22181 | @@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d | |
22182 | PCI_DMA_TODEVICE); | |
22183 | if (vcc->pop) vcc->pop(vcc,skb); | |
22184 | else dev_kfree_skb_irq(skb); | |
22185 | - atomic_inc(&vcc->stats->tx); | |
22186 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22187 | wake_up(&eni_dev->tx_wait); | |
22188 | dma_complete++; | |
22189 | } | |
22190 | diff -urNp linux-3.0.3/drivers/atm/firestream.c linux-3.0.3/drivers/atm/firestream.c | |
22191 | --- linux-3.0.3/drivers/atm/firestream.c 2011-07-21 22:17:23.000000000 -0400 | |
22192 | +++ linux-3.0.3/drivers/atm/firestream.c 2011-08-23 21:47:55.000000000 -0400 | |
22193 | @@ -749,7 +749,7 @@ static void process_txdone_queue (struct | |
22194 | } | |
22195 | } | |
22196 | ||
22197 | - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx); | |
22198 | + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx); | |
22199 | ||
22200 | fs_dprintk (FS_DEBUG_TXMEM, "i"); | |
22201 | fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb); | |
22202 | @@ -816,7 +816,7 @@ static void process_incoming (struct fs_ | |
22203 | #endif | |
22204 | skb_put (skb, qe->p1 & 0xffff); | |
22205 | ATM_SKB(skb)->vcc = atm_vcc; | |
22206 | - atomic_inc(&atm_vcc->stats->rx); | |
22207 | + atomic_inc_unchecked(&atm_vcc->stats->rx); | |
22208 | __net_timestamp(skb); | |
22209 | fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb); | |
22210 | atm_vcc->push (atm_vcc, skb); | |
22211 | @@ -837,12 +837,12 @@ static void process_incoming (struct fs_ | |
22212 | kfree (pe); | |
22213 | } | |
22214 | if (atm_vcc) | |
22215 | - atomic_inc(&atm_vcc->stats->rx_drop); | |
22216 | + atomic_inc_unchecked(&atm_vcc->stats->rx_drop); | |
22217 | break; | |
22218 | case 0x1f: /* Reassembly abort: no buffers. */ | |
22219 | /* Silently increment error counter. */ | |
22220 | if (atm_vcc) | |
22221 | - atomic_inc(&atm_vcc->stats->rx_drop); | |
22222 | + atomic_inc_unchecked(&atm_vcc->stats->rx_drop); | |
22223 | break; | |
22224 | default: /* Hmm. Haven't written the code to handle the others yet... -- REW */ | |
22225 | printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", | |
22226 | diff -urNp linux-3.0.3/drivers/atm/fore200e.c linux-3.0.3/drivers/atm/fore200e.c | |
22227 | --- linux-3.0.3/drivers/atm/fore200e.c 2011-07-21 22:17:23.000000000 -0400 | |
22228 | +++ linux-3.0.3/drivers/atm/fore200e.c 2011-08-23 21:47:55.000000000 -0400 | |
22229 | @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200 | |
22230 | #endif | |
22231 | /* check error condition */ | |
22232 | if (*entry->status & STATUS_ERROR) | |
22233 | - atomic_inc(&vcc->stats->tx_err); | |
22234 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22235 | else | |
22236 | - atomic_inc(&vcc->stats->tx); | |
22237 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22238 | } | |
22239 | } | |
22240 | ||
22241 | @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2 | |
22242 | if (skb == NULL) { | |
22243 | DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len); | |
22244 | ||
22245 | - atomic_inc(&vcc->stats->rx_drop); | |
22246 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22247 | return -ENOMEM; | |
22248 | } | |
22249 | ||
22250 | @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2 | |
22251 | ||
22252 | dev_kfree_skb_any(skb); | |
22253 | ||
22254 | - atomic_inc(&vcc->stats->rx_drop); | |
22255 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22256 | return -ENOMEM; | |
22257 | } | |
22258 | ||
22259 | ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0); | |
22260 | ||
22261 | vcc->push(vcc, skb); | |
22262 | - atomic_inc(&vcc->stats->rx); | |
22263 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22264 | ||
22265 | ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0); | |
22266 | ||
22267 | @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200 | |
22268 | DPRINTK(2, "damaged PDU on %d.%d.%d\n", | |
22269 | fore200e->atm_dev->number, | |
22270 | entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci); | |
22271 | - atomic_inc(&vcc->stats->rx_err); | |
22272 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22273 | } | |
22274 | } | |
22275 | ||
22276 | @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc | |
22277 | goto retry_here; | |
22278 | } | |
22279 | ||
22280 | - atomic_inc(&vcc->stats->tx_err); | |
22281 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22282 | ||
22283 | fore200e->tx_sat++; | |
22284 | DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n", | |
22285 | diff -urNp linux-3.0.3/drivers/atm/he.c linux-3.0.3/drivers/atm/he.c | |
22286 | --- linux-3.0.3/drivers/atm/he.c 2011-07-21 22:17:23.000000000 -0400 | |
22287 | +++ linux-3.0.3/drivers/atm/he.c 2011-08-23 21:47:55.000000000 -0400 | |
22288 | @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i | |
22289 | ||
22290 | if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) { | |
22291 | hprintk("HBUF_ERR! (cid 0x%x)\n", cid); | |
22292 | - atomic_inc(&vcc->stats->rx_drop); | |
22293 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22294 | goto return_host_buffers; | |
22295 | } | |
22296 | ||
22297 | @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i | |
22298 | RBRQ_LEN_ERR(he_dev->rbrq_head) | |
22299 | ? "LEN_ERR" : "", | |
22300 | vcc->vpi, vcc->vci); | |
22301 | - atomic_inc(&vcc->stats->rx_err); | |
22302 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22303 | goto return_host_buffers; | |
22304 | } | |
22305 | ||
22306 | @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i | |
22307 | vcc->push(vcc, skb); | |
22308 | spin_lock(&he_dev->global_lock); | |
22309 | ||
22310 | - atomic_inc(&vcc->stats->rx); | |
22311 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22312 | ||
22313 | return_host_buffers: | |
22314 | ++pdus_assembled; | |
22315 | @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str | |
22316 | tpd->vcc->pop(tpd->vcc, tpd->skb); | |
22317 | else | |
22318 | dev_kfree_skb_any(tpd->skb); | |
22319 | - atomic_inc(&tpd->vcc->stats->tx_err); | |
22320 | + atomic_inc_unchecked(&tpd->vcc->stats->tx_err); | |
22321 | } | |
22322 | pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status)); | |
22323 | return; | |
22324 | @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b | |
22325 | vcc->pop(vcc, skb); | |
22326 | else | |
22327 | dev_kfree_skb_any(skb); | |
22328 | - atomic_inc(&vcc->stats->tx_err); | |
22329 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22330 | return -EINVAL; | |
22331 | } | |
22332 | ||
22333 | @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b | |
22334 | vcc->pop(vcc, skb); | |
22335 | else | |
22336 | dev_kfree_skb_any(skb); | |
22337 | - atomic_inc(&vcc->stats->tx_err); | |
22338 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22339 | return -EINVAL; | |
22340 | } | |
22341 | #endif | |
22342 | @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b | |
22343 | vcc->pop(vcc, skb); | |
22344 | else | |
22345 | dev_kfree_skb_any(skb); | |
22346 | - atomic_inc(&vcc->stats->tx_err); | |
22347 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22348 | spin_unlock_irqrestore(&he_dev->global_lock, flags); | |
22349 | return -ENOMEM; | |
22350 | } | |
22351 | @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b | |
22352 | vcc->pop(vcc, skb); | |
22353 | else | |
22354 | dev_kfree_skb_any(skb); | |
22355 | - atomic_inc(&vcc->stats->tx_err); | |
22356 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22357 | spin_unlock_irqrestore(&he_dev->global_lock, flags); | |
22358 | return -ENOMEM; | |
22359 | } | |
22360 | @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b | |
22361 | __enqueue_tpd(he_dev, tpd, cid); | |
22362 | spin_unlock_irqrestore(&he_dev->global_lock, flags); | |
22363 | ||
22364 | - atomic_inc(&vcc->stats->tx); | |
22365 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22366 | ||
22367 | return 0; | |
22368 | } | |
22369 | diff -urNp linux-3.0.3/drivers/atm/horizon.c linux-3.0.3/drivers/atm/horizon.c | |
22370 | --- linux-3.0.3/drivers/atm/horizon.c 2011-07-21 22:17:23.000000000 -0400 | |
22371 | +++ linux-3.0.3/drivers/atm/horizon.c 2011-08-23 21:47:55.000000000 -0400 | |
22372 | @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, | |
22373 | { | |
22374 | struct atm_vcc * vcc = ATM_SKB(skb)->vcc; | |
22375 | // VC layer stats | |
22376 | - atomic_inc(&vcc->stats->rx); | |
22377 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22378 | __net_timestamp(skb); | |
22379 | // end of our responsibility | |
22380 | vcc->push (vcc, skb); | |
22381 | @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const | |
22382 | dev->tx_iovec = NULL; | |
22383 | ||
22384 | // VC layer stats | |
22385 | - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx); | |
22386 | + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx); | |
22387 | ||
22388 | // free the skb | |
22389 | hrz_kfree_skb (skb); | |
22390 | diff -urNp linux-3.0.3/drivers/atm/idt77252.c linux-3.0.3/drivers/atm/idt77252.c | |
22391 | --- linux-3.0.3/drivers/atm/idt77252.c 2011-07-21 22:17:23.000000000 -0400 | |
22392 | +++ linux-3.0.3/drivers/atm/idt77252.c 2011-08-23 21:47:55.000000000 -0400 | |
22393 | @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str | |
22394 | else | |
22395 | dev_kfree_skb(skb); | |
22396 | ||
22397 | - atomic_inc(&vcc->stats->tx); | |
22398 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22399 | } | |
22400 | ||
22401 | atomic_dec(&scq->used); | |
22402 | @@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st | |
22403 | if ((sb = dev_alloc_skb(64)) == NULL) { | |
22404 | printk("%s: Can't allocate buffers for aal0.\n", | |
22405 | card->name); | |
22406 | - atomic_add(i, &vcc->stats->rx_drop); | |
22407 | + atomic_add_unchecked(i, &vcc->stats->rx_drop); | |
22408 | break; | |
22409 | } | |
22410 | if (!atm_charge(vcc, sb->truesize)) { | |
22411 | RXPRINTK("%s: atm_charge() dropped aal0 packets.\n", | |
22412 | card->name); | |
22413 | - atomic_add(i - 1, &vcc->stats->rx_drop); | |
22414 | + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); | |
22415 | dev_kfree_skb(sb); | |
22416 | break; | |
22417 | } | |
22418 | @@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st | |
22419 | ATM_SKB(sb)->vcc = vcc; | |
22420 | __net_timestamp(sb); | |
22421 | vcc->push(vcc, sb); | |
22422 | - atomic_inc(&vcc->stats->rx); | |
22423 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22424 | ||
22425 | cell += ATM_CELL_PAYLOAD; | |
22426 | } | |
22427 | @@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st | |
22428 | "(CDC: %08x)\n", | |
22429 | card->name, len, rpp->len, readl(SAR_REG_CDC)); | |
22430 | recycle_rx_pool_skb(card, rpp); | |
22431 | - atomic_inc(&vcc->stats->rx_err); | |
22432 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22433 | return; | |
22434 | } | |
22435 | if (stat & SAR_RSQE_CRC) { | |
22436 | RXPRINTK("%s: AAL5 CRC error.\n", card->name); | |
22437 | recycle_rx_pool_skb(card, rpp); | |
22438 | - atomic_inc(&vcc->stats->rx_err); | |
22439 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22440 | return; | |
22441 | } | |
22442 | if (skb_queue_len(&rpp->queue) > 1) { | |
22443 | @@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st | |
22444 | RXPRINTK("%s: Can't alloc RX skb.\n", | |
22445 | card->name); | |
22446 | recycle_rx_pool_skb(card, rpp); | |
22447 | - atomic_inc(&vcc->stats->rx_err); | |
22448 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22449 | return; | |
22450 | } | |
22451 | if (!atm_charge(vcc, skb->truesize)) { | |
22452 | @@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st | |
22453 | __net_timestamp(skb); | |
22454 | ||
22455 | vcc->push(vcc, skb); | |
22456 | - atomic_inc(&vcc->stats->rx); | |
22457 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22458 | ||
22459 | return; | |
22460 | } | |
22461 | @@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st | |
22462 | __net_timestamp(skb); | |
22463 | ||
22464 | vcc->push(vcc, skb); | |
22465 | - atomic_inc(&vcc->stats->rx); | |
22466 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22467 | ||
22468 | if (skb->truesize > SAR_FB_SIZE_3) | |
22469 | add_rx_skb(card, 3, SAR_FB_SIZE_3, 1); | |
22470 | @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car | |
22471 | if (vcc->qos.aal != ATM_AAL0) { | |
22472 | RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n", | |
22473 | card->name, vpi, vci); | |
22474 | - atomic_inc(&vcc->stats->rx_drop); | |
22475 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22476 | goto drop; | |
22477 | } | |
22478 | ||
22479 | if ((sb = dev_alloc_skb(64)) == NULL) { | |
22480 | printk("%s: Can't allocate buffers for AAL0.\n", | |
22481 | card->name); | |
22482 | - atomic_inc(&vcc->stats->rx_err); | |
22483 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22484 | goto drop; | |
22485 | } | |
22486 | ||
22487 | @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car | |
22488 | ATM_SKB(sb)->vcc = vcc; | |
22489 | __net_timestamp(sb); | |
22490 | vcc->push(vcc, sb); | |
22491 | - atomic_inc(&vcc->stats->rx); | |
22492 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22493 | ||
22494 | drop: | |
22495 | skb_pull(queue, 64); | |
22496 | @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s | |
22497 | ||
22498 | if (vc == NULL) { | |
22499 | printk("%s: NULL connection in send().\n", card->name); | |
22500 | - atomic_inc(&vcc->stats->tx_err); | |
22501 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22502 | dev_kfree_skb(skb); | |
22503 | return -EINVAL; | |
22504 | } | |
22505 | if (!test_bit(VCF_TX, &vc->flags)) { | |
22506 | printk("%s: Trying to transmit on a non-tx VC.\n", card->name); | |
22507 | - atomic_inc(&vcc->stats->tx_err); | |
22508 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22509 | dev_kfree_skb(skb); | |
22510 | return -EINVAL; | |
22511 | } | |
22512 | @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s | |
22513 | break; | |
22514 | default: | |
22515 | printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal); | |
22516 | - atomic_inc(&vcc->stats->tx_err); | |
22517 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22518 | dev_kfree_skb(skb); | |
22519 | return -EINVAL; | |
22520 | } | |
22521 | ||
22522 | if (skb_shinfo(skb)->nr_frags != 0) { | |
22523 | printk("%s: No scatter-gather yet.\n", card->name); | |
22524 | - atomic_inc(&vcc->stats->tx_err); | |
22525 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22526 | dev_kfree_skb(skb); | |
22527 | return -EINVAL; | |
22528 | } | |
22529 | @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s | |
22530 | ||
22531 | err = queue_skb(card, vc, skb, oam); | |
22532 | if (err) { | |
22533 | - atomic_inc(&vcc->stats->tx_err); | |
22534 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22535 | dev_kfree_skb(skb); | |
22536 | return err; | |
22537 | } | |
22538 | @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v | |
22539 | skb = dev_alloc_skb(64); | |
22540 | if (!skb) { | |
22541 | printk("%s: Out of memory in send_oam().\n", card->name); | |
22542 | - atomic_inc(&vcc->stats->tx_err); | |
22543 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22544 | return -ENOMEM; | |
22545 | } | |
22546 | atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc); | |
22547 | diff -urNp linux-3.0.3/drivers/atm/iphase.c linux-3.0.3/drivers/atm/iphase.c | |
22548 | --- linux-3.0.3/drivers/atm/iphase.c 2011-07-21 22:17:23.000000000 -0400 | |
22549 | +++ linux-3.0.3/drivers/atm/iphase.c 2011-08-23 21:47:55.000000000 -0400 | |
22550 | @@ -1120,7 +1120,7 @@ static int rx_pkt(struct atm_dev *dev) | |
22551 | status = (u_short) (buf_desc_ptr->desc_mode); | |
22552 | if (status & (RX_CER | RX_PTE | RX_OFL)) | |
22553 | { | |
22554 | - atomic_inc(&vcc->stats->rx_err); | |
22555 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22556 | IF_ERR(printk("IA: bad packet, dropping it");) | |
22557 | if (status & RX_CER) { | |
22558 | IF_ERR(printk(" cause: packet CRC error\n");) | |
22559 | @@ -1143,7 +1143,7 @@ static int rx_pkt(struct atm_dev *dev) | |
22560 | len = dma_addr - buf_addr; | |
22561 | if (len > iadev->rx_buf_sz) { | |
22562 | printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz); | |
22563 | - atomic_inc(&vcc->stats->rx_err); | |
22564 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22565 | goto out_free_desc; | |
22566 | } | |
22567 | ||
22568 | @@ -1293,7 +1293,7 @@ static void rx_dle_intr(struct atm_dev * | |
22569 | ia_vcc = INPH_IA_VCC(vcc); | |
22570 | if (ia_vcc == NULL) | |
22571 | { | |
22572 | - atomic_inc(&vcc->stats->rx_err); | |
22573 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22574 | dev_kfree_skb_any(skb); | |
22575 | atm_return(vcc, atm_guess_pdu2truesize(len)); | |
22576 | goto INCR_DLE; | |
22577 | @@ -1305,7 +1305,7 @@ static void rx_dle_intr(struct atm_dev * | |
22578 | if ((length > iadev->rx_buf_sz) || (length > | |
22579 | (skb->len - sizeof(struct cpcs_trailer)))) | |
22580 | { | |
22581 | - atomic_inc(&vcc->stats->rx_err); | |
22582 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22583 | IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)", | |
22584 | length, skb->len);) | |
22585 | dev_kfree_skb_any(skb); | |
22586 | @@ -1321,7 +1321,7 @@ static void rx_dle_intr(struct atm_dev * | |
22587 | ||
22588 | IF_RX(printk("rx_dle_intr: skb push");) | |
22589 | vcc->push(vcc,skb); | |
22590 | - atomic_inc(&vcc->stats->rx); | |
22591 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22592 | iadev->rx_pkt_cnt++; | |
22593 | } | |
22594 | INCR_DLE: | |
22595 | @@ -2801,15 +2801,15 @@ static int ia_ioctl(struct atm_dev *dev, | |
22596 | { | |
22597 | struct k_sonet_stats *stats; | |
22598 | stats = &PRIV(_ia_dev[board])->sonet_stats; | |
22599 | - printk("section_bip: %d\n", atomic_read(&stats->section_bip)); | |
22600 | - printk("line_bip : %d\n", atomic_read(&stats->line_bip)); | |
22601 | - printk("path_bip : %d\n", atomic_read(&stats->path_bip)); | |
22602 | - printk("line_febe : %d\n", atomic_read(&stats->line_febe)); | |
22603 | - printk("path_febe : %d\n", atomic_read(&stats->path_febe)); | |
22604 | - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs)); | |
22605 | - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs)); | |
22606 | - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells)); | |
22607 | - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells)); | |
22608 | + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip)); | |
22609 | + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip)); | |
22610 | + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip)); | |
22611 | + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe)); | |
22612 | + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe)); | |
22613 | + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs)); | |
22614 | + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs)); | |
22615 | + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells)); | |
22616 | + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells)); | |
22617 | } | |
22618 | ia_cmds.status = 0; | |
22619 | break; | |
22620 | @@ -2914,7 +2914,7 @@ static int ia_pkt_tx (struct atm_vcc *vc | |
22621 | if ((desc == 0) || (desc > iadev->num_tx_desc)) | |
22622 | { | |
22623 | IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) | |
22624 | - atomic_inc(&vcc->stats->tx); | |
22625 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22626 | if (vcc->pop) | |
22627 | vcc->pop(vcc, skb); | |
22628 | else | |
22629 | @@ -3019,14 +3019,14 @@ static int ia_pkt_tx (struct atm_vcc *vc | |
22630 | ATM_DESC(skb) = vcc->vci; | |
22631 | skb_queue_tail(&iadev->tx_dma_q, skb); | |
22632 | ||
22633 | - atomic_inc(&vcc->stats->tx); | |
22634 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22635 | iadev->tx_pkt_cnt++; | |
22636 | /* Increment transaction counter */ | |
22637 | writel(2, iadev->dma+IPHASE5575_TX_COUNTER); | |
22638 | ||
22639 | #if 0 | |
22640 | /* add flow control logic */ | |
22641 | - if (atomic_read(&vcc->stats->tx) % 20 == 0) { | |
22642 | + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) { | |
22643 | if (iavcc->vc_desc_cnt > 10) { | |
22644 | vcc->tx_quota = vcc->tx_quota * 3 / 4; | |
22645 | printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota ); | |
22646 | diff -urNp linux-3.0.3/drivers/atm/lanai.c linux-3.0.3/drivers/atm/lanai.c | |
22647 | --- linux-3.0.3/drivers/atm/lanai.c 2011-07-21 22:17:23.000000000 -0400 | |
22648 | +++ linux-3.0.3/drivers/atm/lanai.c 2011-08-23 21:47:55.000000000 -0400 | |
22649 | @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l | |
22650 | vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0); | |
22651 | lanai_endtx(lanai, lvcc); | |
22652 | lanai_free_skb(lvcc->tx.atmvcc, skb); | |
22653 | - atomic_inc(&lvcc->tx.atmvcc->stats->tx); | |
22654 | + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx); | |
22655 | } | |
22656 | ||
22657 | /* Try to fill the buffer - don't call unless there is backlog */ | |
22658 | @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc | |
22659 | ATM_SKB(skb)->vcc = lvcc->rx.atmvcc; | |
22660 | __net_timestamp(skb); | |
22661 | lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb); | |
22662 | - atomic_inc(&lvcc->rx.atmvcc->stats->rx); | |
22663 | + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx); | |
22664 | out: | |
22665 | lvcc->rx.buf.ptr = end; | |
22666 | cardvcc_write(lvcc, endptr, vcc_rxreadptr); | |
22667 | @@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d | |
22668 | DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 " | |
22669 | "vcc %d\n", lanai->number, (unsigned int) s, vci); | |
22670 | lanai->stats.service_rxnotaal5++; | |
22671 | - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err); | |
22672 | + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err); | |
22673 | return 0; | |
22674 | } | |
22675 | if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) { | |
22676 | @@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d | |
22677 | int bytes; | |
22678 | read_unlock(&vcc_sklist_lock); | |
22679 | DPRINTK("got trashed rx pdu on vci %d\n", vci); | |
22680 | - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err); | |
22681 | + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err); | |
22682 | lvcc->stats.x.aal5.service_trash++; | |
22683 | bytes = (SERVICE_GET_END(s) * 16) - | |
22684 | (((unsigned long) lvcc->rx.buf.ptr) - | |
22685 | @@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d | |
22686 | } | |
22687 | if (s & SERVICE_STREAM) { | |
22688 | read_unlock(&vcc_sklist_lock); | |
22689 | - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err); | |
22690 | + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err); | |
22691 | lvcc->stats.x.aal5.service_stream++; | |
22692 | printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream " | |
22693 | "PDU on VCI %d!\n", lanai->number, vci); | |
22694 | @@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d | |
22695 | return 0; | |
22696 | } | |
22697 | DPRINTK("got rx crc error on vci %d\n", vci); | |
22698 | - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err); | |
22699 | + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err); | |
22700 | lvcc->stats.x.aal5.service_rxcrc++; | |
22701 | lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4]; | |
22702 | cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr); | |
22703 | diff -urNp linux-3.0.3/drivers/atm/nicstar.c linux-3.0.3/drivers/atm/nicstar.c | |
22704 | --- linux-3.0.3/drivers/atm/nicstar.c 2011-07-21 22:17:23.000000000 -0400 | |
22705 | +++ linux-3.0.3/drivers/atm/nicstar.c 2011-08-23 21:47:55.000000000 -0400 | |
22706 | @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, | |
22707 | if ((vc = (vc_map *) vcc->dev_data) == NULL) { | |
22708 | printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", | |
22709 | card->index); | |
22710 | - atomic_inc(&vcc->stats->tx_err); | |
22711 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22712 | dev_kfree_skb_any(skb); | |
22713 | return -EINVAL; | |
22714 | } | |
22715 | @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, | |
22716 | if (!vc->tx) { | |
22717 | printk("nicstar%d: Trying to transmit on a non-tx VC.\n", | |
22718 | card->index); | |
22719 | - atomic_inc(&vcc->stats->tx_err); | |
22720 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22721 | dev_kfree_skb_any(skb); | |
22722 | return -EINVAL; | |
22723 | } | |
22724 | @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, | |
22725 | if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) { | |
22726 | printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", | |
22727 | card->index); | |
22728 | - atomic_inc(&vcc->stats->tx_err); | |
22729 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22730 | dev_kfree_skb_any(skb); | |
22731 | return -EINVAL; | |
22732 | } | |
22733 | ||
22734 | if (skb_shinfo(skb)->nr_frags != 0) { | |
22735 | printk("nicstar%d: No scatter-gather yet.\n", card->index); | |
22736 | - atomic_inc(&vcc->stats->tx_err); | |
22737 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22738 | dev_kfree_skb_any(skb); | |
22739 | return -EINVAL; | |
22740 | } | |
22741 | @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, | |
22742 | } | |
22743 | ||
22744 | if (push_scqe(card, vc, scq, &scqe, skb) != 0) { | |
22745 | - atomic_inc(&vcc->stats->tx_err); | |
22746 | + atomic_inc_unchecked(&vcc->stats->tx_err); | |
22747 | dev_kfree_skb_any(skb); | |
22748 | return -EIO; | |
22749 | } | |
22750 | - atomic_inc(&vcc->stats->tx); | |
22751 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22752 | ||
22753 | return 0; | |
22754 | } | |
22755 | @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns | |
22756 | printk | |
22757 | ("nicstar%d: Can't allocate buffers for aal0.\n", | |
22758 | card->index); | |
22759 | - atomic_add(i, &vcc->stats->rx_drop); | |
22760 | + atomic_add_unchecked(i, &vcc->stats->rx_drop); | |
22761 | break; | |
22762 | } | |
22763 | if (!atm_charge(vcc, sb->truesize)) { | |
22764 | RXPRINTK | |
22765 | ("nicstar%d: atm_charge() dropped aal0 packets.\n", | |
22766 | card->index); | |
22767 | - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */ | |
22768 | + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */ | |
22769 | dev_kfree_skb_any(sb); | |
22770 | break; | |
22771 | } | |
22772 | @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22773 | ATM_SKB(sb)->vcc = vcc; | |
22774 | __net_timestamp(sb); | |
22775 | vcc->push(vcc, sb); | |
22776 | - atomic_inc(&vcc->stats->rx); | |
22777 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22778 | cell += ATM_CELL_PAYLOAD; | |
22779 | } | |
22780 | ||
22781 | @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22782 | if (iovb == NULL) { | |
22783 | printk("nicstar%d: Out of iovec buffers.\n", | |
22784 | card->index); | |
22785 | - atomic_inc(&vcc->stats->rx_drop); | |
22786 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22787 | recycle_rx_buf(card, skb); | |
22788 | return; | |
22789 | } | |
22790 | @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22791 | small or large buffer itself. */ | |
22792 | } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) { | |
22793 | printk("nicstar%d: received too big AAL5 SDU.\n", card->index); | |
22794 | - atomic_inc(&vcc->stats->rx_err); | |
22795 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22796 | recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data, | |
22797 | NS_MAX_IOVECS); | |
22798 | NS_PRV_IOVCNT(iovb) = 0; | |
22799 | @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22800 | ("nicstar%d: Expected a small buffer, and this is not one.\n", | |
22801 | card->index); | |
22802 | which_list(card, skb); | |
22803 | - atomic_inc(&vcc->stats->rx_err); | |
22804 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22805 | recycle_rx_buf(card, skb); | |
22806 | vc->rx_iov = NULL; | |
22807 | recycle_iov_buf(card, iovb); | |
22808 | @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22809 | ("nicstar%d: Expected a large buffer, and this is not one.\n", | |
22810 | card->index); | |
22811 | which_list(card, skb); | |
22812 | - atomic_inc(&vcc->stats->rx_err); | |
22813 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22814 | recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data, | |
22815 | NS_PRV_IOVCNT(iovb)); | |
22816 | vc->rx_iov = NULL; | |
22817 | @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22818 | printk(" - PDU size mismatch.\n"); | |
22819 | else | |
22820 | printk(".\n"); | |
22821 | - atomic_inc(&vcc->stats->rx_err); | |
22822 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
22823 | recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data, | |
22824 | NS_PRV_IOVCNT(iovb)); | |
22825 | vc->rx_iov = NULL; | |
22826 | @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22827 | /* skb points to a small buffer */ | |
22828 | if (!atm_charge(vcc, skb->truesize)) { | |
22829 | push_rxbufs(card, skb); | |
22830 | - atomic_inc(&vcc->stats->rx_drop); | |
22831 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22832 | } else { | |
22833 | skb_put(skb, len); | |
22834 | dequeue_sm_buf(card, skb); | |
22835 | @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22836 | ATM_SKB(skb)->vcc = vcc; | |
22837 | __net_timestamp(skb); | |
22838 | vcc->push(vcc, skb); | |
22839 | - atomic_inc(&vcc->stats->rx); | |
22840 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22841 | } | |
22842 | } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */ | |
22843 | struct sk_buff *sb; | |
22844 | @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22845 | if (len <= NS_SMBUFSIZE) { | |
22846 | if (!atm_charge(vcc, sb->truesize)) { | |
22847 | push_rxbufs(card, sb); | |
22848 | - atomic_inc(&vcc->stats->rx_drop); | |
22849 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22850 | } else { | |
22851 | skb_put(sb, len); | |
22852 | dequeue_sm_buf(card, sb); | |
22853 | @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22854 | ATM_SKB(sb)->vcc = vcc; | |
22855 | __net_timestamp(sb); | |
22856 | vcc->push(vcc, sb); | |
22857 | - atomic_inc(&vcc->stats->rx); | |
22858 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22859 | } | |
22860 | ||
22861 | push_rxbufs(card, skb); | |
22862 | @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22863 | ||
22864 | if (!atm_charge(vcc, skb->truesize)) { | |
22865 | push_rxbufs(card, skb); | |
22866 | - atomic_inc(&vcc->stats->rx_drop); | |
22867 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22868 | } else { | |
22869 | dequeue_lg_buf(card, skb); | |
22870 | #ifdef NS_USE_DESTRUCTORS | |
22871 | @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22872 | ATM_SKB(skb)->vcc = vcc; | |
22873 | __net_timestamp(skb); | |
22874 | vcc->push(vcc, skb); | |
22875 | - atomic_inc(&vcc->stats->rx); | |
22876 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22877 | } | |
22878 | ||
22879 | push_rxbufs(card, sb); | |
22880 | @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22881 | printk | |
22882 | ("nicstar%d: Out of huge buffers.\n", | |
22883 | card->index); | |
22884 | - atomic_inc(&vcc->stats->rx_drop); | |
22885 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22886 | recycle_iovec_rx_bufs(card, | |
22887 | (struct iovec *) | |
22888 | iovb->data, | |
22889 | @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22890 | card->hbpool.count++; | |
22891 | } else | |
22892 | dev_kfree_skb_any(hb); | |
22893 | - atomic_inc(&vcc->stats->rx_drop); | |
22894 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
22895 | } else { | |
22896 | /* Copy the small buffer to the huge buffer */ | |
22897 | sb = (struct sk_buff *)iov->iov_base; | |
22898 | @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns | |
22899 | #endif /* NS_USE_DESTRUCTORS */ | |
22900 | __net_timestamp(hb); | |
22901 | vcc->push(vcc, hb); | |
22902 | - atomic_inc(&vcc->stats->rx); | |
22903 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22904 | } | |
22905 | } | |
22906 | ||
22907 | diff -urNp linux-3.0.3/drivers/atm/solos-pci.c linux-3.0.3/drivers/atm/solos-pci.c | |
22908 | --- linux-3.0.3/drivers/atm/solos-pci.c 2011-07-21 22:17:23.000000000 -0400 | |
22909 | +++ linux-3.0.3/drivers/atm/solos-pci.c 2011-08-23 21:48:14.000000000 -0400 | |
22910 | @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg) | |
22911 | } | |
22912 | atm_charge(vcc, skb->truesize); | |
22913 | vcc->push(vcc, skb); | |
22914 | - atomic_inc(&vcc->stats->rx); | |
22915 | + atomic_inc_unchecked(&vcc->stats->rx); | |
22916 | break; | |
22917 | ||
22918 | case PKT_STATUS: | |
22919 | @@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff * | |
22920 | char msg[500]; | |
22921 | char item[10]; | |
22922 | ||
22923 | + pax_track_stack(); | |
22924 | + | |
22925 | len = buf->len; | |
22926 | for (i = 0; i < len; i++){ | |
22927 | if(i % 8 == 0) | |
22928 | @@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_car | |
22929 | vcc = SKB_CB(oldskb)->vcc; | |
22930 | ||
22931 | if (vcc) { | |
22932 | - atomic_inc(&vcc->stats->tx); | |
22933 | + atomic_inc_unchecked(&vcc->stats->tx); | |
22934 | solos_pop(vcc, oldskb); | |
22935 | } else | |
22936 | dev_kfree_skb_irq(oldskb); | |
22937 | diff -urNp linux-3.0.3/drivers/atm/suni.c linux-3.0.3/drivers/atm/suni.c | |
22938 | --- linux-3.0.3/drivers/atm/suni.c 2011-07-21 22:17:23.000000000 -0400 | |
22939 | +++ linux-3.0.3/drivers/atm/suni.c 2011-08-23 21:47:55.000000000 -0400 | |
22940 | @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock); | |
22941 | ||
22942 | ||
22943 | #define ADD_LIMITED(s,v) \ | |
22944 | - atomic_add((v),&stats->s); \ | |
22945 | - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX); | |
22946 | + atomic_add_unchecked((v),&stats->s); \ | |
22947 | + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX); | |
22948 | ||
22949 | ||
22950 | static void suni_hz(unsigned long from_timer) | |
22951 | diff -urNp linux-3.0.3/drivers/atm/uPD98402.c linux-3.0.3/drivers/atm/uPD98402.c | |
22952 | --- linux-3.0.3/drivers/atm/uPD98402.c 2011-07-21 22:17:23.000000000 -0400 | |
22953 | +++ linux-3.0.3/drivers/atm/uPD98402.c 2011-08-23 21:47:55.000000000 -0400 | |
22954 | @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d | |
22955 | struct sonet_stats tmp; | |
22956 | int error = 0; | |
22957 | ||
22958 | - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs); | |
22959 | + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs); | |
22960 | sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp); | |
22961 | if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp)); | |
22962 | if (zero && !error) { | |
22963 | @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev | |
22964 | ||
22965 | ||
22966 | #define ADD_LIMITED(s,v) \ | |
22967 | - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \ | |
22968 | - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \ | |
22969 | - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); } | |
22970 | + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \ | |
22971 | + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \ | |
22972 | + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); } | |
22973 | ||
22974 | ||
22975 | static void stat_event(struct atm_dev *dev) | |
22976 | @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev | |
22977 | if (reason & uPD98402_INT_PFM) stat_event(dev); | |
22978 | if (reason & uPD98402_INT_PCO) { | |
22979 | (void) GET(PCOCR); /* clear interrupt cause */ | |
22980 | - atomic_add(GET(HECCT), | |
22981 | + atomic_add_unchecked(GET(HECCT), | |
22982 | &PRIV(dev)->sonet_stats.uncorr_hcs); | |
22983 | } | |
22984 | if ((reason & uPD98402_INT_RFO) && | |
22985 | @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev | |
22986 | PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO | | |
22987 | uPD98402_INT_LOS),PIMR); /* enable them */ | |
22988 | (void) fetch_stats(dev,NULL,1); /* clear kernel counters */ | |
22989 | - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1); | |
22990 | - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1); | |
22991 | - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1); | |
22992 | + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1); | |
22993 | + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1); | |
22994 | + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1); | |
22995 | return 0; | |
22996 | } | |
22997 | ||
22998 | diff -urNp linux-3.0.3/drivers/atm/zatm.c linux-3.0.3/drivers/atm/zatm.c | |
22999 | --- linux-3.0.3/drivers/atm/zatm.c 2011-07-21 22:17:23.000000000 -0400 | |
23000 | +++ linux-3.0.3/drivers/atm/zatm.c 2011-08-23 21:47:55.000000000 -0400 | |
23001 | @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy | |
23002 | } | |
23003 | if (!size) { | |
23004 | dev_kfree_skb_irq(skb); | |
23005 | - if (vcc) atomic_inc(&vcc->stats->rx_err); | |
23006 | + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err); | |
23007 | continue; | |
23008 | } | |
23009 | if (!atm_charge(vcc,skb->truesize)) { | |
23010 | @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy | |
23011 | skb->len = size; | |
23012 | ATM_SKB(skb)->vcc = vcc; | |
23013 | vcc->push(vcc,skb); | |
23014 | - atomic_inc(&vcc->stats->rx); | |
23015 | + atomic_inc_unchecked(&vcc->stats->rx); | |
23016 | } | |
23017 | zout(pos & 0xffff,MTA(mbx)); | |
23018 | #if 0 /* probably a stupid idea */ | |
23019 | @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD | |
23020 | skb_queue_head(&zatm_vcc->backlog,skb); | |
23021 | break; | |
23022 | } | |
23023 | - atomic_inc(&vcc->stats->tx); | |
23024 | + atomic_inc_unchecked(&vcc->stats->tx); | |
23025 | wake_up(&zatm_vcc->tx_wait); | |
23026 | } | |
23027 | ||
23028 | diff -urNp linux-3.0.3/drivers/base/power/wakeup.c linux-3.0.3/drivers/base/power/wakeup.c | |
23029 | --- linux-3.0.3/drivers/base/power/wakeup.c 2011-07-21 22:17:23.000000000 -0400 | |
23030 | +++ linux-3.0.3/drivers/base/power/wakeup.c 2011-08-23 21:47:55.000000000 -0400 | |
23031 | @@ -29,14 +29,14 @@ bool events_check_enabled; | |
23032 | * They need to be modified together atomically, so it's better to use one | |
23033 | * atomic variable to hold them both. | |
23034 | */ | |
23035 | -static atomic_t combined_event_count = ATOMIC_INIT(0); | |
23036 | +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0); | |
23037 | ||
23038 | #define IN_PROGRESS_BITS (sizeof(int) * 4) | |
23039 | #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1) | |
23040 | ||
23041 | static void split_counters(unsigned int *cnt, unsigned int *inpr) | |
23042 | { | |
23043 | - unsigned int comb = atomic_read(&combined_event_count); | |
23044 | + unsigned int comb = atomic_read_unchecked(&combined_event_count); | |
23045 | ||
23046 | *cnt = (comb >> IN_PROGRESS_BITS); | |
23047 | *inpr = comb & MAX_IN_PROGRESS; | |
23048 | @@ -350,7 +350,7 @@ static void wakeup_source_activate(struc | |
23049 | ws->last_time = ktime_get(); | |
23050 | ||
23051 | /* Increment the counter of events in progress. */ | |
23052 | - atomic_inc(&combined_event_count); | |
23053 | + atomic_inc_unchecked(&combined_event_count); | |
23054 | } | |
23055 | ||
23056 | /** | |
23057 | @@ -440,7 +440,7 @@ static void wakeup_source_deactivate(str | |
23058 | * Increment the counter of registered wakeup events and decrement the | |
23059 | * couter of wakeup events in progress simultaneously. | |
23060 | */ | |
23061 | - atomic_add(MAX_IN_PROGRESS, &combined_event_count); | |
23062 | + atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count); | |
23063 | } | |
23064 | ||
23065 | /** | |
23066 | diff -urNp linux-3.0.3/drivers/block/cciss.c linux-3.0.3/drivers/block/cciss.c | |
23067 | --- linux-3.0.3/drivers/block/cciss.c 2011-07-21 22:17:23.000000000 -0400 | |
23068 | +++ linux-3.0.3/drivers/block/cciss.c 2011-08-23 21:48:14.000000000 -0400 | |
23069 | @@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct | |
23070 | int err; | |
23071 | u32 cp; | |
23072 | ||
23073 | + memset(&arg64, 0, sizeof(arg64)); | |
23074 | + | |
23075 | err = 0; | |
23076 | err |= | |
23077 | copy_from_user(&arg64.LUN_info, &arg32->LUN_info, | |
23078 | @@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h) | |
23079 | while (!list_empty(&h->reqQ)) { | |
23080 | c = list_entry(h->reqQ.next, CommandList_struct, list); | |
23081 | /* can't do anything if fifo is full */ | |
23082 | - if ((h->access.fifo_full(h))) { | |
23083 | + if ((h->access->fifo_full(h))) { | |
23084 | dev_warn(&h->pdev->dev, "fifo full\n"); | |
23085 | break; | |
23086 | } | |
23087 | @@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h) | |
23088 | h->Qdepth--; | |
23089 | ||
23090 | /* Tell the controller execute command */ | |
23091 | - h->access.submit_command(h, c); | |
23092 | + h->access->submit_command(h, c); | |
23093 | ||
23094 | /* Put job onto the completed Q */ | |
23095 | addQ(&h->cmpQ, c); | |
23096 | @@ -3422,17 +3424,17 @@ startio: | |
23097 | ||
23098 | static inline unsigned long get_next_completion(ctlr_info_t *h) | |
23099 | { | |
23100 | - return h->access.command_completed(h); | |
23101 | + return h->access->command_completed(h); | |
23102 | } | |
23103 | ||
23104 | static inline int interrupt_pending(ctlr_info_t *h) | |
23105 | { | |
23106 | - return h->access.intr_pending(h); | |
23107 | + return h->access->intr_pending(h); | |
23108 | } | |
23109 | ||
23110 | static inline long interrupt_not_for_us(ctlr_info_t *h) | |
23111 | { | |
23112 | - return ((h->access.intr_pending(h) == 0) || | |
23113 | + return ((h->access->intr_pending(h) == 0) || | |
23114 | (h->interrupts_enabled == 0)); | |
23115 | } | |
23116 | ||
23117 | @@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info | |
23118 | u32 a; | |
23119 | ||
23120 | if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant))) | |
23121 | - return h->access.command_completed(h); | |
23122 | + return h->access->command_completed(h); | |
23123 | ||
23124 | if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) { | |
23125 | a = *(h->reply_pool_head); /* Next cmd in ring buffer */ | |
23126 | @@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controll | |
23127 | trans_support & CFGTBL_Trans_use_short_tags); | |
23128 | ||
23129 | /* Change the access methods to the performant access methods */ | |
23130 | - h->access = SA5_performant_access; | |
23131 | + h->access = &SA5_performant_access; | |
23132 | h->transMethod = CFGTBL_Trans_Performant; | |
23133 | ||
23134 | return; | |
23135 | @@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr | |
23136 | if (prod_index < 0) | |
23137 | return -ENODEV; | |
23138 | h->product_name = products[prod_index].product_name; | |
23139 | - h->access = *(products[prod_index].access); | |
23140 | + h->access = products[prod_index].access; | |
23141 | ||
23142 | if (cciss_board_disabled(h)) { | |
23143 | dev_warn(&h->pdev->dev, "controller appears to be disabled\n"); | |
23144 | @@ -5002,7 +5004,7 @@ reinit_after_soft_reset: | |
23145 | } | |
23146 | ||
23147 | /* make sure the board interrupts are off */ | |
23148 | - h->access.set_intr_mask(h, CCISS_INTR_OFF); | |
23149 | + h->access->set_intr_mask(h, CCISS_INTR_OFF); | |
23150 | rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx); | |
23151 | if (rc) | |
23152 | goto clean2; | |
23153 | @@ -5054,7 +5056,7 @@ reinit_after_soft_reset: | |
23154 | * fake ones to scoop up any residual completions. | |
23155 | */ | |
23156 | spin_lock_irqsave(&h->lock, flags); | |
23157 | - h->access.set_intr_mask(h, CCISS_INTR_OFF); | |
23158 | + h->access->set_intr_mask(h, CCISS_INTR_OFF); | |
23159 | spin_unlock_irqrestore(&h->lock, flags); | |
23160 | free_irq(h->intr[PERF_MODE_INT], h); | |
23161 | rc = cciss_request_irq(h, cciss_msix_discard_completions, | |
23162 | @@ -5074,9 +5076,9 @@ reinit_after_soft_reset: | |
23163 | dev_info(&h->pdev->dev, "Board READY.\n"); | |
23164 | dev_info(&h->pdev->dev, | |
23165 | "Waiting for stale completions to drain.\n"); | |
23166 | - h->access.set_intr_mask(h, CCISS_INTR_ON); | |
23167 | + h->access->set_intr_mask(h, CCISS_INTR_ON); | |
23168 | msleep(10000); | |
23169 | - h->access.set_intr_mask(h, CCISS_INTR_OFF); | |
23170 | + h->access->set_intr_mask(h, CCISS_INTR_OFF); | |
23171 | ||
23172 | rc = controller_reset_failed(h->cfgtable); | |
23173 | if (rc) | |
23174 | @@ -5099,7 +5101,7 @@ reinit_after_soft_reset: | |
23175 | cciss_scsi_setup(h); | |
23176 | ||
23177 | /* Turn the interrupts on so we can service requests */ | |
23178 | - h->access.set_intr_mask(h, CCISS_INTR_ON); | |
23179 | + h->access->set_intr_mask(h, CCISS_INTR_ON); | |
23180 | ||
23181 | /* Get the firmware version */ | |
23182 | inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL); | |
23183 | @@ -5171,7 +5173,7 @@ static void cciss_shutdown(struct pci_de | |
23184 | kfree(flush_buf); | |
23185 | if (return_code != IO_OK) | |
23186 | dev_warn(&h->pdev->dev, "Error flushing cache\n"); | |
23187 | - h->access.set_intr_mask(h, CCISS_INTR_OFF); | |
23188 | + h->access->set_intr_mask(h, CCISS_INTR_OFF); | |
23189 | free_irq(h->intr[PERF_MODE_INT], h); | |
23190 | } | |
23191 | ||
23192 | diff -urNp linux-3.0.3/drivers/block/cciss.h linux-3.0.3/drivers/block/cciss.h | |
23193 | --- linux-3.0.3/drivers/block/cciss.h 2011-08-23 21:44:40.000000000 -0400 | |
23194 | +++ linux-3.0.3/drivers/block/cciss.h 2011-08-23 21:47:55.000000000 -0400 | |
23195 | @@ -100,7 +100,7 @@ struct ctlr_info | |
23196 | /* information about each logical volume */ | |
23197 | drive_info_struct *drv[CISS_MAX_LUN]; | |
23198 | ||
23199 | - struct access_method access; | |
23200 | + struct access_method *access; | |
23201 | ||
23202 | /* queue and queue Info */ | |
23203 | struct list_head reqQ; | |
23204 | diff -urNp linux-3.0.3/drivers/block/cpqarray.c linux-3.0.3/drivers/block/cpqarray.c | |
23205 | --- linux-3.0.3/drivers/block/cpqarray.c 2011-07-21 22:17:23.000000000 -0400 | |
23206 | +++ linux-3.0.3/drivers/block/cpqarray.c 2011-08-23 21:48:14.000000000 -0400 | |
23207 | @@ -404,7 +404,7 @@ static int __devinit cpqarray_register_c | |
23208 | if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) { | |
23209 | goto Enomem4; | |
23210 | } | |
23211 | - hba[i]->access.set_intr_mask(hba[i], 0); | |
23212 | + hba[i]->access->set_intr_mask(hba[i], 0); | |
23213 | if (request_irq(hba[i]->intr, do_ida_intr, | |
23214 | IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i])) | |
23215 | { | |
23216 | @@ -459,7 +459,7 @@ static int __devinit cpqarray_register_c | |
23217 | add_timer(&hba[i]->timer); | |
23218 | ||
23219 | /* Enable IRQ now that spinlock and rate limit timer are set up */ | |
23220 | - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY); | |
23221 | + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY); | |
23222 | ||
23223 | for(j=0; j<NWD; j++) { | |
23224 | struct gendisk *disk = ida_gendisk[i][j]; | |
23225 | @@ -694,7 +694,7 @@ DBGINFO( | |
23226 | for(i=0; i<NR_PRODUCTS; i++) { | |
23227 | if (board_id == products[i].board_id) { | |
23228 | c->product_name = products[i].product_name; | |
23229 | - c->access = *(products[i].access); | |
23230 | + c->access = products[i].access; | |
23231 | break; | |
23232 | } | |
23233 | } | |
23234 | @@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detec | |
23235 | hba[ctlr]->intr = intr; | |
23236 | sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr); | |
23237 | hba[ctlr]->product_name = products[j].product_name; | |
23238 | - hba[ctlr]->access = *(products[j].access); | |
23239 | + hba[ctlr]->access = products[j].access; | |
23240 | hba[ctlr]->ctlr = ctlr; | |
23241 | hba[ctlr]->board_id = board_id; | |
23242 | hba[ctlr]->pci_dev = NULL; /* not PCI */ | |
23243 | @@ -911,6 +911,8 @@ static void do_ida_request(struct reques | |
23244 | struct scatterlist tmp_sg[SG_MAX]; | |
23245 | int i, dir, seg; | |
23246 | ||
23247 | + pax_track_stack(); | |
23248 | + | |
23249 | queue_next: | |
23250 | creq = blk_peek_request(q); | |
23251 | if (!creq) | |
23252 | @@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h) | |
23253 | ||
23254 | while((c = h->reqQ) != NULL) { | |
23255 | /* Can't do anything if we're busy */ | |
23256 | - if (h->access.fifo_full(h) == 0) | |
23257 | + if (h->access->fifo_full(h) == 0) | |
23258 | return; | |
23259 | ||
23260 | /* Get the first entry from the request Q */ | |
23261 | @@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h) | |
23262 | h->Qdepth--; | |
23263 | ||
23264 | /* Tell the controller to do our bidding */ | |
23265 | - h->access.submit_command(h, c); | |
23266 | + h->access->submit_command(h, c); | |
23267 | ||
23268 | /* Get onto the completion Q */ | |
23269 | addQ(&h->cmpQ, c); | |
23270 | @@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq, | |
23271 | unsigned long flags; | |
23272 | __u32 a,a1; | |
23273 | ||
23274 | - istat = h->access.intr_pending(h); | |
23275 | + istat = h->access->intr_pending(h); | |
23276 | /* Is this interrupt for us? */ | |
23277 | if (istat == 0) | |
23278 | return IRQ_NONE; | |
23279 | @@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq, | |
23280 | */ | |
23281 | spin_lock_irqsave(IDA_LOCK(h->ctlr), flags); | |
23282 | if (istat & FIFO_NOT_EMPTY) { | |
23283 | - while((a = h->access.command_completed(h))) { | |
23284 | + while((a = h->access->command_completed(h))) { | |
23285 | a1 = a; a &= ~3; | |
23286 | if ((c = h->cmpQ) == NULL) | |
23287 | { | |
23288 | @@ -1449,11 +1451,11 @@ static int sendcmd( | |
23289 | /* | |
23290 | * Disable interrupt | |
23291 | */ | |
23292 | - info_p->access.set_intr_mask(info_p, 0); | |
23293 | + info_p->access->set_intr_mask(info_p, 0); | |
23294 | /* Make sure there is room in the command FIFO */ | |
23295 | /* Actually it should be completely empty at this time. */ | |
23296 | for (i = 200000; i > 0; i--) { | |
23297 | - temp = info_p->access.fifo_full(info_p); | |
23298 | + temp = info_p->access->fifo_full(info_p); | |
23299 | if (temp != 0) { | |
23300 | break; | |
23301 | } | |
23302 | @@ -1466,7 +1468,7 @@ DBG( | |
23303 | /* | |
23304 | * Send the cmd | |
23305 | */ | |
23306 | - info_p->access.submit_command(info_p, c); | |
23307 | + info_p->access->submit_command(info_p, c); | |
23308 | complete = pollcomplete(ctlr); | |
23309 | ||
23310 | pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr, | |
23311 | @@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t | |
23312 | * we check the new geometry. Then turn interrupts back on when | |
23313 | * we're done. | |
23314 | */ | |
23315 | - host->access.set_intr_mask(host, 0); | |
23316 | + host->access->set_intr_mask(host, 0); | |
23317 | getgeometry(ctlr); | |
23318 | - host->access.set_intr_mask(host, FIFO_NOT_EMPTY); | |
23319 | + host->access->set_intr_mask(host, FIFO_NOT_EMPTY); | |
23320 | ||
23321 | for(i=0; i<NWD; i++) { | |
23322 | struct gendisk *disk = ida_gendisk[ctlr][i]; | |
23323 | @@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr) | |
23324 | /* Wait (up to 2 seconds) for a command to complete */ | |
23325 | ||
23326 | for (i = 200000; i > 0; i--) { | |
23327 | - done = hba[ctlr]->access.command_completed(hba[ctlr]); | |
23328 | + done = hba[ctlr]->access->command_completed(hba[ctlr]); | |
23329 | if (done == 0) { | |
23330 | udelay(10); /* a short fixed delay */ | |
23331 | } else | |
23332 | diff -urNp linux-3.0.3/drivers/block/cpqarray.h linux-3.0.3/drivers/block/cpqarray.h | |
23333 | --- linux-3.0.3/drivers/block/cpqarray.h 2011-07-21 22:17:23.000000000 -0400 | |
23334 | +++ linux-3.0.3/drivers/block/cpqarray.h 2011-08-23 21:47:55.000000000 -0400 | |
23335 | @@ -99,7 +99,7 @@ struct ctlr_info { | |
23336 | drv_info_t drv[NWD]; | |
23337 | struct proc_dir_entry *proc; | |
23338 | ||
23339 | - struct access_method access; | |
23340 | + struct access_method *access; | |
23341 | ||
23342 | cmdlist_t *reqQ; | |
23343 | cmdlist_t *cmpQ; | |
23344 | diff -urNp linux-3.0.3/drivers/block/DAC960.c linux-3.0.3/drivers/block/DAC960.c | |
23345 | --- linux-3.0.3/drivers/block/DAC960.c 2011-07-21 22:17:23.000000000 -0400 | |
23346 | +++ linux-3.0.3/drivers/block/DAC960.c 2011-08-23 21:48:14.000000000 -0400 | |
23347 | @@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur | |
23348 | unsigned long flags; | |
23349 | int Channel, TargetID; | |
23350 | ||
23351 | + pax_track_stack(); | |
23352 | + | |
23353 | if (!init_dma_loaf(Controller->PCIDevice, &local_dma, | |
23354 | DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) + | |
23355 | sizeof(DAC960_SCSI_Inquiry_T) + | |
23356 | diff -urNp linux-3.0.3/drivers/block/drbd/drbd_int.h linux-3.0.3/drivers/block/drbd/drbd_int.h | |
23357 | --- linux-3.0.3/drivers/block/drbd/drbd_int.h 2011-07-21 22:17:23.000000000 -0400 | |
23358 | +++ linux-3.0.3/drivers/block/drbd/drbd_int.h 2011-08-23 21:47:55.000000000 -0400 | |
23359 | @@ -737,7 +737,7 @@ struct drbd_request; | |
23360 | struct drbd_epoch { | |
23361 | struct list_head list; | |
23362 | unsigned int barrier_nr; | |
23363 | - atomic_t epoch_size; /* increased on every request added. */ | |
23364 | + atomic_unchecked_t epoch_size; /* increased on every request added. */ | |
23365 | atomic_t active; /* increased on every req. added, and dec on every finished. */ | |
23366 | unsigned long flags; | |
23367 | }; | |
23368 | @@ -1109,7 +1109,7 @@ struct drbd_conf { | |
23369 | void *int_dig_in; | |
23370 | void *int_dig_vv; | |
23371 | wait_queue_head_t seq_wait; | |
23372 | - atomic_t packet_seq; | |
23373 | + atomic_unchecked_t packet_seq; | |
23374 | unsigned int peer_seq; | |
23375 | spinlock_t peer_seq_lock; | |
23376 | unsigned int minor; | |
23377 | diff -urNp linux-3.0.3/drivers/block/drbd/drbd_main.c linux-3.0.3/drivers/block/drbd/drbd_main.c | |
23378 | --- linux-3.0.3/drivers/block/drbd/drbd_main.c 2011-07-21 22:17:23.000000000 -0400 | |
23379 | +++ linux-3.0.3/drivers/block/drbd/drbd_main.c 2011-08-23 21:47:55.000000000 -0400 | |
23380 | @@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_co | |
23381 | p.sector = sector; | |
23382 | p.block_id = block_id; | |
23383 | p.blksize = blksize; | |
23384 | - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq)); | |
23385 | + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq)); | |
23386 | ||
23387 | if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED) | |
23388 | return false; | |
23389 | @@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *m | |
23390 | p.sector = cpu_to_be64(req->sector); | |
23391 | p.block_id = (unsigned long)req; | |
23392 | p.seq_num = cpu_to_be32(req->seq_num = | |
23393 | - atomic_add_return(1, &mdev->packet_seq)); | |
23394 | + atomic_add_return_unchecked(1, &mdev->packet_seq)); | |
23395 | ||
23396 | dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw); | |
23397 | ||
23398 | @@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_ | |
23399 | atomic_set(&mdev->unacked_cnt, 0); | |
23400 | atomic_set(&mdev->local_cnt, 0); | |
23401 | atomic_set(&mdev->net_cnt, 0); | |
23402 | - atomic_set(&mdev->packet_seq, 0); | |
23403 | + atomic_set_unchecked(&mdev->packet_seq, 0); | |
23404 | atomic_set(&mdev->pp_in_use, 0); | |
23405 | atomic_set(&mdev->pp_in_use_by_net, 0); | |
23406 | atomic_set(&mdev->rs_sect_in, 0); | |
23407 | @@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf | |
23408 | mdev->receiver.t_state); | |
23409 | ||
23410 | /* no need to lock it, I'm the only thread alive */ | |
23411 | - if (atomic_read(&mdev->current_epoch->epoch_size) != 0) | |
23412 | - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size)); | |
23413 | + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0) | |
23414 | + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size)); | |
23415 | mdev->al_writ_cnt = | |
23416 | mdev->bm_writ_cnt = | |
23417 | mdev->read_cnt = | |
23418 | diff -urNp linux-3.0.3/drivers/block/drbd/drbd_nl.c linux-3.0.3/drivers/block/drbd/drbd_nl.c | |
23419 | --- linux-3.0.3/drivers/block/drbd/drbd_nl.c 2011-07-21 22:17:23.000000000 -0400 | |
23420 | +++ linux-3.0.3/drivers/block/drbd/drbd_nl.c 2011-08-23 21:47:55.000000000 -0400 | |
23421 | @@ -2359,7 +2359,7 @@ static void drbd_connector_callback(stru | |
23422 | module_put(THIS_MODULE); | |
23423 | } | |
23424 | ||
23425 | -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */ | |
23426 | +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */ | |
23427 | ||
23428 | static unsigned short * | |
23429 | __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data, | |
23430 | @@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf * | |
23431 | cn_reply->id.idx = CN_IDX_DRBD; | |
23432 | cn_reply->id.val = CN_VAL_DRBD; | |
23433 | ||
23434 | - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq); | |
23435 | + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq); | |
23436 | cn_reply->ack = 0; /* not used here. */ | |
23437 | cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + | |
23438 | (int)((char *)tl - (char *)reply->tag_list); | |
23439 | @@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_co | |
23440 | cn_reply->id.idx = CN_IDX_DRBD; | |
23441 | cn_reply->id.val = CN_VAL_DRBD; | |
23442 | ||
23443 | - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq); | |
23444 | + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq); | |
23445 | cn_reply->ack = 0; /* not used here. */ | |
23446 | cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + | |
23447 | (int)((char *)tl - (char *)reply->tag_list); | |
23448 | @@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mde | |
23449 | cn_reply->id.idx = CN_IDX_DRBD; | |
23450 | cn_reply->id.val = CN_VAL_DRBD; | |
23451 | ||
23452 | - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq); | |
23453 | + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq); | |
23454 | cn_reply->ack = 0; // not used here. | |
23455 | cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + | |
23456 | (int)((char*)tl - (char*)reply->tag_list); | |
23457 | @@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drb | |
23458 | cn_reply->id.idx = CN_IDX_DRBD; | |
23459 | cn_reply->id.val = CN_VAL_DRBD; | |
23460 | ||
23461 | - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq); | |
23462 | + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq); | |
23463 | cn_reply->ack = 0; /* not used here. */ | |
23464 | cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + | |
23465 | (int)((char *)tl - (char *)reply->tag_list); | |
23466 | diff -urNp linux-3.0.3/drivers/block/drbd/drbd_receiver.c linux-3.0.3/drivers/block/drbd/drbd_receiver.c | |
23467 | --- linux-3.0.3/drivers/block/drbd/drbd_receiver.c 2011-07-21 22:17:23.000000000 -0400 | |
23468 | +++ linux-3.0.3/drivers/block/drbd/drbd_receiver.c 2011-08-23 21:47:55.000000000 -0400 | |
23469 | @@ -894,7 +894,7 @@ retry: | |
23470 | sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10; | |
23471 | sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT; | |
23472 | ||
23473 | - atomic_set(&mdev->packet_seq, 0); | |
23474 | + atomic_set_unchecked(&mdev->packet_seq, 0); | |
23475 | mdev->peer_seq = 0; | |
23476 | ||
23477 | drbd_thread_start(&mdev->asender); | |
23478 | @@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish | |
23479 | do { | |
23480 | next_epoch = NULL; | |
23481 | ||
23482 | - epoch_size = atomic_read(&epoch->epoch_size); | |
23483 | + epoch_size = atomic_read_unchecked(&epoch->epoch_size); | |
23484 | ||
23485 | switch (ev & ~EV_CLEANUP) { | |
23486 | case EV_PUT: | |
23487 | @@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish | |
23488 | rv = FE_DESTROYED; | |
23489 | } else { | |
23490 | epoch->flags = 0; | |
23491 | - atomic_set(&epoch->epoch_size, 0); | |
23492 | + atomic_set_unchecked(&epoch->epoch_size, 0); | |
23493 | /* atomic_set(&epoch->active, 0); is already zero */ | |
23494 | if (rv == FE_STILL_LIVE) | |
23495 | rv = FE_RECYCLED; | |
23496 | @@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_c | |
23497 | drbd_wait_ee_list_empty(mdev, &mdev->active_ee); | |
23498 | drbd_flush(mdev); | |
23499 | ||
23500 | - if (atomic_read(&mdev->current_epoch->epoch_size)) { | |
23501 | + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) { | |
23502 | epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO); | |
23503 | if (epoch) | |
23504 | break; | |
23505 | } | |
23506 | ||
23507 | epoch = mdev->current_epoch; | |
23508 | - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0); | |
23509 | + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0); | |
23510 | ||
23511 | D_ASSERT(atomic_read(&epoch->active) == 0); | |
23512 | D_ASSERT(epoch->flags == 0); | |
23513 | @@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_c | |
23514 | } | |
23515 | ||
23516 | epoch->flags = 0; | |
23517 | - atomic_set(&epoch->epoch_size, 0); | |
23518 | + atomic_set_unchecked(&epoch->epoch_size, 0); | |
23519 | atomic_set(&epoch->active, 0); | |
23520 | ||
23521 | spin_lock(&mdev->epoch_lock); | |
23522 | - if (atomic_read(&mdev->current_epoch->epoch_size)) { | |
23523 | + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) { | |
23524 | list_add(&epoch->list, &mdev->current_epoch->list); | |
23525 | mdev->current_epoch = epoch; | |
23526 | mdev->epochs++; | |
23527 | @@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf | |
23528 | spin_unlock(&mdev->peer_seq_lock); | |
23529 | ||
23530 | drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size); | |
23531 | - atomic_inc(&mdev->current_epoch->epoch_size); | |
23532 | + atomic_inc_unchecked(&mdev->current_epoch->epoch_size); | |
23533 | return drbd_drain_block(mdev, data_size); | |
23534 | } | |
23535 | ||
23536 | @@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf | |
23537 | ||
23538 | spin_lock(&mdev->epoch_lock); | |
23539 | e->epoch = mdev->current_epoch; | |
23540 | - atomic_inc(&e->epoch->epoch_size); | |
23541 | + atomic_inc_unchecked(&e->epoch->epoch_size); | |
23542 | atomic_inc(&e->epoch->active); | |
23543 | spin_unlock(&mdev->epoch_lock); | |
23544 | ||
23545 | @@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_ | |
23546 | D_ASSERT(list_empty(&mdev->done_ee)); | |
23547 | ||
23548 | /* ok, no more ee's on the fly, it is safe to reset the epoch_size */ | |
23549 | - atomic_set(&mdev->current_epoch->epoch_size, 0); | |
23550 | + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0); | |
23551 | D_ASSERT(list_empty(&mdev->current_epoch->list)); | |
23552 | } | |
23553 | ||
23554 | diff -urNp linux-3.0.3/drivers/block/nbd.c linux-3.0.3/drivers/block/nbd.c | |
23555 | --- linux-3.0.3/drivers/block/nbd.c 2011-07-21 22:17:23.000000000 -0400 | |
23556 | +++ linux-3.0.3/drivers/block/nbd.c 2011-08-23 21:48:14.000000000 -0400 | |
23557 | @@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device * | |
23558 | struct kvec iov; | |
23559 | sigset_t blocked, oldset; | |
23560 | ||
23561 | + pax_track_stack(); | |
23562 | + | |
23563 | if (unlikely(!sock)) { | |
23564 | printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n", | |
23565 | lo->disk->disk_name, (send ? "send" : "recv")); | |
23566 | @@ -572,6 +574,8 @@ static void do_nbd_request(struct reques | |
23567 | static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo, | |
23568 | unsigned int cmd, unsigned long arg) | |
23569 | { | |
23570 | + pax_track_stack(); | |
23571 | + | |
23572 | switch (cmd) { | |
23573 | case NBD_DISCONNECT: { | |
23574 | struct request sreq; | |
23575 | diff -urNp linux-3.0.3/drivers/char/agp/frontend.c linux-3.0.3/drivers/char/agp/frontend.c | |
23576 | --- linux-3.0.3/drivers/char/agp/frontend.c 2011-07-21 22:17:23.000000000 -0400 | |
23577 | +++ linux-3.0.3/drivers/char/agp/frontend.c 2011-08-23 21:47:55.000000000 -0400 | |
23578 | @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag | |
23579 | if (copy_from_user(&reserve, arg, sizeof(struct agp_region))) | |
23580 | return -EFAULT; | |
23581 | ||
23582 | - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment)) | |
23583 | + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv)) | |
23584 | return -EFAULT; | |
23585 | ||
23586 | client = agp_find_client_by_pid(reserve.pid); | |
23587 | diff -urNp linux-3.0.3/drivers/char/briq_panel.c linux-3.0.3/drivers/char/briq_panel.c | |
23588 | --- linux-3.0.3/drivers/char/briq_panel.c 2011-07-21 22:17:23.000000000 -0400 | |
23589 | +++ linux-3.0.3/drivers/char/briq_panel.c 2011-08-23 21:48:14.000000000 -0400 | |
23590 | @@ -9,6 +9,7 @@ | |
23591 | #include <linux/types.h> | |
23592 | #include <linux/errno.h> | |
23593 | #include <linux/tty.h> | |
23594 | +#include <linux/mutex.h> | |
23595 | #include <linux/timer.h> | |
23596 | #include <linux/kernel.h> | |
23597 | #include <linux/wait.h> | |
23598 | @@ -34,6 +35,7 @@ static int vfd_is_open; | |
23599 | static unsigned char vfd[40]; | |
23600 | static int vfd_cursor; | |
23601 | static unsigned char ledpb, led; | |
23602 | +static DEFINE_MUTEX(vfd_mutex); | |
23603 | ||
23604 | static void update_vfd(void) | |
23605 | { | |
23606 | @@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f | |
23607 | if (!vfd_is_open) | |
23608 | return -EBUSY; | |
23609 | ||
23610 | + mutex_lock(&vfd_mutex); | |
23611 | for (;;) { | |
23612 | char c; | |
23613 | if (!indx) | |
23614 | break; | |
23615 | - if (get_user(c, buf)) | |
23616 | + if (get_user(c, buf)) { | |
23617 | + mutex_unlock(&vfd_mutex); | |
23618 | return -EFAULT; | |
23619 | + } | |
23620 | if (esc) { | |
23621 | set_led(c); | |
23622 | esc = 0; | |
23623 | @@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f | |
23624 | buf++; | |
23625 | } | |
23626 | update_vfd(); | |
23627 | + mutex_unlock(&vfd_mutex); | |
23628 | ||
23629 | return len; | |
23630 | } | |
23631 | diff -urNp linux-3.0.3/drivers/char/genrtc.c linux-3.0.3/drivers/char/genrtc.c | |
23632 | --- linux-3.0.3/drivers/char/genrtc.c 2011-07-21 22:17:23.000000000 -0400 | |
23633 | +++ linux-3.0.3/drivers/char/genrtc.c 2011-08-23 21:48:14.000000000 -0400 | |
23634 | @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi | |
23635 | switch (cmd) { | |
23636 | ||
23637 | case RTC_PLL_GET: | |
23638 | + memset(&pll, 0, sizeof(pll)); | |
23639 | if (get_rtc_pll(&pll)) | |
23640 | return -EINVAL; | |
23641 | else | |
23642 | diff -urNp linux-3.0.3/drivers/char/hpet.c linux-3.0.3/drivers/char/hpet.c | |
23643 | --- linux-3.0.3/drivers/char/hpet.c 2011-07-21 22:17:23.000000000 -0400 | |
23644 | +++ linux-3.0.3/drivers/char/hpet.c 2011-08-23 21:47:55.000000000 -0400 | |
23645 | @@ -572,7 +572,7 @@ static inline unsigned long hpet_time_di | |
23646 | } | |
23647 | ||
23648 | static int | |
23649 | -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, | |
23650 | +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, | |
23651 | struct hpet_info *info) | |
23652 | { | |
23653 | struct hpet_timer __iomem *timer; | |
23654 | diff -urNp linux-3.0.3/drivers/char/ipmi/ipmi_msghandler.c linux-3.0.3/drivers/char/ipmi/ipmi_msghandler.c | |
23655 | --- linux-3.0.3/drivers/char/ipmi/ipmi_msghandler.c 2011-07-21 22:17:23.000000000 -0400 | |
23656 | +++ linux-3.0.3/drivers/char/ipmi/ipmi_msghandler.c 2011-08-23 21:48:14.000000000 -0400 | |
23657 | @@ -415,7 +415,7 @@ struct ipmi_smi { | |
23658 | struct proc_dir_entry *proc_dir; | |
23659 | char proc_dir_name[10]; | |
23660 | ||
23661 | - atomic_t stats[IPMI_NUM_STATS]; | |
23662 | + atomic_unchecked_t stats[IPMI_NUM_STATS]; | |
23663 | ||
23664 | /* | |
23665 | * run_to_completion duplicate of smb_info, smi_info | |
23666 | @@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex); | |
23667 | ||
23668 | ||
23669 | #define ipmi_inc_stat(intf, stat) \ | |
23670 | - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat]) | |
23671 | + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]) | |
23672 | #define ipmi_get_stat(intf, stat) \ | |
23673 | - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat])) | |
23674 | + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])) | |
23675 | ||
23676 | static int is_lan_addr(struct ipmi_addr *addr) | |
23677 | { | |
23678 | @@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_ha | |
23679 | INIT_LIST_HEAD(&intf->cmd_rcvrs); | |
23680 | init_waitqueue_head(&intf->waitq); | |
23681 | for (i = 0; i < IPMI_NUM_STATS; i++) | |
23682 | - atomic_set(&intf->stats[i], 0); | |
23683 | + atomic_set_unchecked(&intf->stats[i], 0); | |
23684 | ||
23685 | intf->proc_dir = NULL; | |
23686 | ||
23687 | @@ -4220,6 +4220,8 @@ static void send_panic_events(char *str) | |
23688 | struct ipmi_smi_msg smi_msg; | |
23689 | struct ipmi_recv_msg recv_msg; | |
23690 | ||
23691 | + pax_track_stack(); | |
23692 | + | |
23693 | si = (struct ipmi_system_interface_addr *) &addr; | |
23694 | si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; | |
23695 | si->channel = IPMI_BMC_CHANNEL; | |
23696 | diff -urNp linux-3.0.3/drivers/char/ipmi/ipmi_si_intf.c linux-3.0.3/drivers/char/ipmi/ipmi_si_intf.c | |
23697 | --- linux-3.0.3/drivers/char/ipmi/ipmi_si_intf.c 2011-07-21 22:17:23.000000000 -0400 | |
23698 | +++ linux-3.0.3/drivers/char/ipmi/ipmi_si_intf.c 2011-08-23 21:47:55.000000000 -0400 | |
23699 | @@ -277,7 +277,7 @@ struct smi_info { | |
23700 | unsigned char slave_addr; | |
23701 | ||
23702 | /* Counters and things for the proc filesystem. */ | |
23703 | - atomic_t stats[SI_NUM_STATS]; | |
23704 | + atomic_unchecked_t stats[SI_NUM_STATS]; | |
23705 | ||
23706 | struct task_struct *thread; | |
23707 | ||
23708 | @@ -286,9 +286,9 @@ struct smi_info { | |
23709 | }; | |
23710 | ||
23711 | #define smi_inc_stat(smi, stat) \ | |
23712 | - atomic_inc(&(smi)->stats[SI_STAT_ ## stat]) | |
23713 | + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat]) | |
23714 | #define smi_get_stat(smi, stat) \ | |
23715 | - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat])) | |
23716 | + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat])) | |
23717 | ||
23718 | #define SI_MAX_PARMS 4 | |
23719 | ||
23720 | @@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info | |
23721 | atomic_set(&new_smi->req_events, 0); | |
23722 | new_smi->run_to_completion = 0; | |
23723 | for (i = 0; i < SI_NUM_STATS; i++) | |
23724 | - atomic_set(&new_smi->stats[i], 0); | |
23725 | + atomic_set_unchecked(&new_smi->stats[i], 0); | |
23726 | ||
23727 | new_smi->interrupt_disabled = 1; | |
23728 | atomic_set(&new_smi->stop_operation, 0); | |
23729 | diff -urNp linux-3.0.3/drivers/char/Kconfig linux-3.0.3/drivers/char/Kconfig | |
23730 | --- linux-3.0.3/drivers/char/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
23731 | +++ linux-3.0.3/drivers/char/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
23732 | @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig" | |
23733 | ||
23734 | config DEVKMEM | |
23735 | bool "/dev/kmem virtual device support" | |
23736 | - default y | |
23737 | + default n | |
23738 | + depends on !GRKERNSEC_KMEM | |
23739 | help | |
23740 | Say Y here if you want to support the /dev/kmem device. The | |
23741 | /dev/kmem device is rarely used, but can be used for certain | |
23742 | @@ -596,6 +597,7 @@ config DEVPORT | |
23743 | bool | |
23744 | depends on !M68K | |
23745 | depends on ISA || PCI | |
23746 | + depends on !GRKERNSEC_KMEM | |
23747 | default y | |
23748 | ||
23749 | source "drivers/s390/char/Kconfig" | |
23750 | diff -urNp linux-3.0.3/drivers/char/mem.c linux-3.0.3/drivers/char/mem.c | |
23751 | --- linux-3.0.3/drivers/char/mem.c 2011-07-21 22:17:23.000000000 -0400 | |
23752 | +++ linux-3.0.3/drivers/char/mem.c 2011-08-23 21:48:14.000000000 -0400 | |
23753 | @@ -18,6 +18,7 @@ | |
23754 | #include <linux/raw.h> | |
23755 | #include <linux/tty.h> | |
23756 | #include <linux/capability.h> | |
23757 | +#include <linux/security.h> | |
23758 | #include <linux/ptrace.h> | |
23759 | #include <linux/device.h> | |
23760 | #include <linux/highmem.h> | |
23761 | @@ -34,6 +35,10 @@ | |
23762 | # include <linux/efi.h> | |
23763 | #endif | |
23764 | ||
23765 | +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC) | |
23766 | +extern struct file_operations grsec_fops; | |
23767 | +#endif | |
23768 | + | |
23769 | static inline unsigned long size_inside_page(unsigned long start, | |
23770 | unsigned long size) | |
23771 | { | |
23772 | @@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig | |
23773 | ||
23774 | while (cursor < to) { | |
23775 | if (!devmem_is_allowed(pfn)) { | |
23776 | +#ifdef CONFIG_GRKERNSEC_KMEM | |
23777 | + gr_handle_mem_readwrite(from, to); | |
23778 | +#else | |
23779 | printk(KERN_INFO | |
23780 | "Program %s tried to access /dev/mem between %Lx->%Lx.\n", | |
23781 | current->comm, from, to); | |
23782 | +#endif | |
23783 | return 0; | |
23784 | } | |
23785 | cursor += PAGE_SIZE; | |
23786 | @@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig | |
23787 | } | |
23788 | return 1; | |
23789 | } | |
23790 | +#elif defined(CONFIG_GRKERNSEC_KMEM) | |
23791 | +static inline int range_is_allowed(unsigned long pfn, unsigned long size) | |
23792 | +{ | |
23793 | + return 0; | |
23794 | +} | |
23795 | #else | |
23796 | static inline int range_is_allowed(unsigned long pfn, unsigned long size) | |
23797 | { | |
23798 | @@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil | |
23799 | ||
23800 | while (count > 0) { | |
23801 | unsigned long remaining; | |
23802 | + char *temp; | |
23803 | ||
23804 | sz = size_inside_page(p, count); | |
23805 | ||
23806 | @@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil | |
23807 | if (!ptr) | |
23808 | return -EFAULT; | |
23809 | ||
23810 | - remaining = copy_to_user(buf, ptr, sz); | |
23811 | +#ifdef CONFIG_PAX_USERCOPY | |
23812 | + temp = kmalloc(sz, GFP_KERNEL); | |
23813 | + if (!temp) { | |
23814 | + unxlate_dev_mem_ptr(p, ptr); | |
23815 | + return -ENOMEM; | |
23816 | + } | |
23817 | + memcpy(temp, ptr, sz); | |
23818 | +#else | |
23819 | + temp = ptr; | |
23820 | +#endif | |
23821 | + | |
23822 | + remaining = copy_to_user(buf, temp, sz); | |
23823 | + | |
23824 | +#ifdef CONFIG_PAX_USERCOPY | |
23825 | + kfree(temp); | |
23826 | +#endif | |
23827 | + | |
23828 | unxlate_dev_mem_ptr(p, ptr); | |
23829 | if (remaining) | |
23830 | return -EFAULT; | |
23831 | @@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi | |
23832 | size_t count, loff_t *ppos) | |
23833 | { | |
23834 | unsigned long p = *ppos; | |
23835 | - ssize_t low_count, read, sz; | |
23836 | + ssize_t low_count, read, sz, err = 0; | |
23837 | char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */ | |
23838 | - int err = 0; | |
23839 | ||
23840 | read = 0; | |
23841 | if (p < (unsigned long) high_memory) { | |
23842 | @@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi | |
23843 | } | |
23844 | #endif | |
23845 | while (low_count > 0) { | |
23846 | + char *temp; | |
23847 | + | |
23848 | sz = size_inside_page(p, low_count); | |
23849 | ||
23850 | /* | |
23851 | @@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi | |
23852 | */ | |
23853 | kbuf = xlate_dev_kmem_ptr((char *)p); | |
23854 | ||
23855 | - if (copy_to_user(buf, kbuf, sz)) | |
23856 | +#ifdef CONFIG_PAX_USERCOPY | |
23857 | + temp = kmalloc(sz, GFP_KERNEL); | |
23858 | + if (!temp) | |
23859 | + return -ENOMEM; | |
23860 | + memcpy(temp, kbuf, sz); | |
23861 | +#else | |
23862 | + temp = kbuf; | |
23863 | +#endif | |
23864 | + | |
23865 | + err = copy_to_user(buf, temp, sz); | |
23866 | + | |
23867 | +#ifdef CONFIG_PAX_USERCOPY | |
23868 | + kfree(temp); | |
23869 | +#endif | |
23870 | + | |
23871 | + if (err) | |
23872 | return -EFAULT; | |
23873 | buf += sz; | |
23874 | p += sz; | |
23875 | @@ -866,6 +913,9 @@ static const struct memdev { | |
23876 | #ifdef CONFIG_CRASH_DUMP | |
23877 | [12] = { "oldmem", 0, &oldmem_fops, NULL }, | |
23878 | #endif | |
23879 | +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC) | |
23880 | + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL }, | |
23881 | +#endif | |
23882 | }; | |
23883 | ||
23884 | static int memory_open(struct inode *inode, struct file *filp) | |
23885 | diff -urNp linux-3.0.3/drivers/char/nvram.c linux-3.0.3/drivers/char/nvram.c | |
23886 | --- linux-3.0.3/drivers/char/nvram.c 2011-07-21 22:17:23.000000000 -0400 | |
23887 | +++ linux-3.0.3/drivers/char/nvram.c 2011-08-23 21:47:55.000000000 -0400 | |
23888 | @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f | |
23889 | ||
23890 | spin_unlock_irq(&rtc_lock); | |
23891 | ||
23892 | - if (copy_to_user(buf, contents, tmp - contents)) | |
23893 | + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents)) | |
23894 | return -EFAULT; | |
23895 | ||
23896 | *ppos = i; | |
23897 | diff -urNp linux-3.0.3/drivers/char/random.c linux-3.0.3/drivers/char/random.c | |
23898 | --- linux-3.0.3/drivers/char/random.c 2011-08-23 21:44:40.000000000 -0400 | |
23899 | +++ linux-3.0.3/drivers/char/random.c 2011-08-23 21:48:14.000000000 -0400 | |
23900 | @@ -261,8 +261,13 @@ | |
23901 | /* | |
23902 | * Configuration information | |
23903 | */ | |
23904 | +#ifdef CONFIG_GRKERNSEC_RANDNET | |
23905 | +#define INPUT_POOL_WORDS 512 | |
23906 | +#define OUTPUT_POOL_WORDS 128 | |
23907 | +#else | |
23908 | #define INPUT_POOL_WORDS 128 | |
23909 | #define OUTPUT_POOL_WORDS 32 | |
23910 | +#endif | |
23911 | #define SEC_XFER_SIZE 512 | |
23912 | #define EXTRACT_SIZE 10 | |
23913 | ||
23914 | @@ -300,10 +305,17 @@ static struct poolinfo { | |
23915 | int poolwords; | |
23916 | int tap1, tap2, tap3, tap4, tap5; | |
23917 | } poolinfo_table[] = { | |
23918 | +#ifdef CONFIG_GRKERNSEC_RANDNET | |
23919 | + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */ | |
23920 | + { 512, 411, 308, 208, 104, 1 }, | |
23921 | + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */ | |
23922 | + { 128, 103, 76, 51, 25, 1 }, | |
23923 | +#else | |
23924 | /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */ | |
23925 | { 128, 103, 76, 51, 25, 1 }, | |
23926 | /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */ | |
23927 | { 32, 26, 20, 14, 7, 1 }, | |
23928 | +#endif | |
23929 | #if 0 | |
23930 | /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */ | |
23931 | { 2048, 1638, 1231, 819, 411, 1 }, | |
23932 | @@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru | |
23933 | ||
23934 | extract_buf(r, tmp); | |
23935 | i = min_t(int, nbytes, EXTRACT_SIZE); | |
23936 | - if (copy_to_user(buf, tmp, i)) { | |
23937 | + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) { | |
23938 | ret = -EFAULT; | |
23939 | break; | |
23940 | } | |
23941 | @@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid); | |
23942 | #include <linux/sysctl.h> | |
23943 | ||
23944 | static int min_read_thresh = 8, min_write_thresh; | |
23945 | -static int max_read_thresh = INPUT_POOL_WORDS * 32; | |
23946 | +static int max_read_thresh = OUTPUT_POOL_WORDS * 32; | |
23947 | static int max_write_thresh = INPUT_POOL_WORDS * 32; | |
23948 | static char sysctl_bootid[16]; | |
23949 | ||
23950 | diff -urNp linux-3.0.3/drivers/char/sonypi.c linux-3.0.3/drivers/char/sonypi.c | |
23951 | --- linux-3.0.3/drivers/char/sonypi.c 2011-07-21 22:17:23.000000000 -0400 | |
23952 | +++ linux-3.0.3/drivers/char/sonypi.c 2011-08-23 21:47:55.000000000 -0400 | |
23953 | @@ -55,6 +55,7 @@ | |
23954 | #include <asm/uaccess.h> | |
23955 | #include <asm/io.h> | |
23956 | #include <asm/system.h> | |
23957 | +#include <asm/local.h> | |
23958 | ||
23959 | #include <linux/sonypi.h> | |
23960 | ||
23961 | @@ -491,7 +492,7 @@ static struct sonypi_device { | |
23962 | spinlock_t fifo_lock; | |
23963 | wait_queue_head_t fifo_proc_list; | |
23964 | struct fasync_struct *fifo_async; | |
23965 | - int open_count; | |
23966 | + local_t open_count; | |
23967 | int model; | |
23968 | struct input_dev *input_jog_dev; | |
23969 | struct input_dev *input_key_dev; | |
23970 | @@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st | |
23971 | static int sonypi_misc_release(struct inode *inode, struct file *file) | |
23972 | { | |
23973 | mutex_lock(&sonypi_device.lock); | |
23974 | - sonypi_device.open_count--; | |
23975 | + local_dec(&sonypi_device.open_count); | |
23976 | mutex_unlock(&sonypi_device.lock); | |
23977 | return 0; | |
23978 | } | |
23979 | @@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode | |
23980 | { | |
23981 | mutex_lock(&sonypi_device.lock); | |
23982 | /* Flush input queue on first open */ | |
23983 | - if (!sonypi_device.open_count) | |
23984 | + if (!local_read(&sonypi_device.open_count)) | |
23985 | kfifo_reset(&sonypi_device.fifo); | |
23986 | - sonypi_device.open_count++; | |
23987 | + local_inc(&sonypi_device.open_count); | |
23988 | mutex_unlock(&sonypi_device.lock); | |
23989 | ||
23990 | return 0; | |
23991 | diff -urNp linux-3.0.3/drivers/char/tpm/tpm_bios.c linux-3.0.3/drivers/char/tpm/tpm_bios.c | |
23992 | --- linux-3.0.3/drivers/char/tpm/tpm_bios.c 2011-07-21 22:17:23.000000000 -0400 | |
23993 | +++ linux-3.0.3/drivers/char/tpm/tpm_bios.c 2011-08-23 21:47:55.000000000 -0400 | |
23994 | @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start | |
23995 | event = addr; | |
23996 | ||
23997 | if ((event->event_type == 0 && event->event_size == 0) || | |
23998 | - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit)) | |
23999 | + (event->event_size >= limit - addr - sizeof(struct tcpa_event))) | |
24000 | return NULL; | |
24001 | ||
24002 | return addr; | |
24003 | @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next( | |
24004 | return NULL; | |
24005 | ||
24006 | if ((event->event_type == 0 && event->event_size == 0) || | |
24007 | - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit)) | |
24008 | + (event->event_size >= limit - v - sizeof(struct tcpa_event))) | |
24009 | return NULL; | |
24010 | ||
24011 | (*pos)++; | |
24012 | @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_ | |
24013 | int i; | |
24014 | ||
24015 | for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++) | |
24016 | - seq_putc(m, data[i]); | |
24017 | + if (!seq_putc(m, data[i])) | |
24018 | + return -EFAULT; | |
24019 | ||
24020 | return 0; | |
24021 | } | |
24022 | @@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log | |
24023 | log->bios_event_log_end = log->bios_event_log + len; | |
24024 | ||
24025 | virt = acpi_os_map_memory(start, len); | |
24026 | + if (!virt) { | |
24027 | + kfree(log->bios_event_log); | |
24028 | + log->bios_event_log = NULL; | |
24029 | + return -EFAULT; | |
24030 | + } | |
24031 | ||
24032 | memcpy(log->bios_event_log, virt, len); | |
24033 | ||
24034 | diff -urNp linux-3.0.3/drivers/char/tpm/tpm.c linux-3.0.3/drivers/char/tpm/tpm.c | |
24035 | --- linux-3.0.3/drivers/char/tpm/tpm.c 2011-07-21 22:17:23.000000000 -0400 | |
24036 | +++ linux-3.0.3/drivers/char/tpm/tpm.c 2011-08-23 21:48:14.000000000 -0400 | |
24037 | @@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c | |
24038 | chip->vendor.req_complete_val) | |
24039 | goto out_recv; | |
24040 | ||
24041 | - if ((status == chip->vendor.req_canceled)) { | |
24042 | + if (status == chip->vendor.req_canceled) { | |
24043 | dev_err(chip->dev, "Operation Canceled\n"); | |
24044 | rc = -ECANCELED; | |
24045 | goto out; | |
24046 | @@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de | |
24047 | ||
24048 | struct tpm_chip *chip = dev_get_drvdata(dev); | |
24049 | ||
24050 | + pax_track_stack(); | |
24051 | + | |
24052 | tpm_cmd.header.in = tpm_readpubek_header; | |
24053 | err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, | |
24054 | "attempting to read the PUBEK"); | |
24055 | diff -urNp linux-3.0.3/drivers/crypto/hifn_795x.c linux-3.0.3/drivers/crypto/hifn_795x.c | |
24056 | --- linux-3.0.3/drivers/crypto/hifn_795x.c 2011-07-21 22:17:23.000000000 -0400 | |
24057 | +++ linux-3.0.3/drivers/crypto/hifn_795x.c 2011-08-23 21:48:14.000000000 -0400 | |
24058 | @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device | |
24059 | 0xCA, 0x34, 0x2B, 0x2E}; | |
24060 | struct scatterlist sg; | |
24061 | ||
24062 | + pax_track_stack(); | |
24063 | + | |
24064 | memset(src, 0, sizeof(src)); | |
24065 | memset(ctx.key, 0, sizeof(ctx.key)); | |
24066 | ||
24067 | diff -urNp linux-3.0.3/drivers/crypto/padlock-aes.c linux-3.0.3/drivers/crypto/padlock-aes.c | |
24068 | --- linux-3.0.3/drivers/crypto/padlock-aes.c 2011-07-21 22:17:23.000000000 -0400 | |
24069 | +++ linux-3.0.3/drivers/crypto/padlock-aes.c 2011-08-23 21:48:14.000000000 -0400 | |
24070 | @@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm | |
24071 | struct crypto_aes_ctx gen_aes; | |
24072 | int cpu; | |
24073 | ||
24074 | + pax_track_stack(); | |
24075 | + | |
24076 | if (key_len % 8) { | |
24077 | *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; | |
24078 | return -EINVAL; | |
24079 | diff -urNp linux-3.0.3/drivers/edac/edac_pci_sysfs.c linux-3.0.3/drivers/edac/edac_pci_sysfs.c | |
24080 | --- linux-3.0.3/drivers/edac/edac_pci_sysfs.c 2011-07-21 22:17:23.000000000 -0400 | |
24081 | +++ linux-3.0.3/drivers/edac/edac_pci_sysfs.c 2011-08-23 21:47:55.000000000 -0400 | |
24082 | @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log | |
24083 | static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */ | |
24084 | static int edac_pci_poll_msec = 1000; /* one second workq period */ | |
24085 | ||
24086 | -static atomic_t pci_parity_count = ATOMIC_INIT(0); | |
24087 | -static atomic_t pci_nonparity_count = ATOMIC_INIT(0); | |
24088 | +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0); | |
24089 | +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0); | |
24090 | ||
24091 | static struct kobject *edac_pci_top_main_kobj; | |
24092 | static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0); | |
24093 | @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str | |
24094 | edac_printk(KERN_CRIT, EDAC_PCI, | |
24095 | "Signaled System Error on %s\n", | |
24096 | pci_name(dev)); | |
24097 | - atomic_inc(&pci_nonparity_count); | |
24098 | + atomic_inc_unchecked(&pci_nonparity_count); | |
24099 | } | |
24100 | ||
24101 | if (status & (PCI_STATUS_PARITY)) { | |
24102 | @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str | |
24103 | "Master Data Parity Error on %s\n", | |
24104 | pci_name(dev)); | |
24105 | ||
24106 | - atomic_inc(&pci_parity_count); | |
24107 | + atomic_inc_unchecked(&pci_parity_count); | |
24108 | } | |
24109 | ||
24110 | if (status & (PCI_STATUS_DETECTED_PARITY)) { | |
24111 | @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str | |
24112 | "Detected Parity Error on %s\n", | |
24113 | pci_name(dev)); | |
24114 | ||
24115 | - atomic_inc(&pci_parity_count); | |
24116 | + atomic_inc_unchecked(&pci_parity_count); | |
24117 | } | |
24118 | } | |
24119 | ||
24120 | @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str | |
24121 | edac_printk(KERN_CRIT, EDAC_PCI, "Bridge " | |
24122 | "Signaled System Error on %s\n", | |
24123 | pci_name(dev)); | |
24124 | - atomic_inc(&pci_nonparity_count); | |
24125 | + atomic_inc_unchecked(&pci_nonparity_count); | |
24126 | } | |
24127 | ||
24128 | if (status & (PCI_STATUS_PARITY)) { | |
24129 | @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str | |
24130 | "Master Data Parity Error on " | |
24131 | "%s\n", pci_name(dev)); | |
24132 | ||
24133 | - atomic_inc(&pci_parity_count); | |
24134 | + atomic_inc_unchecked(&pci_parity_count); | |
24135 | } | |
24136 | ||
24137 | if (status & (PCI_STATUS_DETECTED_PARITY)) { | |
24138 | @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str | |
24139 | "Detected Parity Error on %s\n", | |
24140 | pci_name(dev)); | |
24141 | ||
24142 | - atomic_inc(&pci_parity_count); | |
24143 | + atomic_inc_unchecked(&pci_parity_count); | |
24144 | } | |
24145 | } | |
24146 | } | |
24147 | @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void) | |
24148 | if (!check_pci_errors) | |
24149 | return; | |
24150 | ||
24151 | - before_count = atomic_read(&pci_parity_count); | |
24152 | + before_count = atomic_read_unchecked(&pci_parity_count); | |
24153 | ||
24154 | /* scan all PCI devices looking for a Parity Error on devices and | |
24155 | * bridges. | |
24156 | @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void) | |
24157 | /* Only if operator has selected panic on PCI Error */ | |
24158 | if (edac_pci_get_panic_on_pe()) { | |
24159 | /* If the count is different 'after' from 'before' */ | |
24160 | - if (before_count != atomic_read(&pci_parity_count)) | |
24161 | + if (before_count != atomic_read_unchecked(&pci_parity_count)) | |
24162 | panic("EDAC: PCI Parity Error"); | |
24163 | } | |
24164 | } | |
24165 | diff -urNp linux-3.0.3/drivers/edac/i7core_edac.c linux-3.0.3/drivers/edac/i7core_edac.c | |
24166 | --- linux-3.0.3/drivers/edac/i7core_edac.c 2011-07-21 22:17:23.000000000 -0400 | |
24167 | +++ linux-3.0.3/drivers/edac/i7core_edac.c 2011-08-23 21:47:55.000000000 -0400 | |
24168 | @@ -1670,7 +1670,7 @@ static void i7core_mce_output_error(stru | |
24169 | char *type, *optype, *err, *msg; | |
24170 | unsigned long error = m->status & 0x1ff0000l; | |
24171 | u32 optypenum = (m->status >> 4) & 0x07; | |
24172 | - u32 core_err_cnt = (m->status >> 38) && 0x7fff; | |
24173 | + u32 core_err_cnt = (m->status >> 38) & 0x7fff; | |
24174 | u32 dimm = (m->misc >> 16) & 0x3; | |
24175 | u32 channel = (m->misc >> 18) & 0x3; | |
24176 | u32 syndrome = m->misc >> 32; | |
24177 | diff -urNp linux-3.0.3/drivers/edac/mce_amd.h linux-3.0.3/drivers/edac/mce_amd.h | |
24178 | --- linux-3.0.3/drivers/edac/mce_amd.h 2011-07-21 22:17:23.000000000 -0400 | |
24179 | +++ linux-3.0.3/drivers/edac/mce_amd.h 2011-08-23 21:47:55.000000000 -0400 | |
24180 | @@ -83,7 +83,7 @@ struct amd_decoder_ops { | |
24181 | bool (*dc_mce)(u16, u8); | |
24182 | bool (*ic_mce)(u16, u8); | |
24183 | bool (*nb_mce)(u16, u8); | |
24184 | -}; | |
24185 | +} __no_const; | |
24186 | ||
24187 | void amd_report_gart_errors(bool); | |
24188 | void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32)); | |
24189 | diff -urNp linux-3.0.3/drivers/firewire/core-card.c linux-3.0.3/drivers/firewire/core-card.c | |
24190 | --- linux-3.0.3/drivers/firewire/core-card.c 2011-07-21 22:17:23.000000000 -0400 | |
24191 | +++ linux-3.0.3/drivers/firewire/core-card.c 2011-08-23 21:47:55.000000000 -0400 | |
24192 | @@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref) | |
24193 | ||
24194 | void fw_core_remove_card(struct fw_card *card) | |
24195 | { | |
24196 | - struct fw_card_driver dummy_driver = dummy_driver_template; | |
24197 | + fw_card_driver_no_const dummy_driver = dummy_driver_template; | |
24198 | ||
24199 | card->driver->update_phy_reg(card, 4, | |
24200 | PHY_LINK_ACTIVE | PHY_CONTENDER, 0); | |
24201 | diff -urNp linux-3.0.3/drivers/firewire/core-cdev.c linux-3.0.3/drivers/firewire/core-cdev.c | |
24202 | --- linux-3.0.3/drivers/firewire/core-cdev.c 2011-08-23 21:44:40.000000000 -0400 | |
24203 | +++ linux-3.0.3/drivers/firewire/core-cdev.c 2011-08-23 21:47:55.000000000 -0400 | |
24204 | @@ -1313,8 +1313,7 @@ static int init_iso_resource(struct clie | |
24205 | int ret; | |
24206 | ||
24207 | if ((request->channels == 0 && request->bandwidth == 0) || | |
24208 | - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL || | |
24209 | - request->bandwidth < 0) | |
24210 | + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL) | |
24211 | return -EINVAL; | |
24212 | ||
24213 | r = kmalloc(sizeof(*r), GFP_KERNEL); | |
24214 | diff -urNp linux-3.0.3/drivers/firewire/core.h linux-3.0.3/drivers/firewire/core.h | |
24215 | --- linux-3.0.3/drivers/firewire/core.h 2011-07-21 22:17:23.000000000 -0400 | |
24216 | +++ linux-3.0.3/drivers/firewire/core.h 2011-08-23 21:47:55.000000000 -0400 | |
24217 | @@ -101,6 +101,7 @@ struct fw_card_driver { | |
24218 | ||
24219 | int (*stop_iso)(struct fw_iso_context *ctx); | |
24220 | }; | |
24221 | +typedef struct fw_card_driver __no_const fw_card_driver_no_const; | |
24222 | ||
24223 | void fw_card_initialize(struct fw_card *card, | |
24224 | const struct fw_card_driver *driver, struct device *device); | |
24225 | diff -urNp linux-3.0.3/drivers/firewire/core-transaction.c linux-3.0.3/drivers/firewire/core-transaction.c | |
24226 | --- linux-3.0.3/drivers/firewire/core-transaction.c 2011-07-21 22:17:23.000000000 -0400 | |
24227 | +++ linux-3.0.3/drivers/firewire/core-transaction.c 2011-08-23 21:48:14.000000000 -0400 | |
24228 | @@ -37,6 +37,7 @@ | |
24229 | #include <linux/timer.h> | |
24230 | #include <linux/types.h> | |
24231 | #include <linux/workqueue.h> | |
24232 | +#include <linux/sched.h> | |
24233 | ||
24234 | #include <asm/byteorder.h> | |
24235 | ||
24236 | @@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *c | |
24237 | struct transaction_callback_data d; | |
24238 | struct fw_transaction t; | |
24239 | ||
24240 | + pax_track_stack(); | |
24241 | + | |
24242 | init_timer_on_stack(&t.split_timeout_timer); | |
24243 | init_completion(&d.done); | |
24244 | d.payload = payload; | |
24245 | diff -urNp linux-3.0.3/drivers/firmware/dmi_scan.c linux-3.0.3/drivers/firmware/dmi_scan.c | |
24246 | --- linux-3.0.3/drivers/firmware/dmi_scan.c 2011-07-21 22:17:23.000000000 -0400 | |
24247 | +++ linux-3.0.3/drivers/firmware/dmi_scan.c 2011-08-23 21:47:55.000000000 -0400 | |
24248 | @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void) | |
24249 | } | |
24250 | } | |
24251 | else { | |
24252 | - /* | |
24253 | - * no iounmap() for that ioremap(); it would be a no-op, but | |
24254 | - * it's so early in setup that sucker gets confused into doing | |
24255 | - * what it shouldn't if we actually call it. | |
24256 | - */ | |
24257 | p = dmi_ioremap(0xF0000, 0x10000); | |
24258 | if (p == NULL) | |
24259 | goto error; | |
24260 | diff -urNp linux-3.0.3/drivers/gpio/vr41xx_giu.c linux-3.0.3/drivers/gpio/vr41xx_giu.c | |
24261 | --- linux-3.0.3/drivers/gpio/vr41xx_giu.c 2011-07-21 22:17:23.000000000 -0400 | |
24262 | +++ linux-3.0.3/drivers/gpio/vr41xx_giu.c 2011-08-23 21:47:55.000000000 -0400 | |
24263 | @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq) | |
24264 | printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n", | |
24265 | maskl, pendl, maskh, pendh); | |
24266 | ||
24267 | - atomic_inc(&irq_err_count); | |
24268 | + atomic_inc_unchecked(&irq_err_count); | |
24269 | ||
24270 | return -EINVAL; | |
24271 | } | |
24272 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_crtc_helper.c linux-3.0.3/drivers/gpu/drm/drm_crtc_helper.c | |
24273 | --- linux-3.0.3/drivers/gpu/drm/drm_crtc_helper.c 2011-07-21 22:17:23.000000000 -0400 | |
24274 | +++ linux-3.0.3/drivers/gpu/drm/drm_crtc_helper.c 2011-08-23 21:48:14.000000000 -0400 | |
24275 | @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d | |
24276 | struct drm_crtc *tmp; | |
24277 | int crtc_mask = 1; | |
24278 | ||
24279 | - WARN(!crtc, "checking null crtc?\n"); | |
24280 | + BUG_ON(!crtc); | |
24281 | ||
24282 | dev = crtc->dev; | |
24283 | ||
24284 | @@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm | |
24285 | struct drm_encoder *encoder; | |
24286 | bool ret = true; | |
24287 | ||
24288 | + pax_track_stack(); | |
24289 | + | |
24290 | crtc->enabled = drm_helper_crtc_in_use(crtc); | |
24291 | if (!crtc->enabled) | |
24292 | return true; | |
24293 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_drv.c linux-3.0.3/drivers/gpu/drm/drm_drv.c | |
24294 | --- linux-3.0.3/drivers/gpu/drm/drm_drv.c 2011-07-21 22:17:23.000000000 -0400 | |
24295 | +++ linux-3.0.3/drivers/gpu/drm/drm_drv.c 2011-08-23 21:47:55.000000000 -0400 | |
24296 | @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp, | |
24297 | ||
24298 | dev = file_priv->minor->dev; | |
24299 | atomic_inc(&dev->ioctl_count); | |
24300 | - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]); | |
24301 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]); | |
24302 | ++file_priv->ioctl_count; | |
24303 | ||
24304 | DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n", | |
24305 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_fops.c linux-3.0.3/drivers/gpu/drm/drm_fops.c | |
24306 | --- linux-3.0.3/drivers/gpu/drm/drm_fops.c 2011-07-21 22:17:23.000000000 -0400 | |
24307 | +++ linux-3.0.3/drivers/gpu/drm/drm_fops.c 2011-08-23 21:47:55.000000000 -0400 | |
24308 | @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device * | |
24309 | } | |
24310 | ||
24311 | for (i = 0; i < ARRAY_SIZE(dev->counts); i++) | |
24312 | - atomic_set(&dev->counts[i], 0); | |
24313 | + atomic_set_unchecked(&dev->counts[i], 0); | |
24314 | ||
24315 | dev->sigdata.lock = NULL; | |
24316 | ||
24317 | @@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct | |
24318 | ||
24319 | retcode = drm_open_helper(inode, filp, dev); | |
24320 | if (!retcode) { | |
24321 | - atomic_inc(&dev->counts[_DRM_STAT_OPENS]); | |
24322 | - if (!dev->open_count++) | |
24323 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]); | |
24324 | + if (local_inc_return(&dev->open_count) == 1) | |
24325 | retcode = drm_setup(dev); | |
24326 | } | |
24327 | if (!retcode) { | |
24328 | @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str | |
24329 | ||
24330 | mutex_lock(&drm_global_mutex); | |
24331 | ||
24332 | - DRM_DEBUG("open_count = %d\n", dev->open_count); | |
24333 | + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count)); | |
24334 | ||
24335 | if (dev->driver->preclose) | |
24336 | dev->driver->preclose(dev, file_priv); | |
24337 | @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str | |
24338 | DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n", | |
24339 | task_pid_nr(current), | |
24340 | (long)old_encode_dev(file_priv->minor->device), | |
24341 | - dev->open_count); | |
24342 | + local_read(&dev->open_count)); | |
24343 | ||
24344 | /* if the master has gone away we can't do anything with the lock */ | |
24345 | if (file_priv->minor->master) | |
24346 | @@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str | |
24347 | * End inline drm_release | |
24348 | */ | |
24349 | ||
24350 | - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]); | |
24351 | - if (!--dev->open_count) { | |
24352 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]); | |
24353 | + if (local_dec_and_test(&dev->open_count)) { | |
24354 | if (atomic_read(&dev->ioctl_count)) { | |
24355 | DRM_ERROR("Device busy: %d\n", | |
24356 | atomic_read(&dev->ioctl_count)); | |
24357 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_global.c linux-3.0.3/drivers/gpu/drm/drm_global.c | |
24358 | --- linux-3.0.3/drivers/gpu/drm/drm_global.c 2011-07-21 22:17:23.000000000 -0400 | |
24359 | +++ linux-3.0.3/drivers/gpu/drm/drm_global.c 2011-08-23 21:47:55.000000000 -0400 | |
24360 | @@ -36,7 +36,7 @@ | |
24361 | struct drm_global_item { | |
24362 | struct mutex mutex; | |
24363 | void *object; | |
24364 | - int refcount; | |
24365 | + atomic_t refcount; | |
24366 | }; | |
24367 | ||
24368 | static struct drm_global_item glob[DRM_GLOBAL_NUM]; | |
24369 | @@ -49,7 +49,7 @@ void drm_global_init(void) | |
24370 | struct drm_global_item *item = &glob[i]; | |
24371 | mutex_init(&item->mutex); | |
24372 | item->object = NULL; | |
24373 | - item->refcount = 0; | |
24374 | + atomic_set(&item->refcount, 0); | |
24375 | } | |
24376 | } | |
24377 | ||
24378 | @@ -59,7 +59,7 @@ void drm_global_release(void) | |
24379 | for (i = 0; i < DRM_GLOBAL_NUM; ++i) { | |
24380 | struct drm_global_item *item = &glob[i]; | |
24381 | BUG_ON(item->object != NULL); | |
24382 | - BUG_ON(item->refcount != 0); | |
24383 | + BUG_ON(atomic_read(&item->refcount) != 0); | |
24384 | } | |
24385 | } | |
24386 | ||
24387 | @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa | |
24388 | void *object; | |
24389 | ||
24390 | mutex_lock(&item->mutex); | |
24391 | - if (item->refcount == 0) { | |
24392 | + if (atomic_read(&item->refcount) == 0) { | |
24393 | item->object = kzalloc(ref->size, GFP_KERNEL); | |
24394 | if (unlikely(item->object == NULL)) { | |
24395 | ret = -ENOMEM; | |
24396 | @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa | |
24397 | goto out_err; | |
24398 | ||
24399 | } | |
24400 | - ++item->refcount; | |
24401 | + atomic_inc(&item->refcount); | |
24402 | ref->object = item->object; | |
24403 | object = item->object; | |
24404 | mutex_unlock(&item->mutex); | |
24405 | @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl | |
24406 | struct drm_global_item *item = &glob[ref->global_type]; | |
24407 | ||
24408 | mutex_lock(&item->mutex); | |
24409 | - BUG_ON(item->refcount == 0); | |
24410 | + BUG_ON(atomic_read(&item->refcount) == 0); | |
24411 | BUG_ON(ref->object != item->object); | |
24412 | - if (--item->refcount == 0) { | |
24413 | + if (atomic_dec_and_test(&item->refcount)) { | |
24414 | ref->release(ref); | |
24415 | item->object = NULL; | |
24416 | } | |
24417 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_info.c linux-3.0.3/drivers/gpu/drm/drm_info.c | |
24418 | --- linux-3.0.3/drivers/gpu/drm/drm_info.c 2011-07-21 22:17:23.000000000 -0400 | |
24419 | +++ linux-3.0.3/drivers/gpu/drm/drm_info.c 2011-08-23 21:48:14.000000000 -0400 | |
24420 | @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void | |
24421 | struct drm_local_map *map; | |
24422 | struct drm_map_list *r_list; | |
24423 | ||
24424 | - /* Hardcoded from _DRM_FRAME_BUFFER, | |
24425 | - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and | |
24426 | - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */ | |
24427 | - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" }; | |
24428 | + static const char * const types[] = { | |
24429 | + [_DRM_FRAME_BUFFER] = "FB", | |
24430 | + [_DRM_REGISTERS] = "REG", | |
24431 | + [_DRM_SHM] = "SHM", | |
24432 | + [_DRM_AGP] = "AGP", | |
24433 | + [_DRM_SCATTER_GATHER] = "SG", | |
24434 | + [_DRM_CONSISTENT] = "PCI", | |
24435 | + [_DRM_GEM] = "GEM" }; | |
24436 | const char *type; | |
24437 | int i; | |
24438 | ||
24439 | @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void | |
24440 | map = r_list->map; | |
24441 | if (!map) | |
24442 | continue; | |
24443 | - if (map->type < 0 || map->type > 5) | |
24444 | + if (map->type >= ARRAY_SIZE(types)) | |
24445 | type = "??"; | |
24446 | else | |
24447 | type = types[map->type]; | |
24448 | @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi | |
24449 | vma->vm_flags & VM_MAYSHARE ? 's' : 'p', | |
24450 | vma->vm_flags & VM_LOCKED ? 'l' : '-', | |
24451 | vma->vm_flags & VM_IO ? 'i' : '-', | |
24452 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
24453 | + 0); | |
24454 | +#else | |
24455 | vma->vm_pgoff); | |
24456 | +#endif | |
24457 | ||
24458 | #if defined(__i386__) | |
24459 | pgprot = pgprot_val(vma->vm_page_prot); | |
24460 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_ioctl.c linux-3.0.3/drivers/gpu/drm/drm_ioctl.c | |
24461 | --- linux-3.0.3/drivers/gpu/drm/drm_ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
24462 | +++ linux-3.0.3/drivers/gpu/drm/drm_ioctl.c 2011-08-23 21:47:55.000000000 -0400 | |
24463 | @@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev, | |
24464 | stats->data[i].value = | |
24465 | (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0); | |
24466 | else | |
24467 | - stats->data[i].value = atomic_read(&dev->counts[i]); | |
24468 | + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]); | |
24469 | stats->data[i].type = dev->types[i]; | |
24470 | } | |
24471 | ||
24472 | diff -urNp linux-3.0.3/drivers/gpu/drm/drm_lock.c linux-3.0.3/drivers/gpu/drm/drm_lock.c | |
24473 | --- linux-3.0.3/drivers/gpu/drm/drm_lock.c 2011-07-21 22:17:23.000000000 -0400 | |
24474 | +++ linux-3.0.3/drivers/gpu/drm/drm_lock.c 2011-08-23 21:47:55.000000000 -0400 | |
24475 | @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi | |
24476 | if (drm_lock_take(&master->lock, lock->context)) { | |
24477 | master->lock.file_priv = file_priv; | |
24478 | master->lock.lock_time = jiffies; | |
24479 | - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]); | |
24480 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]); | |
24481 | break; /* Got lock */ | |
24482 | } | |
24483 | ||
24484 | @@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v | |
24485 | return -EINVAL; | |
24486 | } | |
24487 | ||
24488 | - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]); | |
24489 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]); | |
24490 | ||
24491 | if (drm_lock_free(&master->lock, lock->context)) { | |
24492 | /* FIXME: Should really bail out here. */ | |
24493 | diff -urNp linux-3.0.3/drivers/gpu/drm/i810/i810_dma.c linux-3.0.3/drivers/gpu/drm/i810/i810_dma.c | |
24494 | --- linux-3.0.3/drivers/gpu/drm/i810/i810_dma.c 2011-07-21 22:17:23.000000000 -0400 | |
24495 | +++ linux-3.0.3/drivers/gpu/drm/i810/i810_dma.c 2011-08-23 21:47:55.000000000 -0400 | |
24496 | @@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de | |
24497 | dma->buflist[vertex->idx], | |
24498 | vertex->discard, vertex->used); | |
24499 | ||
24500 | - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]); | |
24501 | - atomic_inc(&dev->counts[_DRM_STAT_DMA]); | |
24502 | + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]); | |
24503 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]); | |
24504 | sarea_priv->last_enqueue = dev_priv->counter - 1; | |
24505 | sarea_priv->last_dispatch = (int)hw_status[5]; | |
24506 | ||
24507 | @@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device | |
24508 | i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used, | |
24509 | mc->last_render); | |
24510 | ||
24511 | - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]); | |
24512 | - atomic_inc(&dev->counts[_DRM_STAT_DMA]); | |
24513 | + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]); | |
24514 | + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]); | |
24515 | sarea_priv->last_enqueue = dev_priv->counter - 1; | |
24516 | sarea_priv->last_dispatch = (int)hw_status[5]; | |
24517 | ||
24518 | diff -urNp linux-3.0.3/drivers/gpu/drm/i810/i810_drv.h linux-3.0.3/drivers/gpu/drm/i810/i810_drv.h | |
24519 | --- linux-3.0.3/drivers/gpu/drm/i810/i810_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
24520 | +++ linux-3.0.3/drivers/gpu/drm/i810/i810_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
24521 | @@ -108,8 +108,8 @@ typedef struct drm_i810_private { | |
24522 | int page_flipping; | |
24523 | ||
24524 | wait_queue_head_t irq_queue; | |
24525 | - atomic_t irq_received; | |
24526 | - atomic_t irq_emitted; | |
24527 | + atomic_unchecked_t irq_received; | |
24528 | + atomic_unchecked_t irq_emitted; | |
24529 | ||
24530 | int front_offset; | |
24531 | } drm_i810_private_t; | |
24532 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.3/drivers/gpu/drm/i915/i915_debugfs.c | |
24533 | --- linux-3.0.3/drivers/gpu/drm/i915/i915_debugfs.c 2011-07-21 22:17:23.000000000 -0400 | |
24534 | +++ linux-3.0.3/drivers/gpu/drm/i915/i915_debugfs.c 2011-08-23 21:47:55.000000000 -0400 | |
24535 | @@ -497,7 +497,7 @@ static int i915_interrupt_info(struct se | |
24536 | I915_READ(GTIMR)); | |
24537 | } | |
24538 | seq_printf(m, "Interrupts received: %d\n", | |
24539 | - atomic_read(&dev_priv->irq_received)); | |
24540 | + atomic_read_unchecked(&dev_priv->irq_received)); | |
24541 | for (i = 0; i < I915_NUM_RINGS; i++) { | |
24542 | if (IS_GEN6(dev)) { | |
24543 | seq_printf(m, "Graphics Interrupt mask (%s): %08x\n", | |
24544 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/i915_dma.c linux-3.0.3/drivers/gpu/drm/i915/i915_dma.c | |
24545 | --- linux-3.0.3/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:44:40.000000000 -0400 | |
24546 | +++ linux-3.0.3/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:47:55.000000000 -0400 | |
24547 | @@ -1169,7 +1169,7 @@ static bool i915_switcheroo_can_switch(s | |
24548 | bool can_switch; | |
24549 | ||
24550 | spin_lock(&dev->count_lock); | |
24551 | - can_switch = (dev->open_count == 0); | |
24552 | + can_switch = (local_read(&dev->open_count) == 0); | |
24553 | spin_unlock(&dev->count_lock); | |
24554 | return can_switch; | |
24555 | } | |
24556 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/i915_drv.h linux-3.0.3/drivers/gpu/drm/i915/i915_drv.h | |
24557 | --- linux-3.0.3/drivers/gpu/drm/i915/i915_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
24558 | +++ linux-3.0.3/drivers/gpu/drm/i915/i915_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
24559 | @@ -219,7 +219,7 @@ struct drm_i915_display_funcs { | |
24560 | /* render clock increase/decrease */ | |
24561 | /* display clock increase/decrease */ | |
24562 | /* pll clock increase/decrease */ | |
24563 | -}; | |
24564 | +} __no_const; | |
24565 | ||
24566 | struct intel_device_info { | |
24567 | u8 gen; | |
24568 | @@ -300,7 +300,7 @@ typedef struct drm_i915_private { | |
24569 | int current_page; | |
24570 | int page_flipping; | |
24571 | ||
24572 | - atomic_t irq_received; | |
24573 | + atomic_unchecked_t irq_received; | |
24574 | ||
24575 | /* protects the irq masks */ | |
24576 | spinlock_t irq_lock; | |
24577 | @@ -874,7 +874,7 @@ struct drm_i915_gem_object { | |
24578 | * will be page flipped away on the next vblank. When it | |
24579 | * reaches 0, dev_priv->pending_flip_queue will be woken up. | |
24580 | */ | |
24581 | - atomic_t pending_flip; | |
24582 | + atomic_unchecked_t pending_flip; | |
24583 | }; | |
24584 | ||
24585 | #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base) | |
24586 | @@ -1247,7 +1247,7 @@ extern int intel_setup_gmbus(struct drm_ | |
24587 | extern void intel_teardown_gmbus(struct drm_device *dev); | |
24588 | extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed); | |
24589 | extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit); | |
24590 | -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter) | |
24591 | +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter) | |
24592 | { | |
24593 | return container_of(adapter, struct intel_gmbus, adapter)->force_bit; | |
24594 | } | |
24595 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-3.0.3/drivers/gpu/drm/i915/i915_gem_execbuffer.c | |
24596 | --- linux-3.0.3/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-07-21 22:17:23.000000000 -0400 | |
24597 | +++ linux-3.0.3/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-08-23 21:47:55.000000000 -0400 | |
24598 | @@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct | |
24599 | i915_gem_clflush_object(obj); | |
24600 | ||
24601 | if (obj->base.pending_write_domain) | |
24602 | - cd->flips |= atomic_read(&obj->pending_flip); | |
24603 | + cd->flips |= atomic_read_unchecked(&obj->pending_flip); | |
24604 | ||
24605 | /* The actual obj->write_domain will be updated with | |
24606 | * pending_write_domain after we emit the accumulated flush for all | |
24607 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/i915_irq.c linux-3.0.3/drivers/gpu/drm/i915/i915_irq.c | |
24608 | --- linux-3.0.3/drivers/gpu/drm/i915/i915_irq.c 2011-08-23 21:44:40.000000000 -0400 | |
24609 | +++ linux-3.0.3/drivers/gpu/drm/i915/i915_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
24610 | @@ -473,7 +473,7 @@ static irqreturn_t ivybridge_irq_handler | |
24611 | u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; | |
24612 | struct drm_i915_master_private *master_priv; | |
24613 | ||
24614 | - atomic_inc(&dev_priv->irq_received); | |
24615 | + atomic_inc_unchecked(&dev_priv->irq_received); | |
24616 | ||
24617 | /* disable master interrupt before clearing iir */ | |
24618 | de_ier = I915_READ(DEIER); | |
24619 | @@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler( | |
24620 | struct drm_i915_master_private *master_priv; | |
24621 | u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT; | |
24622 | ||
24623 | - atomic_inc(&dev_priv->irq_received); | |
24624 | + atomic_inc_unchecked(&dev_priv->irq_received); | |
24625 | ||
24626 | if (IS_GEN6(dev)) | |
24627 | bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT; | |
24628 | @@ -1226,7 +1226,7 @@ static irqreturn_t i915_driver_irq_handl | |
24629 | int ret = IRQ_NONE, pipe; | |
24630 | bool blc_event = false; | |
24631 | ||
24632 | - atomic_inc(&dev_priv->irq_received); | |
24633 | + atomic_inc_unchecked(&dev_priv->irq_received); | |
24634 | ||
24635 | iir = I915_READ(IIR); | |
24636 | ||
24637 | @@ -1735,7 +1735,7 @@ static void ironlake_irq_preinstall(stru | |
24638 | { | |
24639 | drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; | |
24640 | ||
24641 | - atomic_set(&dev_priv->irq_received, 0); | |
24642 | + atomic_set_unchecked(&dev_priv->irq_received, 0); | |
24643 | ||
24644 | INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); | |
24645 | INIT_WORK(&dev_priv->error_work, i915_error_work_func); | |
24646 | @@ -1899,7 +1899,7 @@ static void i915_driver_irq_preinstall(s | |
24647 | drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; | |
24648 | int pipe; | |
24649 | ||
24650 | - atomic_set(&dev_priv->irq_received, 0); | |
24651 | + atomic_set_unchecked(&dev_priv->irq_received, 0); | |
24652 | ||
24653 | INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); | |
24654 | INIT_WORK(&dev_priv->error_work, i915_error_work_func); | |
24655 | diff -urNp linux-3.0.3/drivers/gpu/drm/i915/intel_display.c linux-3.0.3/drivers/gpu/drm/i915/intel_display.c | |
24656 | --- linux-3.0.3/drivers/gpu/drm/i915/intel_display.c 2011-08-23 21:44:40.000000000 -0400 | |
24657 | +++ linux-3.0.3/drivers/gpu/drm/i915/intel_display.c 2011-08-23 21:47:55.000000000 -0400 | |
24658 | @@ -1961,7 +1961,7 @@ intel_pipe_set_base(struct drm_crtc *crt | |
24659 | ||
24660 | wait_event(dev_priv->pending_flip_queue, | |
24661 | atomic_read(&dev_priv->mm.wedged) || | |
24662 | - atomic_read(&obj->pending_flip) == 0); | |
24663 | + atomic_read_unchecked(&obj->pending_flip) == 0); | |
24664 | ||
24665 | /* Big Hammer, we also need to ensure that any pending | |
24666 | * MI_WAIT_FOR_EVENT inside a user batch buffer on the | |
24667 | @@ -2548,7 +2548,7 @@ static void intel_crtc_wait_for_pending_ | |
24668 | obj = to_intel_framebuffer(crtc->fb)->obj; | |
24669 | dev_priv = crtc->dev->dev_private; | |
24670 | wait_event(dev_priv->pending_flip_queue, | |
24671 | - atomic_read(&obj->pending_flip) == 0); | |
24672 | + atomic_read_unchecked(&obj->pending_flip) == 0); | |
24673 | } | |
24674 | ||
24675 | static bool intel_crtc_driving_pch(struct drm_crtc *crtc) | |
24676 | @@ -6225,7 +6225,7 @@ static void do_intel_finish_page_flip(st | |
24677 | ||
24678 | atomic_clear_mask(1 << intel_crtc->plane, | |
24679 | &obj->pending_flip.counter); | |
24680 | - if (atomic_read(&obj->pending_flip) == 0) | |
24681 | + if (atomic_read_unchecked(&obj->pending_flip) == 0) | |
24682 | wake_up(&dev_priv->pending_flip_queue); | |
24683 | ||
24684 | schedule_work(&work->work); | |
24685 | @@ -6514,7 +6514,7 @@ static int intel_crtc_page_flip(struct d | |
24686 | /* Block clients from rendering to the new back buffer until | |
24687 | * the flip occurs and the object is no longer visible. | |
24688 | */ | |
24689 | - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); | |
24690 | + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); | |
24691 | ||
24692 | ret = dev_priv->display.queue_flip(dev, crtc, fb, obj); | |
24693 | if (ret) | |
24694 | @@ -6527,7 +6527,7 @@ static int intel_crtc_page_flip(struct d | |
24695 | return 0; | |
24696 | ||
24697 | cleanup_pending: | |
24698 | - atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); | |
24699 | + atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip); | |
24700 | cleanup_objs: | |
24701 | drm_gem_object_unreference(&work->old_fb_obj->base); | |
24702 | drm_gem_object_unreference(&obj->base); | |
24703 | diff -urNp linux-3.0.3/drivers/gpu/drm/mga/mga_drv.h linux-3.0.3/drivers/gpu/drm/mga/mga_drv.h | |
24704 | --- linux-3.0.3/drivers/gpu/drm/mga/mga_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
24705 | +++ linux-3.0.3/drivers/gpu/drm/mga/mga_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
24706 | @@ -120,9 +120,9 @@ typedef struct drm_mga_private { | |
24707 | u32 clear_cmd; | |
24708 | u32 maccess; | |
24709 | ||
24710 | - atomic_t vbl_received; /**< Number of vblanks received. */ | |
24711 | + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */ | |
24712 | wait_queue_head_t fence_queue; | |
24713 | - atomic_t last_fence_retired; | |
24714 | + atomic_unchecked_t last_fence_retired; | |
24715 | u32 next_fence_to_post; | |
24716 | ||
24717 | unsigned int fb_cpp; | |
24718 | diff -urNp linux-3.0.3/drivers/gpu/drm/mga/mga_irq.c linux-3.0.3/drivers/gpu/drm/mga/mga_irq.c | |
24719 | --- linux-3.0.3/drivers/gpu/drm/mga/mga_irq.c 2011-07-21 22:17:23.000000000 -0400 | |
24720 | +++ linux-3.0.3/drivers/gpu/drm/mga/mga_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
24721 | @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de | |
24722 | if (crtc != 0) | |
24723 | return 0; | |
24724 | ||
24725 | - return atomic_read(&dev_priv->vbl_received); | |
24726 | + return atomic_read_unchecked(&dev_priv->vbl_received); | |
24727 | } | |
24728 | ||
24729 | ||
24730 | @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I | |
24731 | /* VBLANK interrupt */ | |
24732 | if (status & MGA_VLINEPEN) { | |
24733 | MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR); | |
24734 | - atomic_inc(&dev_priv->vbl_received); | |
24735 | + atomic_inc_unchecked(&dev_priv->vbl_received); | |
24736 | drm_handle_vblank(dev, 0); | |
24737 | handled = 1; | |
24738 | } | |
24739 | @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I | |
24740 | if ((prim_start & ~0x03) != (prim_end & ~0x03)) | |
24741 | MGA_WRITE(MGA_PRIMEND, prim_end); | |
24742 | ||
24743 | - atomic_inc(&dev_priv->last_fence_retired); | |
24744 | + atomic_inc_unchecked(&dev_priv->last_fence_retired); | |
24745 | DRM_WAKEUP(&dev_priv->fence_queue); | |
24746 | handled = 1; | |
24747 | } | |
24748 | @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev | |
24749 | * using fences. | |
24750 | */ | |
24751 | DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ, | |
24752 | - (((cur_fence = atomic_read(&dev_priv->last_fence_retired)) | |
24753 | + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired)) | |
24754 | - *sequence) <= (1 << 23))); | |
24755 | ||
24756 | *sequence = cur_fence; | |
24757 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_bios.c linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_bios.c | |
24758 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-07-21 22:17:23.000000000 -0400 | |
24759 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-08-26 19:49:56.000000000 -0400 | |
24760 | @@ -200,7 +200,7 @@ struct methods { | |
24761 | const char desc[8]; | |
24762 | void (*loadbios)(struct drm_device *, uint8_t *); | |
24763 | const bool rw; | |
24764 | -}; | |
24765 | +} __do_const; | |
24766 | ||
24767 | static struct methods shadow_methods[] = { | |
24768 | { "PRAMIN", load_vbios_pramin, true }, | |
24769 | @@ -5488,7 +5488,7 @@ parse_bit_displayport_tbl_entry(struct d | |
24770 | struct bit_table { | |
24771 | const char id; | |
24772 | int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *); | |
24773 | -}; | |
24774 | +} __no_const; | |
24775 | ||
24776 | #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry }) | |
24777 | ||
24778 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_drv.h linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_drv.h | |
24779 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
24780 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
24781 | @@ -227,7 +227,7 @@ struct nouveau_channel { | |
24782 | struct list_head pending; | |
24783 | uint32_t sequence; | |
24784 | uint32_t sequence_ack; | |
24785 | - atomic_t last_sequence_irq; | |
24786 | + atomic_unchecked_t last_sequence_irq; | |
24787 | } fence; | |
24788 | ||
24789 | /* DMA push buffer */ | |
24790 | @@ -304,7 +304,7 @@ struct nouveau_exec_engine { | |
24791 | u32 handle, u16 class); | |
24792 | void (*set_tile_region)(struct drm_device *dev, int i); | |
24793 | void (*tlb_flush)(struct drm_device *, int engine); | |
24794 | -}; | |
24795 | +} __no_const; | |
24796 | ||
24797 | struct nouveau_instmem_engine { | |
24798 | void *priv; | |
24799 | @@ -325,13 +325,13 @@ struct nouveau_instmem_engine { | |
24800 | struct nouveau_mc_engine { | |
24801 | int (*init)(struct drm_device *dev); | |
24802 | void (*takedown)(struct drm_device *dev); | |
24803 | -}; | |
24804 | +} __no_const; | |
24805 | ||
24806 | struct nouveau_timer_engine { | |
24807 | int (*init)(struct drm_device *dev); | |
24808 | void (*takedown)(struct drm_device *dev); | |
24809 | uint64_t (*read)(struct drm_device *dev); | |
24810 | -}; | |
24811 | +} __no_const; | |
24812 | ||
24813 | struct nouveau_fb_engine { | |
24814 | int num_tiles; | |
24815 | @@ -494,7 +494,7 @@ struct nouveau_vram_engine { | |
24816 | void (*put)(struct drm_device *, struct nouveau_mem **); | |
24817 | ||
24818 | bool (*flags_valid)(struct drm_device *, u32 tile_flags); | |
24819 | -}; | |
24820 | +} __no_const; | |
24821 | ||
24822 | struct nouveau_engine { | |
24823 | struct nouveau_instmem_engine instmem; | |
24824 | @@ -640,7 +640,7 @@ struct drm_nouveau_private { | |
24825 | struct drm_global_reference mem_global_ref; | |
24826 | struct ttm_bo_global_ref bo_global_ref; | |
24827 | struct ttm_bo_device bdev; | |
24828 | - atomic_t validate_sequence; | |
24829 | + atomic_unchecked_t validate_sequence; | |
24830 | } ttm; | |
24831 | ||
24832 | struct { | |
24833 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_fence.c linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_fence.c | |
24834 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-07-21 22:17:23.000000000 -0400 | |
24835 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-08-23 21:47:55.000000000 -0400 | |
24836 | @@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan | |
24837 | if (USE_REFCNT(dev)) | |
24838 | sequence = nvchan_rd32(chan, 0x48); | |
24839 | else | |
24840 | - sequence = atomic_read(&chan->fence.last_sequence_irq); | |
24841 | + sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq); | |
24842 | ||
24843 | if (chan->fence.sequence_ack == sequence) | |
24844 | goto out; | |
24845 | @@ -544,7 +544,7 @@ nouveau_fence_channel_init(struct nouvea | |
24846 | ||
24847 | INIT_LIST_HEAD(&chan->fence.pending); | |
24848 | spin_lock_init(&chan->fence.lock); | |
24849 | - atomic_set(&chan->fence.last_sequence_irq, 0); | |
24850 | + atomic_set_unchecked(&chan->fence.last_sequence_irq, 0); | |
24851 | return 0; | |
24852 | } | |
24853 | ||
24854 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_gem.c linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_gem.c | |
24855 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-07-21 22:17:23.000000000 -0400 | |
24856 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-08-23 21:47:55.000000000 -0400 | |
24857 | @@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch | |
24858 | int trycnt = 0; | |
24859 | int ret, i; | |
24860 | ||
24861 | - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence); | |
24862 | + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence); | |
24863 | retry: | |
24864 | if (++trycnt > 100000) { | |
24865 | NV_ERROR(dev, "%s failed and gave up.\n", __func__); | |
24866 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_state.c linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_state.c | |
24867 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_state.c 2011-07-21 22:17:23.000000000 -0400 | |
24868 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nouveau_state.c 2011-08-23 21:47:55.000000000 -0400 | |
24869 | @@ -488,7 +488,7 @@ static bool nouveau_switcheroo_can_switc | |
24870 | bool can_switch; | |
24871 | ||
24872 | spin_lock(&dev->count_lock); | |
24873 | - can_switch = (dev->open_count == 0); | |
24874 | + can_switch = (local_read(&dev->open_count) == 0); | |
24875 | spin_unlock(&dev->count_lock); | |
24876 | return can_switch; | |
24877 | } | |
24878 | diff -urNp linux-3.0.3/drivers/gpu/drm/nouveau/nv04_graph.c linux-3.0.3/drivers/gpu/drm/nouveau/nv04_graph.c | |
24879 | --- linux-3.0.3/drivers/gpu/drm/nouveau/nv04_graph.c 2011-07-21 22:17:23.000000000 -0400 | |
24880 | +++ linux-3.0.3/drivers/gpu/drm/nouveau/nv04_graph.c 2011-08-23 21:47:55.000000000 -0400 | |
24881 | @@ -560,7 +560,7 @@ static int | |
24882 | nv04_graph_mthd_set_ref(struct nouveau_channel *chan, | |
24883 | u32 class, u32 mthd, u32 data) | |
24884 | { | |
24885 | - atomic_set(&chan->fence.last_sequence_irq, data); | |
24886 | + atomic_set_unchecked(&chan->fence.last_sequence_irq, data); | |
24887 | return 0; | |
24888 | } | |
24889 | ||
24890 | diff -urNp linux-3.0.3/drivers/gpu/drm/r128/r128_cce.c linux-3.0.3/drivers/gpu/drm/r128/r128_cce.c | |
24891 | --- linux-3.0.3/drivers/gpu/drm/r128/r128_cce.c 2011-07-21 22:17:23.000000000 -0400 | |
24892 | +++ linux-3.0.3/drivers/gpu/drm/r128/r128_cce.c 2011-08-23 21:47:55.000000000 -0400 | |
24893 | @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d | |
24894 | ||
24895 | /* GH: Simple idle check. | |
24896 | */ | |
24897 | - atomic_set(&dev_priv->idle_count, 0); | |
24898 | + atomic_set_unchecked(&dev_priv->idle_count, 0); | |
24899 | ||
24900 | /* We don't support anything other than bus-mastering ring mode, | |
24901 | * but the ring can be in either AGP or PCI space for the ring | |
24902 | diff -urNp linux-3.0.3/drivers/gpu/drm/r128/r128_drv.h linux-3.0.3/drivers/gpu/drm/r128/r128_drv.h | |
24903 | --- linux-3.0.3/drivers/gpu/drm/r128/r128_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
24904 | +++ linux-3.0.3/drivers/gpu/drm/r128/r128_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
24905 | @@ -90,14 +90,14 @@ typedef struct drm_r128_private { | |
24906 | int is_pci; | |
24907 | unsigned long cce_buffers_offset; | |
24908 | ||
24909 | - atomic_t idle_count; | |
24910 | + atomic_unchecked_t idle_count; | |
24911 | ||
24912 | int page_flipping; | |
24913 | int current_page; | |
24914 | u32 crtc_offset; | |
24915 | u32 crtc_offset_cntl; | |
24916 | ||
24917 | - atomic_t vbl_received; | |
24918 | + atomic_unchecked_t vbl_received; | |
24919 | ||
24920 | u32 color_fmt; | |
24921 | unsigned int front_offset; | |
24922 | diff -urNp linux-3.0.3/drivers/gpu/drm/r128/r128_irq.c linux-3.0.3/drivers/gpu/drm/r128/r128_irq.c | |
24923 | --- linux-3.0.3/drivers/gpu/drm/r128/r128_irq.c 2011-07-21 22:17:23.000000000 -0400 | |
24924 | +++ linux-3.0.3/drivers/gpu/drm/r128/r128_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
24925 | @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d | |
24926 | if (crtc != 0) | |
24927 | return 0; | |
24928 | ||
24929 | - return atomic_read(&dev_priv->vbl_received); | |
24930 | + return atomic_read_unchecked(&dev_priv->vbl_received); | |
24931 | } | |
24932 | ||
24933 | irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS) | |
24934 | @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_ | |
24935 | /* VBLANK interrupt */ | |
24936 | if (status & R128_CRTC_VBLANK_INT) { | |
24937 | R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK); | |
24938 | - atomic_inc(&dev_priv->vbl_received); | |
24939 | + atomic_inc_unchecked(&dev_priv->vbl_received); | |
24940 | drm_handle_vblank(dev, 0); | |
24941 | return IRQ_HANDLED; | |
24942 | } | |
24943 | diff -urNp linux-3.0.3/drivers/gpu/drm/r128/r128_state.c linux-3.0.3/drivers/gpu/drm/r128/r128_state.c | |
24944 | --- linux-3.0.3/drivers/gpu/drm/r128/r128_state.c 2011-07-21 22:17:23.000000000 -0400 | |
24945 | +++ linux-3.0.3/drivers/gpu/drm/r128/r128_state.c 2011-08-23 21:47:55.000000000 -0400 | |
24946 | @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv | |
24947 | ||
24948 | static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv) | |
24949 | { | |
24950 | - if (atomic_read(&dev_priv->idle_count) == 0) | |
24951 | + if (atomic_read_unchecked(&dev_priv->idle_count) == 0) | |
24952 | r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0); | |
24953 | else | |
24954 | - atomic_set(&dev_priv->idle_count, 0); | |
24955 | + atomic_set_unchecked(&dev_priv->idle_count, 0); | |
24956 | } | |
24957 | ||
24958 | #endif | |
24959 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/atom.c linux-3.0.3/drivers/gpu/drm/radeon/atom.c | |
24960 | --- linux-3.0.3/drivers/gpu/drm/radeon/atom.c 2011-07-21 22:17:23.000000000 -0400 | |
24961 | +++ linux-3.0.3/drivers/gpu/drm/radeon/atom.c 2011-08-23 21:48:14.000000000 -0400 | |
24962 | @@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c | |
24963 | char name[512]; | |
24964 | int i; | |
24965 | ||
24966 | + pax_track_stack(); | |
24967 | + | |
24968 | ctx->card = card; | |
24969 | ctx->bios = bios; | |
24970 | ||
24971 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/mkregtable.c linux-3.0.3/drivers/gpu/drm/radeon/mkregtable.c | |
24972 | --- linux-3.0.3/drivers/gpu/drm/radeon/mkregtable.c 2011-07-21 22:17:23.000000000 -0400 | |
24973 | +++ linux-3.0.3/drivers/gpu/drm/radeon/mkregtable.c 2011-08-23 21:47:55.000000000 -0400 | |
24974 | @@ -637,14 +637,14 @@ static int parser_auth(struct table *t, | |
24975 | regex_t mask_rex; | |
24976 | regmatch_t match[4]; | |
24977 | char buf[1024]; | |
24978 | - size_t end; | |
24979 | + long end; | |
24980 | int len; | |
24981 | int done = 0; | |
24982 | int r; | |
24983 | unsigned o; | |
24984 | struct offset *offset; | |
24985 | char last_reg_s[10]; | |
24986 | - int last_reg; | |
24987 | + unsigned long last_reg; | |
24988 | ||
24989 | if (regcomp | |
24990 | (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { | |
24991 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_atombios.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_atombios.c | |
24992 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_atombios.c 2011-07-21 22:17:23.000000000 -0400 | |
24993 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_atombios.c 2011-08-23 21:48:14.000000000 -0400 | |
24994 | @@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from | |
24995 | struct radeon_gpio_rec gpio; | |
24996 | struct radeon_hpd hpd; | |
24997 | ||
24998 | + pax_track_stack(); | |
24999 | + | |
25000 | if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset)) | |
25001 | return false; | |
25002 | ||
25003 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_device.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_device.c | |
25004 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_device.c 2011-08-23 21:44:40.000000000 -0400 | |
25005 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_device.c 2011-08-23 21:47:55.000000000 -0400 | |
25006 | @@ -678,7 +678,7 @@ static bool radeon_switcheroo_can_switch | |
25007 | bool can_switch; | |
25008 | ||
25009 | spin_lock(&dev->count_lock); | |
25010 | - can_switch = (dev->open_count == 0); | |
25011 | + can_switch = (local_read(&dev->open_count) == 0); | |
25012 | spin_unlock(&dev->count_lock); | |
25013 | return can_switch; | |
25014 | } | |
25015 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_display.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_display.c | |
25016 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_display.c 2011-08-23 21:44:40.000000000 -0400 | |
25017 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_display.c 2011-08-23 21:48:14.000000000 -0400 | |
25018 | @@ -946,6 +946,8 @@ void radeon_compute_pll_legacy(struct ra | |
25019 | uint32_t post_div; | |
25020 | u32 pll_out_min, pll_out_max; | |
25021 | ||
25022 | + pax_track_stack(); | |
25023 | + | |
25024 | DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div); | |
25025 | freq = freq * 1000; | |
25026 | ||
25027 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_drv.h linux-3.0.3/drivers/gpu/drm/radeon/radeon_drv.h | |
25028 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
25029 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
25030 | @@ -255,7 +255,7 @@ typedef struct drm_radeon_private { | |
25031 | ||
25032 | /* SW interrupt */ | |
25033 | wait_queue_head_t swi_queue; | |
25034 | - atomic_t swi_emitted; | |
25035 | + atomic_unchecked_t swi_emitted; | |
25036 | int vblank_crtc; | |
25037 | uint32_t irq_enable_reg; | |
25038 | uint32_t r500_disp_irq_reg; | |
25039 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_fence.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_fence.c | |
25040 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_fence.c 2011-07-21 22:17:23.000000000 -0400 | |
25041 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_fence.c 2011-08-23 21:47:55.000000000 -0400 | |
25042 | @@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_devi | |
25043 | write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags); | |
25044 | return 0; | |
25045 | } | |
25046 | - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq); | |
25047 | + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq); | |
25048 | if (!rdev->cp.ready) | |
25049 | /* FIXME: cp is not running assume everythings is done right | |
25050 | * away | |
25051 | @@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct rade | |
25052 | return r; | |
25053 | } | |
25054 | radeon_fence_write(rdev, 0); | |
25055 | - atomic_set(&rdev->fence_drv.seq, 0); | |
25056 | + atomic_set_unchecked(&rdev->fence_drv.seq, 0); | |
25057 | INIT_LIST_HEAD(&rdev->fence_drv.created); | |
25058 | INIT_LIST_HEAD(&rdev->fence_drv.emited); | |
25059 | INIT_LIST_HEAD(&rdev->fence_drv.signaled); | |
25060 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon.h linux-3.0.3/drivers/gpu/drm/radeon/radeon.h | |
25061 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon.h 2011-07-21 22:17:23.000000000 -0400 | |
25062 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon.h 2011-08-23 21:47:55.000000000 -0400 | |
25063 | @@ -191,7 +191,7 @@ extern int sumo_get_temp(struct radeon_d | |
25064 | */ | |
25065 | struct radeon_fence_driver { | |
25066 | uint32_t scratch_reg; | |
25067 | - atomic_t seq; | |
25068 | + atomic_unchecked_t seq; | |
25069 | uint32_t last_seq; | |
25070 | unsigned long last_jiffies; | |
25071 | unsigned long last_timeout; | |
25072 | @@ -960,7 +960,7 @@ struct radeon_asic { | |
25073 | void (*pre_page_flip)(struct radeon_device *rdev, int crtc); | |
25074 | u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base); | |
25075 | void (*post_page_flip)(struct radeon_device *rdev, int crtc); | |
25076 | -}; | |
25077 | +} __no_const; | |
25078 | ||
25079 | /* | |
25080 | * Asic structures | |
25081 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_ioc32.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_ioc32.c | |
25082 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-07-21 22:17:23.000000000 -0400 | |
25083 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-08-23 21:47:55.000000000 -0400 | |
25084 | @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str | |
25085 | request = compat_alloc_user_space(sizeof(*request)); | |
25086 | if (!access_ok(VERIFY_WRITE, request, sizeof(*request)) | |
25087 | || __put_user(req32.param, &request->param) | |
25088 | - || __put_user((void __user *)(unsigned long)req32.value, | |
25089 | + || __put_user((unsigned long)req32.value, | |
25090 | &request->value)) | |
25091 | return -EFAULT; | |
25092 | ||
25093 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_irq.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_irq.c | |
25094 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_irq.c 2011-07-21 22:17:23.000000000 -0400 | |
25095 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
25096 | @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de | |
25097 | unsigned int ret; | |
25098 | RING_LOCALS; | |
25099 | ||
25100 | - atomic_inc(&dev_priv->swi_emitted); | |
25101 | - ret = atomic_read(&dev_priv->swi_emitted); | |
25102 | + atomic_inc_unchecked(&dev_priv->swi_emitted); | |
25103 | + ret = atomic_read_unchecked(&dev_priv->swi_emitted); | |
25104 | ||
25105 | BEGIN_RING(4); | |
25106 | OUT_RING_REG(RADEON_LAST_SWI_REG, ret); | |
25107 | @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct | |
25108 | drm_radeon_private_t *dev_priv = | |
25109 | (drm_radeon_private_t *) dev->dev_private; | |
25110 | ||
25111 | - atomic_set(&dev_priv->swi_emitted, 0); | |
25112 | + atomic_set_unchecked(&dev_priv->swi_emitted, 0); | |
25113 | DRM_INIT_WAITQUEUE(&dev_priv->swi_queue); | |
25114 | ||
25115 | dev->max_vblank_count = 0x001fffff; | |
25116 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_state.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_state.c | |
25117 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_state.c 2011-07-21 22:17:23.000000000 -0400 | |
25118 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_state.c 2011-08-23 21:47:55.000000000 -0400 | |
25119 | @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de | |
25120 | if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS) | |
25121 | sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS; | |
25122 | ||
25123 | - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes, | |
25124 | + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes, | |
25125 | sarea_priv->nbox * sizeof(depth_boxes[0]))) | |
25126 | return -EFAULT; | |
25127 | ||
25128 | @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm | |
25129 | { | |
25130 | drm_radeon_private_t *dev_priv = dev->dev_private; | |
25131 | drm_radeon_getparam_t *param = data; | |
25132 | - int value; | |
25133 | + int value = 0; | |
25134 | ||
25135 | DRM_DEBUG("pid=%d\n", DRM_CURRENTPID); | |
25136 | ||
25137 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/radeon_ttm.c linux-3.0.3/drivers/gpu/drm/radeon/radeon_ttm.c | |
25138 | --- linux-3.0.3/drivers/gpu/drm/radeon/radeon_ttm.c 2011-07-21 22:17:23.000000000 -0400 | |
25139 | +++ linux-3.0.3/drivers/gpu/drm/radeon/radeon_ttm.c 2011-08-23 21:47:55.000000000 -0400 | |
25140 | @@ -644,8 +644,10 @@ int radeon_mmap(struct file *filp, struc | |
25141 | } | |
25142 | if (unlikely(ttm_vm_ops == NULL)) { | |
25143 | ttm_vm_ops = vma->vm_ops; | |
25144 | - radeon_ttm_vm_ops = *ttm_vm_ops; | |
25145 | - radeon_ttm_vm_ops.fault = &radeon_ttm_fault; | |
25146 | + pax_open_kernel(); | |
25147 | + memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops)); | |
25148 | + *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault; | |
25149 | + pax_close_kernel(); | |
25150 | } | |
25151 | vma->vm_ops = &radeon_ttm_vm_ops; | |
25152 | return 0; | |
25153 | diff -urNp linux-3.0.3/drivers/gpu/drm/radeon/rs690.c linux-3.0.3/drivers/gpu/drm/radeon/rs690.c | |
25154 | --- linux-3.0.3/drivers/gpu/drm/radeon/rs690.c 2011-07-21 22:17:23.000000000 -0400 | |
25155 | +++ linux-3.0.3/drivers/gpu/drm/radeon/rs690.c 2011-08-23 21:47:55.000000000 -0400 | |
25156 | @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct | |
25157 | if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full && | |
25158 | rdev->pm.sideport_bandwidth.full) | |
25159 | rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth; | |
25160 | - read_delay_latency.full = dfixed_const(370 * 800 * 1000); | |
25161 | + read_delay_latency.full = dfixed_const(800 * 1000); | |
25162 | read_delay_latency.full = dfixed_div(read_delay_latency, | |
25163 | rdev->pm.igp_sideport_mclk); | |
25164 | + a.full = dfixed_const(370); | |
25165 | + read_delay_latency.full = dfixed_mul(read_delay_latency, a); | |
25166 | } else { | |
25167 | if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full && | |
25168 | rdev->pm.k8_bandwidth.full) | |
25169 | diff -urNp linux-3.0.3/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-3.0.3/drivers/gpu/drm/ttm/ttm_page_alloc.c | |
25170 | --- linux-3.0.3/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-07-21 22:17:23.000000000 -0400 | |
25171 | +++ linux-3.0.3/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-08-23 21:47:55.000000000 -0400 | |
25172 | @@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages | |
25173 | static int ttm_pool_mm_shrink(struct shrinker *shrink, | |
25174 | struct shrink_control *sc) | |
25175 | { | |
25176 | - static atomic_t start_pool = ATOMIC_INIT(0); | |
25177 | + static atomic_unchecked_t start_pool = ATOMIC_INIT(0); | |
25178 | unsigned i; | |
25179 | - unsigned pool_offset = atomic_add_return(1, &start_pool); | |
25180 | + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool); | |
25181 | struct ttm_page_pool *pool; | |
25182 | int shrink_pages = sc->nr_to_scan; | |
25183 | ||
25184 | diff -urNp linux-3.0.3/drivers/gpu/drm/via/via_drv.h linux-3.0.3/drivers/gpu/drm/via/via_drv.h | |
25185 | --- linux-3.0.3/drivers/gpu/drm/via/via_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
25186 | +++ linux-3.0.3/drivers/gpu/drm/via/via_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
25187 | @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer { | |
25188 | typedef uint32_t maskarray_t[5]; | |
25189 | ||
25190 | typedef struct drm_via_irq { | |
25191 | - atomic_t irq_received; | |
25192 | + atomic_unchecked_t irq_received; | |
25193 | uint32_t pending_mask; | |
25194 | uint32_t enable_mask; | |
25195 | wait_queue_head_t irq_queue; | |
25196 | @@ -75,7 +75,7 @@ typedef struct drm_via_private { | |
25197 | struct timeval last_vblank; | |
25198 | int last_vblank_valid; | |
25199 | unsigned usec_per_vblank; | |
25200 | - atomic_t vbl_received; | |
25201 | + atomic_unchecked_t vbl_received; | |
25202 | drm_via_state_t hc_state; | |
25203 | char pci_buf[VIA_PCI_BUF_SIZE]; | |
25204 | const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE]; | |
25205 | diff -urNp linux-3.0.3/drivers/gpu/drm/via/via_irq.c linux-3.0.3/drivers/gpu/drm/via/via_irq.c | |
25206 | --- linux-3.0.3/drivers/gpu/drm/via/via_irq.c 2011-07-21 22:17:23.000000000 -0400 | |
25207 | +++ linux-3.0.3/drivers/gpu/drm/via/via_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
25208 | @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de | |
25209 | if (crtc != 0) | |
25210 | return 0; | |
25211 | ||
25212 | - return atomic_read(&dev_priv->vbl_received); | |
25213 | + return atomic_read_unchecked(&dev_priv->vbl_received); | |
25214 | } | |
25215 | ||
25216 | irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS) | |
25217 | @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I | |
25218 | ||
25219 | status = VIA_READ(VIA_REG_INTERRUPT); | |
25220 | if (status & VIA_IRQ_VBLANK_PENDING) { | |
25221 | - atomic_inc(&dev_priv->vbl_received); | |
25222 | - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) { | |
25223 | + atomic_inc_unchecked(&dev_priv->vbl_received); | |
25224 | + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) { | |
25225 | do_gettimeofday(&cur_vblank); | |
25226 | if (dev_priv->last_vblank_valid) { | |
25227 | dev_priv->usec_per_vblank = | |
25228 | @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I | |
25229 | dev_priv->last_vblank = cur_vblank; | |
25230 | dev_priv->last_vblank_valid = 1; | |
25231 | } | |
25232 | - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) { | |
25233 | + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) { | |
25234 | DRM_DEBUG("US per vblank is: %u\n", | |
25235 | dev_priv->usec_per_vblank); | |
25236 | } | |
25237 | @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I | |
25238 | ||
25239 | for (i = 0; i < dev_priv->num_irqs; ++i) { | |
25240 | if (status & cur_irq->pending_mask) { | |
25241 | - atomic_inc(&cur_irq->irq_received); | |
25242 | + atomic_inc_unchecked(&cur_irq->irq_received); | |
25243 | DRM_WAKEUP(&cur_irq->irq_queue); | |
25244 | handled = 1; | |
25245 | if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) | |
25246 | @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d | |
25247 | DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ, | |
25248 | ((VIA_READ(masks[irq][2]) & masks[irq][3]) == | |
25249 | masks[irq][4])); | |
25250 | - cur_irq_sequence = atomic_read(&cur_irq->irq_received); | |
25251 | + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received); | |
25252 | } else { | |
25253 | DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ, | |
25254 | (((cur_irq_sequence = | |
25255 | - atomic_read(&cur_irq->irq_received)) - | |
25256 | + atomic_read_unchecked(&cur_irq->irq_received)) - | |
25257 | *sequence) <= (1 << 23))); | |
25258 | } | |
25259 | *sequence = cur_irq_sequence; | |
25260 | @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr | |
25261 | } | |
25262 | ||
25263 | for (i = 0; i < dev_priv->num_irqs; ++i) { | |
25264 | - atomic_set(&cur_irq->irq_received, 0); | |
25265 | + atomic_set_unchecked(&cur_irq->irq_received, 0); | |
25266 | cur_irq->enable_mask = dev_priv->irq_masks[i][0]; | |
25267 | cur_irq->pending_mask = dev_priv->irq_masks[i][1]; | |
25268 | DRM_INIT_WAITQUEUE(&cur_irq->irq_queue); | |
25269 | @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, | |
25270 | switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) { | |
25271 | case VIA_IRQ_RELATIVE: | |
25272 | irqwait->request.sequence += | |
25273 | - atomic_read(&cur_irq->irq_received); | |
25274 | + atomic_read_unchecked(&cur_irq->irq_received); | |
25275 | irqwait->request.type &= ~_DRM_VBLANK_RELATIVE; | |
25276 | case VIA_IRQ_ABSOLUTE: | |
25277 | break; | |
25278 | diff -urNp linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | |
25279 | --- linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-07-21 22:17:23.000000000 -0400 | |
25280 | +++ linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-08-23 21:47:55.000000000 -0400 | |
25281 | @@ -240,7 +240,7 @@ struct vmw_private { | |
25282 | * Fencing and IRQs. | |
25283 | */ | |
25284 | ||
25285 | - atomic_t fence_seq; | |
25286 | + atomic_unchecked_t fence_seq; | |
25287 | wait_queue_head_t fence_queue; | |
25288 | wait_queue_head_t fifo_queue; | |
25289 | atomic_t fence_queue_waiters; | |
25290 | diff -urNp linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | |
25291 | --- linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-07-21 22:17:23.000000000 -0400 | |
25292 | +++ linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-08-23 21:47:55.000000000 -0400 | |
25293 | @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev | |
25294 | while (!vmw_lag_lt(queue, us)) { | |
25295 | spin_lock(&queue->lock); | |
25296 | if (list_empty(&queue->head)) | |
25297 | - sequence = atomic_read(&dev_priv->fence_seq); | |
25298 | + sequence = atomic_read_unchecked(&dev_priv->fence_seq); | |
25299 | else { | |
25300 | fence = list_first_entry(&queue->head, | |
25301 | struct vmw_fence, head); | |
25302 | diff -urNp linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | |
25303 | --- linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-07-21 22:17:23.000000000 -0400 | |
25304 | +++ linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-08-23 21:47:55.000000000 -0400 | |
25305 | @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de | |
25306 | (unsigned int) min, | |
25307 | (unsigned int) fifo->capabilities); | |
25308 | ||
25309 | - atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence); | |
25310 | + atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence); | |
25311 | iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE); | |
25312 | vmw_fence_queue_init(&fifo->fence_queue); | |
25313 | return vmw_fifo_send_fence(dev_priv, &dummy); | |
25314 | @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva | |
25315 | ||
25316 | fm = vmw_fifo_reserve(dev_priv, bytes); | |
25317 | if (unlikely(fm == NULL)) { | |
25318 | - *sequence = atomic_read(&dev_priv->fence_seq); | |
25319 | + *sequence = atomic_read_unchecked(&dev_priv->fence_seq); | |
25320 | ret = -ENOMEM; | |
25321 | (void)vmw_fallback_wait(dev_priv, false, true, *sequence, | |
25322 | false, 3*HZ); | |
25323 | @@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva | |
25324 | } | |
25325 | ||
25326 | do { | |
25327 | - *sequence = atomic_add_return(1, &dev_priv->fence_seq); | |
25328 | + *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq); | |
25329 | } while (*sequence == 0); | |
25330 | ||
25331 | if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) { | |
25332 | diff -urNp linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | |
25333 | --- linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-07-21 22:17:23.000000000 -0400 | |
25334 | +++ linux-3.0.3/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-08-23 21:47:55.000000000 -0400 | |
25335 | @@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva | |
25336 | * emitted. Then the fence is stale and signaled. | |
25337 | */ | |
25338 | ||
25339 | - ret = ((atomic_read(&dev_priv->fence_seq) - sequence) | |
25340 | + ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence) | |
25341 | > VMW_FENCE_WRAP); | |
25342 | ||
25343 | return ret; | |
25344 | @@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private | |
25345 | ||
25346 | if (fifo_idle) | |
25347 | down_read(&fifo_state->rwsem); | |
25348 | - signal_seq = atomic_read(&dev_priv->fence_seq); | |
25349 | + signal_seq = atomic_read_unchecked(&dev_priv->fence_seq); | |
25350 | ret = 0; | |
25351 | ||
25352 | for (;;) { | |
25353 | diff -urNp linux-3.0.3/drivers/hid/hid-core.c linux-3.0.3/drivers/hid/hid-core.c | |
25354 | --- linux-3.0.3/drivers/hid/hid-core.c 2011-07-21 22:17:23.000000000 -0400 | |
25355 | +++ linux-3.0.3/drivers/hid/hid-core.c 2011-08-23 21:47:55.000000000 -0400 | |
25356 | @@ -1923,7 +1923,7 @@ static bool hid_ignore(struct hid_device | |
25357 | ||
25358 | int hid_add_device(struct hid_device *hdev) | |
25359 | { | |
25360 | - static atomic_t id = ATOMIC_INIT(0); | |
25361 | + static atomic_unchecked_t id = ATOMIC_INIT(0); | |
25362 | int ret; | |
25363 | ||
25364 | if (WARN_ON(hdev->status & HID_STAT_ADDED)) | |
25365 | @@ -1938,7 +1938,7 @@ int hid_add_device(struct hid_device *hd | |
25366 | /* XXX hack, any other cleaner solution after the driver core | |
25367 | * is converted to allow more than 20 bytes as the device name? */ | |
25368 | dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus, | |
25369 | - hdev->vendor, hdev->product, atomic_inc_return(&id)); | |
25370 | + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id)); | |
25371 | ||
25372 | hid_debug_register(hdev, dev_name(&hdev->dev)); | |
25373 | ret = device_add(&hdev->dev); | |
25374 | diff -urNp linux-3.0.3/drivers/hid/usbhid/hiddev.c linux-3.0.3/drivers/hid/usbhid/hiddev.c | |
25375 | --- linux-3.0.3/drivers/hid/usbhid/hiddev.c 2011-07-21 22:17:23.000000000 -0400 | |
25376 | +++ linux-3.0.3/drivers/hid/usbhid/hiddev.c 2011-08-23 21:47:55.000000000 -0400 | |
25377 | @@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *fi | |
25378 | break; | |
25379 | ||
25380 | case HIDIOCAPPLICATION: | |
25381 | - if (arg < 0 || arg >= hid->maxapplication) | |
25382 | + if (arg >= hid->maxapplication) | |
25383 | break; | |
25384 | ||
25385 | for (i = 0; i < hid->maxcollection; i++) | |
25386 | diff -urNp linux-3.0.3/drivers/hwmon/acpi_power_meter.c linux-3.0.3/drivers/hwmon/acpi_power_meter.c | |
25387 | --- linux-3.0.3/drivers/hwmon/acpi_power_meter.c 2011-07-21 22:17:23.000000000 -0400 | |
25388 | +++ linux-3.0.3/drivers/hwmon/acpi_power_meter.c 2011-08-23 21:47:55.000000000 -0400 | |
25389 | @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d | |
25390 | return res; | |
25391 | ||
25392 | temp /= 1000; | |
25393 | - if (temp < 0) | |
25394 | - return -EINVAL; | |
25395 | ||
25396 | mutex_lock(&resource->lock); | |
25397 | resource->trip[attr->index - 7] = temp; | |
25398 | diff -urNp linux-3.0.3/drivers/hwmon/sht15.c linux-3.0.3/drivers/hwmon/sht15.c | |
25399 | --- linux-3.0.3/drivers/hwmon/sht15.c 2011-07-21 22:17:23.000000000 -0400 | |
25400 | +++ linux-3.0.3/drivers/hwmon/sht15.c 2011-08-23 21:47:55.000000000 -0400 | |
25401 | @@ -166,7 +166,7 @@ struct sht15_data { | |
25402 | int supply_uV; | |
25403 | bool supply_uV_valid; | |
25404 | struct work_struct update_supply_work; | |
25405 | - atomic_t interrupt_handled; | |
25406 | + atomic_unchecked_t interrupt_handled; | |
25407 | }; | |
25408 | ||
25409 | /** | |
25410 | @@ -509,13 +509,13 @@ static int sht15_measurement(struct sht1 | |
25411 | return ret; | |
25412 | ||
25413 | gpio_direction_input(data->pdata->gpio_data); | |
25414 | - atomic_set(&data->interrupt_handled, 0); | |
25415 | + atomic_set_unchecked(&data->interrupt_handled, 0); | |
25416 | ||
25417 | enable_irq(gpio_to_irq(data->pdata->gpio_data)); | |
25418 | if (gpio_get_value(data->pdata->gpio_data) == 0) { | |
25419 | disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data)); | |
25420 | /* Only relevant if the interrupt hasn't occurred. */ | |
25421 | - if (!atomic_read(&data->interrupt_handled)) | |
25422 | + if (!atomic_read_unchecked(&data->interrupt_handled)) | |
25423 | schedule_work(&data->read_work); | |
25424 | } | |
25425 | ret = wait_event_timeout(data->wait_queue, | |
25426 | @@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired | |
25427 | ||
25428 | /* First disable the interrupt */ | |
25429 | disable_irq_nosync(irq); | |
25430 | - atomic_inc(&data->interrupt_handled); | |
25431 | + atomic_inc_unchecked(&data->interrupt_handled); | |
25432 | /* Then schedule a reading work struct */ | |
25433 | if (data->state != SHT15_READING_NOTHING) | |
25434 | schedule_work(&data->read_work); | |
25435 | @@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct wo | |
25436 | * If not, then start the interrupt again - care here as could | |
25437 | * have gone low in meantime so verify it hasn't! | |
25438 | */ | |
25439 | - atomic_set(&data->interrupt_handled, 0); | |
25440 | + atomic_set_unchecked(&data->interrupt_handled, 0); | |
25441 | enable_irq(gpio_to_irq(data->pdata->gpio_data)); | |
25442 | /* If still not occurred or another handler has been scheduled */ | |
25443 | if (gpio_get_value(data->pdata->gpio_data) | |
25444 | - || atomic_read(&data->interrupt_handled)) | |
25445 | + || atomic_read_unchecked(&data->interrupt_handled)) | |
25446 | return; | |
25447 | } | |
25448 | ||
25449 | diff -urNp linux-3.0.3/drivers/hwmon/w83791d.c linux-3.0.3/drivers/hwmon/w83791d.c | |
25450 | --- linux-3.0.3/drivers/hwmon/w83791d.c 2011-07-21 22:17:23.000000000 -0400 | |
25451 | +++ linux-3.0.3/drivers/hwmon/w83791d.c 2011-08-23 21:47:55.000000000 -0400 | |
25452 | @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli | |
25453 | struct i2c_board_info *info); | |
25454 | static int w83791d_remove(struct i2c_client *client); | |
25455 | ||
25456 | -static int w83791d_read(struct i2c_client *client, u8 register); | |
25457 | -static int w83791d_write(struct i2c_client *client, u8 register, u8 value); | |
25458 | +static int w83791d_read(struct i2c_client *client, u8 reg); | |
25459 | +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value); | |
25460 | static struct w83791d_data *w83791d_update_device(struct device *dev); | |
25461 | ||
25462 | #ifdef DEBUG | |
25463 | diff -urNp linux-3.0.3/drivers/i2c/busses/i2c-amd756-s4882.c linux-3.0.3/drivers/i2c/busses/i2c-amd756-s4882.c | |
25464 | --- linux-3.0.3/drivers/i2c/busses/i2c-amd756-s4882.c 2011-07-21 22:17:23.000000000 -0400 | |
25465 | +++ linux-3.0.3/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-23 21:47:55.000000000 -0400 | |
25466 | @@ -43,7 +43,7 @@ | |
25467 | extern struct i2c_adapter amd756_smbus; | |
25468 | ||
25469 | static struct i2c_adapter *s4882_adapter; | |
25470 | -static struct i2c_algorithm *s4882_algo; | |
25471 | +static i2c_algorithm_no_const *s4882_algo; | |
25472 | ||
25473 | /* Wrapper access functions for multiplexed SMBus */ | |
25474 | static DEFINE_MUTEX(amd756_lock); | |
25475 | diff -urNp linux-3.0.3/drivers/i2c/busses/i2c-nforce2-s4985.c linux-3.0.3/drivers/i2c/busses/i2c-nforce2-s4985.c | |
25476 | --- linux-3.0.3/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-07-21 22:17:23.000000000 -0400 | |
25477 | +++ linux-3.0.3/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-23 21:47:55.000000000 -0400 | |
25478 | @@ -41,7 +41,7 @@ | |
25479 | extern struct i2c_adapter *nforce2_smbus; | |
25480 | ||
25481 | static struct i2c_adapter *s4985_adapter; | |
25482 | -static struct i2c_algorithm *s4985_algo; | |
25483 | +static i2c_algorithm_no_const *s4985_algo; | |
25484 | ||
25485 | /* Wrapper access functions for multiplexed SMBus */ | |
25486 | static DEFINE_MUTEX(nforce2_lock); | |
25487 | diff -urNp linux-3.0.3/drivers/i2c/i2c-mux.c linux-3.0.3/drivers/i2c/i2c-mux.c | |
25488 | --- linux-3.0.3/drivers/i2c/i2c-mux.c 2011-07-21 22:17:23.000000000 -0400 | |
25489 | +++ linux-3.0.3/drivers/i2c/i2c-mux.c 2011-08-23 21:47:55.000000000 -0400 | |
25490 | @@ -28,7 +28,7 @@ | |
25491 | /* multiplexer per channel data */ | |
25492 | struct i2c_mux_priv { | |
25493 | struct i2c_adapter adap; | |
25494 | - struct i2c_algorithm algo; | |
25495 | + i2c_algorithm_no_const algo; | |
25496 | ||
25497 | struct i2c_adapter *parent; | |
25498 | void *mux_dev; /* the mux chip/device */ | |
25499 | diff -urNp linux-3.0.3/drivers/ide/ide-cd.c linux-3.0.3/drivers/ide/ide-cd.c | |
25500 | --- linux-3.0.3/drivers/ide/ide-cd.c 2011-07-21 22:17:23.000000000 -0400 | |
25501 | +++ linux-3.0.3/drivers/ide/ide-cd.c 2011-08-23 21:47:55.000000000 -0400 | |
25502 | @@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_ | |
25503 | alignment = queue_dma_alignment(q) | q->dma_pad_mask; | |
25504 | if ((unsigned long)buf & alignment | |
25505 | || blk_rq_bytes(rq) & q->dma_pad_mask | |
25506 | - || object_is_on_stack(buf)) | |
25507 | + || object_starts_on_stack(buf)) | |
25508 | drive->dma = 0; | |
25509 | } | |
25510 | } | |
25511 | diff -urNp linux-3.0.3/drivers/ide/ide-floppy.c linux-3.0.3/drivers/ide/ide-floppy.c | |
25512 | --- linux-3.0.3/drivers/ide/ide-floppy.c 2011-07-21 22:17:23.000000000 -0400 | |
25513 | +++ linux-3.0.3/drivers/ide/ide-floppy.c 2011-08-23 21:48:14.000000000 -0400 | |
25514 | @@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d | |
25515 | u8 pc_buf[256], header_len, desc_cnt; | |
25516 | int i, rc = 1, blocks, length; | |
25517 | ||
25518 | + pax_track_stack(); | |
25519 | + | |
25520 | ide_debug_log(IDE_DBG_FUNC, "enter"); | |
25521 | ||
25522 | drive->bios_cyl = 0; | |
25523 | diff -urNp linux-3.0.3/drivers/ide/setup-pci.c linux-3.0.3/drivers/ide/setup-pci.c | |
25524 | --- linux-3.0.3/drivers/ide/setup-pci.c 2011-07-21 22:17:23.000000000 -0400 | |
25525 | +++ linux-3.0.3/drivers/ide/setup-pci.c 2011-08-23 21:48:14.000000000 -0400 | |
25526 | @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev | |
25527 | int ret, i, n_ports = dev2 ? 4 : 2; | |
25528 | struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL }; | |
25529 | ||
25530 | + pax_track_stack(); | |
25531 | + | |
25532 | for (i = 0; i < n_ports / 2; i++) { | |
25533 | ret = ide_setup_pci_controller(pdev[i], d, !i); | |
25534 | if (ret < 0) | |
25535 | diff -urNp linux-3.0.3/drivers/infiniband/core/cm.c linux-3.0.3/drivers/infiniband/core/cm.c | |
25536 | --- linux-3.0.3/drivers/infiniband/core/cm.c 2011-07-21 22:17:23.000000000 -0400 | |
25537 | +++ linux-3.0.3/drivers/infiniband/core/cm.c 2011-08-23 21:47:55.000000000 -0400 | |
25538 | @@ -113,7 +113,7 @@ static char const counter_group_names[CM | |
25539 | ||
25540 | struct cm_counter_group { | |
25541 | struct kobject obj; | |
25542 | - atomic_long_t counter[CM_ATTR_COUNT]; | |
25543 | + atomic_long_unchecked_t counter[CM_ATTR_COUNT]; | |
25544 | }; | |
25545 | ||
25546 | struct cm_counter_attribute { | |
25547 | @@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm | |
25548 | struct ib_mad_send_buf *msg = NULL; | |
25549 | int ret; | |
25550 | ||
25551 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25552 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25553 | counter[CM_REQ_COUNTER]); | |
25554 | ||
25555 | /* Quick state check to discard duplicate REQs. */ | |
25556 | @@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm | |
25557 | if (!cm_id_priv) | |
25558 | return; | |
25559 | ||
25560 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25561 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25562 | counter[CM_REP_COUNTER]); | |
25563 | ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg); | |
25564 | if (ret) | |
25565 | @@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work | |
25566 | if (cm_id_priv->id.state != IB_CM_REP_SENT && | |
25567 | cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) { | |
25568 | spin_unlock_irq(&cm_id_priv->lock); | |
25569 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25570 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25571 | counter[CM_RTU_COUNTER]); | |
25572 | goto out; | |
25573 | } | |
25574 | @@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor | |
25575 | cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id, | |
25576 | dreq_msg->local_comm_id); | |
25577 | if (!cm_id_priv) { | |
25578 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25579 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25580 | counter[CM_DREQ_COUNTER]); | |
25581 | cm_issue_drep(work->port, work->mad_recv_wc); | |
25582 | return -EINVAL; | |
25583 | @@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor | |
25584 | case IB_CM_MRA_REP_RCVD: | |
25585 | break; | |
25586 | case IB_CM_TIMEWAIT: | |
25587 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25588 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25589 | counter[CM_DREQ_COUNTER]); | |
25590 | if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg)) | |
25591 | goto unlock; | |
25592 | @@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor | |
25593 | cm_free_msg(msg); | |
25594 | goto deref; | |
25595 | case IB_CM_DREQ_RCVD: | |
25596 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25597 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25598 | counter[CM_DREQ_COUNTER]); | |
25599 | goto unlock; | |
25600 | default: | |
25601 | @@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work | |
25602 | ib_modify_mad(cm_id_priv->av.port->mad_agent, | |
25603 | cm_id_priv->msg, timeout)) { | |
25604 | if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD) | |
25605 | - atomic_long_inc(&work->port-> | |
25606 | + atomic_long_inc_unchecked(&work->port-> | |
25607 | counter_group[CM_RECV_DUPLICATES]. | |
25608 | counter[CM_MRA_COUNTER]); | |
25609 | goto out; | |
25610 | @@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work | |
25611 | break; | |
25612 | case IB_CM_MRA_REQ_RCVD: | |
25613 | case IB_CM_MRA_REP_RCVD: | |
25614 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25615 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25616 | counter[CM_MRA_COUNTER]); | |
25617 | /* fall through */ | |
25618 | default: | |
25619 | @@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work | |
25620 | case IB_CM_LAP_IDLE: | |
25621 | break; | |
25622 | case IB_CM_MRA_LAP_SENT: | |
25623 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25624 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25625 | counter[CM_LAP_COUNTER]); | |
25626 | if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg)) | |
25627 | goto unlock; | |
25628 | @@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work | |
25629 | cm_free_msg(msg); | |
25630 | goto deref; | |
25631 | case IB_CM_LAP_RCVD: | |
25632 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25633 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25634 | counter[CM_LAP_COUNTER]); | |
25635 | goto unlock; | |
25636 | default: | |
25637 | @@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm | |
25638 | cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv); | |
25639 | if (cur_cm_id_priv) { | |
25640 | spin_unlock_irq(&cm.lock); | |
25641 | - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25642 | + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES]. | |
25643 | counter[CM_SIDR_REQ_COUNTER]); | |
25644 | goto out; /* Duplicate message. */ | |
25645 | } | |
25646 | @@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma | |
25647 | if (!msg->context[0] && (attr_index != CM_REJ_COUNTER)) | |
25648 | msg->retries = 1; | |
25649 | ||
25650 | - atomic_long_add(1 + msg->retries, | |
25651 | + atomic_long_add_unchecked(1 + msg->retries, | |
25652 | &port->counter_group[CM_XMIT].counter[attr_index]); | |
25653 | if (msg->retries) | |
25654 | - atomic_long_add(msg->retries, | |
25655 | + atomic_long_add_unchecked(msg->retries, | |
25656 | &port->counter_group[CM_XMIT_RETRIES]. | |
25657 | counter[attr_index]); | |
25658 | ||
25659 | @@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma | |
25660 | } | |
25661 | ||
25662 | attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id); | |
25663 | - atomic_long_inc(&port->counter_group[CM_RECV]. | |
25664 | + atomic_long_inc_unchecked(&port->counter_group[CM_RECV]. | |
25665 | counter[attr_id - CM_ATTR_ID_OFFSET]); | |
25666 | ||
25667 | work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths, | |
25668 | @@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko | |
25669 | cm_attr = container_of(attr, struct cm_counter_attribute, attr); | |
25670 | ||
25671 | return sprintf(buf, "%ld\n", | |
25672 | - atomic_long_read(&group->counter[cm_attr->index])); | |
25673 | + atomic_long_read_unchecked(&group->counter[cm_attr->index])); | |
25674 | } | |
25675 | ||
25676 | static const struct sysfs_ops cm_counter_ops = { | |
25677 | diff -urNp linux-3.0.3/drivers/infiniband/core/fmr_pool.c linux-3.0.3/drivers/infiniband/core/fmr_pool.c | |
25678 | --- linux-3.0.3/drivers/infiniband/core/fmr_pool.c 2011-07-21 22:17:23.000000000 -0400 | |
25679 | +++ linux-3.0.3/drivers/infiniband/core/fmr_pool.c 2011-08-23 21:47:55.000000000 -0400 | |
25680 | @@ -97,8 +97,8 @@ struct ib_fmr_pool { | |
25681 | ||
25682 | struct task_struct *thread; | |
25683 | ||
25684 | - atomic_t req_ser; | |
25685 | - atomic_t flush_ser; | |
25686 | + atomic_unchecked_t req_ser; | |
25687 | + atomic_unchecked_t flush_ser; | |
25688 | ||
25689 | wait_queue_head_t force_wait; | |
25690 | }; | |
25691 | @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p | |
25692 | struct ib_fmr_pool *pool = pool_ptr; | |
25693 | ||
25694 | do { | |
25695 | - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) { | |
25696 | + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) { | |
25697 | ib_fmr_batch_release(pool); | |
25698 | ||
25699 | - atomic_inc(&pool->flush_ser); | |
25700 | + atomic_inc_unchecked(&pool->flush_ser); | |
25701 | wake_up_interruptible(&pool->force_wait); | |
25702 | ||
25703 | if (pool->flush_function) | |
25704 | @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p | |
25705 | } | |
25706 | ||
25707 | set_current_state(TASK_INTERRUPTIBLE); | |
25708 | - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 && | |
25709 | + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 && | |
25710 | !kthread_should_stop()) | |
25711 | schedule(); | |
25712 | __set_current_state(TASK_RUNNING); | |
25713 | @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s | |
25714 | pool->dirty_watermark = params->dirty_watermark; | |
25715 | pool->dirty_len = 0; | |
25716 | spin_lock_init(&pool->pool_lock); | |
25717 | - atomic_set(&pool->req_ser, 0); | |
25718 | - atomic_set(&pool->flush_ser, 0); | |
25719 | + atomic_set_unchecked(&pool->req_ser, 0); | |
25720 | + atomic_set_unchecked(&pool->flush_ser, 0); | |
25721 | init_waitqueue_head(&pool->force_wait); | |
25722 | ||
25723 | pool->thread = kthread_run(ib_fmr_cleanup_thread, | |
25724 | @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool | |
25725 | } | |
25726 | spin_unlock_irq(&pool->pool_lock); | |
25727 | ||
25728 | - serial = atomic_inc_return(&pool->req_ser); | |
25729 | + serial = atomic_inc_return_unchecked(&pool->req_ser); | |
25730 | wake_up_process(pool->thread); | |
25731 | ||
25732 | if (wait_event_interruptible(pool->force_wait, | |
25733 | - atomic_read(&pool->flush_ser) - serial >= 0)) | |
25734 | + atomic_read_unchecked(&pool->flush_ser) - serial >= 0)) | |
25735 | return -EINTR; | |
25736 | ||
25737 | return 0; | |
25738 | @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr | |
25739 | } else { | |
25740 | list_add_tail(&fmr->list, &pool->dirty_list); | |
25741 | if (++pool->dirty_len >= pool->dirty_watermark) { | |
25742 | - atomic_inc(&pool->req_ser); | |
25743 | + atomic_inc_unchecked(&pool->req_ser); | |
25744 | wake_up_process(pool->thread); | |
25745 | } | |
25746 | } | |
25747 | diff -urNp linux-3.0.3/drivers/infiniband/hw/cxgb4/mem.c linux-3.0.3/drivers/infiniband/hw/cxgb4/mem.c | |
25748 | --- linux-3.0.3/drivers/infiniband/hw/cxgb4/mem.c 2011-07-21 22:17:23.000000000 -0400 | |
25749 | +++ linux-3.0.3/drivers/infiniband/hw/cxgb4/mem.c 2011-08-23 21:47:55.000000000 -0400 | |
25750 | @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r | |
25751 | int err; | |
25752 | struct fw_ri_tpte tpt; | |
25753 | u32 stag_idx; | |
25754 | - static atomic_t key; | |
25755 | + static atomic_unchecked_t key; | |
25756 | ||
25757 | if (c4iw_fatal_error(rdev)) | |
25758 | return -EIO; | |
25759 | @@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r | |
25760 | &rdev->resource.tpt_fifo_lock); | |
25761 | if (!stag_idx) | |
25762 | return -ENOMEM; | |
25763 | - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff); | |
25764 | + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff); | |
25765 | } | |
25766 | PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n", | |
25767 | __func__, stag_state, type, pdid, stag_idx); | |
25768 | diff -urNp linux-3.0.3/drivers/infiniband/hw/ipath/ipath_fs.c linux-3.0.3/drivers/infiniband/hw/ipath/ipath_fs.c | |
25769 | --- linux-3.0.3/drivers/infiniband/hw/ipath/ipath_fs.c 2011-07-21 22:17:23.000000000 -0400 | |
25770 | +++ linux-3.0.3/drivers/infiniband/hw/ipath/ipath_fs.c 2011-08-23 21:48:14.000000000 -0400 | |
25771 | @@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru | |
25772 | struct infinipath_counters counters; | |
25773 | struct ipath_devdata *dd; | |
25774 | ||
25775 | + pax_track_stack(); | |
25776 | + | |
25777 | dd = file->f_path.dentry->d_inode->i_private; | |
25778 | dd->ipath_f_read_counters(dd, &counters); | |
25779 | ||
25780 | diff -urNp linux-3.0.3/drivers/infiniband/hw/ipath/ipath_rc.c linux-3.0.3/drivers/infiniband/hw/ipath/ipath_rc.c | |
25781 | --- linux-3.0.3/drivers/infiniband/hw/ipath/ipath_rc.c 2011-07-21 22:17:23.000000000 -0400 | |
25782 | +++ linux-3.0.3/drivers/infiniband/hw/ipath/ipath_rc.c 2011-08-23 21:47:55.000000000 -0400 | |
25783 | @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de | |
25784 | struct ib_atomic_eth *ateth; | |
25785 | struct ipath_ack_entry *e; | |
25786 | u64 vaddr; | |
25787 | - atomic64_t *maddr; | |
25788 | + atomic64_unchecked_t *maddr; | |
25789 | u64 sdata; | |
25790 | u32 rkey; | |
25791 | u8 next; | |
25792 | @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de | |
25793 | IB_ACCESS_REMOTE_ATOMIC))) | |
25794 | goto nack_acc_unlck; | |
25795 | /* Perform atomic OP and save result. */ | |
25796 | - maddr = (atomic64_t *) qp->r_sge.sge.vaddr; | |
25797 | + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr; | |
25798 | sdata = be64_to_cpu(ateth->swap_data); | |
25799 | e = &qp->s_ack_queue[qp->r_head_ack_queue]; | |
25800 | e->atomic_data = (opcode == OP(FETCH_ADD)) ? | |
25801 | - (u64) atomic64_add_return(sdata, maddr) - sdata : | |
25802 | + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata : | |
25803 | (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr, | |
25804 | be64_to_cpu(ateth->compare_data), | |
25805 | sdata); | |
25806 | diff -urNp linux-3.0.3/drivers/infiniband/hw/ipath/ipath_ruc.c linux-3.0.3/drivers/infiniband/hw/ipath/ipath_ruc.c | |
25807 | --- linux-3.0.3/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-07-21 22:17:23.000000000 -0400 | |
25808 | +++ linux-3.0.3/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-08-23 21:47:55.000000000 -0400 | |
25809 | @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip | |
25810 | unsigned long flags; | |
25811 | struct ib_wc wc; | |
25812 | u64 sdata; | |
25813 | - atomic64_t *maddr; | |
25814 | + atomic64_unchecked_t *maddr; | |
25815 | enum ib_wc_status send_status; | |
25816 | ||
25817 | /* | |
25818 | @@ -382,11 +382,11 @@ again: | |
25819 | IB_ACCESS_REMOTE_ATOMIC))) | |
25820 | goto acc_err; | |
25821 | /* Perform atomic OP and save result. */ | |
25822 | - maddr = (atomic64_t *) qp->r_sge.sge.vaddr; | |
25823 | + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr; | |
25824 | sdata = wqe->wr.wr.atomic.compare_add; | |
25825 | *(u64 *) sqp->s_sge.sge.vaddr = | |
25826 | (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ? | |
25827 | - (u64) atomic64_add_return(sdata, maddr) - sdata : | |
25828 | + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata : | |
25829 | (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr, | |
25830 | sdata, wqe->wr.wr.atomic.swap); | |
25831 | goto send_comp; | |
25832 | diff -urNp linux-3.0.3/drivers/infiniband/hw/nes/nes.c linux-3.0.3/drivers/infiniband/hw/nes/nes.c | |
25833 | --- linux-3.0.3/drivers/infiniband/hw/nes/nes.c 2011-07-21 22:17:23.000000000 -0400 | |
25834 | +++ linux-3.0.3/drivers/infiniband/hw/nes/nes.c 2011-08-23 21:47:55.000000000 -0400 | |
25835 | @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi | |
25836 | LIST_HEAD(nes_adapter_list); | |
25837 | static LIST_HEAD(nes_dev_list); | |
25838 | ||
25839 | -atomic_t qps_destroyed; | |
25840 | +atomic_unchecked_t qps_destroyed; | |
25841 | ||
25842 | static unsigned int ee_flsh_adapter; | |
25843 | static unsigned int sysfs_nonidx_addr; | |
25844 | @@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str | |
25845 | struct nes_qp *nesqp = cqp_request->cqp_callback_pointer; | |
25846 | struct nes_adapter *nesadapter = nesdev->nesadapter; | |
25847 | ||
25848 | - atomic_inc(&qps_destroyed); | |
25849 | + atomic_inc_unchecked(&qps_destroyed); | |
25850 | ||
25851 | /* Free the control structures */ | |
25852 | ||
25853 | diff -urNp linux-3.0.3/drivers/infiniband/hw/nes/nes_cm.c linux-3.0.3/drivers/infiniband/hw/nes/nes_cm.c | |
25854 | --- linux-3.0.3/drivers/infiniband/hw/nes/nes_cm.c 2011-07-21 22:17:23.000000000 -0400 | |
25855 | +++ linux-3.0.3/drivers/infiniband/hw/nes/nes_cm.c 2011-08-23 21:47:55.000000000 -0400 | |
25856 | @@ -68,14 +68,14 @@ u32 cm_packets_dropped; | |
25857 | u32 cm_packets_retrans; | |
25858 | u32 cm_packets_created; | |
25859 | u32 cm_packets_received; | |
25860 | -atomic_t cm_listens_created; | |
25861 | -atomic_t cm_listens_destroyed; | |
25862 | +atomic_unchecked_t cm_listens_created; | |
25863 | +atomic_unchecked_t cm_listens_destroyed; | |
25864 | u32 cm_backlog_drops; | |
25865 | -atomic_t cm_loopbacks; | |
25866 | -atomic_t cm_nodes_created; | |
25867 | -atomic_t cm_nodes_destroyed; | |
25868 | -atomic_t cm_accel_dropped_pkts; | |
25869 | -atomic_t cm_resets_recvd; | |
25870 | +atomic_unchecked_t cm_loopbacks; | |
25871 | +atomic_unchecked_t cm_nodes_created; | |
25872 | +atomic_unchecked_t cm_nodes_destroyed; | |
25873 | +atomic_unchecked_t cm_accel_dropped_pkts; | |
25874 | +atomic_unchecked_t cm_resets_recvd; | |
25875 | ||
25876 | static inline int mini_cm_accelerated(struct nes_cm_core *, | |
25877 | struct nes_cm_node *); | |
25878 | @@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = { | |
25879 | ||
25880 | static struct nes_cm_core *g_cm_core; | |
25881 | ||
25882 | -atomic_t cm_connects; | |
25883 | -atomic_t cm_accepts; | |
25884 | -atomic_t cm_disconnects; | |
25885 | -atomic_t cm_closes; | |
25886 | -atomic_t cm_connecteds; | |
25887 | -atomic_t cm_connect_reqs; | |
25888 | -atomic_t cm_rejects; | |
25889 | +atomic_unchecked_t cm_connects; | |
25890 | +atomic_unchecked_t cm_accepts; | |
25891 | +atomic_unchecked_t cm_disconnects; | |
25892 | +atomic_unchecked_t cm_closes; | |
25893 | +atomic_unchecked_t cm_connecteds; | |
25894 | +atomic_unchecked_t cm_connect_reqs; | |
25895 | +atomic_unchecked_t cm_rejects; | |
25896 | ||
25897 | ||
25898 | /** | |
25899 | @@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str | |
25900 | kfree(listener); | |
25901 | listener = NULL; | |
25902 | ret = 0; | |
25903 | - atomic_inc(&cm_listens_destroyed); | |
25904 | + atomic_inc_unchecked(&cm_listens_destroyed); | |
25905 | } else { | |
25906 | spin_unlock_irqrestore(&cm_core->listen_list_lock, flags); | |
25907 | } | |
25908 | @@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node( | |
25909 | cm_node->rem_mac); | |
25910 | ||
25911 | add_hte_node(cm_core, cm_node); | |
25912 | - atomic_inc(&cm_nodes_created); | |
25913 | + atomic_inc_unchecked(&cm_nodes_created); | |
25914 | ||
25915 | return cm_node; | |
25916 | } | |
25917 | @@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm | |
25918 | } | |
25919 | ||
25920 | atomic_dec(&cm_core->node_cnt); | |
25921 | - atomic_inc(&cm_nodes_destroyed); | |
25922 | + atomic_inc_unchecked(&cm_nodes_destroyed); | |
25923 | nesqp = cm_node->nesqp; | |
25924 | if (nesqp) { | |
25925 | nesqp->cm_node = NULL; | |
25926 | @@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm | |
25927 | ||
25928 | static void drop_packet(struct sk_buff *skb) | |
25929 | { | |
25930 | - atomic_inc(&cm_accel_dropped_pkts); | |
25931 | + atomic_inc_unchecked(&cm_accel_dropped_pkts); | |
25932 | dev_kfree_skb_any(skb); | |
25933 | } | |
25934 | ||
25935 | @@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm | |
25936 | { | |
25937 | ||
25938 | int reset = 0; /* whether to send reset in case of err.. */ | |
25939 | - atomic_inc(&cm_resets_recvd); | |
25940 | + atomic_inc_unchecked(&cm_resets_recvd); | |
25941 | nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u." | |
25942 | " refcnt=%d\n", cm_node, cm_node->state, | |
25943 | atomic_read(&cm_node->ref_count)); | |
25944 | @@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne | |
25945 | rem_ref_cm_node(cm_node->cm_core, cm_node); | |
25946 | return NULL; | |
25947 | } | |
25948 | - atomic_inc(&cm_loopbacks); | |
25949 | + atomic_inc_unchecked(&cm_loopbacks); | |
25950 | loopbackremotenode->loopbackpartner = cm_node; | |
25951 | loopbackremotenode->tcp_cntxt.rcv_wscale = | |
25952 | NES_CM_DEFAULT_RCV_WND_SCALE; | |
25953 | @@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c | |
25954 | add_ref_cm_node(cm_node); | |
25955 | } else if (cm_node->state == NES_CM_STATE_TSA) { | |
25956 | rem_ref_cm_node(cm_core, cm_node); | |
25957 | - atomic_inc(&cm_accel_dropped_pkts); | |
25958 | + atomic_inc_unchecked(&cm_accel_dropped_pkts); | |
25959 | dev_kfree_skb_any(skb); | |
25960 | break; | |
25961 | } | |
25962 | @@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne | |
25963 | ||
25964 | if ((cm_id) && (cm_id->event_handler)) { | |
25965 | if (issue_disconn) { | |
25966 | - atomic_inc(&cm_disconnects); | |
25967 | + atomic_inc_unchecked(&cm_disconnects); | |
25968 | cm_event.event = IW_CM_EVENT_DISCONNECT; | |
25969 | cm_event.status = disconn_status; | |
25970 | cm_event.local_addr = cm_id->local_addr; | |
25971 | @@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne | |
25972 | } | |
25973 | ||
25974 | if (issue_close) { | |
25975 | - atomic_inc(&cm_closes); | |
25976 | + atomic_inc_unchecked(&cm_closes); | |
25977 | nes_disconnect(nesqp, 1); | |
25978 | ||
25979 | cm_id->provider_data = nesqp; | |
25980 | @@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s | |
25981 | ||
25982 | nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n", | |
25983 | nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener); | |
25984 | - atomic_inc(&cm_accepts); | |
25985 | + atomic_inc_unchecked(&cm_accepts); | |
25986 | ||
25987 | nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n", | |
25988 | netdev_refcnt_read(nesvnic->netdev)); | |
25989 | @@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c | |
25990 | ||
25991 | struct nes_cm_core *cm_core; | |
25992 | ||
25993 | - atomic_inc(&cm_rejects); | |
25994 | + atomic_inc_unchecked(&cm_rejects); | |
25995 | cm_node = (struct nes_cm_node *) cm_id->provider_data; | |
25996 | loopback = cm_node->loopbackpartner; | |
25997 | cm_core = cm_node->cm_core; | |
25998 | @@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id, | |
25999 | ntohl(cm_id->local_addr.sin_addr.s_addr), | |
26000 | ntohs(cm_id->local_addr.sin_port)); | |
26001 | ||
26002 | - atomic_inc(&cm_connects); | |
26003 | + atomic_inc_unchecked(&cm_connects); | |
26004 | nesqp->active_conn = 1; | |
26005 | ||
26006 | /* cache the cm_id in the qp */ | |
26007 | @@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c | |
26008 | g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node); | |
26009 | return err; | |
26010 | } | |
26011 | - atomic_inc(&cm_listens_created); | |
26012 | + atomic_inc_unchecked(&cm_listens_created); | |
26013 | } | |
26014 | ||
26015 | cm_id->add_ref(cm_id); | |
26016 | @@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne | |
26017 | if (nesqp->destroyed) { | |
26018 | return; | |
26019 | } | |
26020 | - atomic_inc(&cm_connecteds); | |
26021 | + atomic_inc_unchecked(&cm_connecteds); | |
26022 | nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on" | |
26023 | " local port 0x%04X. jiffies = %lu.\n", | |
26024 | nesqp->hwqp.qp_id, | |
26025 | @@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm | |
26026 | ||
26027 | cm_id->add_ref(cm_id); | |
26028 | ret = cm_id->event_handler(cm_id, &cm_event); | |
26029 | - atomic_inc(&cm_closes); | |
26030 | + atomic_inc_unchecked(&cm_closes); | |
26031 | cm_event.event = IW_CM_EVENT_CLOSE; | |
26032 | cm_event.status = 0; | |
26033 | cm_event.provider_data = cm_id->provider_data; | |
26034 | @@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_ | |
26035 | return; | |
26036 | cm_id = cm_node->cm_id; | |
26037 | ||
26038 | - atomic_inc(&cm_connect_reqs); | |
26039 | + atomic_inc_unchecked(&cm_connect_reqs); | |
26040 | nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n", | |
26041 | cm_node, cm_id, jiffies); | |
26042 | ||
26043 | @@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n | |
26044 | return; | |
26045 | cm_id = cm_node->cm_id; | |
26046 | ||
26047 | - atomic_inc(&cm_connect_reqs); | |
26048 | + atomic_inc_unchecked(&cm_connect_reqs); | |
26049 | nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n", | |
26050 | cm_node, cm_id, jiffies); | |
26051 | ||
26052 | diff -urNp linux-3.0.3/drivers/infiniband/hw/nes/nes.h linux-3.0.3/drivers/infiniband/hw/nes/nes.h | |
26053 | --- linux-3.0.3/drivers/infiniband/hw/nes/nes.h 2011-07-21 22:17:23.000000000 -0400 | |
26054 | +++ linux-3.0.3/drivers/infiniband/hw/nes/nes.h 2011-08-23 21:47:55.000000000 -0400 | |
26055 | @@ -175,17 +175,17 @@ extern unsigned int nes_debug_level; | |
26056 | extern unsigned int wqm_quanta; | |
26057 | extern struct list_head nes_adapter_list; | |
26058 | ||
26059 | -extern atomic_t cm_connects; | |
26060 | -extern atomic_t cm_accepts; | |
26061 | -extern atomic_t cm_disconnects; | |
26062 | -extern atomic_t cm_closes; | |
26063 | -extern atomic_t cm_connecteds; | |
26064 | -extern atomic_t cm_connect_reqs; | |
26065 | -extern atomic_t cm_rejects; | |
26066 | -extern atomic_t mod_qp_timouts; | |
26067 | -extern atomic_t qps_created; | |
26068 | -extern atomic_t qps_destroyed; | |
26069 | -extern atomic_t sw_qps_destroyed; | |
26070 | +extern atomic_unchecked_t cm_connects; | |
26071 | +extern atomic_unchecked_t cm_accepts; | |
26072 | +extern atomic_unchecked_t cm_disconnects; | |
26073 | +extern atomic_unchecked_t cm_closes; | |
26074 | +extern atomic_unchecked_t cm_connecteds; | |
26075 | +extern atomic_unchecked_t cm_connect_reqs; | |
26076 | +extern atomic_unchecked_t cm_rejects; | |
26077 | +extern atomic_unchecked_t mod_qp_timouts; | |
26078 | +extern atomic_unchecked_t qps_created; | |
26079 | +extern atomic_unchecked_t qps_destroyed; | |
26080 | +extern atomic_unchecked_t sw_qps_destroyed; | |
26081 | extern u32 mh_detected; | |
26082 | extern u32 mh_pauses_sent; | |
26083 | extern u32 cm_packets_sent; | |
26084 | @@ -194,14 +194,14 @@ extern u32 cm_packets_created; | |
26085 | extern u32 cm_packets_received; | |
26086 | extern u32 cm_packets_dropped; | |
26087 | extern u32 cm_packets_retrans; | |
26088 | -extern atomic_t cm_listens_created; | |
26089 | -extern atomic_t cm_listens_destroyed; | |
26090 | +extern atomic_unchecked_t cm_listens_created; | |
26091 | +extern atomic_unchecked_t cm_listens_destroyed; | |
26092 | extern u32 cm_backlog_drops; | |
26093 | -extern atomic_t cm_loopbacks; | |
26094 | -extern atomic_t cm_nodes_created; | |
26095 | -extern atomic_t cm_nodes_destroyed; | |
26096 | -extern atomic_t cm_accel_dropped_pkts; | |
26097 | -extern atomic_t cm_resets_recvd; | |
26098 | +extern atomic_unchecked_t cm_loopbacks; | |
26099 | +extern atomic_unchecked_t cm_nodes_created; | |
26100 | +extern atomic_unchecked_t cm_nodes_destroyed; | |
26101 | +extern atomic_unchecked_t cm_accel_dropped_pkts; | |
26102 | +extern atomic_unchecked_t cm_resets_recvd; | |
26103 | ||
26104 | extern u32 int_mod_timer_init; | |
26105 | extern u32 int_mod_cq_depth_256; | |
26106 | diff -urNp linux-3.0.3/drivers/infiniband/hw/nes/nes_nic.c linux-3.0.3/drivers/infiniband/hw/nes/nes_nic.c | |
26107 | --- linux-3.0.3/drivers/infiniband/hw/nes/nes_nic.c 2011-07-21 22:17:23.000000000 -0400 | |
26108 | +++ linux-3.0.3/drivers/infiniband/hw/nes/nes_nic.c 2011-08-23 21:47:55.000000000 -0400 | |
26109 | @@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats | |
26110 | target_stat_values[++index] = mh_detected; | |
26111 | target_stat_values[++index] = mh_pauses_sent; | |
26112 | target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits; | |
26113 | - target_stat_values[++index] = atomic_read(&cm_connects); | |
26114 | - target_stat_values[++index] = atomic_read(&cm_accepts); | |
26115 | - target_stat_values[++index] = atomic_read(&cm_disconnects); | |
26116 | - target_stat_values[++index] = atomic_read(&cm_connecteds); | |
26117 | - target_stat_values[++index] = atomic_read(&cm_connect_reqs); | |
26118 | - target_stat_values[++index] = atomic_read(&cm_rejects); | |
26119 | - target_stat_values[++index] = atomic_read(&mod_qp_timouts); | |
26120 | - target_stat_values[++index] = atomic_read(&qps_created); | |
26121 | - target_stat_values[++index] = atomic_read(&sw_qps_destroyed); | |
26122 | - target_stat_values[++index] = atomic_read(&qps_destroyed); | |
26123 | - target_stat_values[++index] = atomic_read(&cm_closes); | |
26124 | + target_stat_values[++index] = atomic_read_unchecked(&cm_connects); | |
26125 | + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts); | |
26126 | + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects); | |
26127 | + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds); | |
26128 | + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs); | |
26129 | + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects); | |
26130 | + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts); | |
26131 | + target_stat_values[++index] = atomic_read_unchecked(&qps_created); | |
26132 | + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed); | |
26133 | + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed); | |
26134 | + target_stat_values[++index] = atomic_read_unchecked(&cm_closes); | |
26135 | target_stat_values[++index] = cm_packets_sent; | |
26136 | target_stat_values[++index] = cm_packets_bounced; | |
26137 | target_stat_values[++index] = cm_packets_created; | |
26138 | target_stat_values[++index] = cm_packets_received; | |
26139 | target_stat_values[++index] = cm_packets_dropped; | |
26140 | target_stat_values[++index] = cm_packets_retrans; | |
26141 | - target_stat_values[++index] = atomic_read(&cm_listens_created); | |
26142 | - target_stat_values[++index] = atomic_read(&cm_listens_destroyed); | |
26143 | + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created); | |
26144 | + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed); | |
26145 | target_stat_values[++index] = cm_backlog_drops; | |
26146 | - target_stat_values[++index] = atomic_read(&cm_loopbacks); | |
26147 | - target_stat_values[++index] = atomic_read(&cm_nodes_created); | |
26148 | - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed); | |
26149 | - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts); | |
26150 | - target_stat_values[++index] = atomic_read(&cm_resets_recvd); | |
26151 | + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks); | |
26152 | + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created); | |
26153 | + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed); | |
26154 | + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts); | |
26155 | + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd); | |
26156 | target_stat_values[++index] = nesadapter->free_4kpbl; | |
26157 | target_stat_values[++index] = nesadapter->free_256pbl; | |
26158 | target_stat_values[++index] = int_mod_timer_init; | |
26159 | diff -urNp linux-3.0.3/drivers/infiniband/hw/nes/nes_verbs.c linux-3.0.3/drivers/infiniband/hw/nes/nes_verbs.c | |
26160 | --- linux-3.0.3/drivers/infiniband/hw/nes/nes_verbs.c 2011-07-21 22:17:23.000000000 -0400 | |
26161 | +++ linux-3.0.3/drivers/infiniband/hw/nes/nes_verbs.c 2011-08-23 21:47:55.000000000 -0400 | |
26162 | @@ -46,9 +46,9 @@ | |
26163 | ||
26164 | #include <rdma/ib_umem.h> | |
26165 | ||
26166 | -atomic_t mod_qp_timouts; | |
26167 | -atomic_t qps_created; | |
26168 | -atomic_t sw_qps_destroyed; | |
26169 | +atomic_unchecked_t mod_qp_timouts; | |
26170 | +atomic_unchecked_t qps_created; | |
26171 | +atomic_unchecked_t sw_qps_destroyed; | |
26172 | ||
26173 | static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev); | |
26174 | ||
26175 | @@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc | |
26176 | if (init_attr->create_flags) | |
26177 | return ERR_PTR(-EINVAL); | |
26178 | ||
26179 | - atomic_inc(&qps_created); | |
26180 | + atomic_inc_unchecked(&qps_created); | |
26181 | switch (init_attr->qp_type) { | |
26182 | case IB_QPT_RC: | |
26183 | if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) { | |
26184 | @@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp * | |
26185 | struct iw_cm_event cm_event; | |
26186 | int ret; | |
26187 | ||
26188 | - atomic_inc(&sw_qps_destroyed); | |
26189 | + atomic_inc_unchecked(&sw_qps_destroyed); | |
26190 | nesqp->destroyed = 1; | |
26191 | ||
26192 | /* Blow away the connection if it exists. */ | |
26193 | diff -urNp linux-3.0.3/drivers/infiniband/hw/qib/qib.h linux-3.0.3/drivers/infiniband/hw/qib/qib.h | |
26194 | --- linux-3.0.3/drivers/infiniband/hw/qib/qib.h 2011-07-21 22:17:23.000000000 -0400 | |
26195 | +++ linux-3.0.3/drivers/infiniband/hw/qib/qib.h 2011-08-23 21:47:55.000000000 -0400 | |
26196 | @@ -51,6 +51,7 @@ | |
26197 | #include <linux/completion.h> | |
26198 | #include <linux/kref.h> | |
26199 | #include <linux/sched.h> | |
26200 | +#include <linux/slab.h> | |
26201 | ||
26202 | #include "qib_common.h" | |
26203 | #include "qib_verbs.h" | |
26204 | diff -urNp linux-3.0.3/drivers/input/gameport/gameport.c linux-3.0.3/drivers/input/gameport/gameport.c | |
26205 | --- linux-3.0.3/drivers/input/gameport/gameport.c 2011-07-21 22:17:23.000000000 -0400 | |
26206 | +++ linux-3.0.3/drivers/input/gameport/gameport.c 2011-08-23 21:47:55.000000000 -0400 | |
26207 | @@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys); | |
26208 | */ | |
26209 | static void gameport_init_port(struct gameport *gameport) | |
26210 | { | |
26211 | - static atomic_t gameport_no = ATOMIC_INIT(0); | |
26212 | + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0); | |
26213 | ||
26214 | __module_get(THIS_MODULE); | |
26215 | ||
26216 | mutex_init(&gameport->drv_mutex); | |
26217 | device_initialize(&gameport->dev); | |
26218 | dev_set_name(&gameport->dev, "gameport%lu", | |
26219 | - (unsigned long)atomic_inc_return(&gameport_no) - 1); | |
26220 | + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1); | |
26221 | gameport->dev.bus = &gameport_bus; | |
26222 | gameport->dev.release = gameport_release_port; | |
26223 | if (gameport->parent) | |
26224 | diff -urNp linux-3.0.3/drivers/input/input.c linux-3.0.3/drivers/input/input.c | |
26225 | --- linux-3.0.3/drivers/input/input.c 2011-07-21 22:17:23.000000000 -0400 | |
26226 | +++ linux-3.0.3/drivers/input/input.c 2011-08-23 21:47:55.000000000 -0400 | |
26227 | @@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struc | |
26228 | */ | |
26229 | int input_register_device(struct input_dev *dev) | |
26230 | { | |
26231 | - static atomic_t input_no = ATOMIC_INIT(0); | |
26232 | + static atomic_unchecked_t input_no = ATOMIC_INIT(0); | |
26233 | struct input_handler *handler; | |
26234 | const char *path; | |
26235 | int error; | |
26236 | @@ -1851,7 +1851,7 @@ int input_register_device(struct input_d | |
26237 | dev->setkeycode = input_default_setkeycode; | |
26238 | ||
26239 | dev_set_name(&dev->dev, "input%ld", | |
26240 | - (unsigned long) atomic_inc_return(&input_no) - 1); | |
26241 | + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1); | |
26242 | ||
26243 | error = device_add(&dev->dev); | |
26244 | if (error) | |
26245 | diff -urNp linux-3.0.3/drivers/input/joystick/sidewinder.c linux-3.0.3/drivers/input/joystick/sidewinder.c | |
26246 | --- linux-3.0.3/drivers/input/joystick/sidewinder.c 2011-07-21 22:17:23.000000000 -0400 | |
26247 | +++ linux-3.0.3/drivers/input/joystick/sidewinder.c 2011-08-23 21:48:14.000000000 -0400 | |
26248 | @@ -30,6 +30,7 @@ | |
26249 | #include <linux/kernel.h> | |
26250 | #include <linux/module.h> | |
26251 | #include <linux/slab.h> | |
26252 | +#include <linux/sched.h> | |
26253 | #include <linux/init.h> | |
26254 | #include <linux/input.h> | |
26255 | #include <linux/gameport.h> | |
26256 | @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw) | |
26257 | unsigned char buf[SW_LENGTH]; | |
26258 | int i; | |
26259 | ||
26260 | + pax_track_stack(); | |
26261 | + | |
26262 | i = sw_read_packet(sw->gameport, buf, sw->length, 0); | |
26263 | ||
26264 | if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */ | |
26265 | diff -urNp linux-3.0.3/drivers/input/joystick/xpad.c linux-3.0.3/drivers/input/joystick/xpad.c | |
26266 | --- linux-3.0.3/drivers/input/joystick/xpad.c 2011-07-21 22:17:23.000000000 -0400 | |
26267 | +++ linux-3.0.3/drivers/input/joystick/xpad.c 2011-08-23 21:47:55.000000000 -0400 | |
26268 | @@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas | |
26269 | ||
26270 | static int xpad_led_probe(struct usb_xpad *xpad) | |
26271 | { | |
26272 | - static atomic_t led_seq = ATOMIC_INIT(0); | |
26273 | + static atomic_unchecked_t led_seq = ATOMIC_INIT(0); | |
26274 | long led_no; | |
26275 | struct xpad_led *led; | |
26276 | struct led_classdev *led_cdev; | |
26277 | @@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa | |
26278 | if (!led) | |
26279 | return -ENOMEM; | |
26280 | ||
26281 | - led_no = (long)atomic_inc_return(&led_seq) - 1; | |
26282 | + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1; | |
26283 | ||
26284 | snprintf(led->name, sizeof(led->name), "xpad%ld", led_no); | |
26285 | led->xpad = xpad; | |
26286 | diff -urNp linux-3.0.3/drivers/input/mousedev.c linux-3.0.3/drivers/input/mousedev.c | |
26287 | --- linux-3.0.3/drivers/input/mousedev.c 2011-07-21 22:17:23.000000000 -0400 | |
26288 | +++ linux-3.0.3/drivers/input/mousedev.c 2011-08-23 21:47:55.000000000 -0400 | |
26289 | @@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file | |
26290 | ||
26291 | spin_unlock_irq(&client->packet_lock); | |
26292 | ||
26293 | - if (copy_to_user(buffer, data, count)) | |
26294 | + if (count > sizeof(data) || copy_to_user(buffer, data, count)) | |
26295 | return -EFAULT; | |
26296 | ||
26297 | return count; | |
26298 | diff -urNp linux-3.0.3/drivers/input/serio/serio.c linux-3.0.3/drivers/input/serio/serio.c | |
26299 | --- linux-3.0.3/drivers/input/serio/serio.c 2011-07-21 22:17:23.000000000 -0400 | |
26300 | +++ linux-3.0.3/drivers/input/serio/serio.c 2011-08-23 21:47:55.000000000 -0400 | |
26301 | @@ -497,7 +497,7 @@ static void serio_release_port(struct de | |
26302 | */ | |
26303 | static void serio_init_port(struct serio *serio) | |
26304 | { | |
26305 | - static atomic_t serio_no = ATOMIC_INIT(0); | |
26306 | + static atomic_unchecked_t serio_no = ATOMIC_INIT(0); | |
26307 | ||
26308 | __module_get(THIS_MODULE); | |
26309 | ||
26310 | @@ -508,7 +508,7 @@ static void serio_init_port(struct serio | |
26311 | mutex_init(&serio->drv_mutex); | |
26312 | device_initialize(&serio->dev); | |
26313 | dev_set_name(&serio->dev, "serio%ld", | |
26314 | - (long)atomic_inc_return(&serio_no) - 1); | |
26315 | + (long)atomic_inc_return_unchecked(&serio_no) - 1); | |
26316 | serio->dev.bus = &serio_bus; | |
26317 | serio->dev.release = serio_release_port; | |
26318 | serio->dev.groups = serio_device_attr_groups; | |
26319 | diff -urNp linux-3.0.3/drivers/isdn/capi/capi.c linux-3.0.3/drivers/isdn/capi/capi.c | |
26320 | --- linux-3.0.3/drivers/isdn/capi/capi.c 2011-07-21 22:17:23.000000000 -0400 | |
26321 | +++ linux-3.0.3/drivers/isdn/capi/capi.c 2011-08-23 21:47:55.000000000 -0400 | |
26322 | @@ -83,8 +83,8 @@ struct capiminor { | |
26323 | ||
26324 | struct capi20_appl *ap; | |
26325 | u32 ncci; | |
26326 | - atomic_t datahandle; | |
26327 | - atomic_t msgid; | |
26328 | + atomic_unchecked_t datahandle; | |
26329 | + atomic_unchecked_t msgid; | |
26330 | ||
26331 | struct tty_port port; | |
26332 | int ttyinstop; | |
26333 | @@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *m | |
26334 | capimsg_setu16(s, 2, mp->ap->applid); | |
26335 | capimsg_setu8 (s, 4, CAPI_DATA_B3); | |
26336 | capimsg_setu8 (s, 5, CAPI_RESP); | |
26337 | - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid)); | |
26338 | + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid)); | |
26339 | capimsg_setu32(s, 8, mp->ncci); | |
26340 | capimsg_setu16(s, 12, datahandle); | |
26341 | } | |
26342 | @@ -518,14 +518,14 @@ static void handle_minor_send(struct cap | |
26343 | mp->outbytes -= len; | |
26344 | spin_unlock_bh(&mp->outlock); | |
26345 | ||
26346 | - datahandle = atomic_inc_return(&mp->datahandle); | |
26347 | + datahandle = atomic_inc_return_unchecked(&mp->datahandle); | |
26348 | skb_push(skb, CAPI_DATA_B3_REQ_LEN); | |
26349 | memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN); | |
26350 | capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN); | |
26351 | capimsg_setu16(skb->data, 2, mp->ap->applid); | |
26352 | capimsg_setu8 (skb->data, 4, CAPI_DATA_B3); | |
26353 | capimsg_setu8 (skb->data, 5, CAPI_REQ); | |
26354 | - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid)); | |
26355 | + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid)); | |
26356 | capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */ | |
26357 | capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */ | |
26358 | capimsg_setu16(skb->data, 16, len); /* Data length */ | |
26359 | diff -urNp linux-3.0.3/drivers/isdn/gigaset/common.c linux-3.0.3/drivers/isdn/gigaset/common.c | |
26360 | --- linux-3.0.3/drivers/isdn/gigaset/common.c 2011-07-21 22:17:23.000000000 -0400 | |
26361 | +++ linux-3.0.3/drivers/isdn/gigaset/common.c 2011-08-23 21:47:55.000000000 -0400 | |
26362 | @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct | |
26363 | cs->commands_pending = 0; | |
26364 | cs->cur_at_seq = 0; | |
26365 | cs->gotfwver = -1; | |
26366 | - cs->open_count = 0; | |
26367 | + local_set(&cs->open_count, 0); | |
26368 | cs->dev = NULL; | |
26369 | cs->tty = NULL; | |
26370 | cs->tty_dev = NULL; | |
26371 | diff -urNp linux-3.0.3/drivers/isdn/gigaset/gigaset.h linux-3.0.3/drivers/isdn/gigaset/gigaset.h | |
26372 | --- linux-3.0.3/drivers/isdn/gigaset/gigaset.h 2011-07-21 22:17:23.000000000 -0400 | |
26373 | +++ linux-3.0.3/drivers/isdn/gigaset/gigaset.h 2011-08-23 21:47:55.000000000 -0400 | |
26374 | @@ -35,6 +35,7 @@ | |
26375 | #include <linux/tty_driver.h> | |
26376 | #include <linux/list.h> | |
26377 | #include <asm/atomic.h> | |
26378 | +#include <asm/local.h> | |
26379 | ||
26380 | #define GIG_VERSION {0, 5, 0, 0} | |
26381 | #define GIG_COMPAT {0, 4, 0, 0} | |
26382 | @@ -433,7 +434,7 @@ struct cardstate { | |
26383 | spinlock_t cmdlock; | |
26384 | unsigned curlen, cmdbytes; | |
26385 | ||
26386 | - unsigned open_count; | |
26387 | + local_t open_count; | |
26388 | struct tty_struct *tty; | |
26389 | struct tasklet_struct if_wake_tasklet; | |
26390 | unsigned control_state; | |
26391 | diff -urNp linux-3.0.3/drivers/isdn/gigaset/interface.c linux-3.0.3/drivers/isdn/gigaset/interface.c | |
26392 | --- linux-3.0.3/drivers/isdn/gigaset/interface.c 2011-07-21 22:17:23.000000000 -0400 | |
26393 | +++ linux-3.0.3/drivers/isdn/gigaset/interface.c 2011-08-23 21:47:55.000000000 -0400 | |
26394 | @@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tt | |
26395 | } | |
26396 | tty->driver_data = cs; | |
26397 | ||
26398 | - ++cs->open_count; | |
26399 | - | |
26400 | - if (cs->open_count == 1) { | |
26401 | + if (local_inc_return(&cs->open_count) == 1) { | |
26402 | spin_lock_irqsave(&cs->lock, flags); | |
26403 | cs->tty = tty; | |
26404 | spin_unlock_irqrestore(&cs->lock, flags); | |
26405 | @@ -192,10 +190,10 @@ static void if_close(struct tty_struct * | |
26406 | ||
26407 | if (!cs->connected) | |
26408 | gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */ | |
26409 | - else if (!cs->open_count) | |
26410 | + else if (!local_read(&cs->open_count)) | |
26411 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26412 | else { | |
26413 | - if (!--cs->open_count) { | |
26414 | + if (!local_dec_return(&cs->open_count)) { | |
26415 | spin_lock_irqsave(&cs->lock, flags); | |
26416 | cs->tty = NULL; | |
26417 | spin_unlock_irqrestore(&cs->lock, flags); | |
26418 | @@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *t | |
26419 | if (!cs->connected) { | |
26420 | gig_dbg(DEBUG_IF, "not connected"); | |
26421 | retval = -ENODEV; | |
26422 | - } else if (!cs->open_count) | |
26423 | + } else if (!local_read(&cs->open_count)) | |
26424 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26425 | else { | |
26426 | retval = 0; | |
26427 | @@ -360,7 +358,7 @@ static int if_write(struct tty_struct *t | |
26428 | retval = -ENODEV; | |
26429 | goto done; | |
26430 | } | |
26431 | - if (!cs->open_count) { | |
26432 | + if (!local_read(&cs->open_count)) { | |
26433 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26434 | retval = -ENODEV; | |
26435 | goto done; | |
26436 | @@ -413,7 +411,7 @@ static int if_write_room(struct tty_stru | |
26437 | if (!cs->connected) { | |
26438 | gig_dbg(DEBUG_IF, "not connected"); | |
26439 | retval = -ENODEV; | |
26440 | - } else if (!cs->open_count) | |
26441 | + } else if (!local_read(&cs->open_count)) | |
26442 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26443 | else if (cs->mstate != MS_LOCKED) { | |
26444 | dev_warn(cs->dev, "can't write to unlocked device\n"); | |
26445 | @@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty | |
26446 | ||
26447 | if (!cs->connected) | |
26448 | gig_dbg(DEBUG_IF, "not connected"); | |
26449 | - else if (!cs->open_count) | |
26450 | + else if (!local_read(&cs->open_count)) | |
26451 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26452 | else if (cs->mstate != MS_LOCKED) | |
26453 | dev_warn(cs->dev, "can't write to unlocked device\n"); | |
26454 | @@ -471,7 +469,7 @@ static void if_throttle(struct tty_struc | |
26455 | ||
26456 | if (!cs->connected) | |
26457 | gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */ | |
26458 | - else if (!cs->open_count) | |
26459 | + else if (!local_read(&cs->open_count)) | |
26460 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26461 | else | |
26462 | gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__); | |
26463 | @@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_str | |
26464 | ||
26465 | if (!cs->connected) | |
26466 | gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */ | |
26467 | - else if (!cs->open_count) | |
26468 | + else if (!local_read(&cs->open_count)) | |
26469 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26470 | else | |
26471 | gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__); | |
26472 | @@ -526,7 +524,7 @@ static void if_set_termios(struct tty_st | |
26473 | goto out; | |
26474 | } | |
26475 | ||
26476 | - if (!cs->open_count) { | |
26477 | + if (!local_read(&cs->open_count)) { | |
26478 | dev_warn(cs->dev, "%s: device not opened\n", __func__); | |
26479 | goto out; | |
26480 | } | |
26481 | diff -urNp linux-3.0.3/drivers/isdn/hardware/avm/b1.c linux-3.0.3/drivers/isdn/hardware/avm/b1.c | |
26482 | --- linux-3.0.3/drivers/isdn/hardware/avm/b1.c 2011-07-21 22:17:23.000000000 -0400 | |
26483 | +++ linux-3.0.3/drivers/isdn/hardware/avm/b1.c 2011-08-23 21:47:55.000000000 -0400 | |
26484 | @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo | |
26485 | } | |
26486 | if (left) { | |
26487 | if (t4file->user) { | |
26488 | - if (copy_from_user(buf, dp, left)) | |
26489 | + if (left > sizeof buf || copy_from_user(buf, dp, left)) | |
26490 | return -EFAULT; | |
26491 | } else { | |
26492 | memcpy(buf, dp, left); | |
26493 | @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo | |
26494 | } | |
26495 | if (left) { | |
26496 | if (config->user) { | |
26497 | - if (copy_from_user(buf, dp, left)) | |
26498 | + if (left > sizeof buf || copy_from_user(buf, dp, left)) | |
26499 | return -EFAULT; | |
26500 | } else { | |
26501 | memcpy(buf, dp, left); | |
26502 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/capidtmf.c linux-3.0.3/drivers/isdn/hardware/eicon/capidtmf.c | |
26503 | --- linux-3.0.3/drivers/isdn/hardware/eicon/capidtmf.c 2011-07-21 22:17:23.000000000 -0400 | |
26504 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/capidtmf.c 2011-08-23 21:48:14.000000000 -0400 | |
26505 | @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta | |
26506 | byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT]; | |
26507 | short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES]; | |
26508 | ||
26509 | + pax_track_stack(); | |
26510 | ||
26511 | if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE) | |
26512 | { | |
26513 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/capifunc.c linux-3.0.3/drivers/isdn/hardware/eicon/capifunc.c | |
26514 | --- linux-3.0.3/drivers/isdn/hardware/eicon/capifunc.c 2011-07-21 22:17:23.000000000 -0400 | |
26515 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/capifunc.c 2011-08-23 21:48:14.000000000 -0400 | |
26516 | @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void) | |
26517 | IDI_SYNC_REQ req; | |
26518 | DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS]; | |
26519 | ||
26520 | + pax_track_stack(); | |
26521 | + | |
26522 | DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table)); | |
26523 | ||
26524 | for (x = 0; x < MAX_DESCRIPTORS; x++) { | |
26525 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/diddfunc.c linux-3.0.3/drivers/isdn/hardware/eicon/diddfunc.c | |
26526 | --- linux-3.0.3/drivers/isdn/hardware/eicon/diddfunc.c 2011-07-21 22:17:23.000000000 -0400 | |
26527 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/diddfunc.c 2011-08-23 21:48:14.000000000 -0400 | |
26528 | @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di | |
26529 | IDI_SYNC_REQ req; | |
26530 | DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS]; | |
26531 | ||
26532 | + pax_track_stack(); | |
26533 | + | |
26534 | DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table)); | |
26535 | ||
26536 | for (x = 0; x < MAX_DESCRIPTORS; x++) { | |
26537 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/divasfunc.c linux-3.0.3/drivers/isdn/hardware/eicon/divasfunc.c | |
26538 | --- linux-3.0.3/drivers/isdn/hardware/eicon/divasfunc.c 2011-07-21 22:17:23.000000000 -0400 | |
26539 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/divasfunc.c 2011-08-23 21:48:14.000000000 -0400 | |
26540 | @@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_di | |
26541 | IDI_SYNC_REQ req; | |
26542 | DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS]; | |
26543 | ||
26544 | + pax_track_stack(); | |
26545 | + | |
26546 | DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table)); | |
26547 | ||
26548 | for (x = 0; x < MAX_DESCRIPTORS; x++) { | |
26549 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/divasync.h linux-3.0.3/drivers/isdn/hardware/eicon/divasync.h | |
26550 | --- linux-3.0.3/drivers/isdn/hardware/eicon/divasync.h 2011-07-21 22:17:23.000000000 -0400 | |
26551 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/divasync.h 2011-08-23 21:47:55.000000000 -0400 | |
26552 | @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter { | |
26553 | } diva_didd_add_adapter_t; | |
26554 | typedef struct _diva_didd_remove_adapter { | |
26555 | IDI_CALL p_request; | |
26556 | -} diva_didd_remove_adapter_t; | |
26557 | +} __no_const diva_didd_remove_adapter_t; | |
26558 | typedef struct _diva_didd_read_adapter_array { | |
26559 | void * buffer; | |
26560 | dword length; | |
26561 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/idifunc.c linux-3.0.3/drivers/isdn/hardware/eicon/idifunc.c | |
26562 | --- linux-3.0.3/drivers/isdn/hardware/eicon/idifunc.c 2011-07-21 22:17:23.000000000 -0400 | |
26563 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/idifunc.c 2011-08-23 21:48:14.000000000 -0400 | |
26564 | @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di | |
26565 | IDI_SYNC_REQ req; | |
26566 | DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS]; | |
26567 | ||
26568 | + pax_track_stack(); | |
26569 | + | |
26570 | DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table)); | |
26571 | ||
26572 | for (x = 0; x < MAX_DESCRIPTORS; x++) { | |
26573 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/message.c linux-3.0.3/drivers/isdn/hardware/eicon/message.c | |
26574 | --- linux-3.0.3/drivers/isdn/hardware/eicon/message.c 2011-07-21 22:17:23.000000000 -0400 | |
26575 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/message.c 2011-08-23 21:48:14.000000000 -0400 | |
26576 | @@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci) | |
26577 | dword d; | |
26578 | word w; | |
26579 | ||
26580 | + pax_track_stack(); | |
26581 | + | |
26582 | a = plci->adapter; | |
26583 | Id = ((word)plci->Id<<8)|a->Id; | |
26584 | PUT_WORD(&SS_Ind[4],0x0000); | |
26585 | @@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE | |
26586 | word j, n, w; | |
26587 | dword d; | |
26588 | ||
26589 | + pax_track_stack(); | |
26590 | + | |
26591 | ||
26592 | for(i=0;i<8;i++) bp_parms[i].length = 0; | |
26593 | for(i=0;i<2;i++) global_config[i].length = 0; | |
26594 | @@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARS | |
26595 | const byte llc3[] = {4,3,2,2,6,6,0}; | |
26596 | const byte header[] = {0,2,3,3,0,0,0}; | |
26597 | ||
26598 | + pax_track_stack(); | |
26599 | + | |
26600 | for(i=0;i<8;i++) bp_parms[i].length = 0; | |
26601 | for(i=0;i<6;i++) b2_config_parms[i].length = 0; | |
26602 | for(i=0;i<5;i++) b3_config_parms[i].length = 0; | |
26603 | @@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI | |
26604 | word appl_number_group_type[MAX_APPL]; | |
26605 | PLCI *auxplci; | |
26606 | ||
26607 | + pax_track_stack(); | |
26608 | + | |
26609 | set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */ | |
26610 | ||
26611 | if(!a->group_optimization_enabled) | |
26612 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/mntfunc.c linux-3.0.3/drivers/isdn/hardware/eicon/mntfunc.c | |
26613 | --- linux-3.0.3/drivers/isdn/hardware/eicon/mntfunc.c 2011-07-21 22:17:23.000000000 -0400 | |
26614 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/mntfunc.c 2011-08-23 21:48:14.000000000 -0400 | |
26615 | @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di | |
26616 | IDI_SYNC_REQ req; | |
26617 | DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS]; | |
26618 | ||
26619 | + pax_track_stack(); | |
26620 | + | |
26621 | DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table)); | |
26622 | ||
26623 | for (x = 0; x < MAX_DESCRIPTORS; x++) { | |
26624 | diff -urNp linux-3.0.3/drivers/isdn/hardware/eicon/xdi_adapter.h linux-3.0.3/drivers/isdn/hardware/eicon/xdi_adapter.h | |
26625 | --- linux-3.0.3/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-07-21 22:17:23.000000000 -0400 | |
26626 | +++ linux-3.0.3/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-23 21:47:55.000000000 -0400 | |
26627 | @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t { | |
26628 | typedef struct _diva_os_idi_adapter_interface { | |
26629 | diva_init_card_proc_t cleanup_adapter_proc; | |
26630 | diva_cmd_card_proc_t cmd_proc; | |
26631 | -} diva_os_idi_adapter_interface_t; | |
26632 | +} __no_const diva_os_idi_adapter_interface_t; | |
26633 | ||
26634 | typedef struct _diva_os_xdi_adapter { | |
26635 | struct list_head link; | |
26636 | diff -urNp linux-3.0.3/drivers/isdn/i4l/isdn_common.c linux-3.0.3/drivers/isdn/i4l/isdn_common.c | |
26637 | --- linux-3.0.3/drivers/isdn/i4l/isdn_common.c 2011-07-21 22:17:23.000000000 -0400 | |
26638 | +++ linux-3.0.3/drivers/isdn/i4l/isdn_common.c 2011-08-23 21:48:14.000000000 -0400 | |
26639 | @@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd, | |
26640 | } iocpar; | |
26641 | void __user *argp = (void __user *)arg; | |
26642 | ||
26643 | + pax_track_stack(); | |
26644 | + | |
26645 | #define name iocpar.name | |
26646 | #define bname iocpar.bname | |
26647 | #define iocts iocpar.iocts | |
26648 | diff -urNp linux-3.0.3/drivers/isdn/icn/icn.c linux-3.0.3/drivers/isdn/icn/icn.c | |
26649 | --- linux-3.0.3/drivers/isdn/icn/icn.c 2011-07-21 22:17:23.000000000 -0400 | |
26650 | +++ linux-3.0.3/drivers/isdn/icn/icn.c 2011-08-23 21:47:55.000000000 -0400 | |
26651 | @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len | |
26652 | if (count > len) | |
26653 | count = len; | |
26654 | if (user) { | |
26655 | - if (copy_from_user(msg, buf, count)) | |
26656 | + if (count > sizeof msg || copy_from_user(msg, buf, count)) | |
26657 | return -EFAULT; | |
26658 | } else | |
26659 | memcpy(msg, buf, count); | |
26660 | diff -urNp linux-3.0.3/drivers/lguest/core.c linux-3.0.3/drivers/lguest/core.c | |
26661 | --- linux-3.0.3/drivers/lguest/core.c 2011-07-21 22:17:23.000000000 -0400 | |
26662 | +++ linux-3.0.3/drivers/lguest/core.c 2011-08-23 21:47:55.000000000 -0400 | |
26663 | @@ -92,9 +92,17 @@ static __init int map_switcher(void) | |
26664 | * it's worked so far. The end address needs +1 because __get_vm_area | |
26665 | * allocates an extra guard page, so we need space for that. | |
26666 | */ | |
26667 | + | |
26668 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
26669 | + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, | |
26670 | + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR | |
26671 | + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE); | |
26672 | +#else | |
26673 | switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, | |
26674 | VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR | |
26675 | + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE); | |
26676 | +#endif | |
26677 | + | |
26678 | if (!switcher_vma) { | |
26679 | err = -ENOMEM; | |
26680 | printk("lguest: could not map switcher pages high\n"); | |
26681 | @@ -119,7 +127,7 @@ static __init int map_switcher(void) | |
26682 | * Now the Switcher is mapped at the right address, we can't fail! | |
26683 | * Copy in the compiled-in Switcher code (from <arch>_switcher.S). | |
26684 | */ | |
26685 | - memcpy(switcher_vma->addr, start_switcher_text, | |
26686 | + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text), | |
26687 | end_switcher_text - start_switcher_text); | |
26688 | ||
26689 | printk(KERN_INFO "lguest: mapped switcher at %p\n", | |
26690 | diff -urNp linux-3.0.3/drivers/lguest/x86/core.c linux-3.0.3/drivers/lguest/x86/core.c | |
26691 | --- linux-3.0.3/drivers/lguest/x86/core.c 2011-07-21 22:17:23.000000000 -0400 | |
26692 | +++ linux-3.0.3/drivers/lguest/x86/core.c 2011-08-23 21:47:55.000000000 -0400 | |
26693 | @@ -59,7 +59,7 @@ static struct { | |
26694 | /* Offset from where switcher.S was compiled to where we've copied it */ | |
26695 | static unsigned long switcher_offset(void) | |
26696 | { | |
26697 | - return SWITCHER_ADDR - (unsigned long)start_switcher_text; | |
26698 | + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text); | |
26699 | } | |
26700 | ||
26701 | /* This cpu's struct lguest_pages. */ | |
26702 | @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg | |
26703 | * These copies are pretty cheap, so we do them unconditionally: */ | |
26704 | /* Save the current Host top-level page directory. | |
26705 | */ | |
26706 | + | |
26707 | +#ifdef CONFIG_PAX_PER_CPU_PGD | |
26708 | + pages->state.host_cr3 = read_cr3(); | |
26709 | +#else | |
26710 | pages->state.host_cr3 = __pa(current->mm->pgd); | |
26711 | +#endif | |
26712 | + | |
26713 | /* | |
26714 | * Set up the Guest's page tables to see this CPU's pages (and no | |
26715 | * other CPU's pages). | |
26716 | @@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void) | |
26717 | * compiled-in switcher code and the high-mapped copy we just made. | |
26718 | */ | |
26719 | for (i = 0; i < IDT_ENTRIES; i++) | |
26720 | - default_idt_entries[i] += switcher_offset(); | |
26721 | + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset(); | |
26722 | ||
26723 | /* | |
26724 | * Set up the Switcher's per-cpu areas. | |
26725 | @@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void) | |
26726 | * it will be undisturbed when we switch. To change %cs and jump we | |
26727 | * need this structure to feed to Intel's "lcall" instruction. | |
26728 | */ | |
26729 | - lguest_entry.offset = (long)switch_to_guest + switcher_offset(); | |
26730 | + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset(); | |
26731 | lguest_entry.segment = LGUEST_CS; | |
26732 | ||
26733 | /* | |
26734 | diff -urNp linux-3.0.3/drivers/lguest/x86/switcher_32.S linux-3.0.3/drivers/lguest/x86/switcher_32.S | |
26735 | --- linux-3.0.3/drivers/lguest/x86/switcher_32.S 2011-07-21 22:17:23.000000000 -0400 | |
26736 | +++ linux-3.0.3/drivers/lguest/x86/switcher_32.S 2011-08-23 21:47:55.000000000 -0400 | |
26737 | @@ -87,6 +87,7 @@ | |
26738 | #include <asm/page.h> | |
26739 | #include <asm/segment.h> | |
26740 | #include <asm/lguest.h> | |
26741 | +#include <asm/processor-flags.h> | |
26742 | ||
26743 | // We mark the start of the code to copy | |
26744 | // It's placed in .text tho it's never run here | |
26745 | @@ -149,6 +150,13 @@ ENTRY(switch_to_guest) | |
26746 | // Changes type when we load it: damn Intel! | |
26747 | // For after we switch over our page tables | |
26748 | // That entry will be read-only: we'd crash. | |
26749 | + | |
26750 | +#ifdef CONFIG_PAX_KERNEXEC | |
26751 | + mov %cr0, %edx | |
26752 | + xor $X86_CR0_WP, %edx | |
26753 | + mov %edx, %cr0 | |
26754 | +#endif | |
26755 | + | |
26756 | movl $(GDT_ENTRY_TSS*8), %edx | |
26757 | ltr %dx | |
26758 | ||
26759 | @@ -157,9 +165,15 @@ ENTRY(switch_to_guest) | |
26760 | // Let's clear it again for our return. | |
26761 | // The GDT descriptor of the Host | |
26762 | // Points to the table after two "size" bytes | |
26763 | - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx | |
26764 | + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax | |
26765 | // Clear "used" from type field (byte 5, bit 2) | |
26766 | - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx) | |
26767 | + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax) | |
26768 | + | |
26769 | +#ifdef CONFIG_PAX_KERNEXEC | |
26770 | + mov %cr0, %eax | |
26771 | + xor $X86_CR0_WP, %eax | |
26772 | + mov %eax, %cr0 | |
26773 | +#endif | |
26774 | ||
26775 | // Once our page table's switched, the Guest is live! | |
26776 | // The Host fades as we run this final step. | |
26777 | @@ -295,13 +309,12 @@ deliver_to_host: | |
26778 | // I consulted gcc, and it gave | |
26779 | // These instructions, which I gladly credit: | |
26780 | leal (%edx,%ebx,8), %eax | |
26781 | - movzwl (%eax),%edx | |
26782 | - movl 4(%eax), %eax | |
26783 | - xorw %ax, %ax | |
26784 | - orl %eax, %edx | |
26785 | + movl 4(%eax), %edx | |
26786 | + movw (%eax), %dx | |
26787 | // Now the address of the handler's in %edx | |
26788 | // We call it now: its "iret" drops us home. | |
26789 | - jmp *%edx | |
26790 | + ljmp $__KERNEL_CS, $1f | |
26791 | +1: jmp *%edx | |
26792 | ||
26793 | // Every interrupt can come to us here | |
26794 | // But we must truly tell each apart. | |
26795 | diff -urNp linux-3.0.3/drivers/md/dm.c linux-3.0.3/drivers/md/dm.c | |
26796 | --- linux-3.0.3/drivers/md/dm.c 2011-08-23 21:44:40.000000000 -0400 | |
26797 | +++ linux-3.0.3/drivers/md/dm.c 2011-08-23 21:47:55.000000000 -0400 | |
26798 | @@ -164,9 +164,9 @@ struct mapped_device { | |
26799 | /* | |
26800 | * Event handling. | |
26801 | */ | |
26802 | - atomic_t event_nr; | |
26803 | + atomic_unchecked_t event_nr; | |
26804 | wait_queue_head_t eventq; | |
26805 | - atomic_t uevent_seq; | |
26806 | + atomic_unchecked_t uevent_seq; | |
26807 | struct list_head uevent_list; | |
26808 | spinlock_t uevent_lock; /* Protect access to uevent_list */ | |
26809 | ||
26810 | @@ -1842,8 +1842,8 @@ static struct mapped_device *alloc_dev(i | |
26811 | rwlock_init(&md->map_lock); | |
26812 | atomic_set(&md->holders, 1); | |
26813 | atomic_set(&md->open_count, 0); | |
26814 | - atomic_set(&md->event_nr, 0); | |
26815 | - atomic_set(&md->uevent_seq, 0); | |
26816 | + atomic_set_unchecked(&md->event_nr, 0); | |
26817 | + atomic_set_unchecked(&md->uevent_seq, 0); | |
26818 | INIT_LIST_HEAD(&md->uevent_list); | |
26819 | spin_lock_init(&md->uevent_lock); | |
26820 | ||
26821 | @@ -1977,7 +1977,7 @@ static void event_callback(void *context | |
26822 | ||
26823 | dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj); | |
26824 | ||
26825 | - atomic_inc(&md->event_nr); | |
26826 | + atomic_inc_unchecked(&md->event_nr); | |
26827 | wake_up(&md->eventq); | |
26828 | } | |
26829 | ||
26830 | @@ -2553,18 +2553,18 @@ int dm_kobject_uevent(struct mapped_devi | |
26831 | ||
26832 | uint32_t dm_next_uevent_seq(struct mapped_device *md) | |
26833 | { | |
26834 | - return atomic_add_return(1, &md->uevent_seq); | |
26835 | + return atomic_add_return_unchecked(1, &md->uevent_seq); | |
26836 | } | |
26837 | ||
26838 | uint32_t dm_get_event_nr(struct mapped_device *md) | |
26839 | { | |
26840 | - return atomic_read(&md->event_nr); | |
26841 | + return atomic_read_unchecked(&md->event_nr); | |
26842 | } | |
26843 | ||
26844 | int dm_wait_event(struct mapped_device *md, int event_nr) | |
26845 | { | |
26846 | return wait_event_interruptible(md->eventq, | |
26847 | - (event_nr != atomic_read(&md->event_nr))); | |
26848 | + (event_nr != atomic_read_unchecked(&md->event_nr))); | |
26849 | } | |
26850 | ||
26851 | void dm_uevent_add(struct mapped_device *md, struct list_head *elist) | |
26852 | diff -urNp linux-3.0.3/drivers/md/dm-ioctl.c linux-3.0.3/drivers/md/dm-ioctl.c | |
26853 | --- linux-3.0.3/drivers/md/dm-ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
26854 | +++ linux-3.0.3/drivers/md/dm-ioctl.c 2011-08-23 21:47:55.000000000 -0400 | |
26855 | @@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str | |
26856 | cmd == DM_LIST_VERSIONS_CMD) | |
26857 | return 0; | |
26858 | ||
26859 | - if ((cmd == DM_DEV_CREATE_CMD)) { | |
26860 | + if (cmd == DM_DEV_CREATE_CMD) { | |
26861 | if (!*param->name) { | |
26862 | DMWARN("name not supplied when creating device"); | |
26863 | return -EINVAL; | |
26864 | diff -urNp linux-3.0.3/drivers/md/dm-raid1.c linux-3.0.3/drivers/md/dm-raid1.c | |
26865 | --- linux-3.0.3/drivers/md/dm-raid1.c 2011-07-21 22:17:23.000000000 -0400 | |
26866 | +++ linux-3.0.3/drivers/md/dm-raid1.c 2011-08-23 21:47:55.000000000 -0400 | |
26867 | @@ -40,7 +40,7 @@ enum dm_raid1_error { | |
26868 | ||
26869 | struct mirror { | |
26870 | struct mirror_set *ms; | |
26871 | - atomic_t error_count; | |
26872 | + atomic_unchecked_t error_count; | |
26873 | unsigned long error_type; | |
26874 | struct dm_dev *dev; | |
26875 | sector_t offset; | |
26876 | @@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(s | |
26877 | struct mirror *m; | |
26878 | ||
26879 | for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++) | |
26880 | - if (!atomic_read(&m->error_count)) | |
26881 | + if (!atomic_read_unchecked(&m->error_count)) | |
26882 | return m; | |
26883 | ||
26884 | return NULL; | |
26885 | @@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m | |
26886 | * simple way to tell if a device has encountered | |
26887 | * errors. | |
26888 | */ | |
26889 | - atomic_inc(&m->error_count); | |
26890 | + atomic_inc_unchecked(&m->error_count); | |
26891 | ||
26892 | if (test_and_set_bit(error_type, &m->error_type)) | |
26893 | return; | |
26894 | @@ -408,7 +408,7 @@ static struct mirror *choose_mirror(stru | |
26895 | struct mirror *m = get_default_mirror(ms); | |
26896 | ||
26897 | do { | |
26898 | - if (likely(!atomic_read(&m->error_count))) | |
26899 | + if (likely(!atomic_read_unchecked(&m->error_count))) | |
26900 | return m; | |
26901 | ||
26902 | if (m-- == ms->mirror) | |
26903 | @@ -422,7 +422,7 @@ static int default_ok(struct mirror *m) | |
26904 | { | |
26905 | struct mirror *default_mirror = get_default_mirror(m->ms); | |
26906 | ||
26907 | - return !atomic_read(&default_mirror->error_count); | |
26908 | + return !atomic_read_unchecked(&default_mirror->error_count); | |
26909 | } | |
26910 | ||
26911 | static int mirror_available(struct mirror_set *ms, struct bio *bio) | |
26912 | @@ -559,7 +559,7 @@ static void do_reads(struct mirror_set * | |
26913 | */ | |
26914 | if (likely(region_in_sync(ms, region, 1))) | |
26915 | m = choose_mirror(ms, bio->bi_sector); | |
26916 | - else if (m && atomic_read(&m->error_count)) | |
26917 | + else if (m && atomic_read_unchecked(&m->error_count)) | |
26918 | m = NULL; | |
26919 | ||
26920 | if (likely(m)) | |
26921 | @@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set | |
26922 | } | |
26923 | ||
26924 | ms->mirror[mirror].ms = ms; | |
26925 | - atomic_set(&(ms->mirror[mirror].error_count), 0); | |
26926 | + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0); | |
26927 | ms->mirror[mirror].error_type = 0; | |
26928 | ms->mirror[mirror].offset = offset; | |
26929 | ||
26930 | @@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ | |
26931 | */ | |
26932 | static char device_status_char(struct mirror *m) | |
26933 | { | |
26934 | - if (!atomic_read(&(m->error_count))) | |
26935 | + if (!atomic_read_unchecked(&(m->error_count))) | |
26936 | return 'A'; | |
26937 | ||
26938 | return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' : | |
26939 | diff -urNp linux-3.0.3/drivers/md/dm-stripe.c linux-3.0.3/drivers/md/dm-stripe.c | |
26940 | --- linux-3.0.3/drivers/md/dm-stripe.c 2011-07-21 22:17:23.000000000 -0400 | |
26941 | +++ linux-3.0.3/drivers/md/dm-stripe.c 2011-08-23 21:47:55.000000000 -0400 | |
26942 | @@ -20,7 +20,7 @@ struct stripe { | |
26943 | struct dm_dev *dev; | |
26944 | sector_t physical_start; | |
26945 | ||
26946 | - atomic_t error_count; | |
26947 | + atomic_unchecked_t error_count; | |
26948 | }; | |
26949 | ||
26950 | struct stripe_c { | |
26951 | @@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target * | |
26952 | kfree(sc); | |
26953 | return r; | |
26954 | } | |
26955 | - atomic_set(&(sc->stripe[i].error_count), 0); | |
26956 | + atomic_set_unchecked(&(sc->stripe[i].error_count), 0); | |
26957 | } | |
26958 | ||
26959 | ti->private = sc; | |
26960 | @@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe | |
26961 | DMEMIT("%d ", sc->stripes); | |
26962 | for (i = 0; i < sc->stripes; i++) { | |
26963 | DMEMIT("%s ", sc->stripe[i].dev->name); | |
26964 | - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ? | |
26965 | + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ? | |
26966 | 'D' : 'A'; | |
26967 | } | |
26968 | buffer[i] = '\0'; | |
26969 | @@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe | |
26970 | */ | |
26971 | for (i = 0; i < sc->stripes; i++) | |
26972 | if (!strcmp(sc->stripe[i].dev->name, major_minor)) { | |
26973 | - atomic_inc(&(sc->stripe[i].error_count)); | |
26974 | - if (atomic_read(&(sc->stripe[i].error_count)) < | |
26975 | + atomic_inc_unchecked(&(sc->stripe[i].error_count)); | |
26976 | + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) < | |
26977 | DM_IO_ERROR_THRESHOLD) | |
26978 | schedule_work(&sc->trigger_event); | |
26979 | } | |
26980 | diff -urNp linux-3.0.3/drivers/md/dm-table.c linux-3.0.3/drivers/md/dm-table.c | |
26981 | --- linux-3.0.3/drivers/md/dm-table.c 2011-07-21 22:17:23.000000000 -0400 | |
26982 | +++ linux-3.0.3/drivers/md/dm-table.c 2011-08-23 21:47:55.000000000 -0400 | |
26983 | @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct | |
26984 | if (!dev_size) | |
26985 | return 0; | |
26986 | ||
26987 | - if ((start >= dev_size) || (start + len > dev_size)) { | |
26988 | + if ((start >= dev_size) || (len > dev_size - start)) { | |
26989 | DMWARN("%s: %s too small for target: " | |
26990 | "start=%llu, len=%llu, dev_size=%llu", | |
26991 | dm_device_name(ti->table->md), bdevname(bdev, b), | |
26992 | diff -urNp linux-3.0.3/drivers/md/md.c linux-3.0.3/drivers/md/md.c | |
26993 | --- linux-3.0.3/drivers/md/md.c 2011-07-21 22:17:23.000000000 -0400 | |
26994 | +++ linux-3.0.3/drivers/md/md.c 2011-08-23 21:47:55.000000000 -0400 | |
26995 | @@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev); | |
26996 | * start build, activate spare | |
26997 | */ | |
26998 | static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters); | |
26999 | -static atomic_t md_event_count; | |
27000 | +static atomic_unchecked_t md_event_count; | |
27001 | void md_new_event(mddev_t *mddev) | |
27002 | { | |
27003 | - atomic_inc(&md_event_count); | |
27004 | + atomic_inc_unchecked(&md_event_count); | |
27005 | wake_up(&md_event_waiters); | |
27006 | } | |
27007 | EXPORT_SYMBOL_GPL(md_new_event); | |
27008 | @@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event); | |
27009 | */ | |
27010 | static void md_new_event_inintr(mddev_t *mddev) | |
27011 | { | |
27012 | - atomic_inc(&md_event_count); | |
27013 | + atomic_inc_unchecked(&md_event_count); | |
27014 | wake_up(&md_event_waiters); | |
27015 | } | |
27016 | ||
27017 | @@ -1457,7 +1457,7 @@ static int super_1_load(mdk_rdev_t *rdev | |
27018 | ||
27019 | rdev->preferred_minor = 0xffff; | |
27020 | rdev->data_offset = le64_to_cpu(sb->data_offset); | |
27021 | - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read)); | |
27022 | + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read)); | |
27023 | ||
27024 | rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256; | |
27025 | bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1; | |
27026 | @@ -1635,7 +1635,7 @@ static void super_1_sync(mddev_t *mddev, | |
27027 | else | |
27028 | sb->resync_offset = cpu_to_le64(0); | |
27029 | ||
27030 | - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors)); | |
27031 | + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors)); | |
27032 | ||
27033 | sb->raid_disks = cpu_to_le32(mddev->raid_disks); | |
27034 | sb->size = cpu_to_le64(mddev->dev_sectors); | |
27035 | @@ -2428,7 +2428,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho | |
27036 | static ssize_t | |
27037 | errors_show(mdk_rdev_t *rdev, char *page) | |
27038 | { | |
27039 | - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors)); | |
27040 | + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors)); | |
27041 | } | |
27042 | ||
27043 | static ssize_t | |
27044 | @@ -2437,7 +2437,7 @@ errors_store(mdk_rdev_t *rdev, const cha | |
27045 | char *e; | |
27046 | unsigned long n = simple_strtoul(buf, &e, 10); | |
27047 | if (*buf && (*e == 0 || *e == '\n')) { | |
27048 | - atomic_set(&rdev->corrected_errors, n); | |
27049 | + atomic_set_unchecked(&rdev->corrected_errors, n); | |
27050 | return len; | |
27051 | } | |
27052 | return -EINVAL; | |
27053 | @@ -2793,8 +2793,8 @@ void md_rdev_init(mdk_rdev_t *rdev) | |
27054 | rdev->last_read_error.tv_sec = 0; | |
27055 | rdev->last_read_error.tv_nsec = 0; | |
27056 | atomic_set(&rdev->nr_pending, 0); | |
27057 | - atomic_set(&rdev->read_errors, 0); | |
27058 | - atomic_set(&rdev->corrected_errors, 0); | |
27059 | + atomic_set_unchecked(&rdev->read_errors, 0); | |
27060 | + atomic_set_unchecked(&rdev->corrected_errors, 0); | |
27061 | ||
27062 | INIT_LIST_HEAD(&rdev->same_set); | |
27063 | init_waitqueue_head(&rdev->blocked_wait); | |
27064 | @@ -6415,7 +6415,7 @@ static int md_seq_show(struct seq_file * | |
27065 | ||
27066 | spin_unlock(&pers_lock); | |
27067 | seq_printf(seq, "\n"); | |
27068 | - mi->event = atomic_read(&md_event_count); | |
27069 | + mi->event = atomic_read_unchecked(&md_event_count); | |
27070 | return 0; | |
27071 | } | |
27072 | if (v == (void*)2) { | |
27073 | @@ -6504,7 +6504,7 @@ static int md_seq_show(struct seq_file * | |
27074 | chunk_kb ? "KB" : "B"); | |
27075 | if (bitmap->file) { | |
27076 | seq_printf(seq, ", file: "); | |
27077 | - seq_path(seq, &bitmap->file->f_path, " \t\n"); | |
27078 | + seq_path(seq, &bitmap->file->f_path, " \t\n\\"); | |
27079 | } | |
27080 | ||
27081 | seq_printf(seq, "\n"); | |
27082 | @@ -6538,7 +6538,7 @@ static int md_seq_open(struct inode *ino | |
27083 | else { | |
27084 | struct seq_file *p = file->private_data; | |
27085 | p->private = mi; | |
27086 | - mi->event = atomic_read(&md_event_count); | |
27087 | + mi->event = atomic_read_unchecked(&md_event_count); | |
27088 | } | |
27089 | return error; | |
27090 | } | |
27091 | @@ -6554,7 +6554,7 @@ static unsigned int mdstat_poll(struct f | |
27092 | /* always allow read */ | |
27093 | mask = POLLIN | POLLRDNORM; | |
27094 | ||
27095 | - if (mi->event != atomic_read(&md_event_count)) | |
27096 | + if (mi->event != atomic_read_unchecked(&md_event_count)) | |
27097 | mask |= POLLERR | POLLPRI; | |
27098 | return mask; | |
27099 | } | |
27100 | @@ -6598,7 +6598,7 @@ static int is_mddev_idle(mddev_t *mddev, | |
27101 | struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; | |
27102 | curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + | |
27103 | (int)part_stat_read(&disk->part0, sectors[1]) - | |
27104 | - atomic_read(&disk->sync_io); | |
27105 | + atomic_read_unchecked(&disk->sync_io); | |
27106 | /* sync IO will cause sync_io to increase before the disk_stats | |
27107 | * as sync_io is counted when a request starts, and | |
27108 | * disk_stats is counted when it completes. | |
27109 | diff -urNp linux-3.0.3/drivers/md/md.h linux-3.0.3/drivers/md/md.h | |
27110 | --- linux-3.0.3/drivers/md/md.h 2011-07-21 22:17:23.000000000 -0400 | |
27111 | +++ linux-3.0.3/drivers/md/md.h 2011-08-23 21:47:55.000000000 -0400 | |
27112 | @@ -97,13 +97,13 @@ struct mdk_rdev_s | |
27113 | * only maintained for arrays that | |
27114 | * support hot removal | |
27115 | */ | |
27116 | - atomic_t read_errors; /* number of consecutive read errors that | |
27117 | + atomic_unchecked_t read_errors; /* number of consecutive read errors that | |
27118 | * we have tried to ignore. | |
27119 | */ | |
27120 | struct timespec last_read_error; /* monotonic time since our | |
27121 | * last read error | |
27122 | */ | |
27123 | - atomic_t corrected_errors; /* number of corrected read errors, | |
27124 | + atomic_unchecked_t corrected_errors; /* number of corrected read errors, | |
27125 | * for reporting to userspace and storing | |
27126 | * in superblock. | |
27127 | */ | |
27128 | @@ -344,7 +344,7 @@ static inline void rdev_dec_pending(mdk_ | |
27129 | ||
27130 | static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors) | |
27131 | { | |
27132 | - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io); | |
27133 | + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io); | |
27134 | } | |
27135 | ||
27136 | struct mdk_personality | |
27137 | diff -urNp linux-3.0.3/drivers/md/raid10.c linux-3.0.3/drivers/md/raid10.c | |
27138 | --- linux-3.0.3/drivers/md/raid10.c 2011-07-21 22:17:23.000000000 -0400 | |
27139 | +++ linux-3.0.3/drivers/md/raid10.c 2011-08-23 21:47:55.000000000 -0400 | |
27140 | @@ -1186,7 +1186,7 @@ static void end_sync_read(struct bio *bi | |
27141 | if (test_bit(BIO_UPTODATE, &bio->bi_flags)) | |
27142 | set_bit(R10BIO_Uptodate, &r10_bio->state); | |
27143 | else { | |
27144 | - atomic_add(r10_bio->sectors, | |
27145 | + atomic_add_unchecked(r10_bio->sectors, | |
27146 | &conf->mirrors[d].rdev->corrected_errors); | |
27147 | if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery)) | |
27148 | md_error(r10_bio->mddev, | |
27149 | @@ -1394,7 +1394,7 @@ static void check_decay_read_errors(mdde | |
27150 | { | |
27151 | struct timespec cur_time_mon; | |
27152 | unsigned long hours_since_last; | |
27153 | - unsigned int read_errors = atomic_read(&rdev->read_errors); | |
27154 | + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors); | |
27155 | ||
27156 | ktime_get_ts(&cur_time_mon); | |
27157 | ||
27158 | @@ -1416,9 +1416,9 @@ static void check_decay_read_errors(mdde | |
27159 | * overflowing the shift of read_errors by hours_since_last. | |
27160 | */ | |
27161 | if (hours_since_last >= 8 * sizeof(read_errors)) | |
27162 | - atomic_set(&rdev->read_errors, 0); | |
27163 | + atomic_set_unchecked(&rdev->read_errors, 0); | |
27164 | else | |
27165 | - atomic_set(&rdev->read_errors, read_errors >> hours_since_last); | |
27166 | + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last); | |
27167 | } | |
27168 | ||
27169 | /* | |
27170 | @@ -1448,8 +1448,8 @@ static void fix_read_error(conf_t *conf, | |
27171 | return; | |
27172 | ||
27173 | check_decay_read_errors(mddev, rdev); | |
27174 | - atomic_inc(&rdev->read_errors); | |
27175 | - if (atomic_read(&rdev->read_errors) > max_read_errors) { | |
27176 | + atomic_inc_unchecked(&rdev->read_errors); | |
27177 | + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) { | |
27178 | char b[BDEVNAME_SIZE]; | |
27179 | bdevname(rdev->bdev, b); | |
27180 | ||
27181 | @@ -1457,7 +1457,7 @@ static void fix_read_error(conf_t *conf, | |
27182 | "md/raid10:%s: %s: Raid device exceeded " | |
27183 | "read_error threshold [cur %d:max %d]\n", | |
27184 | mdname(mddev), b, | |
27185 | - atomic_read(&rdev->read_errors), max_read_errors); | |
27186 | + atomic_read_unchecked(&rdev->read_errors), max_read_errors); | |
27187 | printk(KERN_NOTICE | |
27188 | "md/raid10:%s: %s: Failing raid device\n", | |
27189 | mdname(mddev), b); | |
27190 | @@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf, | |
27191 | test_bit(In_sync, &rdev->flags)) { | |
27192 | atomic_inc(&rdev->nr_pending); | |
27193 | rcu_read_unlock(); | |
27194 | - atomic_add(s, &rdev->corrected_errors); | |
27195 | + atomic_add_unchecked(s, &rdev->corrected_errors); | |
27196 | if (sync_page_io(rdev, | |
27197 | r10_bio->devs[sl].addr + | |
27198 | sect, | |
27199 | diff -urNp linux-3.0.3/drivers/md/raid1.c linux-3.0.3/drivers/md/raid1.c | |
27200 | --- linux-3.0.3/drivers/md/raid1.c 2011-07-21 22:17:23.000000000 -0400 | |
27201 | +++ linux-3.0.3/drivers/md/raid1.c 2011-08-23 21:47:55.000000000 -0400 | |
27202 | @@ -1263,7 +1263,7 @@ static int fix_sync_read_error(r1bio_t * | |
27203 | rdev_dec_pending(rdev, mddev); | |
27204 | md_error(mddev, rdev); | |
27205 | } else | |
27206 | - atomic_add(s, &rdev->corrected_errors); | |
27207 | + atomic_add_unchecked(s, &rdev->corrected_errors); | |
27208 | } | |
27209 | d = start; | |
27210 | while (d != r1_bio->read_disk) { | |
27211 | @@ -1492,7 +1492,7 @@ static void fix_read_error(conf_t *conf, | |
27212 | /* Well, this device is dead */ | |
27213 | md_error(mddev, rdev); | |
27214 | else { | |
27215 | - atomic_add(s, &rdev->corrected_errors); | |
27216 | + atomic_add_unchecked(s, &rdev->corrected_errors); | |
27217 | printk(KERN_INFO | |
27218 | "md/raid1:%s: read error corrected " | |
27219 | "(%d sectors at %llu on %s)\n", | |
27220 | diff -urNp linux-3.0.3/drivers/md/raid5.c linux-3.0.3/drivers/md/raid5.c | |
27221 | --- linux-3.0.3/drivers/md/raid5.c 2011-07-21 22:17:23.000000000 -0400 | |
27222 | +++ linux-3.0.3/drivers/md/raid5.c 2011-08-23 21:48:14.000000000 -0400 | |
27223 | @@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea | |
27224 | bi->bi_next = NULL; | |
27225 | if ((rw & WRITE) && | |
27226 | test_bit(R5_ReWrite, &sh->dev[i].flags)) | |
27227 | - atomic_add(STRIPE_SECTORS, | |
27228 | + atomic_add_unchecked(STRIPE_SECTORS, | |
27229 | &rdev->corrected_errors); | |
27230 | generic_make_request(bi); | |
27231 | } else { | |
27232 | @@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc | |
27233 | clear_bit(R5_ReadError, &sh->dev[i].flags); | |
27234 | clear_bit(R5_ReWrite, &sh->dev[i].flags); | |
27235 | } | |
27236 | - if (atomic_read(&conf->disks[i].rdev->read_errors)) | |
27237 | - atomic_set(&conf->disks[i].rdev->read_errors, 0); | |
27238 | + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors)) | |
27239 | + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0); | |
27240 | } else { | |
27241 | const char *bdn = bdevname(conf->disks[i].rdev->bdev, b); | |
27242 | int retry = 0; | |
27243 | rdev = conf->disks[i].rdev; | |
27244 | ||
27245 | clear_bit(R5_UPTODATE, &sh->dev[i].flags); | |
27246 | - atomic_inc(&rdev->read_errors); | |
27247 | + atomic_inc_unchecked(&rdev->read_errors); | |
27248 | if (conf->mddev->degraded >= conf->max_degraded) | |
27249 | printk_rl(KERN_WARNING | |
27250 | "md/raid:%s: read error not correctable " | |
27251 | @@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc | |
27252 | (unsigned long long)(sh->sector | |
27253 | + rdev->data_offset), | |
27254 | bdn); | |
27255 | - else if (atomic_read(&rdev->read_errors) | |
27256 | + else if (atomic_read_unchecked(&rdev->read_errors) | |
27257 | > conf->max_nr_stripes) | |
27258 | printk(KERN_WARNING | |
27259 | "md/raid:%s: Too many read errors, failing device %s.\n", | |
27260 | @@ -1945,6 +1945,7 @@ static sector_t compute_blocknr(struct s | |
27261 | sector_t r_sector; | |
27262 | struct stripe_head sh2; | |
27263 | ||
27264 | + pax_track_stack(); | |
27265 | ||
27266 | chunk_offset = sector_div(new_sector, sectors_per_chunk); | |
27267 | stripe = new_sector; | |
27268 | diff -urNp linux-3.0.3/drivers/media/common/saa7146_hlp.c linux-3.0.3/drivers/media/common/saa7146_hlp.c | |
27269 | --- linux-3.0.3/drivers/media/common/saa7146_hlp.c 2011-07-21 22:17:23.000000000 -0400 | |
27270 | +++ linux-3.0.3/drivers/media/common/saa7146_hlp.c 2011-08-23 21:48:14.000000000 -0400 | |
27271 | @@ -353,6 +353,8 @@ static void calculate_clipping_registers | |
27272 | ||
27273 | int x[32], y[32], w[32], h[32]; | |
27274 | ||
27275 | + pax_track_stack(); | |
27276 | + | |
27277 | /* clear out memory */ | |
27278 | memset(&line_list[0], 0x00, sizeof(u32)*32); | |
27279 | memset(&pixel_list[0], 0x00, sizeof(u32)*32); | |
27280 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-3.0.3/drivers/media/dvb/dvb-core/dvb_ca_en50221.c | |
27281 | --- linux-3.0.3/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-07-21 22:17:23.000000000 -0400 | |
27282 | +++ linux-3.0.3/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-08-23 21:48:14.000000000 -0400 | |
27283 | @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru | |
27284 | u8 buf[HOST_LINK_BUF_SIZE]; | |
27285 | int i; | |
27286 | ||
27287 | + pax_track_stack(); | |
27288 | + | |
27289 | dprintk("%s\n", __func__); | |
27290 | ||
27291 | /* check if we have space for a link buf in the rx_buffer */ | |
27292 | @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s | |
27293 | unsigned long timeout; | |
27294 | int written; | |
27295 | ||
27296 | + pax_track_stack(); | |
27297 | + | |
27298 | dprintk("%s\n", __func__); | |
27299 | ||
27300 | /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */ | |
27301 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-core/dvb_demux.h linux-3.0.3/drivers/media/dvb/dvb-core/dvb_demux.h | |
27302 | --- linux-3.0.3/drivers/media/dvb/dvb-core/dvb_demux.h 2011-07-21 22:17:23.000000000 -0400 | |
27303 | +++ linux-3.0.3/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-24 18:24:40.000000000 -0400 | |
27304 | @@ -68,12 +68,12 @@ struct dvb_demux_feed { | |
27305 | union { | |
27306 | struct dmx_ts_feed ts; | |
27307 | struct dmx_section_feed sec; | |
27308 | - } feed; | |
27309 | + } __no_const feed; | |
27310 | ||
27311 | union { | |
27312 | dmx_ts_cb ts; | |
27313 | dmx_section_cb sec; | |
27314 | - } cb; | |
27315 | + } __no_const cb; | |
27316 | ||
27317 | struct dvb_demux *demux; | |
27318 | void *priv; | |
27319 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-core/dvbdev.c linux-3.0.3/drivers/media/dvb/dvb-core/dvbdev.c | |
27320 | --- linux-3.0.3/drivers/media/dvb/dvb-core/dvbdev.c 2011-07-21 22:17:23.000000000 -0400 | |
27321 | +++ linux-3.0.3/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-24 18:24:19.000000000 -0400 | |
27322 | @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt | |
27323 | const struct dvb_device *template, void *priv, int type) | |
27324 | { | |
27325 | struct dvb_device *dvbdev; | |
27326 | - struct file_operations *dvbdevfops; | |
27327 | + file_operations_no_const *dvbdevfops; | |
27328 | struct device *clsdev; | |
27329 | int minor; | |
27330 | int id; | |
27331 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-usb/cxusb.c linux-3.0.3/drivers/media/dvb/dvb-usb/cxusb.c | |
27332 | --- linux-3.0.3/drivers/media/dvb/dvb-usb/cxusb.c 2011-07-21 22:17:23.000000000 -0400 | |
27333 | +++ linux-3.0.3/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-24 18:26:33.000000000 -0400 | |
27334 | @@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_di | |
27335 | struct dib0700_adapter_state { | |
27336 | int (*set_param_save) (struct dvb_frontend *, | |
27337 | struct dvb_frontend_parameters *); | |
27338 | -}; | |
27339 | +} __no_const; | |
27340 | ||
27341 | static int dib7070_set_param_override(struct dvb_frontend *fe, | |
27342 | struct dvb_frontend_parameters *fep) | |
27343 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-usb/dib0700_core.c linux-3.0.3/drivers/media/dvb/dvb-usb/dib0700_core.c | |
27344 | --- linux-3.0.3/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-07-21 22:17:23.000000000 -0400 | |
27345 | +++ linux-3.0.3/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-08-23 21:48:14.000000000 -0400 | |
27346 | @@ -434,6 +434,8 @@ int dib0700_download_firmware(struct usb | |
27347 | if (!buf) | |
27348 | return -ENOMEM; | |
27349 | ||
27350 | + pax_track_stack(); | |
27351 | + | |
27352 | while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) { | |
27353 | deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n", | |
27354 | hx.addr, hx.len, hx.chk); | |
27355 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-usb/dibusb.h linux-3.0.3/drivers/media/dvb/dvb-usb/dibusb.h | |
27356 | --- linux-3.0.3/drivers/media/dvb/dvb-usb/dibusb.h 2011-07-21 22:17:23.000000000 -0400 | |
27357 | +++ linux-3.0.3/drivers/media/dvb/dvb-usb/dibusb.h 2011-08-24 18:27:27.000000000 -0400 | |
27358 | @@ -97,7 +97,7 @@ | |
27359 | #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02 | |
27360 | ||
27361 | struct dibusb_state { | |
27362 | - struct dib_fe_xfer_ops ops; | |
27363 | + dib_fe_xfer_ops_no_const ops; | |
27364 | int mt2060_present; | |
27365 | u8 tuner_addr; | |
27366 | }; | |
27367 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-usb/dw2102.c linux-3.0.3/drivers/media/dvb/dvb-usb/dw2102.c | |
27368 | --- linux-3.0.3/drivers/media/dvb/dvb-usb/dw2102.c 2011-07-21 22:17:23.000000000 -0400 | |
27369 | +++ linux-3.0.3/drivers/media/dvb/dvb-usb/dw2102.c 2011-08-24 18:27:45.000000000 -0400 | |
27370 | @@ -95,7 +95,7 @@ struct su3000_state { | |
27371 | ||
27372 | struct s6x0_state { | |
27373 | int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v); | |
27374 | -}; | |
27375 | +} __no_const; | |
27376 | ||
27377 | /* debug */ | |
27378 | static int dvb_usb_dw2102_debug; | |
27379 | diff -urNp linux-3.0.3/drivers/media/dvb/dvb-usb/lmedm04.c linux-3.0.3/drivers/media/dvb/dvb-usb/lmedm04.c | |
27380 | --- linux-3.0.3/drivers/media/dvb/dvb-usb/lmedm04.c 2011-07-21 22:17:23.000000000 -0400 | |
27381 | +++ linux-3.0.3/drivers/media/dvb/dvb-usb/lmedm04.c 2011-08-23 21:48:14.000000000 -0400 | |
27382 | @@ -742,6 +742,7 @@ static int lme2510_download_firmware(str | |
27383 | usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), | |
27384 | 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000); | |
27385 | ||
27386 | + pax_track_stack(); | |
27387 | ||
27388 | data[0] = 0x8a; | |
27389 | len_in = 1; | |
27390 | @@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_dev | |
27391 | int ret = 0, len_in; | |
27392 | u8 data[512] = {0}; | |
27393 | ||
27394 | + pax_track_stack(); | |
27395 | + | |
27396 | data[0] = 0x0a; | |
27397 | len_in = 1; | |
27398 | info("FRM Firmware Cold Reset"); | |
27399 | diff -urNp linux-3.0.3/drivers/media/dvb/frontends/dib3000.h linux-3.0.3/drivers/media/dvb/frontends/dib3000.h | |
27400 | --- linux-3.0.3/drivers/media/dvb/frontends/dib3000.h 2011-07-21 22:17:23.000000000 -0400 | |
27401 | +++ linux-3.0.3/drivers/media/dvb/frontends/dib3000.h 2011-08-24 18:28:18.000000000 -0400 | |
27402 | @@ -40,10 +40,11 @@ struct dib_fe_xfer_ops | |
27403 | int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff); | |
27404 | int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl); | |
27405 | }; | |
27406 | +typedef struct dib_fe_xfer_ops __no_const dib_fe_xfer_ops_no_const; | |
27407 | ||
27408 | #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE)) | |
27409 | extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config, | |
27410 | - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops); | |
27411 | + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops); | |
27412 | #else | |
27413 | static inline struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config, | |
27414 | struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops) | |
27415 | diff -urNp linux-3.0.3/drivers/media/dvb/frontends/dib3000mb.c linux-3.0.3/drivers/media/dvb/frontends/dib3000mb.c | |
27416 | --- linux-3.0.3/drivers/media/dvb/frontends/dib3000mb.c 2011-07-21 22:17:23.000000000 -0400 | |
27417 | +++ linux-3.0.3/drivers/media/dvb/frontends/dib3000mb.c 2011-08-24 18:28:42.000000000 -0400 | |
27418 | @@ -756,7 +756,7 @@ static int dib3000mb_tuner_pass_ctrl(str | |
27419 | static struct dvb_frontend_ops dib3000mb_ops; | |
27420 | ||
27421 | struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config, | |
27422 | - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops) | |
27423 | + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops) | |
27424 | { | |
27425 | struct dib3000_state* state = NULL; | |
27426 | ||
27427 | diff -urNp linux-3.0.3/drivers/media/dvb/frontends/mb86a16.c linux-3.0.3/drivers/media/dvb/frontends/mb86a16.c | |
27428 | --- linux-3.0.3/drivers/media/dvb/frontends/mb86a16.c 2011-07-21 22:17:23.000000000 -0400 | |
27429 | +++ linux-3.0.3/drivers/media/dvb/frontends/mb86a16.c 2011-08-23 21:48:14.000000000 -0400 | |
27430 | @@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16 | |
27431 | int ret = -1; | |
27432 | int sync; | |
27433 | ||
27434 | + pax_track_stack(); | |
27435 | + | |
27436 | dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate); | |
27437 | ||
27438 | fcp = 3000; | |
27439 | diff -urNp linux-3.0.3/drivers/media/dvb/frontends/or51211.c linux-3.0.3/drivers/media/dvb/frontends/or51211.c | |
27440 | --- linux-3.0.3/drivers/media/dvb/frontends/or51211.c 2011-07-21 22:17:23.000000000 -0400 | |
27441 | +++ linux-3.0.3/drivers/media/dvb/frontends/or51211.c 2011-08-23 21:48:14.000000000 -0400 | |
27442 | @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct | |
27443 | u8 tudata[585]; | |
27444 | int i; | |
27445 | ||
27446 | + pax_track_stack(); | |
27447 | + | |
27448 | dprintk("Firmware is %zd bytes\n",fw->size); | |
27449 | ||
27450 | /* Get eprom data */ | |
27451 | diff -urNp linux-3.0.3/drivers/media/video/cx18/cx18-driver.c linux-3.0.3/drivers/media/video/cx18/cx18-driver.c | |
27452 | --- linux-3.0.3/drivers/media/video/cx18/cx18-driver.c 2011-07-21 22:17:23.000000000 -0400 | |
27453 | +++ linux-3.0.3/drivers/media/video/cx18/cx18-driver.c 2011-08-23 21:48:14.000000000 -0400 | |
27454 | @@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s | |
27455 | struct i2c_client c; | |
27456 | u8 eedata[256]; | |
27457 | ||
27458 | + pax_track_stack(); | |
27459 | + | |
27460 | memset(&c, 0, sizeof(c)); | |
27461 | strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name)); | |
27462 | c.adapter = &cx->i2c_adap[0]; | |
27463 | diff -urNp linux-3.0.3/drivers/media/video/cx23885/cx23885-input.c linux-3.0.3/drivers/media/video/cx23885/cx23885-input.c | |
27464 | --- linux-3.0.3/drivers/media/video/cx23885/cx23885-input.c 2011-07-21 22:17:23.000000000 -0400 | |
27465 | +++ linux-3.0.3/drivers/media/video/cx23885/cx23885-input.c 2011-08-23 21:48:14.000000000 -0400 | |
27466 | @@ -53,6 +53,8 @@ static void cx23885_input_process_measur | |
27467 | bool handle = false; | |
27468 | struct ir_raw_event ir_core_event[64]; | |
27469 | ||
27470 | + pax_track_stack(); | |
27471 | + | |
27472 | do { | |
27473 | num = 0; | |
27474 | v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event, | |
27475 | diff -urNp linux-3.0.3/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-3.0.3/drivers/media/video/pvrusb2/pvrusb2-eeprom.c | |
27476 | --- linux-3.0.3/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-07-21 22:17:23.000000000 -0400 | |
27477 | +++ linux-3.0.3/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-08-23 21:48:14.000000000 -0400 | |
27478 | @@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw | |
27479 | u8 *eeprom; | |
27480 | struct tveeprom tvdata; | |
27481 | ||
27482 | + pax_track_stack(); | |
27483 | + | |
27484 | memset(&tvdata,0,sizeof(tvdata)); | |
27485 | ||
27486 | eeprom = pvr2_eeprom_fetch(hdw); | |
27487 | diff -urNp linux-3.0.3/drivers/media/video/saa7134/saa6752hs.c linux-3.0.3/drivers/media/video/saa7134/saa6752hs.c | |
27488 | --- linux-3.0.3/drivers/media/video/saa7134/saa6752hs.c 2011-07-21 22:17:23.000000000 -0400 | |
27489 | +++ linux-3.0.3/drivers/media/video/saa7134/saa6752hs.c 2011-08-23 21:48:14.000000000 -0400 | |
27490 | @@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su | |
27491 | unsigned char localPAT[256]; | |
27492 | unsigned char localPMT[256]; | |
27493 | ||
27494 | + pax_track_stack(); | |
27495 | + | |
27496 | /* Set video format - must be done first as it resets other settings */ | |
27497 | set_reg8(client, 0x41, h->video_format); | |
27498 | ||
27499 | diff -urNp linux-3.0.3/drivers/media/video/saa7164/saa7164-cmd.c linux-3.0.3/drivers/media/video/saa7164/saa7164-cmd.c | |
27500 | --- linux-3.0.3/drivers/media/video/saa7164/saa7164-cmd.c 2011-07-21 22:17:23.000000000 -0400 | |
27501 | +++ linux-3.0.3/drivers/media/video/saa7164/saa7164-cmd.c 2011-08-23 21:48:14.000000000 -0400 | |
27502 | @@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d | |
27503 | u8 tmp[512]; | |
27504 | dprintk(DBGLVL_CMD, "%s()\n", __func__); | |
27505 | ||
27506 | + pax_track_stack(); | |
27507 | + | |
27508 | /* While any outstand message on the bus exists... */ | |
27509 | do { | |
27510 | ||
27511 | @@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d | |
27512 | u8 tmp[512]; | |
27513 | dprintk(DBGLVL_CMD, "%s()\n", __func__); | |
27514 | ||
27515 | + pax_track_stack(); | |
27516 | + | |
27517 | while (loop) { | |
27518 | ||
27519 | struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 }; | |
27520 | diff -urNp linux-3.0.3/drivers/media/video/timblogiw.c linux-3.0.3/drivers/media/video/timblogiw.c | |
27521 | --- linux-3.0.3/drivers/media/video/timblogiw.c 2011-07-21 22:17:23.000000000 -0400 | |
27522 | +++ linux-3.0.3/drivers/media/video/timblogiw.c 2011-08-24 18:29:20.000000000 -0400 | |
27523 | @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *f | |
27524 | ||
27525 | /* Platform device functions */ | |
27526 | ||
27527 | -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = { | |
27528 | +static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = { | |
27529 | .vidioc_querycap = timblogiw_querycap, | |
27530 | .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt, | |
27531 | .vidioc_g_fmt_vid_cap = timblogiw_g_fmt, | |
27532 | diff -urNp linux-3.0.3/drivers/media/video/usbvision/usbvision-core.c linux-3.0.3/drivers/media/video/usbvision/usbvision-core.c | |
27533 | --- linux-3.0.3/drivers/media/video/usbvision/usbvision-core.c 2011-07-21 22:17:23.000000000 -0400 | |
27534 | +++ linux-3.0.3/drivers/media/video/usbvision/usbvision-core.c 2011-08-23 21:48:14.000000000 -0400 | |
27535 | @@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_ | |
27536 | unsigned char rv, gv, bv; | |
27537 | static unsigned char *Y, *U, *V; | |
27538 | ||
27539 | + pax_track_stack(); | |
27540 | + | |
27541 | frame = usbvision->cur_frame; | |
27542 | image_size = frame->frmwidth * frame->frmheight; | |
27543 | if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) || | |
27544 | diff -urNp linux-3.0.3/drivers/media/video/videobuf-dma-sg.c linux-3.0.3/drivers/media/video/videobuf-dma-sg.c | |
27545 | --- linux-3.0.3/drivers/media/video/videobuf-dma-sg.c 2011-07-21 22:17:23.000000000 -0400 | |
27546 | +++ linux-3.0.3/drivers/media/video/videobuf-dma-sg.c 2011-08-23 21:48:14.000000000 -0400 | |
27547 | @@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size) | |
27548 | { | |
27549 | struct videobuf_queue q; | |
27550 | ||
27551 | + pax_track_stack(); | |
27552 | + | |
27553 | /* Required to make generic handler to call __videobuf_alloc */ | |
27554 | q.int_ops = &sg_ops; | |
27555 | ||
27556 | diff -urNp linux-3.0.3/drivers/message/fusion/mptbase.c linux-3.0.3/drivers/message/fusion/mptbase.c | |
27557 | --- linux-3.0.3/drivers/message/fusion/mptbase.c 2011-07-21 22:17:23.000000000 -0400 | |
27558 | +++ linux-3.0.3/drivers/message/fusion/mptbase.c 2011-08-23 21:48:14.000000000 -0400 | |
27559 | @@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct | |
27560 | seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth); | |
27561 | seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize); | |
27562 | ||
27563 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
27564 | + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL); | |
27565 | +#else | |
27566 | seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", | |
27567 | (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma); | |
27568 | +#endif | |
27569 | + | |
27570 | /* | |
27571 | * Rounding UP to nearest 4-kB boundary here... | |
27572 | */ | |
27573 | diff -urNp linux-3.0.3/drivers/message/fusion/mptsas.c linux-3.0.3/drivers/message/fusion/mptsas.c | |
27574 | --- linux-3.0.3/drivers/message/fusion/mptsas.c 2011-07-21 22:17:23.000000000 -0400 | |
27575 | +++ linux-3.0.3/drivers/message/fusion/mptsas.c 2011-08-23 21:47:55.000000000 -0400 | |
27576 | @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin | |
27577 | return 0; | |
27578 | } | |
27579 | ||
27580 | +static inline void | |
27581 | +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy) | |
27582 | +{ | |
27583 | + if (phy_info->port_details) { | |
27584 | + phy_info->port_details->rphy = rphy; | |
27585 | + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n", | |
27586 | + ioc->name, rphy)); | |
27587 | + } | |
27588 | + | |
27589 | + if (rphy) { | |
27590 | + dsaswideprintk(ioc, dev_printk(KERN_DEBUG, | |
27591 | + &rphy->dev, MYIOC_s_FMT "add:", ioc->name)); | |
27592 | + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n", | |
27593 | + ioc->name, rphy, rphy->dev.release)); | |
27594 | + } | |
27595 | +} | |
27596 | + | |
27597 | /* no mutex */ | |
27598 | static void | |
27599 | mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details) | |
27600 | @@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p | |
27601 | return NULL; | |
27602 | } | |
27603 | ||
27604 | -static inline void | |
27605 | -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy) | |
27606 | -{ | |
27607 | - if (phy_info->port_details) { | |
27608 | - phy_info->port_details->rphy = rphy; | |
27609 | - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n", | |
27610 | - ioc->name, rphy)); | |
27611 | - } | |
27612 | - | |
27613 | - if (rphy) { | |
27614 | - dsaswideprintk(ioc, dev_printk(KERN_DEBUG, | |
27615 | - &rphy->dev, MYIOC_s_FMT "add:", ioc->name)); | |
27616 | - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n", | |
27617 | - ioc->name, rphy, rphy->dev.release)); | |
27618 | - } | |
27619 | -} | |
27620 | - | |
27621 | static inline struct sas_port * | |
27622 | mptsas_get_port(struct mptsas_phyinfo *phy_info) | |
27623 | { | |
27624 | diff -urNp linux-3.0.3/drivers/message/fusion/mptscsih.c linux-3.0.3/drivers/message/fusion/mptscsih.c | |
27625 | --- linux-3.0.3/drivers/message/fusion/mptscsih.c 2011-07-21 22:17:23.000000000 -0400 | |
27626 | +++ linux-3.0.3/drivers/message/fusion/mptscsih.c 2011-08-23 21:47:55.000000000 -0400 | |
27627 | @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost) | |
27628 | ||
27629 | h = shost_priv(SChost); | |
27630 | ||
27631 | - if (h) { | |
27632 | - if (h->info_kbuf == NULL) | |
27633 | - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL) | |
27634 | - return h->info_kbuf; | |
27635 | - h->info_kbuf[0] = '\0'; | |
27636 | + if (!h) | |
27637 | + return NULL; | |
27638 | ||
27639 | - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0); | |
27640 | - h->info_kbuf[size-1] = '\0'; | |
27641 | - } | |
27642 | + if (h->info_kbuf == NULL) | |
27643 | + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL) | |
27644 | + return h->info_kbuf; | |
27645 | + h->info_kbuf[0] = '\0'; | |
27646 | + | |
27647 | + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0); | |
27648 | + h->info_kbuf[size-1] = '\0'; | |
27649 | ||
27650 | return h->info_kbuf; | |
27651 | } | |
27652 | diff -urNp linux-3.0.3/drivers/message/i2o/i2o_config.c linux-3.0.3/drivers/message/i2o/i2o_config.c | |
27653 | --- linux-3.0.3/drivers/message/i2o/i2o_config.c 2011-07-21 22:17:23.000000000 -0400 | |
27654 | +++ linux-3.0.3/drivers/message/i2o/i2o_config.c 2011-08-23 21:48:14.000000000 -0400 | |
27655 | @@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon | |
27656 | struct i2o_message *msg; | |
27657 | unsigned int iop; | |
27658 | ||
27659 | + pax_track_stack(); | |
27660 | + | |
27661 | if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg)) | |
27662 | return -EFAULT; | |
27663 | ||
27664 | diff -urNp linux-3.0.3/drivers/message/i2o/i2o_proc.c linux-3.0.3/drivers/message/i2o/i2o_proc.c | |
27665 | --- linux-3.0.3/drivers/message/i2o/i2o_proc.c 2011-07-21 22:17:23.000000000 -0400 | |
27666 | +++ linux-3.0.3/drivers/message/i2o/i2o_proc.c 2011-08-23 21:47:55.000000000 -0400 | |
27667 | @@ -255,13 +255,6 @@ static char *scsi_devices[] = { | |
27668 | "Array Controller Device" | |
27669 | }; | |
27670 | ||
27671 | -static char *chtostr(u8 * chars, int n) | |
27672 | -{ | |
27673 | - char tmp[256]; | |
27674 | - tmp[0] = 0; | |
27675 | - return strncat(tmp, (char *)chars, n); | |
27676 | -} | |
27677 | - | |
27678 | static int i2o_report_query_status(struct seq_file *seq, int block_status, | |
27679 | char *group) | |
27680 | { | |
27681 | @@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct | |
27682 | ||
27683 | seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id); | |
27684 | seq_printf(seq, "%-#8x", ddm_table.module_id); | |
27685 | - seq_printf(seq, "%-29s", | |
27686 | - chtostr(ddm_table.module_name_version, 28)); | |
27687 | + seq_printf(seq, "%-.28s", ddm_table.module_name_version); | |
27688 | seq_printf(seq, "%9d ", ddm_table.data_size); | |
27689 | seq_printf(seq, "%8d", ddm_table.code_size); | |
27690 | ||
27691 | @@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s | |
27692 | ||
27693 | seq_printf(seq, "%-#7x", dst->i2o_vendor_id); | |
27694 | seq_printf(seq, "%-#8x", dst->module_id); | |
27695 | - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28)); | |
27696 | - seq_printf(seq, "%-9s", chtostr(dst->date, 8)); | |
27697 | + seq_printf(seq, "%-.28s", dst->module_name_version); | |
27698 | + seq_printf(seq, "%-.8s", dst->date); | |
27699 | seq_printf(seq, "%8d ", dst->module_size); | |
27700 | seq_printf(seq, "%8d ", dst->mpb_size); | |
27701 | seq_printf(seq, "0x%04x", dst->module_flags); | |
27702 | @@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str | |
27703 | seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0])); | |
27704 | seq_printf(seq, "Owner TID : %0#5x\n", work16[2]); | |
27705 | seq_printf(seq, "Parent TID : %0#5x\n", work16[3]); | |
27706 | - seq_printf(seq, "Vendor info : %s\n", | |
27707 | - chtostr((u8 *) (work32 + 2), 16)); | |
27708 | - seq_printf(seq, "Product info : %s\n", | |
27709 | - chtostr((u8 *) (work32 + 6), 16)); | |
27710 | - seq_printf(seq, "Description : %s\n", | |
27711 | - chtostr((u8 *) (work32 + 10), 16)); | |
27712 | - seq_printf(seq, "Product rev. : %s\n", | |
27713 | - chtostr((u8 *) (work32 + 14), 8)); | |
27714 | + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2)); | |
27715 | + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6)); | |
27716 | + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10)); | |
27717 | + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14)); | |
27718 | ||
27719 | seq_printf(seq, "Serial number : "); | |
27720 | print_serial_number(seq, (u8 *) (work32 + 16), | |
27721 | @@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str | |
27722 | } | |
27723 | ||
27724 | seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid); | |
27725 | - seq_printf(seq, "Module name : %s\n", | |
27726 | - chtostr(result.module_name, 24)); | |
27727 | - seq_printf(seq, "Module revision : %s\n", | |
27728 | - chtostr(result.module_rev, 8)); | |
27729 | + seq_printf(seq, "Module name : %.24s\n", result.module_name); | |
27730 | + seq_printf(seq, "Module revision : %.8s\n", result.module_rev); | |
27731 | ||
27732 | seq_printf(seq, "Serial number : "); | |
27733 | print_serial_number(seq, result.serial_number, sizeof(result) - 36); | |
27734 | @@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq | |
27735 | return 0; | |
27736 | } | |
27737 | ||
27738 | - seq_printf(seq, "Device name : %s\n", | |
27739 | - chtostr(result.device_name, 64)); | |
27740 | - seq_printf(seq, "Service name : %s\n", | |
27741 | - chtostr(result.service_name, 64)); | |
27742 | - seq_printf(seq, "Physical name : %s\n", | |
27743 | - chtostr(result.physical_location, 64)); | |
27744 | - seq_printf(seq, "Instance number : %s\n", | |
27745 | - chtostr(result.instance_number, 4)); | |
27746 | + seq_printf(seq, "Device name : %.64s\n", result.device_name); | |
27747 | + seq_printf(seq, "Service name : %.64s\n", result.service_name); | |
27748 | + seq_printf(seq, "Physical name : %.64s\n", result.physical_location); | |
27749 | + seq_printf(seq, "Instance number : %.4s\n", result.instance_number); | |
27750 | ||
27751 | return 0; | |
27752 | } | |
27753 | diff -urNp linux-3.0.3/drivers/message/i2o/iop.c linux-3.0.3/drivers/message/i2o/iop.c | |
27754 | --- linux-3.0.3/drivers/message/i2o/iop.c 2011-07-21 22:17:23.000000000 -0400 | |
27755 | +++ linux-3.0.3/drivers/message/i2o/iop.c 2011-08-23 21:47:55.000000000 -0400 | |
27756 | @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro | |
27757 | ||
27758 | spin_lock_irqsave(&c->context_list_lock, flags); | |
27759 | ||
27760 | - if (unlikely(atomic_inc_and_test(&c->context_list_counter))) | |
27761 | - atomic_inc(&c->context_list_counter); | |
27762 | + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter))) | |
27763 | + atomic_inc_unchecked(&c->context_list_counter); | |
27764 | ||
27765 | - entry->context = atomic_read(&c->context_list_counter); | |
27766 | + entry->context = atomic_read_unchecked(&c->context_list_counter); | |
27767 | ||
27768 | list_add(&entry->list, &c->context_list); | |
27769 | ||
27770 | @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi | |
27771 | ||
27772 | #if BITS_PER_LONG == 64 | |
27773 | spin_lock_init(&c->context_list_lock); | |
27774 | - atomic_set(&c->context_list_counter, 0); | |
27775 | + atomic_set_unchecked(&c->context_list_counter, 0); | |
27776 | INIT_LIST_HEAD(&c->context_list); | |
27777 | #endif | |
27778 | ||
27779 | diff -urNp linux-3.0.3/drivers/mfd/abx500-core.c linux-3.0.3/drivers/mfd/abx500-core.c | |
27780 | --- linux-3.0.3/drivers/mfd/abx500-core.c 2011-07-21 22:17:23.000000000 -0400 | |
27781 | +++ linux-3.0.3/drivers/mfd/abx500-core.c 2011-08-23 21:47:55.000000000 -0400 | |
27782 | @@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list); | |
27783 | ||
27784 | struct abx500_device_entry { | |
27785 | struct list_head list; | |
27786 | - struct abx500_ops ops; | |
27787 | + abx500_ops_no_const ops; | |
27788 | struct device *dev; | |
27789 | }; | |
27790 | ||
27791 | diff -urNp linux-3.0.3/drivers/mfd/janz-cmodio.c linux-3.0.3/drivers/mfd/janz-cmodio.c | |
27792 | --- linux-3.0.3/drivers/mfd/janz-cmodio.c 2011-07-21 22:17:23.000000000 -0400 | |
27793 | +++ linux-3.0.3/drivers/mfd/janz-cmodio.c 2011-08-23 21:47:55.000000000 -0400 | |
27794 | @@ -13,6 +13,7 @@ | |
27795 | ||
27796 | #include <linux/kernel.h> | |
27797 | #include <linux/module.h> | |
27798 | +#include <linux/slab.h> | |
27799 | #include <linux/init.h> | |
27800 | #include <linux/pci.h> | |
27801 | #include <linux/interrupt.h> | |
27802 | diff -urNp linux-3.0.3/drivers/mfd/wm8350-i2c.c linux-3.0.3/drivers/mfd/wm8350-i2c.c | |
27803 | --- linux-3.0.3/drivers/mfd/wm8350-i2c.c 2011-07-21 22:17:23.000000000 -0400 | |
27804 | +++ linux-3.0.3/drivers/mfd/wm8350-i2c.c 2011-08-23 21:48:14.000000000 -0400 | |
27805 | @@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc | |
27806 | u8 msg[(WM8350_MAX_REGISTER << 1) + 1]; | |
27807 | int ret; | |
27808 | ||
27809 | + pax_track_stack(); | |
27810 | + | |
27811 | if (bytes > ((WM8350_MAX_REGISTER << 1) + 1)) | |
27812 | return -EINVAL; | |
27813 | ||
27814 | diff -urNp linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.c linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.c | |
27815 | --- linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.c 2011-07-21 22:17:23.000000000 -0400 | |
27816 | +++ linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.c 2011-08-23 21:47:55.000000000 -0400 | |
27817 | @@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in | |
27818 | * the lid is closed. This leads to interrupts as soon as a little move | |
27819 | * is done. | |
27820 | */ | |
27821 | - atomic_inc(&lis3_dev.count); | |
27822 | + atomic_inc_unchecked(&lis3_dev.count); | |
27823 | ||
27824 | wake_up_interruptible(&lis3_dev.misc_wait); | |
27825 | kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN); | |
27826 | @@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in | |
27827 | if (lis3_dev.pm_dev) | |
27828 | pm_runtime_get_sync(lis3_dev.pm_dev); | |
27829 | ||
27830 | - atomic_set(&lis3_dev.count, 0); | |
27831 | + atomic_set_unchecked(&lis3_dev.count, 0); | |
27832 | return 0; | |
27833 | } | |
27834 | ||
27835 | @@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc | |
27836 | add_wait_queue(&lis3_dev.misc_wait, &wait); | |
27837 | while (true) { | |
27838 | set_current_state(TASK_INTERRUPTIBLE); | |
27839 | - data = atomic_xchg(&lis3_dev.count, 0); | |
27840 | + data = atomic_xchg_unchecked(&lis3_dev.count, 0); | |
27841 | if (data) | |
27842 | break; | |
27843 | ||
27844 | @@ -583,7 +583,7 @@ out: | |
27845 | static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait) | |
27846 | { | |
27847 | poll_wait(file, &lis3_dev.misc_wait, wait); | |
27848 | - if (atomic_read(&lis3_dev.count)) | |
27849 | + if (atomic_read_unchecked(&lis3_dev.count)) | |
27850 | return POLLIN | POLLRDNORM; | |
27851 | return 0; | |
27852 | } | |
27853 | diff -urNp linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.h linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.h | |
27854 | --- linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.h 2011-07-21 22:17:23.000000000 -0400 | |
27855 | +++ linux-3.0.3/drivers/misc/lis3lv02d/lis3lv02d.h 2011-08-23 21:47:55.000000000 -0400 | |
27856 | @@ -265,7 +265,7 @@ struct lis3lv02d { | |
27857 | struct input_polled_dev *idev; /* input device */ | |
27858 | struct platform_device *pdev; /* platform device */ | |
27859 | struct regulator_bulk_data regulators[2]; | |
27860 | - atomic_t count; /* interrupt count after last read */ | |
27861 | + atomic_unchecked_t count; /* interrupt count after last read */ | |
27862 | union axis_conversion ac; /* hw -> logical axis */ | |
27863 | int mapped_btns[3]; | |
27864 | ||
27865 | diff -urNp linux-3.0.3/drivers/misc/sgi-gru/gruhandles.c linux-3.0.3/drivers/misc/sgi-gru/gruhandles.c | |
27866 | --- linux-3.0.3/drivers/misc/sgi-gru/gruhandles.c 2011-07-21 22:17:23.000000000 -0400 | |
27867 | +++ linux-3.0.3/drivers/misc/sgi-gru/gruhandles.c 2011-08-23 21:47:55.000000000 -0400 | |
27868 | @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op | |
27869 | unsigned long nsec; | |
27870 | ||
27871 | nsec = CLKS2NSEC(clks); | |
27872 | - atomic_long_inc(&mcs_op_statistics[op].count); | |
27873 | - atomic_long_add(nsec, &mcs_op_statistics[op].total); | |
27874 | + atomic_long_inc_unchecked(&mcs_op_statistics[op].count); | |
27875 | + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total); | |
27876 | if (mcs_op_statistics[op].max < nsec) | |
27877 | mcs_op_statistics[op].max = nsec; | |
27878 | } | |
27879 | diff -urNp linux-3.0.3/drivers/misc/sgi-gru/gruprocfs.c linux-3.0.3/drivers/misc/sgi-gru/gruprocfs.c | |
27880 | --- linux-3.0.3/drivers/misc/sgi-gru/gruprocfs.c 2011-07-21 22:17:23.000000000 -0400 | |
27881 | +++ linux-3.0.3/drivers/misc/sgi-gru/gruprocfs.c 2011-08-23 21:47:55.000000000 -0400 | |
27882 | @@ -32,9 +32,9 @@ | |
27883 | ||
27884 | #define printstat(s, f) printstat_val(s, &gru_stats.f, #f) | |
27885 | ||
27886 | -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id) | |
27887 | +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id) | |
27888 | { | |
27889 | - unsigned long val = atomic_long_read(v); | |
27890 | + unsigned long val = atomic_long_read_unchecked(v); | |
27891 | ||
27892 | seq_printf(s, "%16lu %s\n", val, id); | |
27893 | } | |
27894 | @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se | |
27895 | ||
27896 | seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks"); | |
27897 | for (op = 0; op < mcsop_last; op++) { | |
27898 | - count = atomic_long_read(&mcs_op_statistics[op].count); | |
27899 | - total = atomic_long_read(&mcs_op_statistics[op].total); | |
27900 | + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count); | |
27901 | + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total); | |
27902 | max = mcs_op_statistics[op].max; | |
27903 | seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count, | |
27904 | count ? total / count : 0, max); | |
27905 | diff -urNp linux-3.0.3/drivers/misc/sgi-gru/grutables.h linux-3.0.3/drivers/misc/sgi-gru/grutables.h | |
27906 | --- linux-3.0.3/drivers/misc/sgi-gru/grutables.h 2011-07-21 22:17:23.000000000 -0400 | |
27907 | +++ linux-3.0.3/drivers/misc/sgi-gru/grutables.h 2011-08-23 21:47:55.000000000 -0400 | |
27908 | @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids; | |
27909 | * GRU statistics. | |
27910 | */ | |
27911 | struct gru_stats_s { | |
27912 | - atomic_long_t vdata_alloc; | |
27913 | - atomic_long_t vdata_free; | |
27914 | - atomic_long_t gts_alloc; | |
27915 | - atomic_long_t gts_free; | |
27916 | - atomic_long_t gms_alloc; | |
27917 | - atomic_long_t gms_free; | |
27918 | - atomic_long_t gts_double_allocate; | |
27919 | - atomic_long_t assign_context; | |
27920 | - atomic_long_t assign_context_failed; | |
27921 | - atomic_long_t free_context; | |
27922 | - atomic_long_t load_user_context; | |
27923 | - atomic_long_t load_kernel_context; | |
27924 | - atomic_long_t lock_kernel_context; | |
27925 | - atomic_long_t unlock_kernel_context; | |
27926 | - atomic_long_t steal_user_context; | |
27927 | - atomic_long_t steal_kernel_context; | |
27928 | - atomic_long_t steal_context_failed; | |
27929 | - atomic_long_t nopfn; | |
27930 | - atomic_long_t asid_new; | |
27931 | - atomic_long_t asid_next; | |
27932 | - atomic_long_t asid_wrap; | |
27933 | - atomic_long_t asid_reuse; | |
27934 | - atomic_long_t intr; | |
27935 | - atomic_long_t intr_cbr; | |
27936 | - atomic_long_t intr_tfh; | |
27937 | - atomic_long_t intr_spurious; | |
27938 | - atomic_long_t intr_mm_lock_failed; | |
27939 | - atomic_long_t call_os; | |
27940 | - atomic_long_t call_os_wait_queue; | |
27941 | - atomic_long_t user_flush_tlb; | |
27942 | - atomic_long_t user_unload_context; | |
27943 | - atomic_long_t user_exception; | |
27944 | - atomic_long_t set_context_option; | |
27945 | - atomic_long_t check_context_retarget_intr; | |
27946 | - atomic_long_t check_context_unload; | |
27947 | - atomic_long_t tlb_dropin; | |
27948 | - atomic_long_t tlb_preload_page; | |
27949 | - atomic_long_t tlb_dropin_fail_no_asid; | |
27950 | - atomic_long_t tlb_dropin_fail_upm; | |
27951 | - atomic_long_t tlb_dropin_fail_invalid; | |
27952 | - atomic_long_t tlb_dropin_fail_range_active; | |
27953 | - atomic_long_t tlb_dropin_fail_idle; | |
27954 | - atomic_long_t tlb_dropin_fail_fmm; | |
27955 | - atomic_long_t tlb_dropin_fail_no_exception; | |
27956 | - atomic_long_t tfh_stale_on_fault; | |
27957 | - atomic_long_t mmu_invalidate_range; | |
27958 | - atomic_long_t mmu_invalidate_page; | |
27959 | - atomic_long_t flush_tlb; | |
27960 | - atomic_long_t flush_tlb_gru; | |
27961 | - atomic_long_t flush_tlb_gru_tgh; | |
27962 | - atomic_long_t flush_tlb_gru_zero_asid; | |
27963 | - | |
27964 | - atomic_long_t copy_gpa; | |
27965 | - atomic_long_t read_gpa; | |
27966 | - | |
27967 | - atomic_long_t mesq_receive; | |
27968 | - atomic_long_t mesq_receive_none; | |
27969 | - atomic_long_t mesq_send; | |
27970 | - atomic_long_t mesq_send_failed; | |
27971 | - atomic_long_t mesq_noop; | |
27972 | - atomic_long_t mesq_send_unexpected_error; | |
27973 | - atomic_long_t mesq_send_lb_overflow; | |
27974 | - atomic_long_t mesq_send_qlimit_reached; | |
27975 | - atomic_long_t mesq_send_amo_nacked; | |
27976 | - atomic_long_t mesq_send_put_nacked; | |
27977 | - atomic_long_t mesq_page_overflow; | |
27978 | - atomic_long_t mesq_qf_locked; | |
27979 | - atomic_long_t mesq_qf_noop_not_full; | |
27980 | - atomic_long_t mesq_qf_switch_head_failed; | |
27981 | - atomic_long_t mesq_qf_unexpected_error; | |
27982 | - atomic_long_t mesq_noop_unexpected_error; | |
27983 | - atomic_long_t mesq_noop_lb_overflow; | |
27984 | - atomic_long_t mesq_noop_qlimit_reached; | |
27985 | - atomic_long_t mesq_noop_amo_nacked; | |
27986 | - atomic_long_t mesq_noop_put_nacked; | |
27987 | - atomic_long_t mesq_noop_page_overflow; | |
27988 | + atomic_long_unchecked_t vdata_alloc; | |
27989 | + atomic_long_unchecked_t vdata_free; | |
27990 | + atomic_long_unchecked_t gts_alloc; | |
27991 | + atomic_long_unchecked_t gts_free; | |
27992 | + atomic_long_unchecked_t gms_alloc; | |
27993 | + atomic_long_unchecked_t gms_free; | |
27994 | + atomic_long_unchecked_t gts_double_allocate; | |
27995 | + atomic_long_unchecked_t assign_context; | |
27996 | + atomic_long_unchecked_t assign_context_failed; | |
27997 | + atomic_long_unchecked_t free_context; | |
27998 | + atomic_long_unchecked_t load_user_context; | |
27999 | + atomic_long_unchecked_t load_kernel_context; | |
28000 | + atomic_long_unchecked_t lock_kernel_context; | |
28001 | + atomic_long_unchecked_t unlock_kernel_context; | |
28002 | + atomic_long_unchecked_t steal_user_context; | |
28003 | + atomic_long_unchecked_t steal_kernel_context; | |
28004 | + atomic_long_unchecked_t steal_context_failed; | |
28005 | + atomic_long_unchecked_t nopfn; | |
28006 | + atomic_long_unchecked_t asid_new; | |
28007 | + atomic_long_unchecked_t asid_next; | |
28008 | + atomic_long_unchecked_t asid_wrap; | |
28009 | + atomic_long_unchecked_t asid_reuse; | |
28010 | + atomic_long_unchecked_t intr; | |
28011 | + atomic_long_unchecked_t intr_cbr; | |
28012 | + atomic_long_unchecked_t intr_tfh; | |
28013 | + atomic_long_unchecked_t intr_spurious; | |
28014 | + atomic_long_unchecked_t intr_mm_lock_failed; | |
28015 | + atomic_long_unchecked_t call_os; | |
28016 | + atomic_long_unchecked_t call_os_wait_queue; | |
28017 | + atomic_long_unchecked_t user_flush_tlb; | |
28018 | + atomic_long_unchecked_t user_unload_context; | |
28019 | + atomic_long_unchecked_t user_exception; | |
28020 | + atomic_long_unchecked_t set_context_option; | |
28021 | + atomic_long_unchecked_t check_context_retarget_intr; | |
28022 | + atomic_long_unchecked_t check_context_unload; | |
28023 | + atomic_long_unchecked_t tlb_dropin; | |
28024 | + atomic_long_unchecked_t tlb_preload_page; | |
28025 | + atomic_long_unchecked_t tlb_dropin_fail_no_asid; | |
28026 | + atomic_long_unchecked_t tlb_dropin_fail_upm; | |
28027 | + atomic_long_unchecked_t tlb_dropin_fail_invalid; | |
28028 | + atomic_long_unchecked_t tlb_dropin_fail_range_active; | |
28029 | + atomic_long_unchecked_t tlb_dropin_fail_idle; | |
28030 | + atomic_long_unchecked_t tlb_dropin_fail_fmm; | |
28031 | + atomic_long_unchecked_t tlb_dropin_fail_no_exception; | |
28032 | + atomic_long_unchecked_t tfh_stale_on_fault; | |
28033 | + atomic_long_unchecked_t mmu_invalidate_range; | |
28034 | + atomic_long_unchecked_t mmu_invalidate_page; | |
28035 | + atomic_long_unchecked_t flush_tlb; | |
28036 | + atomic_long_unchecked_t flush_tlb_gru; | |
28037 | + atomic_long_unchecked_t flush_tlb_gru_tgh; | |
28038 | + atomic_long_unchecked_t flush_tlb_gru_zero_asid; | |
28039 | + | |
28040 | + atomic_long_unchecked_t copy_gpa; | |
28041 | + atomic_long_unchecked_t read_gpa; | |
28042 | + | |
28043 | + atomic_long_unchecked_t mesq_receive; | |
28044 | + atomic_long_unchecked_t mesq_receive_none; | |
28045 | + atomic_long_unchecked_t mesq_send; | |
28046 | + atomic_long_unchecked_t mesq_send_failed; | |
28047 | + atomic_long_unchecked_t mesq_noop; | |
28048 | + atomic_long_unchecked_t mesq_send_unexpected_error; | |
28049 | + atomic_long_unchecked_t mesq_send_lb_overflow; | |
28050 | + atomic_long_unchecked_t mesq_send_qlimit_reached; | |
28051 | + atomic_long_unchecked_t mesq_send_amo_nacked; | |
28052 | + atomic_long_unchecked_t mesq_send_put_nacked; | |
28053 | + atomic_long_unchecked_t mesq_page_overflow; | |
28054 | + atomic_long_unchecked_t mesq_qf_locked; | |
28055 | + atomic_long_unchecked_t mesq_qf_noop_not_full; | |
28056 | + atomic_long_unchecked_t mesq_qf_switch_head_failed; | |
28057 | + atomic_long_unchecked_t mesq_qf_unexpected_error; | |
28058 | + atomic_long_unchecked_t mesq_noop_unexpected_error; | |
28059 | + atomic_long_unchecked_t mesq_noop_lb_overflow; | |
28060 | + atomic_long_unchecked_t mesq_noop_qlimit_reached; | |
28061 | + atomic_long_unchecked_t mesq_noop_amo_nacked; | |
28062 | + atomic_long_unchecked_t mesq_noop_put_nacked; | |
28063 | + atomic_long_unchecked_t mesq_noop_page_overflow; | |
28064 | ||
28065 | }; | |
28066 | ||
28067 | @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start | |
28068 | tghop_invalidate, mcsop_last}; | |
28069 | ||
28070 | struct mcs_op_statistic { | |
28071 | - atomic_long_t count; | |
28072 | - atomic_long_t total; | |
28073 | + atomic_long_unchecked_t count; | |
28074 | + atomic_long_unchecked_t total; | |
28075 | unsigned long max; | |
28076 | }; | |
28077 | ||
28078 | @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st | |
28079 | ||
28080 | #define STAT(id) do { \ | |
28081 | if (gru_options & OPT_STATS) \ | |
28082 | - atomic_long_inc(&gru_stats.id); \ | |
28083 | + atomic_long_inc_unchecked(&gru_stats.id); \ | |
28084 | } while (0) | |
28085 | ||
28086 | #ifdef CONFIG_SGI_GRU_DEBUG | |
28087 | diff -urNp linux-3.0.3/drivers/misc/sgi-xp/xp.h linux-3.0.3/drivers/misc/sgi-xp/xp.h | |
28088 | --- linux-3.0.3/drivers/misc/sgi-xp/xp.h 2011-07-21 22:17:23.000000000 -0400 | |
28089 | +++ linux-3.0.3/drivers/misc/sgi-xp/xp.h 2011-08-23 21:47:55.000000000 -0400 | |
28090 | @@ -289,7 +289,7 @@ struct xpc_interface { | |
28091 | xpc_notify_func, void *); | |
28092 | void (*received) (short, int, void *); | |
28093 | enum xp_retval (*partid_to_nasids) (short, void *); | |
28094 | -}; | |
28095 | +} __no_const; | |
28096 | ||
28097 | extern struct xpc_interface xpc_interface; | |
28098 | ||
28099 | diff -urNp linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0001.c linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0001.c | |
28100 | --- linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0001.c 2011-07-21 22:17:23.000000000 -0400 | |
28101 | +++ linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0001.c 2011-08-23 21:48:14.000000000 -0400 | |
28102 | @@ -757,6 +757,8 @@ static int chip_ready (struct map_info * | |
28103 | struct cfi_pri_intelext *cfip = cfi->cmdset_priv; | |
28104 | unsigned long timeo = jiffies + HZ; | |
28105 | ||
28106 | + pax_track_stack(); | |
28107 | + | |
28108 | /* Prevent setting state FL_SYNCING for chip in suspended state. */ | |
28109 | if (mode == FL_SYNCING && chip->oldstate != FL_READY) | |
28110 | goto sleep; | |
28111 | @@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(stru | |
28112 | unsigned long initial_adr; | |
28113 | int initial_len = len; | |
28114 | ||
28115 | + pax_track_stack(); | |
28116 | + | |
28117 | wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize; | |
28118 | adr += chip->start; | |
28119 | initial_adr = adr; | |
28120 | @@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(st | |
28121 | int retries = 3; | |
28122 | int ret; | |
28123 | ||
28124 | + pax_track_stack(); | |
28125 | + | |
28126 | adr += chip->start; | |
28127 | ||
28128 | retry: | |
28129 | diff -urNp linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0020.c linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0020.c | |
28130 | --- linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0020.c 2011-07-21 22:17:23.000000000 -0400 | |
28131 | +++ linux-3.0.3/drivers/mtd/chips/cfi_cmdset_0020.c 2011-08-23 21:48:14.000000000 -0400 | |
28132 | @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct | |
28133 | unsigned long cmd_addr; | |
28134 | struct cfi_private *cfi = map->fldrv_priv; | |
28135 | ||
28136 | + pax_track_stack(); | |
28137 | + | |
28138 | adr += chip->start; | |
28139 | ||
28140 | /* Ensure cmd read/writes are aligned. */ | |
28141 | @@ -429,6 +431,8 @@ static inline int do_write_buffer(struct | |
28142 | DECLARE_WAITQUEUE(wait, current); | |
28143 | int wbufsize, z; | |
28144 | ||
28145 | + pax_track_stack(); | |
28146 | + | |
28147 | /* M58LW064A requires bus alignment for buffer wriets -- saw */ | |
28148 | if (adr & (map_bankwidth(map)-1)) | |
28149 | return -EINVAL; | |
28150 | @@ -743,6 +747,8 @@ static inline int do_erase_oneblock(stru | |
28151 | DECLARE_WAITQUEUE(wait, current); | |
28152 | int ret = 0; | |
28153 | ||
28154 | + pax_track_stack(); | |
28155 | + | |
28156 | adr += chip->start; | |
28157 | ||
28158 | /* Let's determine this according to the interleave only once */ | |
28159 | @@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struc | |
28160 | unsigned long timeo = jiffies + HZ; | |
28161 | DECLARE_WAITQUEUE(wait, current); | |
28162 | ||
28163 | + pax_track_stack(); | |
28164 | + | |
28165 | adr += chip->start; | |
28166 | ||
28167 | /* Let's determine this according to the interleave only once */ | |
28168 | @@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(str | |
28169 | unsigned long timeo = jiffies + HZ; | |
28170 | DECLARE_WAITQUEUE(wait, current); | |
28171 | ||
28172 | + pax_track_stack(); | |
28173 | + | |
28174 | adr += chip->start; | |
28175 | ||
28176 | /* Let's determine this according to the interleave only once */ | |
28177 | diff -urNp linux-3.0.3/drivers/mtd/devices/doc2000.c linux-3.0.3/drivers/mtd/devices/doc2000.c | |
28178 | --- linux-3.0.3/drivers/mtd/devices/doc2000.c 2011-07-21 22:17:23.000000000 -0400 | |
28179 | +++ linux-3.0.3/drivers/mtd/devices/doc2000.c 2011-08-23 21:47:55.000000000 -0400 | |
28180 | @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt | |
28181 | ||
28182 | /* The ECC will not be calculated correctly if less than 512 is written */ | |
28183 | /* DBB- | |
28184 | - if (len != 0x200 && eccbuf) | |
28185 | + if (len != 0x200) | |
28186 | printk(KERN_WARNING | |
28187 | "ECC needs a full sector write (adr: %lx size %lx)\n", | |
28188 | (long) to, (long) len); | |
28189 | diff -urNp linux-3.0.3/drivers/mtd/devices/doc2001.c linux-3.0.3/drivers/mtd/devices/doc2001.c | |
28190 | --- linux-3.0.3/drivers/mtd/devices/doc2001.c 2011-07-21 22:17:23.000000000 -0400 | |
28191 | +++ linux-3.0.3/drivers/mtd/devices/doc2001.c 2011-08-23 21:47:55.000000000 -0400 | |
28192 | @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt | |
28193 | struct Nand *mychip = &this->chips[from >> (this->chipshift)]; | |
28194 | ||
28195 | /* Don't allow read past end of device */ | |
28196 | - if (from >= this->totlen) | |
28197 | + if (from >= this->totlen || !len) | |
28198 | return -EINVAL; | |
28199 | ||
28200 | /* Don't allow a single read to cross a 512-byte block boundary */ | |
28201 | diff -urNp linux-3.0.3/drivers/mtd/ftl.c linux-3.0.3/drivers/mtd/ftl.c | |
28202 | --- linux-3.0.3/drivers/mtd/ftl.c 2011-07-21 22:17:23.000000000 -0400 | |
28203 | +++ linux-3.0.3/drivers/mtd/ftl.c 2011-08-23 21:48:14.000000000 -0400 | |
28204 | @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t * | |
28205 | loff_t offset; | |
28206 | uint16_t srcunitswap = cpu_to_le16(srcunit); | |
28207 | ||
28208 | + pax_track_stack(); | |
28209 | + | |
28210 | eun = &part->EUNInfo[srcunit]; | |
28211 | xfer = &part->XferInfo[xferunit]; | |
28212 | DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n", | |
28213 | diff -urNp linux-3.0.3/drivers/mtd/inftlcore.c linux-3.0.3/drivers/mtd/inftlcore.c | |
28214 | --- linux-3.0.3/drivers/mtd/inftlcore.c 2011-07-21 22:17:23.000000000 -0400 | |
28215 | +++ linux-3.0.3/drivers/mtd/inftlcore.c 2011-08-23 21:48:14.000000000 -0400 | |
28216 | @@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr | |
28217 | struct inftl_oob oob; | |
28218 | size_t retlen; | |
28219 | ||
28220 | + pax_track_stack(); | |
28221 | + | |
28222 | DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d," | |
28223 | "pending=%d)\n", inftl, thisVUC, pendingblock); | |
28224 | ||
28225 | diff -urNp linux-3.0.3/drivers/mtd/inftlmount.c linux-3.0.3/drivers/mtd/inftlmount.c | |
28226 | --- linux-3.0.3/drivers/mtd/inftlmount.c 2011-07-21 22:17:23.000000000 -0400 | |
28227 | +++ linux-3.0.3/drivers/mtd/inftlmount.c 2011-08-23 21:48:14.000000000 -0400 | |
28228 | @@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL | |
28229 | struct INFTLPartition *ip; | |
28230 | size_t retlen; | |
28231 | ||
28232 | + pax_track_stack(); | |
28233 | + | |
28234 | DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl); | |
28235 | ||
28236 | /* | |
28237 | diff -urNp linux-3.0.3/drivers/mtd/lpddr/qinfo_probe.c linux-3.0.3/drivers/mtd/lpddr/qinfo_probe.c | |
28238 | --- linux-3.0.3/drivers/mtd/lpddr/qinfo_probe.c 2011-07-21 22:17:23.000000000 -0400 | |
28239 | +++ linux-3.0.3/drivers/mtd/lpddr/qinfo_probe.c 2011-08-23 21:48:14.000000000 -0400 | |
28240 | @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map | |
28241 | { | |
28242 | map_word pfow_val[4]; | |
28243 | ||
28244 | + pax_track_stack(); | |
28245 | + | |
28246 | /* Check identification string */ | |
28247 | pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P); | |
28248 | pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F); | |
28249 | diff -urNp linux-3.0.3/drivers/mtd/mtdchar.c linux-3.0.3/drivers/mtd/mtdchar.c | |
28250 | --- linux-3.0.3/drivers/mtd/mtdchar.c 2011-07-21 22:17:23.000000000 -0400 | |
28251 | +++ linux-3.0.3/drivers/mtd/mtdchar.c 2011-08-23 21:48:14.000000000 -0400 | |
28252 | @@ -553,6 +553,8 @@ static int mtd_ioctl(struct file *file, | |
28253 | u_long size; | |
28254 | struct mtd_info_user info; | |
28255 | ||
28256 | + pax_track_stack(); | |
28257 | + | |
28258 | DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n"); | |
28259 | ||
28260 | size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT; | |
28261 | diff -urNp linux-3.0.3/drivers/mtd/nand/denali.c linux-3.0.3/drivers/mtd/nand/denali.c | |
28262 | --- linux-3.0.3/drivers/mtd/nand/denali.c 2011-07-21 22:17:23.000000000 -0400 | |
28263 | +++ linux-3.0.3/drivers/mtd/nand/denali.c 2011-08-23 21:47:55.000000000 -0400 | |
28264 | @@ -26,6 +26,7 @@ | |
28265 | #include <linux/pci.h> | |
28266 | #include <linux/mtd/mtd.h> | |
28267 | #include <linux/module.h> | |
28268 | +#include <linux/slab.h> | |
28269 | ||
28270 | #include "denali.h" | |
28271 | ||
28272 | diff -urNp linux-3.0.3/drivers/mtd/nftlcore.c linux-3.0.3/drivers/mtd/nftlcore.c | |
28273 | --- linux-3.0.3/drivers/mtd/nftlcore.c 2011-07-21 22:17:23.000000000 -0400 | |
28274 | +++ linux-3.0.3/drivers/mtd/nftlcore.c 2011-08-23 21:48:14.000000000 -0400 | |
28275 | @@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre | |
28276 | int inplace = 1; | |
28277 | size_t retlen; | |
28278 | ||
28279 | + pax_track_stack(); | |
28280 | + | |
28281 | memset(BlockMap, 0xff, sizeof(BlockMap)); | |
28282 | memset(BlockFreeFound, 0, sizeof(BlockFreeFound)); | |
28283 | ||
28284 | diff -urNp linux-3.0.3/drivers/mtd/nftlmount.c linux-3.0.3/drivers/mtd/nftlmount.c | |
28285 | --- linux-3.0.3/drivers/mtd/nftlmount.c 2011-07-21 22:17:23.000000000 -0400 | |
28286 | +++ linux-3.0.3/drivers/mtd/nftlmount.c 2011-08-23 21:48:14.000000000 -0400 | |
28287 | @@ -24,6 +24,7 @@ | |
28288 | #include <asm/errno.h> | |
28289 | #include <linux/delay.h> | |
28290 | #include <linux/slab.h> | |
28291 | +#include <linux/sched.h> | |
28292 | #include <linux/mtd/mtd.h> | |
28293 | #include <linux/mtd/nand.h> | |
28294 | #include <linux/mtd/nftl.h> | |
28295 | @@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr | |
28296 | struct mtd_info *mtd = nftl->mbd.mtd; | |
28297 | unsigned int i; | |
28298 | ||
28299 | + pax_track_stack(); | |
28300 | + | |
28301 | /* Assume logical EraseSize == physical erasesize for starting the scan. | |
28302 | We'll sort it out later if we find a MediaHeader which says otherwise */ | |
28303 | /* Actually, we won't. The new DiskOnChip driver has already scanned | |
28304 | diff -urNp linux-3.0.3/drivers/mtd/ubi/build.c linux-3.0.3/drivers/mtd/ubi/build.c | |
28305 | --- linux-3.0.3/drivers/mtd/ubi/build.c 2011-07-21 22:17:23.000000000 -0400 | |
28306 | +++ linux-3.0.3/drivers/mtd/ubi/build.c 2011-08-23 21:47:55.000000000 -0400 | |
28307 | @@ -1287,7 +1287,7 @@ module_exit(ubi_exit); | |
28308 | static int __init bytes_str_to_int(const char *str) | |
28309 | { | |
28310 | char *endp; | |
28311 | - unsigned long result; | |
28312 | + unsigned long result, scale = 1; | |
28313 | ||
28314 | result = simple_strtoul(str, &endp, 0); | |
28315 | if (str == endp || result >= INT_MAX) { | |
28316 | @@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const | |
28317 | ||
28318 | switch (*endp) { | |
28319 | case 'G': | |
28320 | - result *= 1024; | |
28321 | + scale *= 1024; | |
28322 | case 'M': | |
28323 | - result *= 1024; | |
28324 | + scale *= 1024; | |
28325 | case 'K': | |
28326 | - result *= 1024; | |
28327 | + scale *= 1024; | |
28328 | if (endp[1] == 'i' && endp[2] == 'B') | |
28329 | endp += 2; | |
28330 | case '\0': | |
28331 | @@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const | |
28332 | return -EINVAL; | |
28333 | } | |
28334 | ||
28335 | - return result; | |
28336 | + if ((intoverflow_t)result*scale >= INT_MAX) { | |
28337 | + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n", | |
28338 | + str); | |
28339 | + return -EINVAL; | |
28340 | + } | |
28341 | + | |
28342 | + return result*scale; | |
28343 | } | |
28344 | ||
28345 | /** | |
28346 | diff -urNp linux-3.0.3/drivers/net/bna/bfa_ioc_ct.c linux-3.0.3/drivers/net/bna/bfa_ioc_ct.c | |
28347 | --- linux-3.0.3/drivers/net/bna/bfa_ioc_ct.c 2011-07-21 22:17:23.000000000 -0400 | |
28348 | +++ linux-3.0.3/drivers/net/bna/bfa_ioc_ct.c 2011-08-23 21:47:55.000000000 -0400 | |
28349 | @@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct b | |
28350 | static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc); | |
28351 | static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode); | |
28352 | ||
28353 | -static struct bfa_ioc_hwif nw_hwif_ct; | |
28354 | +static struct bfa_ioc_hwif nw_hwif_ct = { | |
28355 | + .ioc_pll_init = bfa_ioc_ct_pll_init, | |
28356 | + .ioc_firmware_lock = bfa_ioc_ct_firmware_lock, | |
28357 | + .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock, | |
28358 | + .ioc_reg_init = bfa_ioc_ct_reg_init, | |
28359 | + .ioc_map_port = bfa_ioc_ct_map_port, | |
28360 | + .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set, | |
28361 | + .ioc_notify_fail = bfa_ioc_ct_notify_fail, | |
28362 | + .ioc_ownership_reset = bfa_ioc_ct_ownership_reset, | |
28363 | + .ioc_sync_start = bfa_ioc_ct_sync_start, | |
28364 | + .ioc_sync_join = bfa_ioc_ct_sync_join, | |
28365 | + .ioc_sync_leave = bfa_ioc_ct_sync_leave, | |
28366 | + .ioc_sync_ack = bfa_ioc_ct_sync_ack, | |
28367 | + .ioc_sync_complete = bfa_ioc_ct_sync_complete | |
28368 | +}; | |
28369 | ||
28370 | /** | |
28371 | * Called from bfa_ioc_attach() to map asic specific calls. | |
28372 | @@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct; | |
28373 | void | |
28374 | bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc) | |
28375 | { | |
28376 | - nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init; | |
28377 | - nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock; | |
28378 | - nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock; | |
28379 | - nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init; | |
28380 | - nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port; | |
28381 | - nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set; | |
28382 | - nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail; | |
28383 | - nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset; | |
28384 | - nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start; | |
28385 | - nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join; | |
28386 | - nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave; | |
28387 | - nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack; | |
28388 | - nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete; | |
28389 | - | |
28390 | ioc->ioc_hwif = &nw_hwif_ct; | |
28391 | } | |
28392 | ||
28393 | diff -urNp linux-3.0.3/drivers/net/bna/bnad.c linux-3.0.3/drivers/net/bna/bnad.c | |
28394 | --- linux-3.0.3/drivers/net/bna/bnad.c 2011-07-21 22:17:23.000000000 -0400 | |
28395 | +++ linux-3.0.3/drivers/net/bna/bnad.c 2011-08-23 21:47:55.000000000 -0400 | |
28396 | @@ -1681,7 +1681,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx | |
28397 | struct bna_intr_info *intr_info = | |
28398 | &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info; | |
28399 | struct bna_tx_config *tx_config = &bnad->tx_config[tx_id]; | |
28400 | - struct bna_tx_event_cbfn tx_cbfn; | |
28401 | + static struct bna_tx_event_cbfn tx_cbfn = { | |
28402 | + /* Initialize the tx event handlers */ | |
28403 | + .tcb_setup_cbfn = bnad_cb_tcb_setup, | |
28404 | + .tcb_destroy_cbfn = bnad_cb_tcb_destroy, | |
28405 | + .tx_stall_cbfn = bnad_cb_tx_stall, | |
28406 | + .tx_resume_cbfn = bnad_cb_tx_resume, | |
28407 | + .tx_cleanup_cbfn = bnad_cb_tx_cleanup | |
28408 | + }; | |
28409 | struct bna_tx *tx; | |
28410 | unsigned long flags; | |
28411 | ||
28412 | @@ -1690,13 +1697,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx | |
28413 | tx_config->txq_depth = bnad->txq_depth; | |
28414 | tx_config->tx_type = BNA_TX_T_REGULAR; | |
28415 | ||
28416 | - /* Initialize the tx event handlers */ | |
28417 | - tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup; | |
28418 | - tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy; | |
28419 | - tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall; | |
28420 | - tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume; | |
28421 | - tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup; | |
28422 | - | |
28423 | /* Get BNA's resource requirement for one tx object */ | |
28424 | spin_lock_irqsave(&bnad->bna_lock, flags); | |
28425 | bna_tx_res_req(bnad->num_txq_per_tx, | |
28426 | @@ -1827,21 +1827,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx | |
28427 | struct bna_intr_info *intr_info = | |
28428 | &res_info[BNA_RX_RES_T_INTR].res_u.intr_info; | |
28429 | struct bna_rx_config *rx_config = &bnad->rx_config[rx_id]; | |
28430 | - struct bna_rx_event_cbfn rx_cbfn; | |
28431 | + static struct bna_rx_event_cbfn rx_cbfn = { | |
28432 | + /* Initialize the Rx event handlers */ | |
28433 | + .rcb_setup_cbfn = bnad_cb_rcb_setup, | |
28434 | + .rcb_destroy_cbfn = bnad_cb_rcb_destroy, | |
28435 | + .ccb_setup_cbfn = bnad_cb_ccb_setup, | |
28436 | + .ccb_destroy_cbfn = bnad_cb_ccb_destroy, | |
28437 | + .rx_cleanup_cbfn = bnad_cb_rx_cleanup, | |
28438 | + .rx_post_cbfn = bnad_cb_rx_post | |
28439 | + }; | |
28440 | struct bna_rx *rx; | |
28441 | unsigned long flags; | |
28442 | ||
28443 | /* Initialize the Rx object configuration */ | |
28444 | bnad_init_rx_config(bnad, rx_config); | |
28445 | ||
28446 | - /* Initialize the Rx event handlers */ | |
28447 | - rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup; | |
28448 | - rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy; | |
28449 | - rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup; | |
28450 | - rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy; | |
28451 | - rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup; | |
28452 | - rx_cbfn.rx_post_cbfn = bnad_cb_rx_post; | |
28453 | - | |
28454 | /* Get BNA's resource requirement for one Rx object */ | |
28455 | spin_lock_irqsave(&bnad->bna_lock, flags); | |
28456 | bna_rx_res_req(rx_config, res_info); | |
28457 | diff -urNp linux-3.0.3/drivers/net/bnx2.c linux-3.0.3/drivers/net/bnx2.c | |
28458 | --- linux-3.0.3/drivers/net/bnx2.c 2011-07-21 22:17:23.000000000 -0400 | |
28459 | +++ linux-3.0.3/drivers/net/bnx2.c 2011-08-23 21:48:14.000000000 -0400 | |
28460 | @@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp) | |
28461 | int rc = 0; | |
28462 | u32 magic, csum; | |
28463 | ||
28464 | + pax_track_stack(); | |
28465 | + | |
28466 | if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0) | |
28467 | goto test_nvram_done; | |
28468 | ||
28469 | diff -urNp linux-3.0.3/drivers/net/bnx2x/bnx2x_ethtool.c linux-3.0.3/drivers/net/bnx2x/bnx2x_ethtool.c | |
28470 | --- linux-3.0.3/drivers/net/bnx2x/bnx2x_ethtool.c 2011-07-21 22:17:23.000000000 -0400 | |
28471 | +++ linux-3.0.3/drivers/net/bnx2x/bnx2x_ethtool.c 2011-08-23 21:48:14.000000000 -0400 | |
28472 | @@ -1705,6 +1705,8 @@ static int bnx2x_test_nvram(struct bnx2x | |
28473 | int i, rc; | |
28474 | u32 magic, crc; | |
28475 | ||
28476 | + pax_track_stack(); | |
28477 | + | |
28478 | if (BP_NOMCP(bp)) | |
28479 | return 0; | |
28480 | ||
28481 | diff -urNp linux-3.0.3/drivers/net/cxgb3/l2t.h linux-3.0.3/drivers/net/cxgb3/l2t.h | |
28482 | --- linux-3.0.3/drivers/net/cxgb3/l2t.h 2011-07-21 22:17:23.000000000 -0400 | |
28483 | +++ linux-3.0.3/drivers/net/cxgb3/l2t.h 2011-08-23 21:47:55.000000000 -0400 | |
28484 | @@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func) | |
28485 | */ | |
28486 | struct l2t_skb_cb { | |
28487 | arp_failure_handler_func arp_failure_handler; | |
28488 | -}; | |
28489 | +} __no_const; | |
28490 | ||
28491 | #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb) | |
28492 | ||
28493 | diff -urNp linux-3.0.3/drivers/net/cxgb4/cxgb4_main.c linux-3.0.3/drivers/net/cxgb4/cxgb4_main.c | |
28494 | --- linux-3.0.3/drivers/net/cxgb4/cxgb4_main.c 2011-07-21 22:17:23.000000000 -0400 | |
28495 | +++ linux-3.0.3/drivers/net/cxgb4/cxgb4_main.c 2011-08-23 21:48:14.000000000 -0400 | |
28496 | @@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct | |
28497 | unsigned int nchan = adap->params.nports; | |
28498 | struct msix_entry entries[MAX_INGQ + 1]; | |
28499 | ||
28500 | + pax_track_stack(); | |
28501 | + | |
28502 | for (i = 0; i < ARRAY_SIZE(entries); ++i) | |
28503 | entries[i].entry = i; | |
28504 | ||
28505 | diff -urNp linux-3.0.3/drivers/net/cxgb4/t4_hw.c linux-3.0.3/drivers/net/cxgb4/t4_hw.c | |
28506 | --- linux-3.0.3/drivers/net/cxgb4/t4_hw.c 2011-07-21 22:17:23.000000000 -0400 | |
28507 | +++ linux-3.0.3/drivers/net/cxgb4/t4_hw.c 2011-08-23 21:48:14.000000000 -0400 | |
28508 | @@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter | |
28509 | u8 vpd[VPD_LEN], csum; | |
28510 | unsigned int vpdr_len, kw_offset, id_len; | |
28511 | ||
28512 | + pax_track_stack(); | |
28513 | + | |
28514 | ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd); | |
28515 | if (ret < 0) | |
28516 | return ret; | |
28517 | diff -urNp linux-3.0.3/drivers/net/e1000e/82571.c linux-3.0.3/drivers/net/e1000e/82571.c | |
28518 | --- linux-3.0.3/drivers/net/e1000e/82571.c 2011-07-21 22:17:23.000000000 -0400 | |
28519 | +++ linux-3.0.3/drivers/net/e1000e/82571.c 2011-08-23 21:47:55.000000000 -0400 | |
28520 | @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s | |
28521 | { | |
28522 | struct e1000_hw *hw = &adapter->hw; | |
28523 | struct e1000_mac_info *mac = &hw->mac; | |
28524 | - struct e1000_mac_operations *func = &mac->ops; | |
28525 | + e1000_mac_operations_no_const *func = &mac->ops; | |
28526 | u32 swsm = 0; | |
28527 | u32 swsm2 = 0; | |
28528 | bool force_clear_smbi = false; | |
28529 | diff -urNp linux-3.0.3/drivers/net/e1000e/es2lan.c linux-3.0.3/drivers/net/e1000e/es2lan.c | |
28530 | --- linux-3.0.3/drivers/net/e1000e/es2lan.c 2011-07-21 22:17:23.000000000 -0400 | |
28531 | +++ linux-3.0.3/drivers/net/e1000e/es2lan.c 2011-08-23 21:47:55.000000000 -0400 | |
28532 | @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es | |
28533 | { | |
28534 | struct e1000_hw *hw = &adapter->hw; | |
28535 | struct e1000_mac_info *mac = &hw->mac; | |
28536 | - struct e1000_mac_operations *func = &mac->ops; | |
28537 | + e1000_mac_operations_no_const *func = &mac->ops; | |
28538 | ||
28539 | /* Set media type */ | |
28540 | switch (adapter->pdev->device) { | |
28541 | diff -urNp linux-3.0.3/drivers/net/e1000e/hw.h linux-3.0.3/drivers/net/e1000e/hw.h | |
28542 | --- linux-3.0.3/drivers/net/e1000e/hw.h 2011-07-21 22:17:23.000000000 -0400 | |
28543 | +++ linux-3.0.3/drivers/net/e1000e/hw.h 2011-08-23 21:47:55.000000000 -0400 | |
28544 | @@ -776,6 +776,7 @@ struct e1000_mac_operations { | |
28545 | void (*write_vfta)(struct e1000_hw *, u32, u32); | |
28546 | s32 (*read_mac_addr)(struct e1000_hw *); | |
28547 | }; | |
28548 | +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const; | |
28549 | ||
28550 | /* Function pointers for the PHY. */ | |
28551 | struct e1000_phy_operations { | |
28552 | @@ -799,6 +800,7 @@ struct e1000_phy_operations { | |
28553 | void (*power_up)(struct e1000_hw *); | |
28554 | void (*power_down)(struct e1000_hw *); | |
28555 | }; | |
28556 | +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const; | |
28557 | ||
28558 | /* Function pointers for the NVM. */ | |
28559 | struct e1000_nvm_operations { | |
28560 | @@ -810,9 +812,10 @@ struct e1000_nvm_operations { | |
28561 | s32 (*validate)(struct e1000_hw *); | |
28562 | s32 (*write)(struct e1000_hw *, u16, u16, u16 *); | |
28563 | }; | |
28564 | +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const; | |
28565 | ||
28566 | struct e1000_mac_info { | |
28567 | - struct e1000_mac_operations ops; | |
28568 | + e1000_mac_operations_no_const ops; | |
28569 | u8 addr[ETH_ALEN]; | |
28570 | u8 perm_addr[ETH_ALEN]; | |
28571 | ||
28572 | @@ -853,7 +856,7 @@ struct e1000_mac_info { | |
28573 | }; | |
28574 | ||
28575 | struct e1000_phy_info { | |
28576 | - struct e1000_phy_operations ops; | |
28577 | + e1000_phy_operations_no_const ops; | |
28578 | ||
28579 | enum e1000_phy_type type; | |
28580 | ||
28581 | @@ -887,7 +890,7 @@ struct e1000_phy_info { | |
28582 | }; | |
28583 | ||
28584 | struct e1000_nvm_info { | |
28585 | - struct e1000_nvm_operations ops; | |
28586 | + e1000_nvm_operations_no_const ops; | |
28587 | ||
28588 | enum e1000_nvm_type type; | |
28589 | enum e1000_nvm_override override; | |
28590 | diff -urNp linux-3.0.3/drivers/net/hamradio/6pack.c linux-3.0.3/drivers/net/hamradio/6pack.c | |
28591 | --- linux-3.0.3/drivers/net/hamradio/6pack.c 2011-07-21 22:17:23.000000000 -0400 | |
28592 | +++ linux-3.0.3/drivers/net/hamradio/6pack.c 2011-08-23 21:48:14.000000000 -0400 | |
28593 | @@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t | |
28594 | unsigned char buf[512]; | |
28595 | int count1; | |
28596 | ||
28597 | + pax_track_stack(); | |
28598 | + | |
28599 | if (!count) | |
28600 | return; | |
28601 | ||
28602 | diff -urNp linux-3.0.3/drivers/net/igb/e1000_hw.h linux-3.0.3/drivers/net/igb/e1000_hw.h | |
28603 | --- linux-3.0.3/drivers/net/igb/e1000_hw.h 2011-07-21 22:17:23.000000000 -0400 | |
28604 | +++ linux-3.0.3/drivers/net/igb/e1000_hw.h 2011-08-23 21:47:55.000000000 -0400 | |
28605 | @@ -314,6 +314,7 @@ struct e1000_mac_operations { | |
28606 | s32 (*read_mac_addr)(struct e1000_hw *); | |
28607 | s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *); | |
28608 | }; | |
28609 | +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const; | |
28610 | ||
28611 | struct e1000_phy_operations { | |
28612 | s32 (*acquire)(struct e1000_hw *); | |
28613 | @@ -330,6 +331,7 @@ struct e1000_phy_operations { | |
28614 | s32 (*set_d3_lplu_state)(struct e1000_hw *, bool); | |
28615 | s32 (*write_reg)(struct e1000_hw *, u32, u16); | |
28616 | }; | |
28617 | +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const; | |
28618 | ||
28619 | struct e1000_nvm_operations { | |
28620 | s32 (*acquire)(struct e1000_hw *); | |
28621 | @@ -339,6 +341,7 @@ struct e1000_nvm_operations { | |
28622 | s32 (*update)(struct e1000_hw *); | |
28623 | s32 (*validate)(struct e1000_hw *); | |
28624 | }; | |
28625 | +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const; | |
28626 | ||
28627 | struct e1000_info { | |
28628 | s32 (*get_invariants)(struct e1000_hw *); | |
28629 | @@ -350,7 +353,7 @@ struct e1000_info { | |
28630 | extern const struct e1000_info e1000_82575_info; | |
28631 | ||
28632 | struct e1000_mac_info { | |
28633 | - struct e1000_mac_operations ops; | |
28634 | + e1000_mac_operations_no_const ops; | |
28635 | ||
28636 | u8 addr[6]; | |
28637 | u8 perm_addr[6]; | |
28638 | @@ -388,7 +391,7 @@ struct e1000_mac_info { | |
28639 | }; | |
28640 | ||
28641 | struct e1000_phy_info { | |
28642 | - struct e1000_phy_operations ops; | |
28643 | + e1000_phy_operations_no_const ops; | |
28644 | ||
28645 | enum e1000_phy_type type; | |
28646 | ||
28647 | @@ -423,7 +426,7 @@ struct e1000_phy_info { | |
28648 | }; | |
28649 | ||
28650 | struct e1000_nvm_info { | |
28651 | - struct e1000_nvm_operations ops; | |
28652 | + e1000_nvm_operations_no_const ops; | |
28653 | enum e1000_nvm_type type; | |
28654 | enum e1000_nvm_override override; | |
28655 | ||
28656 | @@ -468,6 +471,7 @@ struct e1000_mbx_operations { | |
28657 | s32 (*check_for_ack)(struct e1000_hw *, u16); | |
28658 | s32 (*check_for_rst)(struct e1000_hw *, u16); | |
28659 | }; | |
28660 | +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const; | |
28661 | ||
28662 | struct e1000_mbx_stats { | |
28663 | u32 msgs_tx; | |
28664 | @@ -479,7 +483,7 @@ struct e1000_mbx_stats { | |
28665 | }; | |
28666 | ||
28667 | struct e1000_mbx_info { | |
28668 | - struct e1000_mbx_operations ops; | |
28669 | + e1000_mbx_operations_no_const ops; | |
28670 | struct e1000_mbx_stats stats; | |
28671 | u32 timeout; | |
28672 | u32 usec_delay; | |
28673 | diff -urNp linux-3.0.3/drivers/net/igbvf/vf.h linux-3.0.3/drivers/net/igbvf/vf.h | |
28674 | --- linux-3.0.3/drivers/net/igbvf/vf.h 2011-07-21 22:17:23.000000000 -0400 | |
28675 | +++ linux-3.0.3/drivers/net/igbvf/vf.h 2011-08-23 21:47:55.000000000 -0400 | |
28676 | @@ -189,9 +189,10 @@ struct e1000_mac_operations { | |
28677 | s32 (*read_mac_addr)(struct e1000_hw *); | |
28678 | s32 (*set_vfta)(struct e1000_hw *, u16, bool); | |
28679 | }; | |
28680 | +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const; | |
28681 | ||
28682 | struct e1000_mac_info { | |
28683 | - struct e1000_mac_operations ops; | |
28684 | + e1000_mac_operations_no_const ops; | |
28685 | u8 addr[6]; | |
28686 | u8 perm_addr[6]; | |
28687 | ||
28688 | @@ -213,6 +214,7 @@ struct e1000_mbx_operations { | |
28689 | s32 (*check_for_ack)(struct e1000_hw *); | |
28690 | s32 (*check_for_rst)(struct e1000_hw *); | |
28691 | }; | |
28692 | +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const; | |
28693 | ||
28694 | struct e1000_mbx_stats { | |
28695 | u32 msgs_tx; | |
28696 | @@ -224,7 +226,7 @@ struct e1000_mbx_stats { | |
28697 | }; | |
28698 | ||
28699 | struct e1000_mbx_info { | |
28700 | - struct e1000_mbx_operations ops; | |
28701 | + e1000_mbx_operations_no_const ops; | |
28702 | struct e1000_mbx_stats stats; | |
28703 | u32 timeout; | |
28704 | u32 usec_delay; | |
28705 | diff -urNp linux-3.0.3/drivers/net/ixgb/ixgb_main.c linux-3.0.3/drivers/net/ixgb/ixgb_main.c | |
28706 | --- linux-3.0.3/drivers/net/ixgb/ixgb_main.c 2011-07-21 22:17:23.000000000 -0400 | |
28707 | +++ linux-3.0.3/drivers/net/ixgb/ixgb_main.c 2011-08-23 21:48:14.000000000 -0400 | |
28708 | @@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev | |
28709 | u32 rctl; | |
28710 | int i; | |
28711 | ||
28712 | + pax_track_stack(); | |
28713 | + | |
28714 | /* Check for Promiscuous and All Multicast modes */ | |
28715 | ||
28716 | rctl = IXGB_READ_REG(hw, RCTL); | |
28717 | diff -urNp linux-3.0.3/drivers/net/ixgb/ixgb_param.c linux-3.0.3/drivers/net/ixgb/ixgb_param.c | |
28718 | --- linux-3.0.3/drivers/net/ixgb/ixgb_param.c 2011-07-21 22:17:23.000000000 -0400 | |
28719 | +++ linux-3.0.3/drivers/net/ixgb/ixgb_param.c 2011-08-23 21:48:14.000000000 -0400 | |
28720 | @@ -261,6 +261,9 @@ void __devinit | |
28721 | ixgb_check_options(struct ixgb_adapter *adapter) | |
28722 | { | |
28723 | int bd = adapter->bd_number; | |
28724 | + | |
28725 | + pax_track_stack(); | |
28726 | + | |
28727 | if (bd >= IXGB_MAX_NIC) { | |
28728 | pr_notice("Warning: no configuration for board #%i\n", bd); | |
28729 | pr_notice("Using defaults for all values\n"); | |
28730 | diff -urNp linux-3.0.3/drivers/net/ixgbe/ixgbe_type.h linux-3.0.3/drivers/net/ixgbe/ixgbe_type.h | |
28731 | --- linux-3.0.3/drivers/net/ixgbe/ixgbe_type.h 2011-07-21 22:17:23.000000000 -0400 | |
28732 | +++ linux-3.0.3/drivers/net/ixgbe/ixgbe_type.h 2011-08-23 21:47:55.000000000 -0400 | |
28733 | @@ -2584,6 +2584,7 @@ struct ixgbe_eeprom_operations { | |
28734 | s32 (*update_checksum)(struct ixgbe_hw *); | |
28735 | u16 (*calc_checksum)(struct ixgbe_hw *); | |
28736 | }; | |
28737 | +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const; | |
28738 | ||
28739 | struct ixgbe_mac_operations { | |
28740 | s32 (*init_hw)(struct ixgbe_hw *); | |
28741 | @@ -2639,6 +2640,7 @@ struct ixgbe_mac_operations { | |
28742 | /* Flow Control */ | |
28743 | s32 (*fc_enable)(struct ixgbe_hw *, s32); | |
28744 | }; | |
28745 | +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const; | |
28746 | ||
28747 | struct ixgbe_phy_operations { | |
28748 | s32 (*identify)(struct ixgbe_hw *); | |
28749 | @@ -2658,9 +2660,10 @@ struct ixgbe_phy_operations { | |
28750 | s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8); | |
28751 | s32 (*check_overtemp)(struct ixgbe_hw *); | |
28752 | }; | |
28753 | +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const; | |
28754 | ||
28755 | struct ixgbe_eeprom_info { | |
28756 | - struct ixgbe_eeprom_operations ops; | |
28757 | + ixgbe_eeprom_operations_no_const ops; | |
28758 | enum ixgbe_eeprom_type type; | |
28759 | u32 semaphore_delay; | |
28760 | u16 word_size; | |
28761 | @@ -2670,7 +2673,7 @@ struct ixgbe_eeprom_info { | |
28762 | ||
28763 | #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01 | |
28764 | struct ixgbe_mac_info { | |
28765 | - struct ixgbe_mac_operations ops; | |
28766 | + ixgbe_mac_operations_no_const ops; | |
28767 | enum ixgbe_mac_type type; | |
28768 | u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS]; | |
28769 | u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS]; | |
28770 | @@ -2698,7 +2701,7 @@ struct ixgbe_mac_info { | |
28771 | }; | |
28772 | ||
28773 | struct ixgbe_phy_info { | |
28774 | - struct ixgbe_phy_operations ops; | |
28775 | + ixgbe_phy_operations_no_const ops; | |
28776 | struct mdio_if_info mdio; | |
28777 | enum ixgbe_phy_type type; | |
28778 | u32 id; | |
28779 | @@ -2726,6 +2729,7 @@ struct ixgbe_mbx_operations { | |
28780 | s32 (*check_for_ack)(struct ixgbe_hw *, u16); | |
28781 | s32 (*check_for_rst)(struct ixgbe_hw *, u16); | |
28782 | }; | |
28783 | +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const; | |
28784 | ||
28785 | struct ixgbe_mbx_stats { | |
28786 | u32 msgs_tx; | |
28787 | @@ -2737,7 +2741,7 @@ struct ixgbe_mbx_stats { | |
28788 | }; | |
28789 | ||
28790 | struct ixgbe_mbx_info { | |
28791 | - struct ixgbe_mbx_operations ops; | |
28792 | + ixgbe_mbx_operations_no_const ops; | |
28793 | struct ixgbe_mbx_stats stats; | |
28794 | u32 timeout; | |
28795 | u32 usec_delay; | |
28796 | diff -urNp linux-3.0.3/drivers/net/ixgbevf/vf.h linux-3.0.3/drivers/net/ixgbevf/vf.h | |
28797 | --- linux-3.0.3/drivers/net/ixgbevf/vf.h 2011-07-21 22:17:23.000000000 -0400 | |
28798 | +++ linux-3.0.3/drivers/net/ixgbevf/vf.h 2011-08-23 21:47:55.000000000 -0400 | |
28799 | @@ -70,6 +70,7 @@ struct ixgbe_mac_operations { | |
28800 | s32 (*clear_vfta)(struct ixgbe_hw *); | |
28801 | s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool); | |
28802 | }; | |
28803 | +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const; | |
28804 | ||
28805 | enum ixgbe_mac_type { | |
28806 | ixgbe_mac_unknown = 0, | |
28807 | @@ -79,7 +80,7 @@ enum ixgbe_mac_type { | |
28808 | }; | |
28809 | ||
28810 | struct ixgbe_mac_info { | |
28811 | - struct ixgbe_mac_operations ops; | |
28812 | + ixgbe_mac_operations_no_const ops; | |
28813 | u8 addr[6]; | |
28814 | u8 perm_addr[6]; | |
28815 | ||
28816 | @@ -103,6 +104,7 @@ struct ixgbe_mbx_operations { | |
28817 | s32 (*check_for_ack)(struct ixgbe_hw *); | |
28818 | s32 (*check_for_rst)(struct ixgbe_hw *); | |
28819 | }; | |
28820 | +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const; | |
28821 | ||
28822 | struct ixgbe_mbx_stats { | |
28823 | u32 msgs_tx; | |
28824 | @@ -114,7 +116,7 @@ struct ixgbe_mbx_stats { | |
28825 | }; | |
28826 | ||
28827 | struct ixgbe_mbx_info { | |
28828 | - struct ixgbe_mbx_operations ops; | |
28829 | + ixgbe_mbx_operations_no_const ops; | |
28830 | struct ixgbe_mbx_stats stats; | |
28831 | u32 timeout; | |
28832 | u32 udelay; | |
28833 | diff -urNp linux-3.0.3/drivers/net/ksz884x.c linux-3.0.3/drivers/net/ksz884x.c | |
28834 | --- linux-3.0.3/drivers/net/ksz884x.c 2011-07-21 22:17:23.000000000 -0400 | |
28835 | +++ linux-3.0.3/drivers/net/ksz884x.c 2011-08-23 21:48:14.000000000 -0400 | |
28836 | @@ -6534,6 +6534,8 @@ static void netdev_get_ethtool_stats(str | |
28837 | int rc; | |
28838 | u64 counter[TOTAL_PORT_COUNTER_NUM]; | |
28839 | ||
28840 | + pax_track_stack(); | |
28841 | + | |
28842 | mutex_lock(&hw_priv->lock); | |
28843 | n = SWITCH_PORT_NUM; | |
28844 | for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) { | |
28845 | diff -urNp linux-3.0.3/drivers/net/mlx4/main.c linux-3.0.3/drivers/net/mlx4/main.c | |
28846 | --- linux-3.0.3/drivers/net/mlx4/main.c 2011-07-21 22:17:23.000000000 -0400 | |
28847 | +++ linux-3.0.3/drivers/net/mlx4/main.c 2011-08-23 21:48:14.000000000 -0400 | |
28848 | @@ -40,6 +40,7 @@ | |
28849 | #include <linux/dma-mapping.h> | |
28850 | #include <linux/slab.h> | |
28851 | #include <linux/io-mapping.h> | |
28852 | +#include <linux/sched.h> | |
28853 | ||
28854 | #include <linux/mlx4/device.h> | |
28855 | #include <linux/mlx4/doorbell.h> | |
28856 | @@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev | |
28857 | u64 icm_size; | |
28858 | int err; | |
28859 | ||
28860 | + pax_track_stack(); | |
28861 | + | |
28862 | err = mlx4_QUERY_FW(dev); | |
28863 | if (err) { | |
28864 | if (err == -EACCES) | |
28865 | diff -urNp linux-3.0.3/drivers/net/niu.c linux-3.0.3/drivers/net/niu.c | |
28866 | --- linux-3.0.3/drivers/net/niu.c 2011-08-23 21:44:40.000000000 -0400 | |
28867 | +++ linux-3.0.3/drivers/net/niu.c 2011-08-23 21:48:14.000000000 -0400 | |
28868 | @@ -9056,6 +9056,8 @@ static void __devinit niu_try_msix(struc | |
28869 | int i, num_irqs, err; | |
28870 | u8 first_ldg; | |
28871 | ||
28872 | + pax_track_stack(); | |
28873 | + | |
28874 | first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port; | |
28875 | for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++) | |
28876 | ldg_num_map[i] = first_ldg + i; | |
28877 | diff -urNp linux-3.0.3/drivers/net/pcnet32.c linux-3.0.3/drivers/net/pcnet32.c | |
28878 | --- linux-3.0.3/drivers/net/pcnet32.c 2011-07-21 22:17:23.000000000 -0400 | |
28879 | +++ linux-3.0.3/drivers/net/pcnet32.c 2011-08-23 21:47:55.000000000 -0400 | |
28880 | @@ -82,7 +82,7 @@ static int cards_found; | |
28881 | /* | |
28882 | * VLB I/O addresses | |
28883 | */ | |
28884 | -static unsigned int pcnet32_portlist[] __initdata = | |
28885 | +static unsigned int pcnet32_portlist[] __devinitdata = | |
28886 | { 0x300, 0x320, 0x340, 0x360, 0 }; | |
28887 | ||
28888 | static int pcnet32_debug; | |
28889 | @@ -270,7 +270,7 @@ struct pcnet32_private { | |
28890 | struct sk_buff **rx_skbuff; | |
28891 | dma_addr_t *tx_dma_addr; | |
28892 | dma_addr_t *rx_dma_addr; | |
28893 | - struct pcnet32_access a; | |
28894 | + struct pcnet32_access *a; | |
28895 | spinlock_t lock; /* Guard lock */ | |
28896 | unsigned int cur_rx, cur_tx; /* The next free ring entry */ | |
28897 | unsigned int rx_ring_size; /* current rx ring size */ | |
28898 | @@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct n | |
28899 | u16 val; | |
28900 | ||
28901 | netif_wake_queue(dev); | |
28902 | - val = lp->a.read_csr(ioaddr, CSR3); | |
28903 | + val = lp->a->read_csr(ioaddr, CSR3); | |
28904 | val &= 0x00ff; | |
28905 | - lp->a.write_csr(ioaddr, CSR3, val); | |
28906 | + lp->a->write_csr(ioaddr, CSR3, val); | |
28907 | napi_enable(&lp->napi); | |
28908 | } | |
28909 | ||
28910 | @@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_d | |
28911 | r = mii_link_ok(&lp->mii_if); | |
28912 | } else if (lp->chip_version >= PCNET32_79C970A) { | |
28913 | ulong ioaddr = dev->base_addr; /* card base I/O address */ | |
28914 | - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0); | |
28915 | + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0); | |
28916 | } else { /* can not detect link on really old chips */ | |
28917 | r = 1; | |
28918 | } | |
28919 | @@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct | |
28920 | pcnet32_netif_stop(dev); | |
28921 | ||
28922 | spin_lock_irqsave(&lp->lock, flags); | |
28923 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */ | |
28924 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */ | |
28925 | ||
28926 | size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE); | |
28927 | ||
28928 | @@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct | |
28929 | static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1) | |
28930 | { | |
28931 | struct pcnet32_private *lp = netdev_priv(dev); | |
28932 | - struct pcnet32_access *a = &lp->a; /* access to registers */ | |
28933 | + struct pcnet32_access *a = lp->a; /* access to registers */ | |
28934 | ulong ioaddr = dev->base_addr; /* card base I/O address */ | |
28935 | struct sk_buff *skb; /* sk buff */ | |
28936 | int x, i; /* counters */ | |
28937 | @@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct | |
28938 | pcnet32_netif_stop(dev); | |
28939 | ||
28940 | spin_lock_irqsave(&lp->lock, flags); | |
28941 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */ | |
28942 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */ | |
28943 | ||
28944 | numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size)); | |
28945 | ||
28946 | /* Reset the PCNET32 */ | |
28947 | - lp->a.reset(ioaddr); | |
28948 | - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
28949 | + lp->a->reset(ioaddr); | |
28950 | + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
28951 | ||
28952 | /* switch pcnet32 to 32bit mode */ | |
28953 | - lp->a.write_bcr(ioaddr, 20, 2); | |
28954 | + lp->a->write_bcr(ioaddr, 20, 2); | |
28955 | ||
28956 | /* purge & init rings but don't actually restart */ | |
28957 | pcnet32_restart(dev, 0x0000); | |
28958 | ||
28959 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */ | |
28960 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */ | |
28961 | ||
28962 | /* Initialize Transmit buffers. */ | |
28963 | size = data_len + 15; | |
28964 | @@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct | |
28965 | ||
28966 | /* set int loopback in CSR15 */ | |
28967 | x = a->read_csr(ioaddr, CSR15) & 0xfffc; | |
28968 | - lp->a.write_csr(ioaddr, CSR15, x | 0x0044); | |
28969 | + lp->a->write_csr(ioaddr, CSR15, x | 0x0044); | |
28970 | ||
28971 | teststatus = cpu_to_le16(0x8000); | |
28972 | - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */ | |
28973 | + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */ | |
28974 | ||
28975 | /* Check status of descriptors */ | |
28976 | for (x = 0; x < numbuffs; x++) { | |
28977 | @@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct | |
28978 | } | |
28979 | } | |
28980 | ||
28981 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */ | |
28982 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */ | |
28983 | wmb(); | |
28984 | if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) { | |
28985 | netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n"); | |
28986 | @@ -1015,7 +1015,7 @@ clean_up: | |
28987 | pcnet32_restart(dev, CSR0_NORMAL); | |
28988 | } else { | |
28989 | pcnet32_purge_rx_ring(dev); | |
28990 | - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */ | |
28991 | + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */ | |
28992 | } | |
28993 | spin_unlock_irqrestore(&lp->lock, flags); | |
28994 | ||
28995 | @@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct ne | |
28996 | enum ethtool_phys_id_state state) | |
28997 | { | |
28998 | struct pcnet32_private *lp = netdev_priv(dev); | |
28999 | - struct pcnet32_access *a = &lp->a; | |
29000 | + struct pcnet32_access *a = lp->a; | |
29001 | ulong ioaddr = dev->base_addr; | |
29002 | unsigned long flags; | |
29003 | int i; | |
29004 | @@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_de | |
29005 | { | |
29006 | int csr5; | |
29007 | struct pcnet32_private *lp = netdev_priv(dev); | |
29008 | - struct pcnet32_access *a = &lp->a; | |
29009 | + struct pcnet32_access *a = lp->a; | |
29010 | ulong ioaddr = dev->base_addr; | |
29011 | int ticks; | |
29012 | ||
29013 | @@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_stru | |
29014 | spin_lock_irqsave(&lp->lock, flags); | |
29015 | if (pcnet32_tx(dev)) { | |
29016 | /* reset the chip to clear the error condition, then restart */ | |
29017 | - lp->a.reset(ioaddr); | |
29018 | - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
29019 | + lp->a->reset(ioaddr); | |
29020 | + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
29021 | pcnet32_restart(dev, CSR0_START); | |
29022 | netif_wake_queue(dev); | |
29023 | } | |
29024 | @@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_stru | |
29025 | __napi_complete(napi); | |
29026 | ||
29027 | /* clear interrupt masks */ | |
29028 | - val = lp->a.read_csr(ioaddr, CSR3); | |
29029 | + val = lp->a->read_csr(ioaddr, CSR3); | |
29030 | val &= 0x00ff; | |
29031 | - lp->a.write_csr(ioaddr, CSR3, val); | |
29032 | + lp->a->write_csr(ioaddr, CSR3, val); | |
29033 | ||
29034 | /* Set interrupt enable. */ | |
29035 | - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN); | |
29036 | + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN); | |
29037 | ||
29038 | spin_unlock_irqrestore(&lp->lock, flags); | |
29039 | } | |
29040 | @@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_ | |
29041 | int i, csr0; | |
29042 | u16 *buff = ptr; | |
29043 | struct pcnet32_private *lp = netdev_priv(dev); | |
29044 | - struct pcnet32_access *a = &lp->a; | |
29045 | + struct pcnet32_access *a = lp->a; | |
29046 | ulong ioaddr = dev->base_addr; | |
29047 | unsigned long flags; | |
29048 | ||
29049 | @@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_ | |
29050 | for (j = 0; j < PCNET32_MAX_PHYS; j++) { | |
29051 | if (lp->phymask & (1 << j)) { | |
29052 | for (i = 0; i < PCNET32_REGS_PER_PHY; i++) { | |
29053 | - lp->a.write_bcr(ioaddr, 33, | |
29054 | + lp->a->write_bcr(ioaddr, 33, | |
29055 | (j << 5) | i); | |
29056 | - *buff++ = lp->a.read_bcr(ioaddr, 34); | |
29057 | + *buff++ = lp->a->read_bcr(ioaddr, 34); | |
29058 | } | |
29059 | } | |
29060 | } | |
29061 | @@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int | |
29062 | ((cards_found >= MAX_UNITS) || full_duplex[cards_found])) | |
29063 | lp->options |= PCNET32_PORT_FD; | |
29064 | ||
29065 | - lp->a = *a; | |
29066 | + lp->a = a; | |
29067 | ||
29068 | /* prior to register_netdev, dev->name is not yet correct */ | |
29069 | if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) { | |
29070 | @@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int | |
29071 | if (lp->mii) { | |
29072 | /* lp->phycount and lp->phymask are set to 0 by memset above */ | |
29073 | ||
29074 | - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f; | |
29075 | + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f; | |
29076 | /* scan for PHYs */ | |
29077 | for (i = 0; i < PCNET32_MAX_PHYS; i++) { | |
29078 | unsigned short id1, id2; | |
29079 | @@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int | |
29080 | pr_info("Found PHY %04x:%04x at address %d\n", | |
29081 | id1, id2, i); | |
29082 | } | |
29083 | - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5); | |
29084 | + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5); | |
29085 | if (lp->phycount > 1) | |
29086 | lp->options |= PCNET32_PORT_MII; | |
29087 | } | |
29088 | @@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_devic | |
29089 | } | |
29090 | ||
29091 | /* Reset the PCNET32 */ | |
29092 | - lp->a.reset(ioaddr); | |
29093 | + lp->a->reset(ioaddr); | |
29094 | ||
29095 | /* switch pcnet32 to 32bit mode */ | |
29096 | - lp->a.write_bcr(ioaddr, 20, 2); | |
29097 | + lp->a->write_bcr(ioaddr, 20, 2); | |
29098 | ||
29099 | netif_printk(lp, ifup, KERN_DEBUG, dev, | |
29100 | "%s() irq %d tx/rx rings %#x/%#x init %#x\n", | |
29101 | @@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_devic | |
29102 | (u32) (lp->init_dma_addr)); | |
29103 | ||
29104 | /* set/reset autoselect bit */ | |
29105 | - val = lp->a.read_bcr(ioaddr, 2) & ~2; | |
29106 | + val = lp->a->read_bcr(ioaddr, 2) & ~2; | |
29107 | if (lp->options & PCNET32_PORT_ASEL) | |
29108 | val |= 2; | |
29109 | - lp->a.write_bcr(ioaddr, 2, val); | |
29110 | + lp->a->write_bcr(ioaddr, 2, val); | |
29111 | ||
29112 | /* handle full duplex setting */ | |
29113 | if (lp->mii_if.full_duplex) { | |
29114 | - val = lp->a.read_bcr(ioaddr, 9) & ~3; | |
29115 | + val = lp->a->read_bcr(ioaddr, 9) & ~3; | |
29116 | if (lp->options & PCNET32_PORT_FD) { | |
29117 | val |= 1; | |
29118 | if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI)) | |
29119 | @@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_devic | |
29120 | if (lp->chip_version == 0x2627) | |
29121 | val |= 3; | |
29122 | } | |
29123 | - lp->a.write_bcr(ioaddr, 9, val); | |
29124 | + lp->a->write_bcr(ioaddr, 9, val); | |
29125 | } | |
29126 | ||
29127 | /* set/reset GPSI bit in test register */ | |
29128 | - val = lp->a.read_csr(ioaddr, 124) & ~0x10; | |
29129 | + val = lp->a->read_csr(ioaddr, 124) & ~0x10; | |
29130 | if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI) | |
29131 | val |= 0x10; | |
29132 | - lp->a.write_csr(ioaddr, 124, val); | |
29133 | + lp->a->write_csr(ioaddr, 124, val); | |
29134 | ||
29135 | /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */ | |
29136 | if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT && | |
29137 | @@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_devic | |
29138 | * duplex, and/or enable auto negotiation, and clear DANAS | |
29139 | */ | |
29140 | if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) { | |
29141 | - lp->a.write_bcr(ioaddr, 32, | |
29142 | - lp->a.read_bcr(ioaddr, 32) | 0x0080); | |
29143 | + lp->a->write_bcr(ioaddr, 32, | |
29144 | + lp->a->read_bcr(ioaddr, 32) | 0x0080); | |
29145 | /* disable Auto Negotiation, set 10Mpbs, HD */ | |
29146 | - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8; | |
29147 | + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8; | |
29148 | if (lp->options & PCNET32_PORT_FD) | |
29149 | val |= 0x10; | |
29150 | if (lp->options & PCNET32_PORT_100) | |
29151 | val |= 0x08; | |
29152 | - lp->a.write_bcr(ioaddr, 32, val); | |
29153 | + lp->a->write_bcr(ioaddr, 32, val); | |
29154 | } else { | |
29155 | if (lp->options & PCNET32_PORT_ASEL) { | |
29156 | - lp->a.write_bcr(ioaddr, 32, | |
29157 | - lp->a.read_bcr(ioaddr, | |
29158 | + lp->a->write_bcr(ioaddr, 32, | |
29159 | + lp->a->read_bcr(ioaddr, | |
29160 | 32) | 0x0080); | |
29161 | /* enable auto negotiate, setup, disable fd */ | |
29162 | - val = lp->a.read_bcr(ioaddr, 32) & ~0x98; | |
29163 | + val = lp->a->read_bcr(ioaddr, 32) & ~0x98; | |
29164 | val |= 0x20; | |
29165 | - lp->a.write_bcr(ioaddr, 32, val); | |
29166 | + lp->a->write_bcr(ioaddr, 32, val); | |
29167 | } | |
29168 | } | |
29169 | } else { | |
29170 | @@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_devic | |
29171 | * There is really no good other way to handle multiple PHYs | |
29172 | * other than turning off all automatics | |
29173 | */ | |
29174 | - val = lp->a.read_bcr(ioaddr, 2); | |
29175 | - lp->a.write_bcr(ioaddr, 2, val & ~2); | |
29176 | - val = lp->a.read_bcr(ioaddr, 32); | |
29177 | - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */ | |
29178 | + val = lp->a->read_bcr(ioaddr, 2); | |
29179 | + lp->a->write_bcr(ioaddr, 2, val & ~2); | |
29180 | + val = lp->a->read_bcr(ioaddr, 32); | |
29181 | + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */ | |
29182 | ||
29183 | if (!(lp->options & PCNET32_PORT_ASEL)) { | |
29184 | /* setup ecmd */ | |
29185 | @@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_devic | |
29186 | ethtool_cmd_speed_set(&ecmd, | |
29187 | (lp->options & PCNET32_PORT_100) ? | |
29188 | SPEED_100 : SPEED_10); | |
29189 | - bcr9 = lp->a.read_bcr(ioaddr, 9); | |
29190 | + bcr9 = lp->a->read_bcr(ioaddr, 9); | |
29191 | ||
29192 | if (lp->options & PCNET32_PORT_FD) { | |
29193 | ecmd.duplex = DUPLEX_FULL; | |
29194 | @@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_devic | |
29195 | ecmd.duplex = DUPLEX_HALF; | |
29196 | bcr9 |= ~(1 << 0); | |
29197 | } | |
29198 | - lp->a.write_bcr(ioaddr, 9, bcr9); | |
29199 | + lp->a->write_bcr(ioaddr, 9, bcr9); | |
29200 | } | |
29201 | ||
29202 | for (i = 0; i < PCNET32_MAX_PHYS; i++) { | |
29203 | @@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_devic | |
29204 | ||
29205 | #ifdef DO_DXSUFLO | |
29206 | if (lp->dxsuflo) { /* Disable transmit stop on underflow */ | |
29207 | - val = lp->a.read_csr(ioaddr, CSR3); | |
29208 | + val = lp->a->read_csr(ioaddr, CSR3); | |
29209 | val |= 0x40; | |
29210 | - lp->a.write_csr(ioaddr, CSR3, val); | |
29211 | + lp->a->write_csr(ioaddr, CSR3, val); | |
29212 | } | |
29213 | #endif | |
29214 | ||
29215 | @@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_devic | |
29216 | napi_enable(&lp->napi); | |
29217 | ||
29218 | /* Re-initialize the PCNET32, and start it when done. */ | |
29219 | - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff)); | |
29220 | - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16)); | |
29221 | + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff)); | |
29222 | + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16)); | |
29223 | ||
29224 | - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
29225 | - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT); | |
29226 | + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */ | |
29227 | + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT); | |
29228 | ||
29229 | netif_start_queue(dev); | |
29230 | ||
29231 | @@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_devic | |
29232 | ||
29233 | i = 0; | |
29234 | while (i++ < 100) | |
29235 | - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON) | |
29236 | + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON) | |
29237 | break; | |
29238 | /* | |
29239 | * We used to clear the InitDone bit, 0x0100, here but Mark Stockton | |
29240 | * reports that doing so triggers a bug in the '974. | |
29241 | */ | |
29242 | - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL); | |
29243 | + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL); | |
29244 | ||
29245 | netif_printk(lp, ifup, KERN_DEBUG, dev, | |
29246 | "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n", | |
29247 | i, | |
29248 | (u32) (lp->init_dma_addr), | |
29249 | - lp->a.read_csr(ioaddr, CSR0)); | |
29250 | + lp->a->read_csr(ioaddr, CSR0)); | |
29251 | ||
29252 | spin_unlock_irqrestore(&lp->lock, flags); | |
29253 | ||
29254 | @@ -2218,7 +2218,7 @@ err_free_ring: | |
29255 | * Switch back to 16bit mode to avoid problems with dumb | |
29256 | * DOS packet driver after a warm reboot | |
29257 | */ | |
29258 | - lp->a.write_bcr(ioaddr, 20, 4); | |
29259 | + lp->a->write_bcr(ioaddr, 20, 4); | |
29260 | ||
29261 | err_free_irq: | |
29262 | spin_unlock_irqrestore(&lp->lock, flags); | |
29263 | @@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_d | |
29264 | ||
29265 | /* wait for stop */ | |
29266 | for (i = 0; i < 100; i++) | |
29267 | - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP) | |
29268 | + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP) | |
29269 | break; | |
29270 | ||
29271 | if (i >= 100) | |
29272 | @@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_d | |
29273 | return; | |
29274 | ||
29275 | /* ReInit Ring */ | |
29276 | - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT); | |
29277 | + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT); | |
29278 | i = 0; | |
29279 | while (i++ < 1000) | |
29280 | - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON) | |
29281 | + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON) | |
29282 | break; | |
29283 | ||
29284 | - lp->a.write_csr(ioaddr, CSR0, csr0_bits); | |
29285 | + lp->a->write_csr(ioaddr, CSR0, csr0_bits); | |
29286 | } | |
29287 | ||
29288 | static void pcnet32_tx_timeout(struct net_device *dev) | |
29289 | @@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct ne | |
29290 | /* Transmitter timeout, serious problems. */ | |
29291 | if (pcnet32_debug & NETIF_MSG_DRV) | |
29292 | pr_err("%s: transmit timed out, status %4.4x, resetting\n", | |
29293 | - dev->name, lp->a.read_csr(ioaddr, CSR0)); | |
29294 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); | |
29295 | + dev->name, lp->a->read_csr(ioaddr, CSR0)); | |
29296 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); | |
29297 | dev->stats.tx_errors++; | |
29298 | if (netif_msg_tx_err(lp)) { | |
29299 | int i; | |
29300 | @@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(st | |
29301 | ||
29302 | netif_printk(lp, tx_queued, KERN_DEBUG, dev, | |
29303 | "%s() called, csr0 %4.4x\n", | |
29304 | - __func__, lp->a.read_csr(ioaddr, CSR0)); | |
29305 | + __func__, lp->a->read_csr(ioaddr, CSR0)); | |
29306 | ||
29307 | /* Default status -- will not enable Successful-TxDone | |
29308 | * interrupt when that option is available to us. | |
29309 | @@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(st | |
29310 | dev->stats.tx_bytes += skb->len; | |
29311 | ||
29312 | /* Trigger an immediate send poll. */ | |
29313 | - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL); | |
29314 | + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL); | |
29315 | ||
29316 | if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) { | |
29317 | lp->tx_full = 1; | |
29318 | @@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id) | |
29319 | ||
29320 | spin_lock(&lp->lock); | |
29321 | ||
29322 | - csr0 = lp->a.read_csr(ioaddr, CSR0); | |
29323 | + csr0 = lp->a->read_csr(ioaddr, CSR0); | |
29324 | while ((csr0 & 0x8f00) && --boguscnt >= 0) { | |
29325 | if (csr0 == 0xffff) | |
29326 | break; /* PCMCIA remove happened */ | |
29327 | /* Acknowledge all of the current interrupt sources ASAP. */ | |
29328 | - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f); | |
29329 | + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f); | |
29330 | ||
29331 | netif_printk(lp, intr, KERN_DEBUG, dev, | |
29332 | "interrupt csr0=%#2.2x new csr=%#2.2x\n", | |
29333 | - csr0, lp->a.read_csr(ioaddr, CSR0)); | |
29334 | + csr0, lp->a->read_csr(ioaddr, CSR0)); | |
29335 | ||
29336 | /* Log misc errors. */ | |
29337 | if (csr0 & 0x4000) | |
29338 | @@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id) | |
29339 | if (napi_schedule_prep(&lp->napi)) { | |
29340 | u16 val; | |
29341 | /* set interrupt masks */ | |
29342 | - val = lp->a.read_csr(ioaddr, CSR3); | |
29343 | + val = lp->a->read_csr(ioaddr, CSR3); | |
29344 | val |= 0x5f00; | |
29345 | - lp->a.write_csr(ioaddr, CSR3, val); | |
29346 | + lp->a->write_csr(ioaddr, CSR3, val); | |
29347 | ||
29348 | __napi_schedule(&lp->napi); | |
29349 | break; | |
29350 | } | |
29351 | - csr0 = lp->a.read_csr(ioaddr, CSR0); | |
29352 | + csr0 = lp->a->read_csr(ioaddr, CSR0); | |
29353 | } | |
29354 | ||
29355 | netif_printk(lp, intr, KERN_DEBUG, dev, | |
29356 | "exiting interrupt, csr0=%#4.4x\n", | |
29357 | - lp->a.read_csr(ioaddr, CSR0)); | |
29358 | + lp->a->read_csr(ioaddr, CSR0)); | |
29359 | ||
29360 | spin_unlock(&lp->lock); | |
29361 | ||
29362 | @@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_devi | |
29363 | ||
29364 | spin_lock_irqsave(&lp->lock, flags); | |
29365 | ||
29366 | - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112); | |
29367 | + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112); | |
29368 | ||
29369 | netif_printk(lp, ifdown, KERN_DEBUG, dev, | |
29370 | "Shutting down ethercard, status was %2.2x\n", | |
29371 | - lp->a.read_csr(ioaddr, CSR0)); | |
29372 | + lp->a->read_csr(ioaddr, CSR0)); | |
29373 | ||
29374 | /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */ | |
29375 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); | |
29376 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); | |
29377 | ||
29378 | /* | |
29379 | * Switch back to 16bit mode to avoid problems with dumb | |
29380 | * DOS packet driver after a warm reboot | |
29381 | */ | |
29382 | - lp->a.write_bcr(ioaddr, 20, 4); | |
29383 | + lp->a->write_bcr(ioaddr, 20, 4); | |
29384 | ||
29385 | spin_unlock_irqrestore(&lp->lock, flags); | |
29386 | ||
29387 | @@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_ | |
29388 | unsigned long flags; | |
29389 | ||
29390 | spin_lock_irqsave(&lp->lock, flags); | |
29391 | - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112); | |
29392 | + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112); | |
29393 | spin_unlock_irqrestore(&lp->lock, flags); | |
29394 | ||
29395 | return &dev->stats; | |
29396 | @@ -2578,10 +2578,10 @@ static void pcnet32_load_multicast(struc | |
29397 | if (dev->flags & IFF_ALLMULTI) { | |
29398 | ib->filter[0] = cpu_to_le32(~0U); | |
29399 | ib->filter[1] = cpu_to_le32(~0U); | |
29400 | - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff); | |
29401 | - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff); | |
29402 | - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff); | |
29403 | - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff); | |
29404 | + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff); | |
29405 | + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff); | |
29406 | + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff); | |
29407 | + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff); | |
29408 | return; | |
29409 | } | |
29410 | /* clear the multicast filter */ | |
29411 | @@ -2601,7 +2601,7 @@ static void pcnet32_load_multicast(struc | |
29412 | mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf)); | |
29413 | } | |
29414 | for (i = 0; i < 4; i++) | |
29415 | - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i, | |
29416 | + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i, | |
29417 | le16_to_cpu(mcast_table[i])); | |
29418 | } | |
29419 | ||
29420 | @@ -2616,28 +2616,28 @@ static void pcnet32_set_multicast_list(s | |
29421 | ||
29422 | spin_lock_irqsave(&lp->lock, flags); | |
29423 | suspended = pcnet32_suspend(dev, &flags, 0); | |
29424 | - csr15 = lp->a.read_csr(ioaddr, CSR15); | |
29425 | + csr15 = lp->a->read_csr(ioaddr, CSR15); | |
29426 | if (dev->flags & IFF_PROMISC) { | |
29427 | /* Log any net taps. */ | |
29428 | netif_info(lp, hw, dev, "Promiscuous mode enabled\n"); | |
29429 | lp->init_block->mode = | |
29430 | cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) << | |
29431 | 7); | |
29432 | - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000); | |
29433 | + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000); | |
29434 | } else { | |
29435 | lp->init_block->mode = | |
29436 | cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7); | |
29437 | - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff); | |
29438 | + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff); | |
29439 | pcnet32_load_multicast(dev); | |
29440 | } | |
29441 | ||
29442 | if (suspended) { | |
29443 | int csr5; | |
29444 | /* clear SUSPEND (SPND) - CSR5 bit 0 */ | |
29445 | - csr5 = lp->a.read_csr(ioaddr, CSR5); | |
29446 | - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND)); | |
29447 | + csr5 = lp->a->read_csr(ioaddr, CSR5); | |
29448 | + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND)); | |
29449 | } else { | |
29450 | - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); | |
29451 | + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); | |
29452 | pcnet32_restart(dev, CSR0_NORMAL); | |
29453 | netif_wake_queue(dev); | |
29454 | } | |
29455 | @@ -2655,8 +2655,8 @@ static int mdio_read(struct net_device * | |
29456 | if (!lp->mii) | |
29457 | return 0; | |
29458 | ||
29459 | - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f)); | |
29460 | - val_out = lp->a.read_bcr(ioaddr, 34); | |
29461 | + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f)); | |
29462 | + val_out = lp->a->read_bcr(ioaddr, 34); | |
29463 | ||
29464 | return val_out; | |
29465 | } | |
29466 | @@ -2670,8 +2670,8 @@ static void mdio_write(struct net_device | |
29467 | if (!lp->mii) | |
29468 | return; | |
29469 | ||
29470 | - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f)); | |
29471 | - lp->a.write_bcr(ioaddr, 34, val); | |
29472 | + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f)); | |
29473 | + lp->a->write_bcr(ioaddr, 34, val); | |
29474 | } | |
29475 | ||
29476 | static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) | |
29477 | @@ -2748,7 +2748,7 @@ static void pcnet32_check_media(struct n | |
29478 | curr_link = mii_link_ok(&lp->mii_if); | |
29479 | } else { | |
29480 | ulong ioaddr = dev->base_addr; /* card base I/O address */ | |
29481 | - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0); | |
29482 | + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0); | |
29483 | } | |
29484 | if (!curr_link) { | |
29485 | if (prev_link || verbose) { | |
29486 | @@ -2771,13 +2771,13 @@ static void pcnet32_check_media(struct n | |
29487 | (ecmd.duplex == DUPLEX_FULL) | |
29488 | ? "full" : "half"); | |
29489 | } | |
29490 | - bcr9 = lp->a.read_bcr(dev->base_addr, 9); | |
29491 | + bcr9 = lp->a->read_bcr(dev->base_addr, 9); | |
29492 | if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) { | |
29493 | if (lp->mii_if.full_duplex) | |
29494 | bcr9 |= (1 << 0); | |
29495 | else | |
29496 | bcr9 &= ~(1 << 0); | |
29497 | - lp->a.write_bcr(dev->base_addr, 9, bcr9); | |
29498 | + lp->a->write_bcr(dev->base_addr, 9, bcr9); | |
29499 | } | |
29500 | } else { | |
29501 | netif_info(lp, link, dev, "link up\n"); | |
29502 | diff -urNp linux-3.0.3/drivers/net/ppp_generic.c linux-3.0.3/drivers/net/ppp_generic.c | |
29503 | --- linux-3.0.3/drivers/net/ppp_generic.c 2011-07-21 22:17:23.000000000 -0400 | |
29504 | +++ linux-3.0.3/drivers/net/ppp_generic.c 2011-08-23 21:47:55.000000000 -0400 | |
29505 | @@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st | |
29506 | void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data; | |
29507 | struct ppp_stats stats; | |
29508 | struct ppp_comp_stats cstats; | |
29509 | - char *vers; | |
29510 | ||
29511 | switch (cmd) { | |
29512 | case SIOCGPPPSTATS: | |
29513 | @@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st | |
29514 | break; | |
29515 | ||
29516 | case SIOCGPPPVER: | |
29517 | - vers = PPP_VERSION; | |
29518 | - if (copy_to_user(addr, vers, strlen(vers) + 1)) | |
29519 | + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION))) | |
29520 | break; | |
29521 | err = 0; | |
29522 | break; | |
29523 | diff -urNp linux-3.0.3/drivers/net/r8169.c linux-3.0.3/drivers/net/r8169.c | |
29524 | --- linux-3.0.3/drivers/net/r8169.c 2011-08-23 21:44:40.000000000 -0400 | |
29525 | +++ linux-3.0.3/drivers/net/r8169.c 2011-08-23 21:47:55.000000000 -0400 | |
29526 | @@ -645,12 +645,12 @@ struct rtl8169_private { | |
29527 | struct mdio_ops { | |
29528 | void (*write)(void __iomem *, int, int); | |
29529 | int (*read)(void __iomem *, int); | |
29530 | - } mdio_ops; | |
29531 | + } __no_const mdio_ops; | |
29532 | ||
29533 | struct pll_power_ops { | |
29534 | void (*down)(struct rtl8169_private *); | |
29535 | void (*up)(struct rtl8169_private *); | |
29536 | - } pll_power_ops; | |
29537 | + } __no_const pll_power_ops; | |
29538 | ||
29539 | int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv); | |
29540 | int (*get_settings)(struct net_device *, struct ethtool_cmd *); | |
29541 | diff -urNp linux-3.0.3/drivers/net/tg3.h linux-3.0.3/drivers/net/tg3.h | |
29542 | --- linux-3.0.3/drivers/net/tg3.h 2011-07-21 22:17:23.000000000 -0400 | |
29543 | +++ linux-3.0.3/drivers/net/tg3.h 2011-08-23 21:47:55.000000000 -0400 | |
29544 | @@ -134,6 +134,7 @@ | |
29545 | #define CHIPREV_ID_5750_A0 0x4000 | |
29546 | #define CHIPREV_ID_5750_A1 0x4001 | |
29547 | #define CHIPREV_ID_5750_A3 0x4003 | |
29548 | +#define CHIPREV_ID_5750_C1 0x4201 | |
29549 | #define CHIPREV_ID_5750_C2 0x4202 | |
29550 | #define CHIPREV_ID_5752_A0_HW 0x5000 | |
29551 | #define CHIPREV_ID_5752_A0 0x6000 | |
29552 | diff -urNp linux-3.0.3/drivers/net/tokenring/abyss.c linux-3.0.3/drivers/net/tokenring/abyss.c | |
29553 | --- linux-3.0.3/drivers/net/tokenring/abyss.c 2011-07-21 22:17:23.000000000 -0400 | |
29554 | +++ linux-3.0.3/drivers/net/tokenring/abyss.c 2011-08-23 21:47:55.000000000 -0400 | |
29555 | @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = | |
29556 | ||
29557 | static int __init abyss_init (void) | |
29558 | { | |
29559 | - abyss_netdev_ops = tms380tr_netdev_ops; | |
29560 | + pax_open_kernel(); | |
29561 | + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); | |
29562 | ||
29563 | - abyss_netdev_ops.ndo_open = abyss_open; | |
29564 | - abyss_netdev_ops.ndo_stop = abyss_close; | |
29565 | + *(void **)&abyss_netdev_ops.ndo_open = abyss_open; | |
29566 | + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close; | |
29567 | + pax_close_kernel(); | |
29568 | ||
29569 | return pci_register_driver(&abyss_driver); | |
29570 | } | |
29571 | diff -urNp linux-3.0.3/drivers/net/tokenring/madgemc.c linux-3.0.3/drivers/net/tokenring/madgemc.c | |
29572 | --- linux-3.0.3/drivers/net/tokenring/madgemc.c 2011-07-21 22:17:23.000000000 -0400 | |
29573 | +++ linux-3.0.3/drivers/net/tokenring/madgemc.c 2011-08-23 21:47:55.000000000 -0400 | |
29574 | @@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver | |
29575 | ||
29576 | static int __init madgemc_init (void) | |
29577 | { | |
29578 | - madgemc_netdev_ops = tms380tr_netdev_ops; | |
29579 | - madgemc_netdev_ops.ndo_open = madgemc_open; | |
29580 | - madgemc_netdev_ops.ndo_stop = madgemc_close; | |
29581 | + pax_open_kernel(); | |
29582 | + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); | |
29583 | + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open; | |
29584 | + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close; | |
29585 | + pax_close_kernel(); | |
29586 | ||
29587 | return mca_register_driver (&madgemc_driver); | |
29588 | } | |
29589 | diff -urNp linux-3.0.3/drivers/net/tokenring/proteon.c linux-3.0.3/drivers/net/tokenring/proteon.c | |
29590 | --- linux-3.0.3/drivers/net/tokenring/proteon.c 2011-07-21 22:17:23.000000000 -0400 | |
29591 | +++ linux-3.0.3/drivers/net/tokenring/proteon.c 2011-08-23 21:47:55.000000000 -0400 | |
29592 | @@ -353,9 +353,11 @@ static int __init proteon_init(void) | |
29593 | struct platform_device *pdev; | |
29594 | int i, num = 0, err = 0; | |
29595 | ||
29596 | - proteon_netdev_ops = tms380tr_netdev_ops; | |
29597 | - proteon_netdev_ops.ndo_open = proteon_open; | |
29598 | - proteon_netdev_ops.ndo_stop = tms380tr_close; | |
29599 | + pax_open_kernel(); | |
29600 | + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); | |
29601 | + *(void **)&proteon_netdev_ops.ndo_open = proteon_open; | |
29602 | + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close; | |
29603 | + pax_close_kernel(); | |
29604 | ||
29605 | err = platform_driver_register(&proteon_driver); | |
29606 | if (err) | |
29607 | diff -urNp linux-3.0.3/drivers/net/tokenring/skisa.c linux-3.0.3/drivers/net/tokenring/skisa.c | |
29608 | --- linux-3.0.3/drivers/net/tokenring/skisa.c 2011-07-21 22:17:23.000000000 -0400 | |
29609 | +++ linux-3.0.3/drivers/net/tokenring/skisa.c 2011-08-23 21:47:55.000000000 -0400 | |
29610 | @@ -363,9 +363,11 @@ static int __init sk_isa_init(void) | |
29611 | struct platform_device *pdev; | |
29612 | int i, num = 0, err = 0; | |
29613 | ||
29614 | - sk_isa_netdev_ops = tms380tr_netdev_ops; | |
29615 | - sk_isa_netdev_ops.ndo_open = sk_isa_open; | |
29616 | - sk_isa_netdev_ops.ndo_stop = tms380tr_close; | |
29617 | + pax_open_kernel(); | |
29618 | + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); | |
29619 | + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open; | |
29620 | + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close; | |
29621 | + pax_close_kernel(); | |
29622 | ||
29623 | err = platform_driver_register(&sk_isa_driver); | |
29624 | if (err) | |
29625 | diff -urNp linux-3.0.3/drivers/net/tulip/de2104x.c linux-3.0.3/drivers/net/tulip/de2104x.c | |
29626 | --- linux-3.0.3/drivers/net/tulip/de2104x.c 2011-07-21 22:17:23.000000000 -0400 | |
29627 | +++ linux-3.0.3/drivers/net/tulip/de2104x.c 2011-08-23 21:48:14.000000000 -0400 | |
29628 | @@ -1794,6 +1794,8 @@ static void __devinit de21041_get_srom_i | |
29629 | struct de_srom_info_leaf *il; | |
29630 | void *bufp; | |
29631 | ||
29632 | + pax_track_stack(); | |
29633 | + | |
29634 | /* download entire eeprom */ | |
29635 | for (i = 0; i < DE_EEPROM_WORDS; i++) | |
29636 | ((__le16 *)ee_data)[i] = | |
29637 | diff -urNp linux-3.0.3/drivers/net/tulip/de4x5.c linux-3.0.3/drivers/net/tulip/de4x5.c | |
29638 | --- linux-3.0.3/drivers/net/tulip/de4x5.c 2011-07-21 22:17:23.000000000 -0400 | |
29639 | +++ linux-3.0.3/drivers/net/tulip/de4x5.c 2011-08-23 21:47:55.000000000 -0400 | |
29640 | @@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru | |
29641 | for (i=0; i<ETH_ALEN; i++) { | |
29642 | tmp.addr[i] = dev->dev_addr[i]; | |
29643 | } | |
29644 | - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT; | |
29645 | + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT; | |
29646 | break; | |
29647 | ||
29648 | case DE4X5_SET_HWADDR: /* Set the hardware address */ | |
29649 | @@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru | |
29650 | spin_lock_irqsave(&lp->lock, flags); | |
29651 | memcpy(&statbuf, &lp->pktStats, ioc->len); | |
29652 | spin_unlock_irqrestore(&lp->lock, flags); | |
29653 | - if (copy_to_user(ioc->data, &statbuf, ioc->len)) | |
29654 | + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len)) | |
29655 | return -EFAULT; | |
29656 | break; | |
29657 | } | |
29658 | diff -urNp linux-3.0.3/drivers/net/usb/hso.c linux-3.0.3/drivers/net/usb/hso.c | |
29659 | --- linux-3.0.3/drivers/net/usb/hso.c 2011-07-21 22:17:23.000000000 -0400 | |
29660 | +++ linux-3.0.3/drivers/net/usb/hso.c 2011-08-23 21:47:55.000000000 -0400 | |
29661 | @@ -71,7 +71,7 @@ | |
29662 | #include <asm/byteorder.h> | |
29663 | #include <linux/serial_core.h> | |
29664 | #include <linux/serial.h> | |
29665 | - | |
29666 | +#include <asm/local.h> | |
29667 | ||
29668 | #define MOD_AUTHOR "Option Wireless" | |
29669 | #define MOD_DESCRIPTION "USB High Speed Option driver" | |
29670 | @@ -257,7 +257,7 @@ struct hso_serial { | |
29671 | ||
29672 | /* from usb_serial_port */ | |
29673 | struct tty_struct *tty; | |
29674 | - int open_count; | |
29675 | + local_t open_count; | |
29676 | spinlock_t serial_lock; | |
29677 | ||
29678 | int (*write_data) (struct hso_serial *serial); | |
29679 | @@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ | |
29680 | struct urb *urb; | |
29681 | ||
29682 | urb = serial->rx_urb[0]; | |
29683 | - if (serial->open_count > 0) { | |
29684 | + if (local_read(&serial->open_count) > 0) { | |
29685 | count = put_rxbuf_data(urb, serial); | |
29686 | if (count == -1) | |
29687 | return; | |
29688 | @@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal | |
29689 | DUMP1(urb->transfer_buffer, urb->actual_length); | |
29690 | ||
29691 | /* Anyone listening? */ | |
29692 | - if (serial->open_count == 0) | |
29693 | + if (local_read(&serial->open_count) == 0) | |
29694 | return; | |
29695 | ||
29696 | if (status == 0) { | |
29697 | @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st | |
29698 | spin_unlock_irq(&serial->serial_lock); | |
29699 | ||
29700 | /* check for port already opened, if not set the termios */ | |
29701 | - serial->open_count++; | |
29702 | - if (serial->open_count == 1) { | |
29703 | + if (local_inc_return(&serial->open_count) == 1) { | |
29704 | serial->rx_state = RX_IDLE; | |
29705 | /* Force default termio settings */ | |
29706 | _hso_serial_set_termios(tty, NULL); | |
29707 | @@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st | |
29708 | result = hso_start_serial_device(serial->parent, GFP_KERNEL); | |
29709 | if (result) { | |
29710 | hso_stop_serial_device(serial->parent); | |
29711 | - serial->open_count--; | |
29712 | + local_dec(&serial->open_count); | |
29713 | kref_put(&serial->parent->ref, hso_serial_ref_free); | |
29714 | } | |
29715 | } else { | |
29716 | @@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_ | |
29717 | ||
29718 | /* reset the rts and dtr */ | |
29719 | /* do the actual close */ | |
29720 | - serial->open_count--; | |
29721 | + local_dec(&serial->open_count); | |
29722 | ||
29723 | - if (serial->open_count <= 0) { | |
29724 | - serial->open_count = 0; | |
29725 | + if (local_read(&serial->open_count) <= 0) { | |
29726 | + local_set(&serial->open_count, 0); | |
29727 | spin_lock_irq(&serial->serial_lock); | |
29728 | if (serial->tty == tty) { | |
29729 | serial->tty->driver_data = NULL; | |
29730 | @@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc | |
29731 | ||
29732 | /* the actual setup */ | |
29733 | spin_lock_irqsave(&serial->serial_lock, flags); | |
29734 | - if (serial->open_count) | |
29735 | + if (local_read(&serial->open_count)) | |
29736 | _hso_serial_set_termios(tty, old); | |
29737 | else | |
29738 | tty->termios = old; | |
29739 | @@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur | |
29740 | D1("Pending read interrupt on port %d\n", i); | |
29741 | spin_lock(&serial->serial_lock); | |
29742 | if (serial->rx_state == RX_IDLE && | |
29743 | - serial->open_count > 0) { | |
29744 | + local_read(&serial->open_count) > 0) { | |
29745 | /* Setup and send a ctrl req read on | |
29746 | * port i */ | |
29747 | if (!serial->rx_urb_filled[0]) { | |
29748 | @@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interfa | |
29749 | /* Start all serial ports */ | |
29750 | for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) { | |
29751 | if (serial_table[i] && (serial_table[i]->interface == iface)) { | |
29752 | - if (dev2ser(serial_table[i])->open_count) { | |
29753 | + if (local_read(&dev2ser(serial_table[i])->open_count)) { | |
29754 | result = | |
29755 | hso_start_serial_device(serial_table[i], GFP_NOIO); | |
29756 | hso_kick_transmit(dev2ser(serial_table[i])); | |
29757 | diff -urNp linux-3.0.3/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-3.0.3/drivers/net/vmxnet3/vmxnet3_ethtool.c | |
29758 | --- linux-3.0.3/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-07-21 22:17:23.000000000 -0400 | |
29759 | +++ linux-3.0.3/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-08-23 21:47:55.000000000 -0400 | |
29760 | @@ -594,8 +594,7 @@ vmxnet3_set_rss_indir(struct net_device | |
29761 | * Return with error code if any of the queue indices | |
29762 | * is out of range | |
29763 | */ | |
29764 | - if (p->ring_index[i] < 0 || | |
29765 | - p->ring_index[i] >= adapter->num_rx_queues) | |
29766 | + if (p->ring_index[i] >= adapter->num_rx_queues) | |
29767 | return -EINVAL; | |
29768 | } | |
29769 | ||
29770 | diff -urNp linux-3.0.3/drivers/net/vxge/vxge-config.h linux-3.0.3/drivers/net/vxge/vxge-config.h | |
29771 | --- linux-3.0.3/drivers/net/vxge/vxge-config.h 2011-07-21 22:17:23.000000000 -0400 | |
29772 | +++ linux-3.0.3/drivers/net/vxge/vxge-config.h 2011-08-23 21:47:55.000000000 -0400 | |
29773 | @@ -512,7 +512,7 @@ struct vxge_hw_uld_cbs { | |
29774 | void (*link_down)(struct __vxge_hw_device *devh); | |
29775 | void (*crit_err)(struct __vxge_hw_device *devh, | |
29776 | enum vxge_hw_event type, u64 ext_data); | |
29777 | -}; | |
29778 | +} __no_const; | |
29779 | ||
29780 | /* | |
29781 | * struct __vxge_hw_blockpool_entry - Block private data structure | |
29782 | diff -urNp linux-3.0.3/drivers/net/vxge/vxge-main.c linux-3.0.3/drivers/net/vxge/vxge-main.c | |
29783 | --- linux-3.0.3/drivers/net/vxge/vxge-main.c 2011-07-21 22:17:23.000000000 -0400 | |
29784 | +++ linux-3.0.3/drivers/net/vxge/vxge-main.c 2011-08-23 21:48:14.000000000 -0400 | |
29785 | @@ -98,6 +98,8 @@ static inline void VXGE_COMPLETE_VPATH_T | |
29786 | struct sk_buff *completed[NR_SKB_COMPLETED]; | |
29787 | int more; | |
29788 | ||
29789 | + pax_track_stack(); | |
29790 | + | |
29791 | do { | |
29792 | more = 0; | |
29793 | skb_ptr = completed; | |
29794 | @@ -1920,6 +1922,8 @@ static enum vxge_hw_status vxge_rth_conf | |
29795 | u8 mtable[256] = {0}; /* CPU to vpath mapping */ | |
29796 | int index; | |
29797 | ||
29798 | + pax_track_stack(); | |
29799 | + | |
29800 | /* | |
29801 | * Filling | |
29802 | * - itable with bucket numbers | |
29803 | diff -urNp linux-3.0.3/drivers/net/vxge/vxge-traffic.h linux-3.0.3/drivers/net/vxge/vxge-traffic.h | |
29804 | --- linux-3.0.3/drivers/net/vxge/vxge-traffic.h 2011-07-21 22:17:23.000000000 -0400 | |
29805 | +++ linux-3.0.3/drivers/net/vxge/vxge-traffic.h 2011-08-23 21:47:55.000000000 -0400 | |
29806 | @@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs { | |
29807 | struct vxge_hw_mempool_dma *dma_object, | |
29808 | u32 index, | |
29809 | u32 is_last); | |
29810 | -}; | |
29811 | +} __no_const; | |
29812 | ||
29813 | #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \ | |
29814 | ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next) | |
29815 | diff -urNp linux-3.0.3/drivers/net/wan/cycx_x25.c linux-3.0.3/drivers/net/wan/cycx_x25.c | |
29816 | --- linux-3.0.3/drivers/net/wan/cycx_x25.c 2011-07-21 22:17:23.000000000 -0400 | |
29817 | +++ linux-3.0.3/drivers/net/wan/cycx_x25.c 2011-08-23 21:48:14.000000000 -0400 | |
29818 | @@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned | |
29819 | unsigned char hex[1024], | |
29820 | * phex = hex; | |
29821 | ||
29822 | + pax_track_stack(); | |
29823 | + | |
29824 | if (len >= (sizeof(hex) / 2)) | |
29825 | len = (sizeof(hex) / 2) - 1; | |
29826 | ||
29827 | diff -urNp linux-3.0.3/drivers/net/wan/hdlc_x25.c linux-3.0.3/drivers/net/wan/hdlc_x25.c | |
29828 | --- linux-3.0.3/drivers/net/wan/hdlc_x25.c 2011-07-21 22:17:23.000000000 -0400 | |
29829 | +++ linux-3.0.3/drivers/net/wan/hdlc_x25.c 2011-08-23 21:47:55.000000000 -0400 | |
29830 | @@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu | |
29831 | ||
29832 | static int x25_open(struct net_device *dev) | |
29833 | { | |
29834 | - struct lapb_register_struct cb; | |
29835 | + static struct lapb_register_struct cb = { | |
29836 | + .connect_confirmation = x25_connected, | |
29837 | + .connect_indication = x25_connected, | |
29838 | + .disconnect_confirmation = x25_disconnected, | |
29839 | + .disconnect_indication = x25_disconnected, | |
29840 | + .data_indication = x25_data_indication, | |
29841 | + .data_transmit = x25_data_transmit | |
29842 | + }; | |
29843 | int result; | |
29844 | ||
29845 | - cb.connect_confirmation = x25_connected; | |
29846 | - cb.connect_indication = x25_connected; | |
29847 | - cb.disconnect_confirmation = x25_disconnected; | |
29848 | - cb.disconnect_indication = x25_disconnected; | |
29849 | - cb.data_indication = x25_data_indication; | |
29850 | - cb.data_transmit = x25_data_transmit; | |
29851 | - | |
29852 | result = lapb_register(dev, &cb); | |
29853 | if (result != LAPB_OK) | |
29854 | return result; | |
29855 | diff -urNp linux-3.0.3/drivers/net/wimax/i2400m/usb-fw.c linux-3.0.3/drivers/net/wimax/i2400m/usb-fw.c | |
29856 | --- linux-3.0.3/drivers/net/wimax/i2400m/usb-fw.c 2011-07-21 22:17:23.000000000 -0400 | |
29857 | +++ linux-3.0.3/drivers/net/wimax/i2400m/usb-fw.c 2011-08-23 21:48:14.000000000 -0400 | |
29858 | @@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru | |
29859 | int do_autopm = 1; | |
29860 | DECLARE_COMPLETION_ONSTACK(notif_completion); | |
29861 | ||
29862 | + pax_track_stack(); | |
29863 | + | |
29864 | d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n", | |
29865 | i2400m, ack, ack_size); | |
29866 | BUG_ON(_ack == i2400m->bm_ack_buf); | |
29867 | diff -urNp linux-3.0.3/drivers/net/wireless/airo.c linux-3.0.3/drivers/net/wireless/airo.c | |
29868 | --- linux-3.0.3/drivers/net/wireless/airo.c 2011-08-23 21:44:40.000000000 -0400 | |
29869 | +++ linux-3.0.3/drivers/net/wireless/airo.c 2011-08-23 21:48:14.000000000 -0400 | |
29870 | @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s | |
29871 | BSSListElement * loop_net; | |
29872 | BSSListElement * tmp_net; | |
29873 | ||
29874 | + pax_track_stack(); | |
29875 | + | |
29876 | /* Blow away current list of scan results */ | |
29877 | list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) { | |
29878 | list_move_tail (&loop_net->list, &ai->network_free_list); | |
29879 | @@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info * | |
29880 | WepKeyRid wkr; | |
29881 | int rc; | |
29882 | ||
29883 | + pax_track_stack(); | |
29884 | + | |
29885 | memset( &mySsid, 0, sizeof( mySsid ) ); | |
29886 | kfree (ai->flash); | |
29887 | ai->flash = NULL; | |
29888 | @@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct i | |
29889 | __le32 *vals = stats.vals; | |
29890 | int len; | |
29891 | ||
29892 | + pax_track_stack(); | |
29893 | + | |
29894 | if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL) | |
29895 | return -ENOMEM; | |
29896 | data = file->private_data; | |
29897 | @@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct ino | |
29898 | /* If doLoseSync is not 1, we won't do a Lose Sync */ | |
29899 | int doLoseSync = -1; | |
29900 | ||
29901 | + pax_track_stack(); | |
29902 | + | |
29903 | if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL) | |
29904 | return -ENOMEM; | |
29905 | data = file->private_data; | |
29906 | @@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_de | |
29907 | int i; | |
29908 | int loseSync = capable(CAP_NET_ADMIN) ? 1: -1; | |
29909 | ||
29910 | + pax_track_stack(); | |
29911 | + | |
29912 | qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL); | |
29913 | if (!qual) | |
29914 | return -ENOMEM; | |
29915 | @@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(str | |
29916 | CapabilityRid cap_rid; | |
29917 | __le32 *vals = stats_rid.vals; | |
29918 | ||
29919 | + pax_track_stack(); | |
29920 | + | |
29921 | /* Get stats out of the card */ | |
29922 | clear_bit(JOB_WSTATS, &local->jobs); | |
29923 | if (local->power.event) { | |
29924 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath5k/debug.c linux-3.0.3/drivers/net/wireless/ath/ath5k/debug.c | |
29925 | --- linux-3.0.3/drivers/net/wireless/ath/ath5k/debug.c 2011-07-21 22:17:23.000000000 -0400 | |
29926 | +++ linux-3.0.3/drivers/net/wireless/ath/ath5k/debug.c 2011-08-23 21:48:14.000000000 -0400 | |
29927 | @@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f | |
29928 | unsigned int v; | |
29929 | u64 tsf; | |
29930 | ||
29931 | + pax_track_stack(); | |
29932 | + | |
29933 | v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON); | |
29934 | len += snprintf(buf+len, sizeof(buf)-len, | |
29935 | "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n", | |
29936 | @@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi | |
29937 | unsigned int len = 0; | |
29938 | unsigned int i; | |
29939 | ||
29940 | + pax_track_stack(); | |
29941 | + | |
29942 | len += snprintf(buf+len, sizeof(buf)-len, | |
29943 | "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level); | |
29944 | ||
29945 | @@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct | |
29946 | unsigned int i; | |
29947 | unsigned int v; | |
29948 | ||
29949 | + pax_track_stack(); | |
29950 | + | |
29951 | len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n", | |
29952 | sc->ah->ah_ant_mode); | |
29953 | len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n", | |
29954 | @@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil | |
29955 | unsigned int len = 0; | |
29956 | u32 filt = ath5k_hw_get_rx_filter(sc->ah); | |
29957 | ||
29958 | + pax_track_stack(); | |
29959 | + | |
29960 | len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n", | |
29961 | sc->bssidmask); | |
29962 | len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ", | |
29963 | @@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str | |
29964 | unsigned int len = 0; | |
29965 | int i; | |
29966 | ||
29967 | + pax_track_stack(); | |
29968 | + | |
29969 | len += snprintf(buf+len, sizeof(buf)-len, | |
29970 | "RX\n---------------------\n"); | |
29971 | len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n", | |
29972 | @@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file | |
29973 | char buf[700]; | |
29974 | unsigned int len = 0; | |
29975 | ||
29976 | + pax_track_stack(); | |
29977 | + | |
29978 | len += snprintf(buf+len, sizeof(buf)-len, | |
29979 | "HW has PHY error counters:\t%s\n", | |
29980 | sc->ah->ah_capabilities.cap_has_phyerr_counters ? | |
29981 | @@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi | |
29982 | struct ath5k_buf *bf, *bf0; | |
29983 | int i, n; | |
29984 | ||
29985 | + pax_track_stack(); | |
29986 | + | |
29987 | len += snprintf(buf+len, sizeof(buf)-len, | |
29988 | "available txbuffers: %d\n", sc->txbuf_len); | |
29989 | ||
29990 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_calib.c | |
29991 | --- linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-07-21 22:17:23.000000000 -0400 | |
29992 | +++ linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-08-23 21:48:14.000000000 -0400 | |
29993 | @@ -757,6 +757,8 @@ static void ar9003_hw_tx_iq_cal_post_pro | |
29994 | int i, im, j; | |
29995 | int nmeasurement; | |
29996 | ||
29997 | + pax_track_stack(); | |
29998 | + | |
29999 | for (i = 0; i < AR9300_MAX_CHAINS; i++) { | |
30000 | if (ah->txchainmask & (1 << i)) | |
30001 | num_chains++; | |
30002 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_paprd.c | |
30003 | --- linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-07-21 22:17:23.000000000 -0400 | |
30004 | +++ linux-3.0.3/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-08-23 21:48:14.000000000 -0400 | |
30005 | @@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L, | |
30006 | int theta_low_bin = 0; | |
30007 | int i; | |
30008 | ||
30009 | + pax_track_stack(); | |
30010 | + | |
30011 | /* disregard any bin that contains <= 16 samples */ | |
30012 | thresh_accum_cnt = 16; | |
30013 | scale_factor = 5; | |
30014 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath9k/debug.c linux-3.0.3/drivers/net/wireless/ath/ath9k/debug.c | |
30015 | --- linux-3.0.3/drivers/net/wireless/ath/ath9k/debug.c 2011-07-21 22:17:23.000000000 -0400 | |
30016 | +++ linux-3.0.3/drivers/net/wireless/ath/ath9k/debug.c 2011-08-23 21:48:14.000000000 -0400 | |
30017 | @@ -337,6 +337,8 @@ static ssize_t read_file_interrupt(struc | |
30018 | char buf[512]; | |
30019 | unsigned int len = 0; | |
30020 | ||
30021 | + pax_track_stack(); | |
30022 | + | |
30023 | if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { | |
30024 | len += snprintf(buf + len, sizeof(buf) - len, | |
30025 | "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp); | |
30026 | @@ -427,6 +429,8 @@ static ssize_t read_file_wiphy(struct fi | |
30027 | u8 addr[ETH_ALEN]; | |
30028 | u32 tmp; | |
30029 | ||
30030 | + pax_track_stack(); | |
30031 | + | |
30032 | len += snprintf(buf + len, sizeof(buf) - len, | |
30033 | "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n", | |
30034 | wiphy_name(sc->hw->wiphy), | |
30035 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath9k/htc_drv_debug.c linux-3.0.3/drivers/net/wireless/ath/ath9k/htc_drv_debug.c | |
30036 | --- linux-3.0.3/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-07-21 22:17:23.000000000 -0400 | |
30037 | +++ linux-3.0.3/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-08-23 21:48:14.000000000 -0400 | |
30038 | @@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(s | |
30039 | unsigned int len = 0; | |
30040 | int ret = 0; | |
30041 | ||
30042 | + pax_track_stack(); | |
30043 | + | |
30044 | memset(&cmd_rsp, 0, sizeof(cmd_rsp)); | |
30045 | ||
30046 | ath9k_htc_ps_wakeup(priv); | |
30047 | @@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(st | |
30048 | unsigned int len = 0; | |
30049 | int ret = 0; | |
30050 | ||
30051 | + pax_track_stack(); | |
30052 | + | |
30053 | memset(&cmd_rsp, 0, sizeof(cmd_rsp)); | |
30054 | ||
30055 | ath9k_htc_ps_wakeup(priv); | |
30056 | @@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(st | |
30057 | unsigned int len = 0; | |
30058 | int ret = 0; | |
30059 | ||
30060 | + pax_track_stack(); | |
30061 | + | |
30062 | memset(&cmd_rsp, 0, sizeof(cmd_rsp)); | |
30063 | ||
30064 | ath9k_htc_ps_wakeup(priv); | |
30065 | @@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct fil | |
30066 | char buf[512]; | |
30067 | unsigned int len = 0; | |
30068 | ||
30069 | + pax_track_stack(); | |
30070 | + | |
30071 | len += snprintf(buf + len, sizeof(buf) - len, | |
30072 | "%20s : %10u\n", "Buffers queued", | |
30073 | priv->debug.tx_stats.buf_queued); | |
30074 | @@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct fil | |
30075 | char buf[512]; | |
30076 | unsigned int len = 0; | |
30077 | ||
30078 | + pax_track_stack(); | |
30079 | + | |
30080 | spin_lock_bh(&priv->tx.tx_lock); | |
30081 | ||
30082 | len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : "); | |
30083 | @@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct fi | |
30084 | char buf[512]; | |
30085 | unsigned int len = 0; | |
30086 | ||
30087 | + pax_track_stack(); | |
30088 | + | |
30089 | len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n", | |
30090 | "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue)); | |
30091 | ||
30092 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath9k/hw.h linux-3.0.3/drivers/net/wireless/ath/ath9k/hw.h | |
30093 | --- linux-3.0.3/drivers/net/wireless/ath/ath9k/hw.h 2011-08-23 21:44:40.000000000 -0400 | |
30094 | +++ linux-3.0.3/drivers/net/wireless/ath/ath9k/hw.h 2011-08-23 21:47:55.000000000 -0400 | |
30095 | @@ -585,7 +585,7 @@ struct ath_hw_private_ops { | |
30096 | ||
30097 | /* ANI */ | |
30098 | void (*ani_cache_ini_regs)(struct ath_hw *ah); | |
30099 | -}; | |
30100 | +} __no_const; | |
30101 | ||
30102 | /** | |
30103 | * struct ath_hw_ops - callbacks used by hardware code and driver code | |
30104 | @@ -637,7 +637,7 @@ struct ath_hw_ops { | |
30105 | void (*antdiv_comb_conf_set)(struct ath_hw *ah, | |
30106 | struct ath_hw_antcomb_conf *antconf); | |
30107 | ||
30108 | -}; | |
30109 | +} __no_const; | |
30110 | ||
30111 | struct ath_nf_limits { | |
30112 | s16 max; | |
30113 | @@ -650,7 +650,7 @@ struct ath_nf_limits { | |
30114 | #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */ | |
30115 | ||
30116 | struct ath_hw { | |
30117 | - struct ath_ops reg_ops; | |
30118 | + ath_ops_no_const reg_ops; | |
30119 | ||
30120 | struct ieee80211_hw *hw; | |
30121 | struct ath_common common; | |
30122 | diff -urNp linux-3.0.3/drivers/net/wireless/ath/ath.h linux-3.0.3/drivers/net/wireless/ath/ath.h | |
30123 | --- linux-3.0.3/drivers/net/wireless/ath/ath.h 2011-07-21 22:17:23.000000000 -0400 | |
30124 | +++ linux-3.0.3/drivers/net/wireless/ath/ath.h 2011-08-23 21:47:55.000000000 -0400 | |
30125 | @@ -121,6 +121,7 @@ struct ath_ops { | |
30126 | void (*write_flush) (void *); | |
30127 | u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr); | |
30128 | }; | |
30129 | +typedef struct ath_ops __no_const ath_ops_no_const; | |
30130 | ||
30131 | struct ath_common; | |
30132 | struct ath_bus_ops; | |
30133 | diff -urNp linux-3.0.3/drivers/net/wireless/ipw2x00/ipw2100.c linux-3.0.3/drivers/net/wireless/ipw2x00/ipw2100.c | |
30134 | --- linux-3.0.3/drivers/net/wireless/ipw2x00/ipw2100.c 2011-07-21 22:17:23.000000000 -0400 | |
30135 | +++ linux-3.0.3/drivers/net/wireless/ipw2x00/ipw2100.c 2011-08-23 21:48:14.000000000 -0400 | |
30136 | @@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2 | |
30137 | int err; | |
30138 | DECLARE_SSID_BUF(ssid); | |
30139 | ||
30140 | + pax_track_stack(); | |
30141 | + | |
30142 | IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len)); | |
30143 | ||
30144 | if (ssid_len) | |
30145 | @@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210 | |
30146 | struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters; | |
30147 | int err; | |
30148 | ||
30149 | + pax_track_stack(); | |
30150 | + | |
30151 | IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n", | |
30152 | idx, keylen, len); | |
30153 | ||
30154 | diff -urNp linux-3.0.3/drivers/net/wireless/ipw2x00/libipw_rx.c linux-3.0.3/drivers/net/wireless/ipw2x00/libipw_rx.c | |
30155 | --- linux-3.0.3/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-07-21 22:17:23.000000000 -0400 | |
30156 | +++ linux-3.0.3/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-08-23 21:48:14.000000000 -0400 | |
30157 | @@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons | |
30158 | unsigned long flags; | |
30159 | DECLARE_SSID_BUF(ssid); | |
30160 | ||
30161 | + pax_track_stack(); | |
30162 | + | |
30163 | LIBIPW_DEBUG_SCAN("'%s' (%pM" | |
30164 | "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n", | |
30165 | print_ssid(ssid, info_element->data, info_element->len), | |
30166 | diff -urNp linux-3.0.3/drivers/net/wireless/iwlegacy/iwl3945-base.c linux-3.0.3/drivers/net/wireless/iwlegacy/iwl3945-base.c | |
30167 | --- linux-3.0.3/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-07-21 22:17:23.000000000 -0400 | |
30168 | +++ linux-3.0.3/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-08-23 21:47:55.000000000 -0400 | |
30169 | @@ -3962,7 +3962,9 @@ static int iwl3945_pci_probe(struct pci_ | |
30170 | */ | |
30171 | if (iwl3945_mod_params.disable_hw_scan) { | |
30172 | IWL_DEBUG_INFO(priv, "Disabling hw_scan\n"); | |
30173 | - iwl3945_hw_ops.hw_scan = NULL; | |
30174 | + pax_open_kernel(); | |
30175 | + *(void **)&iwl3945_hw_ops.hw_scan = NULL; | |
30176 | + pax_close_kernel(); | |
30177 | } | |
30178 | ||
30179 | IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n"); | |
30180 | diff -urNp linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-agn-rs.c | |
30181 | --- linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-07-21 22:17:23.000000000 -0400 | |
30182 | +++ linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-08-23 21:48:14.000000000 -0400 | |
30183 | @@ -910,6 +910,8 @@ static void rs_tx_status(void *priv_r, s | |
30184 | struct iwl_station_priv *sta_priv = (void *)sta->drv_priv; | |
30185 | struct iwl_rxon_context *ctx = sta_priv->common.ctx; | |
30186 | ||
30187 | + pax_track_stack(); | |
30188 | + | |
30189 | IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n"); | |
30190 | ||
30191 | /* Treat uninitialized rate scaling data same as non-existing. */ | |
30192 | @@ -2918,6 +2920,8 @@ static void rs_fill_link_cmd(struct iwl_ | |
30193 | container_of(lq_sta, struct iwl_station_priv, lq_sta); | |
30194 | struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq; | |
30195 | ||
30196 | + pax_track_stack(); | |
30197 | + | |
30198 | /* Override starting rate (index 0) if needed for debug purposes */ | |
30199 | rs_dbgfs_set_mcs(lq_sta, &new_rate, index); | |
30200 | ||
30201 | diff -urNp linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debugfs.c | |
30202 | --- linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-07-21 22:17:23.000000000 -0400 | |
30203 | +++ linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-08-23 21:48:14.000000000 -0400 | |
30204 | @@ -548,6 +548,8 @@ static ssize_t iwl_dbgfs_status_read(str | |
30205 | int pos = 0; | |
30206 | const size_t bufsz = sizeof(buf); | |
30207 | ||
30208 | + pax_track_stack(); | |
30209 | + | |
30210 | pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n", | |
30211 | test_bit(STATUS_HCMD_ACTIVE, &priv->status)); | |
30212 | pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n", | |
30213 | @@ -680,6 +682,8 @@ static ssize_t iwl_dbgfs_qos_read(struct | |
30214 | char buf[256 * NUM_IWL_RXON_CTX]; | |
30215 | const size_t bufsz = sizeof(buf); | |
30216 | ||
30217 | + pax_track_stack(); | |
30218 | + | |
30219 | for_each_context(priv, ctx) { | |
30220 | pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n", | |
30221 | ctx->ctxid); | |
30222 | diff -urNp linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debug.h linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debug.h | |
30223 | --- linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-07-21 22:17:23.000000000 -0400 | |
30224 | +++ linux-3.0.3/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-08-23 21:47:55.000000000 -0400 | |
30225 | @@ -68,8 +68,8 @@ do { | |
30226 | } while (0) | |
30227 | ||
30228 | #else | |
30229 | -#define IWL_DEBUG(__priv, level, fmt, args...) | |
30230 | -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) | |
30231 | +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0) | |
30232 | +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0) | |
30233 | static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level, | |
30234 | const void *p, u32 len) | |
30235 | {} | |
30236 | diff -urNp linux-3.0.3/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-3.0.3/drivers/net/wireless/iwmc3200wifi/debugfs.c | |
30237 | --- linux-3.0.3/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-07-21 22:17:23.000000000 -0400 | |
30238 | +++ linux-3.0.3/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-08-23 21:48:14.000000000 -0400 | |
30239 | @@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s | |
30240 | int buf_len = 512; | |
30241 | size_t len = 0; | |
30242 | ||
30243 | + pax_track_stack(); | |
30244 | + | |
30245 | if (*ppos != 0) | |
30246 | return 0; | |
30247 | if (count < sizeof(buf)) | |
30248 | diff -urNp linux-3.0.3/drivers/net/wireless/mac80211_hwsim.c linux-3.0.3/drivers/net/wireless/mac80211_hwsim.c | |
30249 | --- linux-3.0.3/drivers/net/wireless/mac80211_hwsim.c 2011-07-21 22:17:23.000000000 -0400 | |
30250 | +++ linux-3.0.3/drivers/net/wireless/mac80211_hwsim.c 2011-08-23 21:47:55.000000000 -0400 | |
30251 | @@ -1260,9 +1260,11 @@ static int __init init_mac80211_hwsim(vo | |
30252 | return -EINVAL; | |
30253 | ||
30254 | if (fake_hw_scan) { | |
30255 | - mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan; | |
30256 | - mac80211_hwsim_ops.sw_scan_start = NULL; | |
30257 | - mac80211_hwsim_ops.sw_scan_complete = NULL; | |
30258 | + pax_open_kernel(); | |
30259 | + *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan; | |
30260 | + *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL; | |
30261 | + *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL; | |
30262 | + pax_close_kernel(); | |
30263 | } | |
30264 | ||
30265 | spin_lock_init(&hwsim_radio_lock); | |
30266 | diff -urNp linux-3.0.3/drivers/net/wireless/rndis_wlan.c linux-3.0.3/drivers/net/wireless/rndis_wlan.c | |
30267 | --- linux-3.0.3/drivers/net/wireless/rndis_wlan.c 2011-07-21 22:17:23.000000000 -0400 | |
30268 | +++ linux-3.0.3/drivers/net/wireless/rndis_wlan.c 2011-08-23 21:47:55.000000000 -0400 | |
30269 | @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn | |
30270 | ||
30271 | netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold); | |
30272 | ||
30273 | - if (rts_threshold < 0 || rts_threshold > 2347) | |
30274 | + if (rts_threshold > 2347) | |
30275 | rts_threshold = 2347; | |
30276 | ||
30277 | tmp = cpu_to_le32(rts_threshold); | |
30278 | diff -urNp linux-3.0.3/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-3.0.3/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c | |
30279 | --- linux-3.0.3/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-07-21 22:17:23.000000000 -0400 | |
30280 | +++ linux-3.0.3/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-08-23 21:48:14.000000000 -0400 | |
30281 | @@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(st | |
30282 | u8 rfpath; | |
30283 | u8 num_total_rfpath = rtlphy->num_total_rfpath; | |
30284 | ||
30285 | + pax_track_stack(); | |
30286 | + | |
30287 | precommoncmdcnt = 0; | |
30288 | _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++, | |
30289 | MAX_PRECMD_CNT, | |
30290 | diff -urNp linux-3.0.3/drivers/net/wireless/wl1251/wl1251.h linux-3.0.3/drivers/net/wireless/wl1251/wl1251.h | |
30291 | --- linux-3.0.3/drivers/net/wireless/wl1251/wl1251.h 2011-07-21 22:17:23.000000000 -0400 | |
30292 | +++ linux-3.0.3/drivers/net/wireless/wl1251/wl1251.h 2011-08-23 21:47:55.000000000 -0400 | |
30293 | @@ -266,7 +266,7 @@ struct wl1251_if_operations { | |
30294 | void (*reset)(struct wl1251 *wl); | |
30295 | void (*enable_irq)(struct wl1251 *wl); | |
30296 | void (*disable_irq)(struct wl1251 *wl); | |
30297 | -}; | |
30298 | +} __no_const; | |
30299 | ||
30300 | struct wl1251 { | |
30301 | struct ieee80211_hw *hw; | |
30302 | diff -urNp linux-3.0.3/drivers/net/wireless/wl12xx/spi.c linux-3.0.3/drivers/net/wireless/wl12xx/spi.c | |
30303 | --- linux-3.0.3/drivers/net/wireless/wl12xx/spi.c 2011-07-21 22:17:23.000000000 -0400 | |
30304 | +++ linux-3.0.3/drivers/net/wireless/wl12xx/spi.c 2011-08-23 21:48:14.000000000 -0400 | |
30305 | @@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct | |
30306 | u32 chunk_len; | |
30307 | int i; | |
30308 | ||
30309 | + pax_track_stack(); | |
30310 | + | |
30311 | WARN_ON(len > WL1271_AGGR_BUFFER_SIZE); | |
30312 | ||
30313 | spi_message_init(&m); | |
30314 | diff -urNp linux-3.0.3/drivers/oprofile/buffer_sync.c linux-3.0.3/drivers/oprofile/buffer_sync.c | |
30315 | --- linux-3.0.3/drivers/oprofile/buffer_sync.c 2011-07-21 22:17:23.000000000 -0400 | |
30316 | +++ linux-3.0.3/drivers/oprofile/buffer_sync.c 2011-08-23 21:47:55.000000000 -0400 | |
30317 | @@ -343,7 +343,7 @@ static void add_data(struct op_entry *en | |
30318 | if (cookie == NO_COOKIE) | |
30319 | offset = pc; | |
30320 | if (cookie == INVALID_COOKIE) { | |
30321 | - atomic_inc(&oprofile_stats.sample_lost_no_mapping); | |
30322 | + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping); | |
30323 | offset = pc; | |
30324 | } | |
30325 | if (cookie != last_cookie) { | |
30326 | @@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct | |
30327 | /* add userspace sample */ | |
30328 | ||
30329 | if (!mm) { | |
30330 | - atomic_inc(&oprofile_stats.sample_lost_no_mm); | |
30331 | + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm); | |
30332 | return 0; | |
30333 | } | |
30334 | ||
30335 | cookie = lookup_dcookie(mm, s->eip, &offset); | |
30336 | ||
30337 | if (cookie == INVALID_COOKIE) { | |
30338 | - atomic_inc(&oprofile_stats.sample_lost_no_mapping); | |
30339 | + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping); | |
30340 | return 0; | |
30341 | } | |
30342 | ||
30343 | @@ -563,7 +563,7 @@ void sync_buffer(int cpu) | |
30344 | /* ignore backtraces if failed to add a sample */ | |
30345 | if (state == sb_bt_start) { | |
30346 | state = sb_bt_ignore; | |
30347 | - atomic_inc(&oprofile_stats.bt_lost_no_mapping); | |
30348 | + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping); | |
30349 | } | |
30350 | } | |
30351 | release_mm(mm); | |
30352 | diff -urNp linux-3.0.3/drivers/oprofile/event_buffer.c linux-3.0.3/drivers/oprofile/event_buffer.c | |
30353 | --- linux-3.0.3/drivers/oprofile/event_buffer.c 2011-07-21 22:17:23.000000000 -0400 | |
30354 | +++ linux-3.0.3/drivers/oprofile/event_buffer.c 2011-08-23 21:47:55.000000000 -0400 | |
30355 | @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value | |
30356 | } | |
30357 | ||
30358 | if (buffer_pos == buffer_size) { | |
30359 | - atomic_inc(&oprofile_stats.event_lost_overflow); | |
30360 | + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow); | |
30361 | return; | |
30362 | } | |
30363 | ||
30364 | diff -urNp linux-3.0.3/drivers/oprofile/oprof.c linux-3.0.3/drivers/oprofile/oprof.c | |
30365 | --- linux-3.0.3/drivers/oprofile/oprof.c 2011-07-21 22:17:23.000000000 -0400 | |
30366 | +++ linux-3.0.3/drivers/oprofile/oprof.c 2011-08-23 21:47:55.000000000 -0400 | |
30367 | @@ -110,7 +110,7 @@ static void switch_worker(struct work_st | |
30368 | if (oprofile_ops.switch_events()) | |
30369 | return; | |
30370 | ||
30371 | - atomic_inc(&oprofile_stats.multiplex_counter); | |
30372 | + atomic_inc_unchecked(&oprofile_stats.multiplex_counter); | |
30373 | start_switch_worker(); | |
30374 | } | |
30375 | ||
30376 | diff -urNp linux-3.0.3/drivers/oprofile/oprofilefs.c linux-3.0.3/drivers/oprofile/oprofilefs.c | |
30377 | --- linux-3.0.3/drivers/oprofile/oprofilefs.c 2011-07-21 22:17:23.000000000 -0400 | |
30378 | +++ linux-3.0.3/drivers/oprofile/oprofilefs.c 2011-08-23 21:47:55.000000000 -0400 | |
30379 | @@ -186,7 +186,7 @@ static const struct file_operations atom | |
30380 | ||
30381 | ||
30382 | int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root, | |
30383 | - char const *name, atomic_t *val) | |
30384 | + char const *name, atomic_unchecked_t *val) | |
30385 | { | |
30386 | return __oprofilefs_create_file(sb, root, name, | |
30387 | &atomic_ro_fops, 0444, val); | |
30388 | diff -urNp linux-3.0.3/drivers/oprofile/oprofile_stats.c linux-3.0.3/drivers/oprofile/oprofile_stats.c | |
30389 | --- linux-3.0.3/drivers/oprofile/oprofile_stats.c 2011-07-21 22:17:23.000000000 -0400 | |
30390 | +++ linux-3.0.3/drivers/oprofile/oprofile_stats.c 2011-08-23 21:47:55.000000000 -0400 | |
30391 | @@ -30,11 +30,11 @@ void oprofile_reset_stats(void) | |
30392 | cpu_buf->sample_invalid_eip = 0; | |
30393 | } | |
30394 | ||
30395 | - atomic_set(&oprofile_stats.sample_lost_no_mm, 0); | |
30396 | - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0); | |
30397 | - atomic_set(&oprofile_stats.event_lost_overflow, 0); | |
30398 | - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0); | |
30399 | - atomic_set(&oprofile_stats.multiplex_counter, 0); | |
30400 | + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0); | |
30401 | + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0); | |
30402 | + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0); | |
30403 | + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0); | |
30404 | + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0); | |
30405 | } | |
30406 | ||
30407 | ||
30408 | diff -urNp linux-3.0.3/drivers/oprofile/oprofile_stats.h linux-3.0.3/drivers/oprofile/oprofile_stats.h | |
30409 | --- linux-3.0.3/drivers/oprofile/oprofile_stats.h 2011-07-21 22:17:23.000000000 -0400 | |
30410 | +++ linux-3.0.3/drivers/oprofile/oprofile_stats.h 2011-08-23 21:47:55.000000000 -0400 | |
30411 | @@ -13,11 +13,11 @@ | |
30412 | #include <asm/atomic.h> | |
30413 | ||
30414 | struct oprofile_stat_struct { | |
30415 | - atomic_t sample_lost_no_mm; | |
30416 | - atomic_t sample_lost_no_mapping; | |
30417 | - atomic_t bt_lost_no_mapping; | |
30418 | - atomic_t event_lost_overflow; | |
30419 | - atomic_t multiplex_counter; | |
30420 | + atomic_unchecked_t sample_lost_no_mm; | |
30421 | + atomic_unchecked_t sample_lost_no_mapping; | |
30422 | + atomic_unchecked_t bt_lost_no_mapping; | |
30423 | + atomic_unchecked_t event_lost_overflow; | |
30424 | + atomic_unchecked_t multiplex_counter; | |
30425 | }; | |
30426 | ||
30427 | extern struct oprofile_stat_struct oprofile_stats; | |
30428 | diff -urNp linux-3.0.3/drivers/parport/procfs.c linux-3.0.3/drivers/parport/procfs.c | |
30429 | --- linux-3.0.3/drivers/parport/procfs.c 2011-07-21 22:17:23.000000000 -0400 | |
30430 | +++ linux-3.0.3/drivers/parport/procfs.c 2011-08-23 21:47:55.000000000 -0400 | |
30431 | @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t | |
30432 | ||
30433 | *ppos += len; | |
30434 | ||
30435 | - return copy_to_user(result, buffer, len) ? -EFAULT : 0; | |
30436 | + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0; | |
30437 | } | |
30438 | ||
30439 | #ifdef CONFIG_PARPORT_1284 | |
30440 | @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table | |
30441 | ||
30442 | *ppos += len; | |
30443 | ||
30444 | - return copy_to_user (result, buffer, len) ? -EFAULT : 0; | |
30445 | + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0; | |
30446 | } | |
30447 | #endif /* IEEE1284.3 support. */ | |
30448 | ||
30449 | diff -urNp linux-3.0.3/drivers/pci/hotplug/cpci_hotplug.h linux-3.0.3/drivers/pci/hotplug/cpci_hotplug.h | |
30450 | --- linux-3.0.3/drivers/pci/hotplug/cpci_hotplug.h 2011-07-21 22:17:23.000000000 -0400 | |
30451 | +++ linux-3.0.3/drivers/pci/hotplug/cpci_hotplug.h 2011-08-23 21:47:55.000000000 -0400 | |
30452 | @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops { | |
30453 | int (*hardware_test) (struct slot* slot, u32 value); | |
30454 | u8 (*get_power) (struct slot* slot); | |
30455 | int (*set_power) (struct slot* slot, int value); | |
30456 | -}; | |
30457 | +} __no_const; | |
30458 | ||
30459 | struct cpci_hp_controller { | |
30460 | unsigned int irq; | |
30461 | diff -urNp linux-3.0.3/drivers/pci/hotplug/cpqphp_nvram.c linux-3.0.3/drivers/pci/hotplug/cpqphp_nvram.c | |
30462 | --- linux-3.0.3/drivers/pci/hotplug/cpqphp_nvram.c 2011-07-21 22:17:23.000000000 -0400 | |
30463 | +++ linux-3.0.3/drivers/pci/hotplug/cpqphp_nvram.c 2011-08-23 21:47:55.000000000 -0400 | |
30464 | @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_ | |
30465 | ||
30466 | void compaq_nvram_init (void __iomem *rom_start) | |
30467 | { | |
30468 | + | |
30469 | +#ifndef CONFIG_PAX_KERNEXEC | |
30470 | if (rom_start) { | |
30471 | compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR); | |
30472 | } | |
30473 | +#endif | |
30474 | + | |
30475 | dbg("int15 entry = %p\n", compaq_int15_entry_point); | |
30476 | ||
30477 | /* initialize our int15 lock */ | |
30478 | diff -urNp linux-3.0.3/drivers/pci/pcie/aspm.c linux-3.0.3/drivers/pci/pcie/aspm.c | |
30479 | --- linux-3.0.3/drivers/pci/pcie/aspm.c 2011-07-21 22:17:23.000000000 -0400 | |
30480 | +++ linux-3.0.3/drivers/pci/pcie/aspm.c 2011-08-23 21:47:55.000000000 -0400 | |
30481 | @@ -27,9 +27,9 @@ | |
30482 | #define MODULE_PARAM_PREFIX "pcie_aspm." | |
30483 | ||
30484 | /* Note: those are not register definitions */ | |
30485 | -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */ | |
30486 | -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */ | |
30487 | -#define ASPM_STATE_L1 (4) /* L1 state */ | |
30488 | +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */ | |
30489 | +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */ | |
30490 | +#define ASPM_STATE_L1 (4U) /* L1 state */ | |
30491 | #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW) | |
30492 | #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1) | |
30493 | ||
30494 | diff -urNp linux-3.0.3/drivers/pci/probe.c linux-3.0.3/drivers/pci/probe.c | |
30495 | --- linux-3.0.3/drivers/pci/probe.c 2011-07-21 22:17:23.000000000 -0400 | |
30496 | +++ linux-3.0.3/drivers/pci/probe.c 2011-08-23 21:47:55.000000000 -0400 | |
30497 | @@ -129,7 +129,7 @@ int __pci_read_base(struct pci_dev *dev, | |
30498 | u32 l, sz, mask; | |
30499 | u16 orig_cmd; | |
30500 | ||
30501 | - mask = type ? PCI_ROM_ADDRESS_MASK : ~0; | |
30502 | + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0; | |
30503 | ||
30504 | if (!dev->mmio_always_on) { | |
30505 | pci_read_config_word(dev, PCI_COMMAND, &orig_cmd); | |
30506 | diff -urNp linux-3.0.3/drivers/pci/proc.c linux-3.0.3/drivers/pci/proc.c | |
30507 | --- linux-3.0.3/drivers/pci/proc.c 2011-07-21 22:17:23.000000000 -0400 | |
30508 | +++ linux-3.0.3/drivers/pci/proc.c 2011-08-23 21:48:14.000000000 -0400 | |
30509 | @@ -476,7 +476,16 @@ static const struct file_operations proc | |
30510 | static int __init pci_proc_init(void) | |
30511 | { | |
30512 | struct pci_dev *dev = NULL; | |
30513 | + | |
30514 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
30515 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
30516 | + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL); | |
30517 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
30518 | + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL); | |
30519 | +#endif | |
30520 | +#else | |
30521 | proc_bus_pci_dir = proc_mkdir("bus/pci", NULL); | |
30522 | +#endif | |
30523 | proc_create("devices", 0, proc_bus_pci_dir, | |
30524 | &proc_bus_pci_dev_operations); | |
30525 | proc_initialized = 1; | |
30526 | diff -urNp linux-3.0.3/drivers/pci/xen-pcifront.c linux-3.0.3/drivers/pci/xen-pcifront.c | |
30527 | --- linux-3.0.3/drivers/pci/xen-pcifront.c 2011-07-21 22:17:23.000000000 -0400 | |
30528 | +++ linux-3.0.3/drivers/pci/xen-pcifront.c 2011-08-23 21:48:14.000000000 -0400 | |
30529 | @@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_ | |
30530 | struct pcifront_sd *sd = bus->sysdata; | |
30531 | struct pcifront_device *pdev = pcifront_get_pdev(sd); | |
30532 | ||
30533 | + pax_track_stack(); | |
30534 | + | |
30535 | if (verbose_request) | |
30536 | dev_info(&pdev->xdev->dev, | |
30537 | "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n", | |
30538 | @@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci | |
30539 | struct pcifront_sd *sd = bus->sysdata; | |
30540 | struct pcifront_device *pdev = pcifront_get_pdev(sd); | |
30541 | ||
30542 | + pax_track_stack(); | |
30543 | + | |
30544 | if (verbose_request) | |
30545 | dev_info(&pdev->xdev->dev, | |
30546 | "write dev=%04x:%02x:%02x.%01x - " | |
30547 | @@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru | |
30548 | struct pcifront_device *pdev = pcifront_get_pdev(sd); | |
30549 | struct msi_desc *entry; | |
30550 | ||
30551 | + pax_track_stack(); | |
30552 | + | |
30553 | if (nvec > SH_INFO_MAX_VEC) { | |
30554 | dev_err(&dev->dev, "too much vector for pci frontend: %x." | |
30555 | " Increase SH_INFO_MAX_VEC.\n", nvec); | |
30556 | @@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st | |
30557 | struct pcifront_sd *sd = dev->bus->sysdata; | |
30558 | struct pcifront_device *pdev = pcifront_get_pdev(sd); | |
30559 | ||
30560 | + pax_track_stack(); | |
30561 | + | |
30562 | err = do_pci_op(pdev, &op); | |
30563 | ||
30564 | /* What should do for error ? */ | |
30565 | @@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc | |
30566 | struct pcifront_sd *sd = dev->bus->sysdata; | |
30567 | struct pcifront_device *pdev = pcifront_get_pdev(sd); | |
30568 | ||
30569 | + pax_track_stack(); | |
30570 | + | |
30571 | err = do_pci_op(pdev, &op); | |
30572 | if (likely(!err)) { | |
30573 | vector[0] = op.value; | |
30574 | diff -urNp linux-3.0.3/drivers/platform/x86/thinkpad_acpi.c linux-3.0.3/drivers/platform/x86/thinkpad_acpi.c | |
30575 | --- linux-3.0.3/drivers/platform/x86/thinkpad_acpi.c 2011-07-21 22:17:23.000000000 -0400 | |
30576 | +++ linux-3.0.3/drivers/platform/x86/thinkpad_acpi.c 2011-08-23 21:47:55.000000000 -0400 | |
30577 | @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void) | |
30578 | return 0; | |
30579 | } | |
30580 | ||
30581 | -void static hotkey_mask_warn_incomplete_mask(void) | |
30582 | +static void hotkey_mask_warn_incomplete_mask(void) | |
30583 | { | |
30584 | /* log only what the user can fix... */ | |
30585 | const u32 wantedmask = hotkey_driver_mask & | |
30586 | diff -urNp linux-3.0.3/drivers/pnp/pnpbios/bioscalls.c linux-3.0.3/drivers/pnp/pnpbios/bioscalls.c | |
30587 | --- linux-3.0.3/drivers/pnp/pnpbios/bioscalls.c 2011-07-21 22:17:23.000000000 -0400 | |
30588 | +++ linux-3.0.3/drivers/pnp/pnpbios/bioscalls.c 2011-08-23 21:47:55.000000000 -0400 | |
30589 | @@ -59,7 +59,7 @@ do { \ | |
30590 | set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \ | |
30591 | } while(0) | |
30592 | ||
30593 | -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092, | |
30594 | +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093, | |
30595 | (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1); | |
30596 | ||
30597 | /* | |
30598 | @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func | |
30599 | ||
30600 | cpu = get_cpu(); | |
30601 | save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8]; | |
30602 | + | |
30603 | + pax_open_kernel(); | |
30604 | get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc; | |
30605 | + pax_close_kernel(); | |
30606 | ||
30607 | /* On some boxes IRQ's during PnP BIOS calls are deadly. */ | |
30608 | spin_lock_irqsave(&pnp_bios_lock, flags); | |
30609 | @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func | |
30610 | :"memory"); | |
30611 | spin_unlock_irqrestore(&pnp_bios_lock, flags); | |
30612 | ||
30613 | + pax_open_kernel(); | |
30614 | get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40; | |
30615 | + pax_close_kernel(); | |
30616 | + | |
30617 | put_cpu(); | |
30618 | ||
30619 | /* If we get here and this is set then the PnP BIOS faulted on us. */ | |
30620 | @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n | |
30621 | return status; | |
30622 | } | |
30623 | ||
30624 | -void pnpbios_calls_init(union pnp_bios_install_struct *header) | |
30625 | +void __init pnpbios_calls_init(union pnp_bios_install_struct *header) | |
30626 | { | |
30627 | int i; | |
30628 | ||
30629 | @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i | |
30630 | pnp_bios_callpoint.offset = header->fields.pm16offset; | |
30631 | pnp_bios_callpoint.segment = PNP_CS16; | |
30632 | ||
30633 | + pax_open_kernel(); | |
30634 | + | |
30635 | for_each_possible_cpu(i) { | |
30636 | struct desc_struct *gdt = get_cpu_gdt_table(i); | |
30637 | if (!gdt) | |
30638 | @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i | |
30639 | set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS], | |
30640 | (unsigned long)__va(header->fields.pm16dseg)); | |
30641 | } | |
30642 | + | |
30643 | + pax_close_kernel(); | |
30644 | } | |
30645 | diff -urNp linux-3.0.3/drivers/pnp/resource.c linux-3.0.3/drivers/pnp/resource.c | |
30646 | --- linux-3.0.3/drivers/pnp/resource.c 2011-07-21 22:17:23.000000000 -0400 | |
30647 | +++ linux-3.0.3/drivers/pnp/resource.c 2011-08-23 21:47:55.000000000 -0400 | |
30648 | @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s | |
30649 | return 1; | |
30650 | ||
30651 | /* check if the resource is valid */ | |
30652 | - if (*irq < 0 || *irq > 15) | |
30653 | + if (*irq > 15) | |
30654 | return 0; | |
30655 | ||
30656 | /* check if the resource is reserved */ | |
30657 | @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s | |
30658 | return 1; | |
30659 | ||
30660 | /* check if the resource is valid */ | |
30661 | - if (*dma < 0 || *dma == 4 || *dma > 7) | |
30662 | + if (*dma == 4 || *dma > 7) | |
30663 | return 0; | |
30664 | ||
30665 | /* check if the resource is reserved */ | |
30666 | diff -urNp linux-3.0.3/drivers/power/bq27x00_battery.c linux-3.0.3/drivers/power/bq27x00_battery.c | |
30667 | --- linux-3.0.3/drivers/power/bq27x00_battery.c 2011-07-21 22:17:23.000000000 -0400 | |
30668 | +++ linux-3.0.3/drivers/power/bq27x00_battery.c 2011-08-23 21:47:55.000000000 -0400 | |
30669 | @@ -67,7 +67,7 @@ | |
30670 | struct bq27x00_device_info; | |
30671 | struct bq27x00_access_methods { | |
30672 | int (*read)(struct bq27x00_device_info *di, u8 reg, bool single); | |
30673 | -}; | |
30674 | +} __no_const; | |
30675 | ||
30676 | enum bq27x00_chip { BQ27000, BQ27500 }; | |
30677 | ||
30678 | diff -urNp linux-3.0.3/drivers/regulator/max8660.c linux-3.0.3/drivers/regulator/max8660.c | |
30679 | --- linux-3.0.3/drivers/regulator/max8660.c 2011-07-21 22:17:23.000000000 -0400 | |
30680 | +++ linux-3.0.3/drivers/regulator/max8660.c 2011-08-23 21:47:55.000000000 -0400 | |
30681 | @@ -383,8 +383,10 @@ static int __devinit max8660_probe(struc | |
30682 | max8660->shadow_regs[MAX8660_OVER1] = 5; | |
30683 | } else { | |
30684 | /* Otherwise devices can be toggled via software */ | |
30685 | - max8660_dcdc_ops.enable = max8660_dcdc_enable; | |
30686 | - max8660_dcdc_ops.disable = max8660_dcdc_disable; | |
30687 | + pax_open_kernel(); | |
30688 | + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable; | |
30689 | + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable; | |
30690 | + pax_close_kernel(); | |
30691 | } | |
30692 | ||
30693 | /* | |
30694 | diff -urNp linux-3.0.3/drivers/regulator/mc13892-regulator.c linux-3.0.3/drivers/regulator/mc13892-regulator.c | |
30695 | --- linux-3.0.3/drivers/regulator/mc13892-regulator.c 2011-07-21 22:17:23.000000000 -0400 | |
30696 | +++ linux-3.0.3/drivers/regulator/mc13892-regulator.c 2011-08-23 21:47:55.000000000 -0400 | |
30697 | @@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_p | |
30698 | } | |
30699 | mc13xxx_unlock(mc13892); | |
30700 | ||
30701 | - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode | |
30702 | + pax_open_kernel(); | |
30703 | + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode | |
30704 | = mc13892_vcam_set_mode; | |
30705 | - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode | |
30706 | + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode | |
30707 | = mc13892_vcam_get_mode; | |
30708 | + pax_close_kernel(); | |
30709 | for (i = 0; i < pdata->num_regulators; i++) { | |
30710 | init_data = &pdata->regulators[i]; | |
30711 | priv->regulators[i] = regulator_register( | |
30712 | diff -urNp linux-3.0.3/drivers/rtc/rtc-dev.c linux-3.0.3/drivers/rtc/rtc-dev.c | |
30713 | --- linux-3.0.3/drivers/rtc/rtc-dev.c 2011-07-21 22:17:23.000000000 -0400 | |
30714 | +++ linux-3.0.3/drivers/rtc/rtc-dev.c 2011-08-23 21:48:14.000000000 -0400 | |
30715 | @@ -14,6 +14,7 @@ | |
30716 | #include <linux/module.h> | |
30717 | #include <linux/rtc.h> | |
30718 | #include <linux/sched.h> | |
30719 | +#include <linux/grsecurity.h> | |
30720 | #include "rtc-core.h" | |
30721 | ||
30722 | static dev_t rtc_devt; | |
30723 | @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f | |
30724 | if (copy_from_user(&tm, uarg, sizeof(tm))) | |
30725 | return -EFAULT; | |
30726 | ||
30727 | + gr_log_timechange(); | |
30728 | + | |
30729 | return rtc_set_time(rtc, &tm); | |
30730 | ||
30731 | case RTC_PIE_ON: | |
30732 | diff -urNp linux-3.0.3/drivers/scsi/aacraid/aacraid.h linux-3.0.3/drivers/scsi/aacraid/aacraid.h | |
30733 | --- linux-3.0.3/drivers/scsi/aacraid/aacraid.h 2011-07-21 22:17:23.000000000 -0400 | |
30734 | +++ linux-3.0.3/drivers/scsi/aacraid/aacraid.h 2011-08-23 21:47:55.000000000 -0400 | |
30735 | @@ -492,7 +492,7 @@ struct adapter_ops | |
30736 | int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd); | |
30737 | /* Administrative operations */ | |
30738 | int (*adapter_comm)(struct aac_dev * dev, int comm); | |
30739 | -}; | |
30740 | +} __no_const; | |
30741 | ||
30742 | /* | |
30743 | * Define which interrupt handler needs to be installed | |
30744 | diff -urNp linux-3.0.3/drivers/scsi/aacraid/commctrl.c linux-3.0.3/drivers/scsi/aacraid/commctrl.c | |
30745 | --- linux-3.0.3/drivers/scsi/aacraid/commctrl.c 2011-07-21 22:17:23.000000000 -0400 | |
30746 | +++ linux-3.0.3/drivers/scsi/aacraid/commctrl.c 2011-08-23 21:48:14.000000000 -0400 | |
30747 | @@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d | |
30748 | u32 actual_fibsize64, actual_fibsize = 0; | |
30749 | int i; | |
30750 | ||
30751 | + pax_track_stack(); | |
30752 | ||
30753 | if (dev->in_reset) { | |
30754 | dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n")); | |
30755 | diff -urNp linux-3.0.3/drivers/scsi/bfa/bfad.c linux-3.0.3/drivers/scsi/bfa/bfad.c | |
30756 | --- linux-3.0.3/drivers/scsi/bfa/bfad.c 2011-07-21 22:17:23.000000000 -0400 | |
30757 | +++ linux-3.0.3/drivers/scsi/bfa/bfad.c 2011-08-23 21:48:14.000000000 -0400 | |
30758 | @@ -1032,6 +1032,8 @@ bfad_start_ops(struct bfad_s *bfad) { | |
30759 | struct bfad_vport_s *vport, *vport_new; | |
30760 | struct bfa_fcs_driver_info_s driver_info; | |
30761 | ||
30762 | + pax_track_stack(); | |
30763 | + | |
30764 | /* Fill the driver_info info to fcs*/ | |
30765 | memset(&driver_info, 0, sizeof(driver_info)); | |
30766 | strncpy(driver_info.version, BFAD_DRIVER_VERSION, | |
30767 | diff -urNp linux-3.0.3/drivers/scsi/bfa/bfa_fcs_lport.c linux-3.0.3/drivers/scsi/bfa/bfa_fcs_lport.c | |
30768 | --- linux-3.0.3/drivers/scsi/bfa/bfa_fcs_lport.c 2011-07-21 22:17:23.000000000 -0400 | |
30769 | +++ linux-3.0.3/drivers/scsi/bfa/bfa_fcs_lport.c 2011-08-23 21:48:14.000000000 -0400 | |
30770 | @@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc | |
30771 | u16 len, count; | |
30772 | u16 templen; | |
30773 | ||
30774 | + pax_track_stack(); | |
30775 | + | |
30776 | /* | |
30777 | * get hba attributes | |
30778 | */ | |
30779 | @@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block( | |
30780 | u8 count = 0; | |
30781 | u16 templen; | |
30782 | ||
30783 | + pax_track_stack(); | |
30784 | + | |
30785 | /* | |
30786 | * get port attributes | |
30787 | */ | |
30788 | diff -urNp linux-3.0.3/drivers/scsi/bfa/bfa_fcs_rport.c linux-3.0.3/drivers/scsi/bfa/bfa_fcs_rport.c | |
30789 | --- linux-3.0.3/drivers/scsi/bfa/bfa_fcs_rport.c 2011-07-21 22:17:23.000000000 -0400 | |
30790 | +++ linux-3.0.3/drivers/scsi/bfa/bfa_fcs_rport.c 2011-08-23 21:48:14.000000000 -0400 | |
30791 | @@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc | |
30792 | struct fc_rpsc_speed_info_s speeds; | |
30793 | struct bfa_port_attr_s pport_attr; | |
30794 | ||
30795 | + pax_track_stack(); | |
30796 | + | |
30797 | bfa_trc(port->fcs, rx_fchs->s_id); | |
30798 | bfa_trc(port->fcs, rx_fchs->d_id); | |
30799 | ||
30800 | diff -urNp linux-3.0.3/drivers/scsi/bfa/bfa.h linux-3.0.3/drivers/scsi/bfa/bfa.h | |
30801 | --- linux-3.0.3/drivers/scsi/bfa/bfa.h 2011-07-21 22:17:23.000000000 -0400 | |
30802 | +++ linux-3.0.3/drivers/scsi/bfa/bfa.h 2011-08-23 21:47:55.000000000 -0400 | |
30803 | @@ -238,7 +238,7 @@ struct bfa_hwif_s { | |
30804 | u32 *nvecs, u32 *maxvec); | |
30805 | void (*hw_msix_get_rme_range) (struct bfa_s *bfa, u32 *start, | |
30806 | u32 *end); | |
30807 | -}; | |
30808 | +} __no_const; | |
30809 | typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status); | |
30810 | ||
30811 | struct bfa_iocfc_s { | |
30812 | diff -urNp linux-3.0.3/drivers/scsi/bfa/bfa_ioc.h linux-3.0.3/drivers/scsi/bfa/bfa_ioc.h | |
30813 | --- linux-3.0.3/drivers/scsi/bfa/bfa_ioc.h 2011-07-21 22:17:23.000000000 -0400 | |
30814 | +++ linux-3.0.3/drivers/scsi/bfa/bfa_ioc.h 2011-08-23 21:47:55.000000000 -0400 | |
30815 | @@ -196,7 +196,7 @@ struct bfa_ioc_cbfn_s { | |
30816 | bfa_ioc_disable_cbfn_t disable_cbfn; | |
30817 | bfa_ioc_hbfail_cbfn_t hbfail_cbfn; | |
30818 | bfa_ioc_reset_cbfn_t reset_cbfn; | |
30819 | -}; | |
30820 | +} __no_const; | |
30821 | ||
30822 | /* | |
30823 | * Heartbeat failure notification queue element. | |
30824 | @@ -268,7 +268,7 @@ struct bfa_ioc_hwif_s { | |
30825 | void (*ioc_sync_leave) (struct bfa_ioc_s *ioc); | |
30826 | void (*ioc_sync_ack) (struct bfa_ioc_s *ioc); | |
30827 | bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc); | |
30828 | -}; | |
30829 | +} __no_const; | |
30830 | ||
30831 | #define bfa_ioc_pcifn(__ioc) ((__ioc)->pcidev.pci_func) | |
30832 | #define bfa_ioc_devid(__ioc) ((__ioc)->pcidev.device_id) | |
30833 | diff -urNp linux-3.0.3/drivers/scsi/BusLogic.c linux-3.0.3/drivers/scsi/BusLogic.c | |
30834 | --- linux-3.0.3/drivers/scsi/BusLogic.c 2011-07-21 22:17:23.000000000 -0400 | |
30835 | +++ linux-3.0.3/drivers/scsi/BusLogic.c 2011-08-23 21:48:14.000000000 -0400 | |
30836 | @@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla | |
30837 | static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter | |
30838 | *PrototypeHostAdapter) | |
30839 | { | |
30840 | + pax_track_stack(); | |
30841 | + | |
30842 | /* | |
30843 | If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint | |
30844 | Host Adapters; otherwise, default to the standard ISA MultiMaster probe. | |
30845 | diff -urNp linux-3.0.3/drivers/scsi/dpt_i2o.c linux-3.0.3/drivers/scsi/dpt_i2o.c | |
30846 | --- linux-3.0.3/drivers/scsi/dpt_i2o.c 2011-07-21 22:17:23.000000000 -0400 | |
30847 | +++ linux-3.0.3/drivers/scsi/dpt_i2o.c 2011-08-23 21:48:14.000000000 -0400 | |
30848 | @@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p | |
30849 | dma_addr_t addr; | |
30850 | ulong flags = 0; | |
30851 | ||
30852 | + pax_track_stack(); | |
30853 | + | |
30854 | memset(&msg, 0, MAX_MESSAGE_SIZE*4); | |
30855 | // get user msg size in u32s | |
30856 | if(get_user(size, &user_msg[0])){ | |
30857 | @@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH | |
30858 | s32 rcode; | |
30859 | dma_addr_t addr; | |
30860 | ||
30861 | + pax_track_stack(); | |
30862 | + | |
30863 | memset(msg, 0 , sizeof(msg)); | |
30864 | len = scsi_bufflen(cmd); | |
30865 | direction = 0x00000000; | |
30866 | diff -urNp linux-3.0.3/drivers/scsi/eata.c linux-3.0.3/drivers/scsi/eata.c | |
30867 | --- linux-3.0.3/drivers/scsi/eata.c 2011-07-21 22:17:23.000000000 -0400 | |
30868 | +++ linux-3.0.3/drivers/scsi/eata.c 2011-08-23 21:48:14.000000000 -0400 | |
30869 | @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por | |
30870 | struct hostdata *ha; | |
30871 | char name[16]; | |
30872 | ||
30873 | + pax_track_stack(); | |
30874 | + | |
30875 | sprintf(name, "%s%d", driver_name, j); | |
30876 | ||
30877 | if (!request_region(port_base, REGION_SIZE, driver_name)) { | |
30878 | diff -urNp linux-3.0.3/drivers/scsi/fcoe/fcoe_ctlr.c linux-3.0.3/drivers/scsi/fcoe/fcoe_ctlr.c | |
30879 | --- linux-3.0.3/drivers/scsi/fcoe/fcoe_ctlr.c 2011-07-21 22:17:23.000000000 -0400 | |
30880 | +++ linux-3.0.3/drivers/scsi/fcoe/fcoe_ctlr.c 2011-08-23 21:48:14.000000000 -0400 | |
30881 | @@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe | |
30882 | } buf; | |
30883 | int rc; | |
30884 | ||
30885 | + pax_track_stack(); | |
30886 | + | |
30887 | fiph = (struct fip_header *)skb->data; | |
30888 | sub = fiph->fip_subcode; | |
30889 | ||
30890 | diff -urNp linux-3.0.3/drivers/scsi/gdth.c linux-3.0.3/drivers/scsi/gdth.c | |
30891 | --- linux-3.0.3/drivers/scsi/gdth.c 2011-07-21 22:17:23.000000000 -0400 | |
30892 | +++ linux-3.0.3/drivers/scsi/gdth.c 2011-08-23 21:48:14.000000000 -0400 | |
30893 | @@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg) | |
30894 | unsigned long flags; | |
30895 | gdth_ha_str *ha; | |
30896 | ||
30897 | + pax_track_stack(); | |
30898 | + | |
30899 | if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv))) | |
30900 | return -EFAULT; | |
30901 | ha = gdth_find_ha(ldrv.ionode); | |
30902 | @@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg | |
30903 | gdth_ha_str *ha; | |
30904 | int rval; | |
30905 | ||
30906 | + pax_track_stack(); | |
30907 | + | |
30908 | if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) || | |
30909 | res.number >= MAX_HDRIVES) | |
30910 | return -EFAULT; | |
30911 | @@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg, | |
30912 | gdth_ha_str *ha; | |
30913 | int rval; | |
30914 | ||
30915 | + pax_track_stack(); | |
30916 | + | |
30917 | if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general))) | |
30918 | return -EFAULT; | |
30919 | ha = gdth_find_ha(gen.ionode); | |
30920 | @@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha) | |
30921 | int i; | |
30922 | gdth_cmd_str gdtcmd; | |
30923 | char cmnd[MAX_COMMAND_SIZE]; | |
30924 | + | |
30925 | + pax_track_stack(); | |
30926 | + | |
30927 | memset(cmnd, 0xff, MAX_COMMAND_SIZE); | |
30928 | ||
30929 | TRACE2(("gdth_flush() hanum %d\n", ha->hanum)); | |
30930 | diff -urNp linux-3.0.3/drivers/scsi/gdth_proc.c linux-3.0.3/drivers/scsi/gdth_proc.c | |
30931 | --- linux-3.0.3/drivers/scsi/gdth_proc.c 2011-07-21 22:17:23.000000000 -0400 | |
30932 | +++ linux-3.0.3/drivers/scsi/gdth_proc.c 2011-08-23 21:48:14.000000000 -0400 | |
30933 | @@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi | |
30934 | u64 paddr; | |
30935 | ||
30936 | char cmnd[MAX_COMMAND_SIZE]; | |
30937 | + | |
30938 | + pax_track_stack(); | |
30939 | + | |
30940 | memset(cmnd, 0xff, 12); | |
30941 | memset(&gdtcmd, 0, sizeof(gdth_cmd_str)); | |
30942 | ||
30943 | @@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch | |
30944 | gdth_hget_str *phg; | |
30945 | char cmnd[MAX_COMMAND_SIZE]; | |
30946 | ||
30947 | + pax_track_stack(); | |
30948 | + | |
30949 | gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL); | |
30950 | estr = kmalloc(sizeof(*estr), GFP_KERNEL); | |
30951 | if (!gdtcmd || !estr) | |
30952 | diff -urNp linux-3.0.3/drivers/scsi/hosts.c linux-3.0.3/drivers/scsi/hosts.c | |
30953 | --- linux-3.0.3/drivers/scsi/hosts.c 2011-07-21 22:17:23.000000000 -0400 | |
30954 | +++ linux-3.0.3/drivers/scsi/hosts.c 2011-08-23 21:47:55.000000000 -0400 | |
30955 | @@ -42,7 +42,7 @@ | |
30956 | #include "scsi_logging.h" | |
30957 | ||
30958 | ||
30959 | -static atomic_t scsi_host_next_hn; /* host_no for next new host */ | |
30960 | +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */ | |
30961 | ||
30962 | ||
30963 | static void scsi_host_cls_release(struct device *dev) | |
30964 | @@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct | |
30965 | * subtract one because we increment first then return, but we need to | |
30966 | * know what the next host number was before increment | |
30967 | */ | |
30968 | - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1; | |
30969 | + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1; | |
30970 | shost->dma_channel = 0xff; | |
30971 | ||
30972 | /* These three are default values which can be overridden */ | |
30973 | diff -urNp linux-3.0.3/drivers/scsi/hpsa.c linux-3.0.3/drivers/scsi/hpsa.c | |
30974 | --- linux-3.0.3/drivers/scsi/hpsa.c 2011-07-21 22:17:23.000000000 -0400 | |
30975 | +++ linux-3.0.3/drivers/scsi/hpsa.c 2011-08-23 21:47:55.000000000 -0400 | |
30976 | @@ -498,7 +498,7 @@ static inline u32 next_command(struct ct | |
30977 | u32 a; | |
30978 | ||
30979 | if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant))) | |
30980 | - return h->access.command_completed(h); | |
30981 | + return h->access->command_completed(h); | |
30982 | ||
30983 | if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) { | |
30984 | a = *(h->reply_pool_head); /* Next cmd in ring buffer */ | |
30985 | @@ -2938,7 +2938,7 @@ static void start_io(struct ctlr_info *h | |
30986 | while (!list_empty(&h->reqQ)) { | |
30987 | c = list_entry(h->reqQ.next, struct CommandList, list); | |
30988 | /* can't do anything if fifo is full */ | |
30989 | - if ((h->access.fifo_full(h))) { | |
30990 | + if ((h->access->fifo_full(h))) { | |
30991 | dev_warn(&h->pdev->dev, "fifo full\n"); | |
30992 | break; | |
30993 | } | |
30994 | @@ -2948,7 +2948,7 @@ static void start_io(struct ctlr_info *h | |
30995 | h->Qdepth--; | |
30996 | ||
30997 | /* Tell the controller execute command */ | |
30998 | - h->access.submit_command(h, c); | |
30999 | + h->access->submit_command(h, c); | |
31000 | ||
31001 | /* Put job onto the completed Q */ | |
31002 | addQ(&h->cmpQ, c); | |
31003 | @@ -2957,17 +2957,17 @@ static void start_io(struct ctlr_info *h | |
31004 | ||
31005 | static inline unsigned long get_next_completion(struct ctlr_info *h) | |
31006 | { | |
31007 | - return h->access.command_completed(h); | |
31008 | + return h->access->command_completed(h); | |
31009 | } | |
31010 | ||
31011 | static inline bool interrupt_pending(struct ctlr_info *h) | |
31012 | { | |
31013 | - return h->access.intr_pending(h); | |
31014 | + return h->access->intr_pending(h); | |
31015 | } | |
31016 | ||
31017 | static inline long interrupt_not_for_us(struct ctlr_info *h) | |
31018 | { | |
31019 | - return (h->access.intr_pending(h) == 0) || | |
31020 | + return (h->access->intr_pending(h) == 0) || | |
31021 | (h->interrupts_enabled == 0); | |
31022 | } | |
31023 | ||
31024 | @@ -3857,7 +3857,7 @@ static int __devinit hpsa_pci_init(struc | |
31025 | if (prod_index < 0) | |
31026 | return -ENODEV; | |
31027 | h->product_name = products[prod_index].product_name; | |
31028 | - h->access = *(products[prod_index].access); | |
31029 | + h->access = products[prod_index].access; | |
31030 | ||
31031 | if (hpsa_board_disabled(h->pdev)) { | |
31032 | dev_warn(&h->pdev->dev, "controller appears to be disabled\n"); | |
31033 | @@ -4134,7 +4134,7 @@ reinit_after_soft_reset: | |
31034 | } | |
31035 | ||
31036 | /* make sure the board interrupts are off */ | |
31037 | - h->access.set_intr_mask(h, HPSA_INTR_OFF); | |
31038 | + h->access->set_intr_mask(h, HPSA_INTR_OFF); | |
31039 | ||
31040 | if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx)) | |
31041 | goto clean2; | |
31042 | @@ -4168,7 +4168,7 @@ reinit_after_soft_reset: | |
31043 | * fake ones to scoop up any residual completions. | |
31044 | */ | |
31045 | spin_lock_irqsave(&h->lock, flags); | |
31046 | - h->access.set_intr_mask(h, HPSA_INTR_OFF); | |
31047 | + h->access->set_intr_mask(h, HPSA_INTR_OFF); | |
31048 | spin_unlock_irqrestore(&h->lock, flags); | |
31049 | free_irq(h->intr[h->intr_mode], h); | |
31050 | rc = hpsa_request_irq(h, hpsa_msix_discard_completions, | |
31051 | @@ -4187,9 +4187,9 @@ reinit_after_soft_reset: | |
31052 | dev_info(&h->pdev->dev, "Board READY.\n"); | |
31053 | dev_info(&h->pdev->dev, | |
31054 | "Waiting for stale completions to drain.\n"); | |
31055 | - h->access.set_intr_mask(h, HPSA_INTR_ON); | |
31056 | + h->access->set_intr_mask(h, HPSA_INTR_ON); | |
31057 | msleep(10000); | |
31058 | - h->access.set_intr_mask(h, HPSA_INTR_OFF); | |
31059 | + h->access->set_intr_mask(h, HPSA_INTR_OFF); | |
31060 | ||
31061 | rc = controller_reset_failed(h->cfgtable); | |
31062 | if (rc) | |
31063 | @@ -4210,7 +4210,7 @@ reinit_after_soft_reset: | |
31064 | } | |
31065 | ||
31066 | /* Turn the interrupts on so we can service requests */ | |
31067 | - h->access.set_intr_mask(h, HPSA_INTR_ON); | |
31068 | + h->access->set_intr_mask(h, HPSA_INTR_ON); | |
31069 | ||
31070 | hpsa_hba_inquiry(h); | |
31071 | hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */ | |
31072 | @@ -4263,7 +4263,7 @@ static void hpsa_shutdown(struct pci_dev | |
31073 | * To write all data in the battery backed cache to disks | |
31074 | */ | |
31075 | hpsa_flush_cache(h); | |
31076 | - h->access.set_intr_mask(h, HPSA_INTR_OFF); | |
31077 | + h->access->set_intr_mask(h, HPSA_INTR_OFF); | |
31078 | free_irq(h->intr[h->intr_mode], h); | |
31079 | #ifdef CONFIG_PCI_MSI | |
31080 | if (h->msix_vector) | |
31081 | @@ -4426,7 +4426,7 @@ static __devinit void hpsa_enter_perform | |
31082 | return; | |
31083 | } | |
31084 | /* Change the access methods to the performant access methods */ | |
31085 | - h->access = SA5_performant_access; | |
31086 | + h->access = &SA5_performant_access; | |
31087 | h->transMethod = CFGTBL_Trans_Performant; | |
31088 | } | |
31089 | ||
31090 | diff -urNp linux-3.0.3/drivers/scsi/hpsa.h linux-3.0.3/drivers/scsi/hpsa.h | |
31091 | --- linux-3.0.3/drivers/scsi/hpsa.h 2011-08-23 21:44:40.000000000 -0400 | |
31092 | +++ linux-3.0.3/drivers/scsi/hpsa.h 2011-08-23 21:47:55.000000000 -0400 | |
31093 | @@ -73,7 +73,7 @@ struct ctlr_info { | |
31094 | unsigned int msix_vector; | |
31095 | unsigned int msi_vector; | |
31096 | int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */ | |
31097 | - struct access_method access; | |
31098 | + struct access_method *access; | |
31099 | ||
31100 | /* queue and queue Info */ | |
31101 | struct list_head reqQ; | |
31102 | diff -urNp linux-3.0.3/drivers/scsi/ips.h linux-3.0.3/drivers/scsi/ips.h | |
31103 | --- linux-3.0.3/drivers/scsi/ips.h 2011-07-21 22:17:23.000000000 -0400 | |
31104 | +++ linux-3.0.3/drivers/scsi/ips.h 2011-08-23 21:47:55.000000000 -0400 | |
31105 | @@ -1027,7 +1027,7 @@ typedef struct { | |
31106 | int (*intr)(struct ips_ha *); | |
31107 | void (*enableint)(struct ips_ha *); | |
31108 | uint32_t (*statupd)(struct ips_ha *); | |
31109 | -} ips_hw_func_t; | |
31110 | +} __no_const ips_hw_func_t; | |
31111 | ||
31112 | typedef struct ips_ha { | |
31113 | uint8_t ha_id[IPS_MAX_CHANNELS+1]; | |
31114 | diff -urNp linux-3.0.3/drivers/scsi/libfc/fc_exch.c linux-3.0.3/drivers/scsi/libfc/fc_exch.c | |
31115 | --- linux-3.0.3/drivers/scsi/libfc/fc_exch.c 2011-07-21 22:17:23.000000000 -0400 | |
31116 | +++ linux-3.0.3/drivers/scsi/libfc/fc_exch.c 2011-08-23 21:47:55.000000000 -0400 | |
31117 | @@ -105,12 +105,12 @@ struct fc_exch_mgr { | |
31118 | * all together if not used XXX | |
31119 | */ | |
31120 | struct { | |
31121 | - atomic_t no_free_exch; | |
31122 | - atomic_t no_free_exch_xid; | |
31123 | - atomic_t xid_not_found; | |
31124 | - atomic_t xid_busy; | |
31125 | - atomic_t seq_not_found; | |
31126 | - atomic_t non_bls_resp; | |
31127 | + atomic_unchecked_t no_free_exch; | |
31128 | + atomic_unchecked_t no_free_exch_xid; | |
31129 | + atomic_unchecked_t xid_not_found; | |
31130 | + atomic_unchecked_t xid_busy; | |
31131 | + atomic_unchecked_t seq_not_found; | |
31132 | + atomic_unchecked_t non_bls_resp; | |
31133 | } stats; | |
31134 | }; | |
31135 | ||
31136 | @@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc( | |
31137 | /* allocate memory for exchange */ | |
31138 | ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC); | |
31139 | if (!ep) { | |
31140 | - atomic_inc(&mp->stats.no_free_exch); | |
31141 | + atomic_inc_unchecked(&mp->stats.no_free_exch); | |
31142 | goto out; | |
31143 | } | |
31144 | memset(ep, 0, sizeof(*ep)); | |
31145 | @@ -761,7 +761,7 @@ out: | |
31146 | return ep; | |
31147 | err: | |
31148 | spin_unlock_bh(&pool->lock); | |
31149 | - atomic_inc(&mp->stats.no_free_exch_xid); | |
31150 | + atomic_inc_unchecked(&mp->stats.no_free_exch_xid); | |
31151 | mempool_free(ep, mp->ep_pool); | |
31152 | return NULL; | |
31153 | } | |
31154 | @@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look | |
31155 | xid = ntohs(fh->fh_ox_id); /* we originated exch */ | |
31156 | ep = fc_exch_find(mp, xid); | |
31157 | if (!ep) { | |
31158 | - atomic_inc(&mp->stats.xid_not_found); | |
31159 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31160 | reject = FC_RJT_OX_ID; | |
31161 | goto out; | |
31162 | } | |
31163 | @@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look | |
31164 | ep = fc_exch_find(mp, xid); | |
31165 | if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) { | |
31166 | if (ep) { | |
31167 | - atomic_inc(&mp->stats.xid_busy); | |
31168 | + atomic_inc_unchecked(&mp->stats.xid_busy); | |
31169 | reject = FC_RJT_RX_ID; | |
31170 | goto rel; | |
31171 | } | |
31172 | @@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look | |
31173 | } | |
31174 | xid = ep->xid; /* get our XID */ | |
31175 | } else if (!ep) { | |
31176 | - atomic_inc(&mp->stats.xid_not_found); | |
31177 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31178 | reject = FC_RJT_RX_ID; /* XID not found */ | |
31179 | goto out; | |
31180 | } | |
31181 | @@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look | |
31182 | } else { | |
31183 | sp = &ep->seq; | |
31184 | if (sp->id != fh->fh_seq_id) { | |
31185 | - atomic_inc(&mp->stats.seq_not_found); | |
31186 | + atomic_inc_unchecked(&mp->stats.seq_not_found); | |
31187 | reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */ | |
31188 | goto rel; | |
31189 | } | |
31190 | @@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct | |
31191 | ||
31192 | ep = fc_exch_find(mp, ntohs(fh->fh_ox_id)); | |
31193 | if (!ep) { | |
31194 | - atomic_inc(&mp->stats.xid_not_found); | |
31195 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31196 | goto out; | |
31197 | } | |
31198 | if (ep->esb_stat & ESB_ST_COMPLETE) { | |
31199 | - atomic_inc(&mp->stats.xid_not_found); | |
31200 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31201 | goto rel; | |
31202 | } | |
31203 | if (ep->rxid == FC_XID_UNKNOWN) | |
31204 | ep->rxid = ntohs(fh->fh_rx_id); | |
31205 | if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) { | |
31206 | - atomic_inc(&mp->stats.xid_not_found); | |
31207 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31208 | goto rel; | |
31209 | } | |
31210 | if (ep->did != ntoh24(fh->fh_s_id) && | |
31211 | ep->did != FC_FID_FLOGI) { | |
31212 | - atomic_inc(&mp->stats.xid_not_found); | |
31213 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31214 | goto rel; | |
31215 | } | |
31216 | sof = fr_sof(fp); | |
31217 | @@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct | |
31218 | sp->ssb_stat |= SSB_ST_RESP; | |
31219 | sp->id = fh->fh_seq_id; | |
31220 | } else if (sp->id != fh->fh_seq_id) { | |
31221 | - atomic_inc(&mp->stats.seq_not_found); | |
31222 | + atomic_inc_unchecked(&mp->stats.seq_not_found); | |
31223 | goto rel; | |
31224 | } | |
31225 | ||
31226 | @@ -1480,9 +1480,9 @@ static void fc_exch_recv_resp(struct fc_ | |
31227 | sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */ | |
31228 | ||
31229 | if (!sp) | |
31230 | - atomic_inc(&mp->stats.xid_not_found); | |
31231 | + atomic_inc_unchecked(&mp->stats.xid_not_found); | |
31232 | else | |
31233 | - atomic_inc(&mp->stats.non_bls_resp); | |
31234 | + atomic_inc_unchecked(&mp->stats.non_bls_resp); | |
31235 | ||
31236 | fc_frame_free(fp); | |
31237 | } | |
31238 | diff -urNp linux-3.0.3/drivers/scsi/libsas/sas_ata.c linux-3.0.3/drivers/scsi/libsas/sas_ata.c | |
31239 | --- linux-3.0.3/drivers/scsi/libsas/sas_ata.c 2011-07-21 22:17:23.000000000 -0400 | |
31240 | +++ linux-3.0.3/drivers/scsi/libsas/sas_ata.c 2011-08-23 21:47:55.000000000 -0400 | |
31241 | @@ -368,7 +368,7 @@ static struct ata_port_operations sas_sa | |
31242 | .postreset = ata_std_postreset, | |
31243 | .error_handler = ata_std_error_handler, | |
31244 | .post_internal_cmd = sas_ata_post_internal, | |
31245 | - .qc_defer = ata_std_qc_defer, | |
31246 | + .qc_defer = ata_std_qc_defer, | |
31247 | .qc_prep = ata_noop_qc_prep, | |
31248 | .qc_issue = sas_ata_qc_issue, | |
31249 | .qc_fill_rtf = sas_ata_qc_fill_rtf, | |
31250 | diff -urNp linux-3.0.3/drivers/scsi/lpfc/lpfc_debugfs.c linux-3.0.3/drivers/scsi/lpfc/lpfc_debugfs.c | |
31251 | --- linux-3.0.3/drivers/scsi/lpfc/lpfc_debugfs.c 2011-07-21 22:17:23.000000000 -0400 | |
31252 | +++ linux-3.0.3/drivers/scsi/lpfc/lpfc_debugfs.c 2011-08-23 21:48:14.000000000 -0400 | |
31253 | @@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_ | |
31254 | ||
31255 | #include <linux/debugfs.h> | |
31256 | ||
31257 | -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0); | |
31258 | +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0); | |
31259 | static unsigned long lpfc_debugfs_start_time = 0L; | |
31260 | ||
31261 | /* iDiag */ | |
31262 | @@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v | |
31263 | lpfc_debugfs_enable = 0; | |
31264 | ||
31265 | len = 0; | |
31266 | - index = (atomic_read(&vport->disc_trc_cnt) + 1) & | |
31267 | + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) & | |
31268 | (lpfc_debugfs_max_disc_trc - 1); | |
31269 | for (i = index; i < lpfc_debugfs_max_disc_trc; i++) { | |
31270 | dtp = vport->disc_trc + i; | |
31271 | @@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l | |
31272 | lpfc_debugfs_enable = 0; | |
31273 | ||
31274 | len = 0; | |
31275 | - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) & | |
31276 | + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) & | |
31277 | (lpfc_debugfs_max_slow_ring_trc - 1); | |
31278 | for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) { | |
31279 | dtp = phba->slow_ring_trc + i; | |
31280 | @@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf | |
31281 | uint32_t *ptr; | |
31282 | char buffer[1024]; | |
31283 | ||
31284 | + pax_track_stack(); | |
31285 | + | |
31286 | off = 0; | |
31287 | spin_lock_irq(&phba->hbalock); | |
31288 | ||
31289 | @@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport | |
31290 | !vport || !vport->disc_trc) | |
31291 | return; | |
31292 | ||
31293 | - index = atomic_inc_return(&vport->disc_trc_cnt) & | |
31294 | + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) & | |
31295 | (lpfc_debugfs_max_disc_trc - 1); | |
31296 | dtp = vport->disc_trc + index; | |
31297 | dtp->fmt = fmt; | |
31298 | dtp->data1 = data1; | |
31299 | dtp->data2 = data2; | |
31300 | dtp->data3 = data3; | |
31301 | - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt); | |
31302 | + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt); | |
31303 | dtp->jif = jiffies; | |
31304 | #endif | |
31305 | return; | |
31306 | @@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h | |
31307 | !phba || !phba->slow_ring_trc) | |
31308 | return; | |
31309 | ||
31310 | - index = atomic_inc_return(&phba->slow_ring_trc_cnt) & | |
31311 | + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) & | |
31312 | (lpfc_debugfs_max_slow_ring_trc - 1); | |
31313 | dtp = phba->slow_ring_trc + index; | |
31314 | dtp->fmt = fmt; | |
31315 | dtp->data1 = data1; | |
31316 | dtp->data2 = data2; | |
31317 | dtp->data3 = data3; | |
31318 | - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt); | |
31319 | + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt); | |
31320 | dtp->jif = jiffies; | |
31321 | #endif | |
31322 | return; | |
31323 | @@ -2606,7 +2608,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor | |
31324 | "slow_ring buffer\n"); | |
31325 | goto debug_failed; | |
31326 | } | |
31327 | - atomic_set(&phba->slow_ring_trc_cnt, 0); | |
31328 | + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0); | |
31329 | memset(phba->slow_ring_trc, 0, | |
31330 | (sizeof(struct lpfc_debugfs_trc) * | |
31331 | lpfc_debugfs_max_slow_ring_trc)); | |
31332 | @@ -2652,7 +2654,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor | |
31333 | "buffer\n"); | |
31334 | goto debug_failed; | |
31335 | } | |
31336 | - atomic_set(&vport->disc_trc_cnt, 0); | |
31337 | + atomic_set_unchecked(&vport->disc_trc_cnt, 0); | |
31338 | ||
31339 | snprintf(name, sizeof(name), "discovery_trace"); | |
31340 | vport->debug_disc_trc = | |
31341 | diff -urNp linux-3.0.3/drivers/scsi/lpfc/lpfc.h linux-3.0.3/drivers/scsi/lpfc/lpfc.h | |
31342 | --- linux-3.0.3/drivers/scsi/lpfc/lpfc.h 2011-07-21 22:17:23.000000000 -0400 | |
31343 | +++ linux-3.0.3/drivers/scsi/lpfc/lpfc.h 2011-08-23 21:47:55.000000000 -0400 | |
31344 | @@ -420,7 +420,7 @@ struct lpfc_vport { | |
31345 | struct dentry *debug_nodelist; | |
31346 | struct dentry *vport_debugfs_root; | |
31347 | struct lpfc_debugfs_trc *disc_trc; | |
31348 | - atomic_t disc_trc_cnt; | |
31349 | + atomic_unchecked_t disc_trc_cnt; | |
31350 | #endif | |
31351 | uint8_t stat_data_enabled; | |
31352 | uint8_t stat_data_blocked; | |
31353 | @@ -826,8 +826,8 @@ struct lpfc_hba { | |
31354 | struct timer_list fabric_block_timer; | |
31355 | unsigned long bit_flags; | |
31356 | #define FABRIC_COMANDS_BLOCKED 0 | |
31357 | - atomic_t num_rsrc_err; | |
31358 | - atomic_t num_cmd_success; | |
31359 | + atomic_unchecked_t num_rsrc_err; | |
31360 | + atomic_unchecked_t num_cmd_success; | |
31361 | unsigned long last_rsrc_error_time; | |
31362 | unsigned long last_ramp_down_time; | |
31363 | unsigned long last_ramp_up_time; | |
31364 | @@ -841,7 +841,7 @@ struct lpfc_hba { | |
31365 | struct dentry *debug_dumpDif; /* BlockGuard BPL*/ | |
31366 | struct dentry *debug_slow_ring_trc; | |
31367 | struct lpfc_debugfs_trc *slow_ring_trc; | |
31368 | - atomic_t slow_ring_trc_cnt; | |
31369 | + atomic_unchecked_t slow_ring_trc_cnt; | |
31370 | /* iDiag debugfs sub-directory */ | |
31371 | struct dentry *idiag_root; | |
31372 | struct dentry *idiag_pci_cfg; | |
31373 | diff -urNp linux-3.0.3/drivers/scsi/lpfc/lpfc_init.c linux-3.0.3/drivers/scsi/lpfc/lpfc_init.c | |
31374 | --- linux-3.0.3/drivers/scsi/lpfc/lpfc_init.c 2011-07-21 22:17:23.000000000 -0400 | |
31375 | +++ linux-3.0.3/drivers/scsi/lpfc/lpfc_init.c 2011-08-23 21:47:56.000000000 -0400 | |
31376 | @@ -9923,8 +9923,10 @@ lpfc_init(void) | |
31377 | printk(LPFC_COPYRIGHT "\n"); | |
31378 | ||
31379 | if (lpfc_enable_npiv) { | |
31380 | - lpfc_transport_functions.vport_create = lpfc_vport_create; | |
31381 | - lpfc_transport_functions.vport_delete = lpfc_vport_delete; | |
31382 | + pax_open_kernel(); | |
31383 | + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create; | |
31384 | + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete; | |
31385 | + pax_close_kernel(); | |
31386 | } | |
31387 | lpfc_transport_template = | |
31388 | fc_attach_transport(&lpfc_transport_functions); | |
31389 | diff -urNp linux-3.0.3/drivers/scsi/lpfc/lpfc_scsi.c linux-3.0.3/drivers/scsi/lpfc/lpfc_scsi.c | |
31390 | --- linux-3.0.3/drivers/scsi/lpfc/lpfc_scsi.c 2011-07-21 22:17:23.000000000 -0400 | |
31391 | +++ linux-3.0.3/drivers/scsi/lpfc/lpfc_scsi.c 2011-08-23 21:47:56.000000000 -0400 | |
31392 | @@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb | |
31393 | uint32_t evt_posted; | |
31394 | ||
31395 | spin_lock_irqsave(&phba->hbalock, flags); | |
31396 | - atomic_inc(&phba->num_rsrc_err); | |
31397 | + atomic_inc_unchecked(&phba->num_rsrc_err); | |
31398 | phba->last_rsrc_error_time = jiffies; | |
31399 | ||
31400 | if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) { | |
31401 | @@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor | |
31402 | unsigned long flags; | |
31403 | struct lpfc_hba *phba = vport->phba; | |
31404 | uint32_t evt_posted; | |
31405 | - atomic_inc(&phba->num_cmd_success); | |
31406 | + atomic_inc_unchecked(&phba->num_cmd_success); | |
31407 | ||
31408 | if (vport->cfg_lun_queue_depth <= queue_depth) | |
31409 | return; | |
31410 | @@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc | |
31411 | unsigned long num_rsrc_err, num_cmd_success; | |
31412 | int i; | |
31413 | ||
31414 | - num_rsrc_err = atomic_read(&phba->num_rsrc_err); | |
31415 | - num_cmd_success = atomic_read(&phba->num_cmd_success); | |
31416 | + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err); | |
31417 | + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success); | |
31418 | ||
31419 | vports = lpfc_create_vport_work_array(phba); | |
31420 | if (vports != NULL) | |
31421 | @@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc | |
31422 | } | |
31423 | } | |
31424 | lpfc_destroy_vport_work_array(phba, vports); | |
31425 | - atomic_set(&phba->num_rsrc_err, 0); | |
31426 | - atomic_set(&phba->num_cmd_success, 0); | |
31427 | + atomic_set_unchecked(&phba->num_rsrc_err, 0); | |
31428 | + atomic_set_unchecked(&phba->num_cmd_success, 0); | |
31429 | } | |
31430 | ||
31431 | /** | |
31432 | @@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h | |
31433 | } | |
31434 | } | |
31435 | lpfc_destroy_vport_work_array(phba, vports); | |
31436 | - atomic_set(&phba->num_rsrc_err, 0); | |
31437 | - atomic_set(&phba->num_cmd_success, 0); | |
31438 | + atomic_set_unchecked(&phba->num_rsrc_err, 0); | |
31439 | + atomic_set_unchecked(&phba->num_cmd_success, 0); | |
31440 | } | |
31441 | ||
31442 | /** | |
31443 | diff -urNp linux-3.0.3/drivers/scsi/megaraid/megaraid_mbox.c linux-3.0.3/drivers/scsi/megaraid/megaraid_mbox.c | |
31444 | --- linux-3.0.3/drivers/scsi/megaraid/megaraid_mbox.c 2011-07-21 22:17:23.000000000 -0400 | |
31445 | +++ linux-3.0.3/drivers/scsi/megaraid/megaraid_mbox.c 2011-08-23 21:48:14.000000000 -0400 | |
31446 | @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter | |
31447 | int rval; | |
31448 | int i; | |
31449 | ||
31450 | + pax_track_stack(); | |
31451 | + | |
31452 | // Allocate memory for the base list of scb for management module. | |
31453 | adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL); | |
31454 | ||
31455 | diff -urNp linux-3.0.3/drivers/scsi/osd/osd_initiator.c linux-3.0.3/drivers/scsi/osd/osd_initiator.c | |
31456 | --- linux-3.0.3/drivers/scsi/osd/osd_initiator.c 2011-07-21 22:17:23.000000000 -0400 | |
31457 | +++ linux-3.0.3/drivers/scsi/osd/osd_initiator.c 2011-08-23 21:48:14.000000000 -0400 | |
31458 | @@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st | |
31459 | int nelem = ARRAY_SIZE(get_attrs), a = 0; | |
31460 | int ret; | |
31461 | ||
31462 | + pax_track_stack(); | |
31463 | + | |
31464 | or = osd_start_request(od, GFP_KERNEL); | |
31465 | if (!or) | |
31466 | return -ENOMEM; | |
31467 | diff -urNp linux-3.0.3/drivers/scsi/pmcraid.c linux-3.0.3/drivers/scsi/pmcraid.c | |
31468 | --- linux-3.0.3/drivers/scsi/pmcraid.c 2011-08-23 21:44:40.000000000 -0400 | |
31469 | +++ linux-3.0.3/drivers/scsi/pmcraid.c 2011-08-23 21:47:56.000000000 -0400 | |
31470 | @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc | |
31471 | res->scsi_dev = scsi_dev; | |
31472 | scsi_dev->hostdata = res; | |
31473 | res->change_detected = 0; | |
31474 | - atomic_set(&res->read_failures, 0); | |
31475 | - atomic_set(&res->write_failures, 0); | |
31476 | + atomic_set_unchecked(&res->read_failures, 0); | |
31477 | + atomic_set_unchecked(&res->write_failures, 0); | |
31478 | rc = 0; | |
31479 | } | |
31480 | spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags); | |
31481 | @@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct | |
31482 | ||
31483 | /* If this was a SCSI read/write command keep count of errors */ | |
31484 | if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD) | |
31485 | - atomic_inc(&res->read_failures); | |
31486 | + atomic_inc_unchecked(&res->read_failures); | |
31487 | else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD) | |
31488 | - atomic_inc(&res->write_failures); | |
31489 | + atomic_inc_unchecked(&res->write_failures); | |
31490 | ||
31491 | if (!RES_IS_GSCSI(res->cfg_entry) && | |
31492 | masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) { | |
31493 | @@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck( | |
31494 | * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses | |
31495 | * hrrq_id assigned here in queuecommand | |
31496 | */ | |
31497 | - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) % | |
31498 | + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) % | |
31499 | pinstance->num_hrrq; | |
31500 | cmd->cmd_done = pmcraid_io_done; | |
31501 | ||
31502 | @@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough( | |
31503 | * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses | |
31504 | * hrrq_id assigned here in queuecommand | |
31505 | */ | |
31506 | - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) % | |
31507 | + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) % | |
31508 | pinstance->num_hrrq; | |
31509 | ||
31510 | if (request_size) { | |
31511 | @@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(stru | |
31512 | ||
31513 | pinstance = container_of(workp, struct pmcraid_instance, worker_q); | |
31514 | /* add resources only after host is added into system */ | |
31515 | - if (!atomic_read(&pinstance->expose_resources)) | |
31516 | + if (!atomic_read_unchecked(&pinstance->expose_resources)) | |
31517 | return; | |
31518 | ||
31519 | fw_version = be16_to_cpu(pinstance->inq_data->fw_version); | |
31520 | @@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instan | |
31521 | init_waitqueue_head(&pinstance->reset_wait_q); | |
31522 | ||
31523 | atomic_set(&pinstance->outstanding_cmds, 0); | |
31524 | - atomic_set(&pinstance->last_message_id, 0); | |
31525 | - atomic_set(&pinstance->expose_resources, 0); | |
31526 | + atomic_set_unchecked(&pinstance->last_message_id, 0); | |
31527 | + atomic_set_unchecked(&pinstance->expose_resources, 0); | |
31528 | ||
31529 | INIT_LIST_HEAD(&pinstance->free_res_q); | |
31530 | INIT_LIST_HEAD(&pinstance->used_res_q); | |
31531 | @@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe( | |
31532 | /* Schedule worker thread to handle CCN and take care of adding and | |
31533 | * removing devices to OS | |
31534 | */ | |
31535 | - atomic_set(&pinstance->expose_resources, 1); | |
31536 | + atomic_set_unchecked(&pinstance->expose_resources, 1); | |
31537 | schedule_work(&pinstance->worker_q); | |
31538 | return rc; | |
31539 | ||
31540 | diff -urNp linux-3.0.3/drivers/scsi/pmcraid.h linux-3.0.3/drivers/scsi/pmcraid.h | |
31541 | --- linux-3.0.3/drivers/scsi/pmcraid.h 2011-07-21 22:17:23.000000000 -0400 | |
31542 | +++ linux-3.0.3/drivers/scsi/pmcraid.h 2011-08-23 21:47:56.000000000 -0400 | |
31543 | @@ -749,7 +749,7 @@ struct pmcraid_instance { | |
31544 | struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS]; | |
31545 | ||
31546 | /* Message id as filled in last fired IOARCB, used to identify HRRQ */ | |
31547 | - atomic_t last_message_id; | |
31548 | + atomic_unchecked_t last_message_id; | |
31549 | ||
31550 | /* configuration table */ | |
31551 | struct pmcraid_config_table *cfg_table; | |
31552 | @@ -778,7 +778,7 @@ struct pmcraid_instance { | |
31553 | atomic_t outstanding_cmds; | |
31554 | ||
31555 | /* should add/delete resources to mid-layer now ?*/ | |
31556 | - atomic_t expose_resources; | |
31557 | + atomic_unchecked_t expose_resources; | |
31558 | ||
31559 | ||
31560 | ||
31561 | @@ -814,8 +814,8 @@ struct pmcraid_resource_entry { | |
31562 | struct pmcraid_config_table_entry_ext cfg_entry_ext; | |
31563 | }; | |
31564 | struct scsi_device *scsi_dev; /* Link scsi_device structure */ | |
31565 | - atomic_t read_failures; /* count of failed READ commands */ | |
31566 | - atomic_t write_failures; /* count of failed WRITE commands */ | |
31567 | + atomic_unchecked_t read_failures; /* count of failed READ commands */ | |
31568 | + atomic_unchecked_t write_failures; /* count of failed WRITE commands */ | |
31569 | ||
31570 | /* To indicate add/delete/modify during CCN */ | |
31571 | u8 change_detected; | |
31572 | diff -urNp linux-3.0.3/drivers/scsi/qla2xxx/qla_def.h linux-3.0.3/drivers/scsi/qla2xxx/qla_def.h | |
31573 | --- linux-3.0.3/drivers/scsi/qla2xxx/qla_def.h 2011-07-21 22:17:23.000000000 -0400 | |
31574 | +++ linux-3.0.3/drivers/scsi/qla2xxx/qla_def.h 2011-08-23 21:47:56.000000000 -0400 | |
31575 | @@ -2244,7 +2244,7 @@ struct isp_operations { | |
31576 | int (*get_flash_version) (struct scsi_qla_host *, void *); | |
31577 | int (*start_scsi) (srb_t *); | |
31578 | int (*abort_isp) (struct scsi_qla_host *); | |
31579 | -}; | |
31580 | +} __no_const; | |
31581 | ||
31582 | /* MSI-X Support *************************************************************/ | |
31583 | ||
31584 | diff -urNp linux-3.0.3/drivers/scsi/qla4xxx/ql4_def.h linux-3.0.3/drivers/scsi/qla4xxx/ql4_def.h | |
31585 | --- linux-3.0.3/drivers/scsi/qla4xxx/ql4_def.h 2011-07-21 22:17:23.000000000 -0400 | |
31586 | +++ linux-3.0.3/drivers/scsi/qla4xxx/ql4_def.h 2011-08-23 21:47:56.000000000 -0400 | |
31587 | @@ -256,7 +256,7 @@ struct ddb_entry { | |
31588 | atomic_t retry_relogin_timer; /* Min Time between relogins | |
31589 | * (4000 only) */ | |
31590 | atomic_t relogin_timer; /* Max Time to wait for relogin to complete */ | |
31591 | - atomic_t relogin_retry_count; /* Num of times relogin has been | |
31592 | + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been | |
31593 | * retried */ | |
31594 | ||
31595 | uint16_t port; | |
31596 | diff -urNp linux-3.0.3/drivers/scsi/qla4xxx/ql4_init.c linux-3.0.3/drivers/scsi/qla4xxx/ql4_init.c | |
31597 | --- linux-3.0.3/drivers/scsi/qla4xxx/ql4_init.c 2011-07-21 22:17:23.000000000 -0400 | |
31598 | +++ linux-3.0.3/drivers/scsi/qla4xxx/ql4_init.c 2011-08-23 21:47:56.000000000 -0400 | |
31599 | @@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_ | |
31600 | ddb_entry->fw_ddb_index = fw_ddb_index; | |
31601 | atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY); | |
31602 | atomic_set(&ddb_entry->relogin_timer, 0); | |
31603 | - atomic_set(&ddb_entry->relogin_retry_count, 0); | |
31604 | + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0); | |
31605 | atomic_set(&ddb_entry->state, DDB_STATE_ONLINE); | |
31606 | list_add_tail(&ddb_entry->list, &ha->ddb_list); | |
31607 | ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry; | |
31608 | @@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s | |
31609 | if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) && | |
31610 | (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) { | |
31611 | atomic_set(&ddb_entry->state, DDB_STATE_ONLINE); | |
31612 | - atomic_set(&ddb_entry->relogin_retry_count, 0); | |
31613 | + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0); | |
31614 | atomic_set(&ddb_entry->relogin_timer, 0); | |
31615 | clear_bit(DF_RELOGIN, &ddb_entry->flags); | |
31616 | iscsi_unblock_session(ddb_entry->sess); | |
31617 | diff -urNp linux-3.0.3/drivers/scsi/qla4xxx/ql4_os.c linux-3.0.3/drivers/scsi/qla4xxx/ql4_os.c | |
31618 | --- linux-3.0.3/drivers/scsi/qla4xxx/ql4_os.c 2011-07-21 22:17:23.000000000 -0400 | |
31619 | +++ linux-3.0.3/drivers/scsi/qla4xxx/ql4_os.c 2011-08-23 21:47:56.000000000 -0400 | |
31620 | @@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_ql | |
31621 | ddb_entry->fw_ddb_device_state == | |
31622 | DDB_DS_SESSION_FAILED) { | |
31623 | /* Reset retry relogin timer */ | |
31624 | - atomic_inc(&ddb_entry->relogin_retry_count); | |
31625 | + atomic_inc_unchecked(&ddb_entry->relogin_retry_count); | |
31626 | DEBUG2(printk("scsi%ld: ddb [%d] relogin" | |
31627 | " timed out-retrying" | |
31628 | " relogin (%d)\n", | |
31629 | ha->host_no, | |
31630 | ddb_entry->fw_ddb_index, | |
31631 | - atomic_read(&ddb_entry-> | |
31632 | + atomic_read_unchecked(&ddb_entry-> | |
31633 | relogin_retry_count)) | |
31634 | ); | |
31635 | start_dpc++; | |
31636 | diff -urNp linux-3.0.3/drivers/scsi/scsi.c linux-3.0.3/drivers/scsi/scsi.c | |
31637 | --- linux-3.0.3/drivers/scsi/scsi.c 2011-07-21 22:17:23.000000000 -0400 | |
31638 | +++ linux-3.0.3/drivers/scsi/scsi.c 2011-08-23 21:47:56.000000000 -0400 | |
31639 | @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd * | |
31640 | unsigned long timeout; | |
31641 | int rtn = 0; | |
31642 | ||
31643 | - atomic_inc(&cmd->device->iorequest_cnt); | |
31644 | + atomic_inc_unchecked(&cmd->device->iorequest_cnt); | |
31645 | ||
31646 | /* check if the device is still usable */ | |
31647 | if (unlikely(cmd->device->sdev_state == SDEV_DEL)) { | |
31648 | diff -urNp linux-3.0.3/drivers/scsi/scsi_debug.c linux-3.0.3/drivers/scsi/scsi_debug.c | |
31649 | --- linux-3.0.3/drivers/scsi/scsi_debug.c 2011-07-21 22:17:23.000000000 -0400 | |
31650 | +++ linux-3.0.3/drivers/scsi/scsi_debug.c 2011-08-23 21:48:14.000000000 -0400 | |
31651 | @@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_ | |
31652 | unsigned char arr[SDEBUG_MAX_MSELECT_SZ]; | |
31653 | unsigned char *cmd = (unsigned char *)scp->cmnd; | |
31654 | ||
31655 | + pax_track_stack(); | |
31656 | + | |
31657 | if ((errsts = check_readiness(scp, 1, devip))) | |
31658 | return errsts; | |
31659 | memset(arr, 0, sizeof(arr)); | |
31660 | @@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm | |
31661 | unsigned char arr[SDEBUG_MAX_LSENSE_SZ]; | |
31662 | unsigned char *cmd = (unsigned char *)scp->cmnd; | |
31663 | ||
31664 | + pax_track_stack(); | |
31665 | + | |
31666 | if ((errsts = check_readiness(scp, 1, devip))) | |
31667 | return errsts; | |
31668 | memset(arr, 0, sizeof(arr)); | |
31669 | diff -urNp linux-3.0.3/drivers/scsi/scsi_lib.c linux-3.0.3/drivers/scsi/scsi_lib.c | |
31670 | --- linux-3.0.3/drivers/scsi/scsi_lib.c 2011-08-23 21:44:40.000000000 -0400 | |
31671 | +++ linux-3.0.3/drivers/scsi/scsi_lib.c 2011-08-23 21:47:56.000000000 -0400 | |
31672 | @@ -1412,7 +1412,7 @@ static void scsi_kill_request(struct req | |
31673 | shost = sdev->host; | |
31674 | scsi_init_cmd_errh(cmd); | |
31675 | cmd->result = DID_NO_CONNECT << 16; | |
31676 | - atomic_inc(&cmd->device->iorequest_cnt); | |
31677 | + atomic_inc_unchecked(&cmd->device->iorequest_cnt); | |
31678 | ||
31679 | /* | |
31680 | * SCSI request completion path will do scsi_device_unbusy(), | |
31681 | @@ -1438,9 +1438,9 @@ static void scsi_softirq_done(struct req | |
31682 | ||
31683 | INIT_LIST_HEAD(&cmd->eh_entry); | |
31684 | ||
31685 | - atomic_inc(&cmd->device->iodone_cnt); | |
31686 | + atomic_inc_unchecked(&cmd->device->iodone_cnt); | |
31687 | if (cmd->result) | |
31688 | - atomic_inc(&cmd->device->ioerr_cnt); | |
31689 | + atomic_inc_unchecked(&cmd->device->ioerr_cnt); | |
31690 | ||
31691 | disposition = scsi_decide_disposition(cmd); | |
31692 | if (disposition != SUCCESS && | |
31693 | diff -urNp linux-3.0.3/drivers/scsi/scsi_sysfs.c linux-3.0.3/drivers/scsi/scsi_sysfs.c | |
31694 | --- linux-3.0.3/drivers/scsi/scsi_sysfs.c 2011-07-21 22:17:23.000000000 -0400 | |
31695 | +++ linux-3.0.3/drivers/scsi/scsi_sysfs.c 2011-08-23 21:47:56.000000000 -0400 | |
31696 | @@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev, | |
31697 | char *buf) \ | |
31698 | { \ | |
31699 | struct scsi_device *sdev = to_scsi_device(dev); \ | |
31700 | - unsigned long long count = atomic_read(&sdev->field); \ | |
31701 | + unsigned long long count = atomic_read_unchecked(&sdev->field); \ | |
31702 | return snprintf(buf, 20, "0x%llx\n", count); \ | |
31703 | } \ | |
31704 | static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL) | |
31705 | diff -urNp linux-3.0.3/drivers/scsi/scsi_transport_fc.c linux-3.0.3/drivers/scsi/scsi_transport_fc.c | |
31706 | --- linux-3.0.3/drivers/scsi/scsi_transport_fc.c 2011-07-21 22:17:23.000000000 -0400 | |
31707 | +++ linux-3.0.3/drivers/scsi/scsi_transport_fc.c 2011-08-23 21:47:56.000000000 -0400 | |
31708 | @@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_ | |
31709 | * Netlink Infrastructure | |
31710 | */ | |
31711 | ||
31712 | -static atomic_t fc_event_seq; | |
31713 | +static atomic_unchecked_t fc_event_seq; | |
31714 | ||
31715 | /** | |
31716 | * fc_get_event_number - Obtain the next sequential FC event number | |
31717 | @@ -497,7 +497,7 @@ static atomic_t fc_event_seq; | |
31718 | u32 | |
31719 | fc_get_event_number(void) | |
31720 | { | |
31721 | - return atomic_add_return(1, &fc_event_seq); | |
31722 | + return atomic_add_return_unchecked(1, &fc_event_seq); | |
31723 | } | |
31724 | EXPORT_SYMBOL(fc_get_event_number); | |
31725 | ||
31726 | @@ -645,7 +645,7 @@ static __init int fc_transport_init(void | |
31727 | { | |
31728 | int error; | |
31729 | ||
31730 | - atomic_set(&fc_event_seq, 0); | |
31731 | + atomic_set_unchecked(&fc_event_seq, 0); | |
31732 | ||
31733 | error = transport_class_register(&fc_host_class); | |
31734 | if (error) | |
31735 | @@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char | |
31736 | char *cp; | |
31737 | ||
31738 | *val = simple_strtoul(buf, &cp, 0); | |
31739 | - if ((*cp && (*cp != '\n')) || (*val < 0)) | |
31740 | + if (*cp && (*cp != '\n')) | |
31741 | return -EINVAL; | |
31742 | /* | |
31743 | * Check for overflow; dev_loss_tmo is u32 | |
31744 | diff -urNp linux-3.0.3/drivers/scsi/scsi_transport_iscsi.c linux-3.0.3/drivers/scsi/scsi_transport_iscsi.c | |
31745 | --- linux-3.0.3/drivers/scsi/scsi_transport_iscsi.c 2011-07-21 22:17:23.000000000 -0400 | |
31746 | +++ linux-3.0.3/drivers/scsi/scsi_transport_iscsi.c 2011-08-23 21:47:56.000000000 -0400 | |
31747 | @@ -83,7 +83,7 @@ struct iscsi_internal { | |
31748 | struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1]; | |
31749 | }; | |
31750 | ||
31751 | -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */ | |
31752 | +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */ | |
31753 | static struct workqueue_struct *iscsi_eh_timer_workq; | |
31754 | ||
31755 | /* | |
31756 | @@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s | |
31757 | int err; | |
31758 | ||
31759 | ihost = shost->shost_data; | |
31760 | - session->sid = atomic_add_return(1, &iscsi_session_nr); | |
31761 | + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr); | |
31762 | ||
31763 | if (id == ISCSI_MAX_TARGET) { | |
31764 | for (id = 0; id < ISCSI_MAX_TARGET; id++) { | |
31765 | @@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v | |
31766 | printk(KERN_INFO "Loading iSCSI transport class v%s.\n", | |
31767 | ISCSI_TRANSPORT_VERSION); | |
31768 | ||
31769 | - atomic_set(&iscsi_session_nr, 0); | |
31770 | + atomic_set_unchecked(&iscsi_session_nr, 0); | |
31771 | ||
31772 | err = class_register(&iscsi_transport_class); | |
31773 | if (err) | |
31774 | diff -urNp linux-3.0.3/drivers/scsi/scsi_transport_srp.c linux-3.0.3/drivers/scsi/scsi_transport_srp.c | |
31775 | --- linux-3.0.3/drivers/scsi/scsi_transport_srp.c 2011-07-21 22:17:23.000000000 -0400 | |
31776 | +++ linux-3.0.3/drivers/scsi/scsi_transport_srp.c 2011-08-23 21:47:56.000000000 -0400 | |
31777 | @@ -33,7 +33,7 @@ | |
31778 | #include "scsi_transport_srp_internal.h" | |
31779 | ||
31780 | struct srp_host_attrs { | |
31781 | - atomic_t next_port_id; | |
31782 | + atomic_unchecked_t next_port_id; | |
31783 | }; | |
31784 | #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data) | |
31785 | ||
31786 | @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo | |
31787 | struct Scsi_Host *shost = dev_to_shost(dev); | |
31788 | struct srp_host_attrs *srp_host = to_srp_host_attrs(shost); | |
31789 | ||
31790 | - atomic_set(&srp_host->next_port_id, 0); | |
31791 | + atomic_set_unchecked(&srp_host->next_port_id, 0); | |
31792 | return 0; | |
31793 | } | |
31794 | ||
31795 | @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S | |
31796 | memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id)); | |
31797 | rport->roles = ids->roles; | |
31798 | ||
31799 | - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id); | |
31800 | + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id); | |
31801 | dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id); | |
31802 | ||
31803 | transport_setup_device(&rport->dev); | |
31804 | diff -urNp linux-3.0.3/drivers/scsi/sg.c linux-3.0.3/drivers/scsi/sg.c | |
31805 | --- linux-3.0.3/drivers/scsi/sg.c 2011-07-21 22:17:23.000000000 -0400 | |
31806 | +++ linux-3.0.3/drivers/scsi/sg.c 2011-08-23 21:47:56.000000000 -0400 | |
31807 | @@ -2310,7 +2310,7 @@ struct sg_proc_leaf { | |
31808 | const struct file_operations * fops; | |
31809 | }; | |
31810 | ||
31811 | -static struct sg_proc_leaf sg_proc_leaf_arr[] = { | |
31812 | +static const struct sg_proc_leaf sg_proc_leaf_arr[] = { | |
31813 | {"allow_dio", &adio_fops}, | |
31814 | {"debug", &debug_fops}, | |
31815 | {"def_reserved_size", &dressz_fops}, | |
31816 | @@ -2325,7 +2325,7 @@ sg_proc_init(void) | |
31817 | { | |
31818 | int k, mask; | |
31819 | int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr); | |
31820 | - struct sg_proc_leaf * leaf; | |
31821 | + const struct sg_proc_leaf * leaf; | |
31822 | ||
31823 | sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL); | |
31824 | if (!sg_proc_sgp) | |
31825 | diff -urNp linux-3.0.3/drivers/scsi/sym53c8xx_2/sym_glue.c linux-3.0.3/drivers/scsi/sym53c8xx_2/sym_glue.c | |
31826 | --- linux-3.0.3/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-07-21 22:17:23.000000000 -0400 | |
31827 | +++ linux-3.0.3/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-08-23 21:48:14.000000000 -0400 | |
31828 | @@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p | |
31829 | int do_iounmap = 0; | |
31830 | int do_disable_device = 1; | |
31831 | ||
31832 | + pax_track_stack(); | |
31833 | + | |
31834 | memset(&sym_dev, 0, sizeof(sym_dev)); | |
31835 | memset(&nvram, 0, sizeof(nvram)); | |
31836 | sym_dev.pdev = pdev; | |
31837 | diff -urNp linux-3.0.3/drivers/scsi/vmw_pvscsi.c linux-3.0.3/drivers/scsi/vmw_pvscsi.c | |
31838 | --- linux-3.0.3/drivers/scsi/vmw_pvscsi.c 2011-07-21 22:17:23.000000000 -0400 | |
31839 | +++ linux-3.0.3/drivers/scsi/vmw_pvscsi.c 2011-08-23 21:48:14.000000000 -0400 | |
31840 | @@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const | |
31841 | dma_addr_t base; | |
31842 | unsigned i; | |
31843 | ||
31844 | + pax_track_stack(); | |
31845 | + | |
31846 | cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT; | |
31847 | cmd.reqRingNumPages = adapter->req_pages; | |
31848 | cmd.cmpRingNumPages = adapter->cmp_pages; | |
31849 | diff -urNp linux-3.0.3/drivers/spi/spi.c linux-3.0.3/drivers/spi/spi.c | |
31850 | --- linux-3.0.3/drivers/spi/spi.c 2011-07-21 22:17:23.000000000 -0400 | |
31851 | +++ linux-3.0.3/drivers/spi/spi.c 2011-08-23 21:47:56.000000000 -0400 | |
31852 | @@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma | |
31853 | EXPORT_SYMBOL_GPL(spi_bus_unlock); | |
31854 | ||
31855 | /* portable code must never pass more than 32 bytes */ | |
31856 | -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES) | |
31857 | +#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES) | |
31858 | ||
31859 | static u8 *buf; | |
31860 | ||
31861 | diff -urNp linux-3.0.3/drivers/staging/ath6kl/os/linux/ar6000_drv.c linux-3.0.3/drivers/staging/ath6kl/os/linux/ar6000_drv.c | |
31862 | --- linux-3.0.3/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-08-23 21:44:40.000000000 -0400 | |
31863 | +++ linux-3.0.3/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-08-23 21:48:14.000000000 -0400 | |
31864 | @@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[ | |
31865 | (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0)) | |
31866 | ||
31867 | ||
31868 | -static struct net_device_ops ar6000_netdev_ops = { | |
31869 | +static net_device_ops_no_const ar6000_netdev_ops = { | |
31870 | .ndo_init = NULL, | |
31871 | .ndo_open = ar6000_open, | |
31872 | .ndo_stop = ar6000_close, | |
31873 | diff -urNp linux-3.0.3/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h linux-3.0.3/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h | |
31874 | --- linux-3.0.3/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-07-21 22:17:23.000000000 -0400 | |
31875 | +++ linux-3.0.3/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-08-23 21:47:56.000000000 -0400 | |
31876 | @@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void | |
31877 | typedef struct ar6k_pal_config_s | |
31878 | { | |
31879 | ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt; | |
31880 | -}ar6k_pal_config_t; | |
31881 | +} __no_const ar6k_pal_config_t; | |
31882 | ||
31883 | void register_pal_cb(ar6k_pal_config_t *palConfig_p); | |
31884 | #endif /* _AR6K_PAL_H_ */ | |
31885 | diff -urNp linux-3.0.3/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-3.0.3/drivers/staging/brcm80211/brcmfmac/dhd_linux.c | |
31886 | --- linux-3.0.3/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-07-21 22:17:23.000000000 -0400 | |
31887 | +++ linux-3.0.3/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-08-23 21:47:56.000000000 -0400 | |
31888 | @@ -853,14 +853,14 @@ static void dhd_op_if(dhd_if_t *ifp) | |
31889 | free_netdev(ifp->net); | |
31890 | } | |
31891 | /* Allocate etherdev, including space for private structure */ | |
31892 | - ifp->net = alloc_etherdev(sizeof(dhd)); | |
31893 | + ifp->net = alloc_etherdev(sizeof(*dhd)); | |
31894 | if (!ifp->net) { | |
31895 | DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__)); | |
31896 | ret = -ENOMEM; | |
31897 | } | |
31898 | if (ret == 0) { | |
31899 | strcpy(ifp->net->name, ifp->name); | |
31900 | - memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd)); | |
31901 | + memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd)); | |
31902 | err = dhd_net_attach(&dhd->pub, ifp->idx); | |
31903 | if (err != 0) { | |
31904 | DHD_ERROR(("%s: dhd_net_attach failed, " | |
31905 | @@ -1872,7 +1872,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu | |
31906 | strcpy(nv_path, nvram_path); | |
31907 | ||
31908 | /* Allocate etherdev, including space for private structure */ | |
31909 | - net = alloc_etherdev(sizeof(dhd)); | |
31910 | + net = alloc_etherdev(sizeof(*dhd)); | |
31911 | if (!net) { | |
31912 | DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__)); | |
31913 | goto fail; | |
31914 | @@ -1888,7 +1888,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu | |
31915 | /* | |
31916 | * Save the dhd_info into the priv | |
31917 | */ | |
31918 | - memcpy(netdev_priv(net), &dhd, sizeof(dhd)); | |
31919 | + memcpy(netdev_priv(net), dhd, sizeof(*dhd)); | |
31920 | ||
31921 | /* Set network interface name if it was provided as module parameter */ | |
31922 | if (iface_name[0]) { | |
31923 | @@ -2004,7 +2004,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu | |
31924 | /* | |
31925 | * Save the dhd_info into the priv | |
31926 | */ | |
31927 | - memcpy(netdev_priv(net), &dhd, sizeof(dhd)); | |
31928 | + memcpy(netdev_priv(net), dhd, sizeof(*dhd)); | |
31929 | ||
31930 | #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC) | |
31931 | g_bus = bus; | |
31932 | diff -urNp linux-3.0.3/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h linux-3.0.3/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h | |
31933 | --- linux-3.0.3/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-07-21 22:17:23.000000000 -0400 | |
31934 | +++ linux-3.0.3/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-08-23 21:47:56.000000000 -0400 | |
31935 | @@ -593,7 +593,7 @@ struct phy_func_ptr { | |
31936 | initfn_t carrsuppr; | |
31937 | rxsigpwrfn_t rxsigpwr; | |
31938 | detachfn_t detach; | |
31939 | -}; | |
31940 | +} __no_const; | |
31941 | typedef struct phy_func_ptr phy_func_ptr_t; | |
31942 | ||
31943 | struct phy_info { | |
31944 | diff -urNp linux-3.0.3/drivers/staging/brcm80211/include/bcmsdh.h linux-3.0.3/drivers/staging/brcm80211/include/bcmsdh.h | |
31945 | --- linux-3.0.3/drivers/staging/brcm80211/include/bcmsdh.h 2011-07-21 22:17:23.000000000 -0400 | |
31946 | +++ linux-3.0.3/drivers/staging/brcm80211/include/bcmsdh.h 2011-08-23 21:47:56.000000000 -0400 | |
31947 | @@ -185,7 +185,7 @@ typedef struct { | |
31948 | u16 func, uint bustype, void *regsva, void *param); | |
31949 | /* detach from device */ | |
31950 | void (*detach) (void *ch); | |
31951 | -} bcmsdh_driver_t; | |
31952 | +} __no_const bcmsdh_driver_t; | |
31953 | ||
31954 | /* platform specific/high level functions */ | |
31955 | extern int bcmsdh_register(bcmsdh_driver_t *driver); | |
31956 | diff -urNp linux-3.0.3/drivers/staging/et131x/et1310_tx.c linux-3.0.3/drivers/staging/et131x/et1310_tx.c | |
31957 | --- linux-3.0.3/drivers/staging/et131x/et1310_tx.c 2011-07-21 22:17:23.000000000 -0400 | |
31958 | +++ linux-3.0.3/drivers/staging/et131x/et1310_tx.c 2011-08-23 21:47:56.000000000 -0400 | |
31959 | @@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru | |
31960 | struct net_device_stats *stats = &etdev->net_stats; | |
31961 | ||
31962 | if (tcb->flags & fMP_DEST_BROAD) | |
31963 | - atomic_inc(&etdev->Stats.brdcstxmt); | |
31964 | + atomic_inc_unchecked(&etdev->Stats.brdcstxmt); | |
31965 | else if (tcb->flags & fMP_DEST_MULTI) | |
31966 | - atomic_inc(&etdev->Stats.multixmt); | |
31967 | + atomic_inc_unchecked(&etdev->Stats.multixmt); | |
31968 | else | |
31969 | - atomic_inc(&etdev->Stats.unixmt); | |
31970 | + atomic_inc_unchecked(&etdev->Stats.unixmt); | |
31971 | ||
31972 | if (tcb->skb) { | |
31973 | stats->tx_bytes += tcb->skb->len; | |
31974 | diff -urNp linux-3.0.3/drivers/staging/et131x/et131x_adapter.h linux-3.0.3/drivers/staging/et131x/et131x_adapter.h | |
31975 | --- linux-3.0.3/drivers/staging/et131x/et131x_adapter.h 2011-07-21 22:17:23.000000000 -0400 | |
31976 | +++ linux-3.0.3/drivers/staging/et131x/et131x_adapter.h 2011-08-23 21:47:56.000000000 -0400 | |
31977 | @@ -110,11 +110,11 @@ typedef struct _ce_stats_t { | |
31978 | * operations | |
31979 | */ | |
31980 | u32 unircv; /* # multicast packets received */ | |
31981 | - atomic_t unixmt; /* # multicast packets for Tx */ | |
31982 | + atomic_unchecked_t unixmt; /* # multicast packets for Tx */ | |
31983 | u32 multircv; /* # multicast packets received */ | |
31984 | - atomic_t multixmt; /* # multicast packets for Tx */ | |
31985 | + atomic_unchecked_t multixmt; /* # multicast packets for Tx */ | |
31986 | u32 brdcstrcv; /* # broadcast packets received */ | |
31987 | - atomic_t brdcstxmt; /* # broadcast packets for Tx */ | |
31988 | + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */ | |
31989 | u32 norcvbuf; /* # Rx packets discarded */ | |
31990 | u32 noxmtbuf; /* # Tx packets discarded */ | |
31991 | ||
31992 | diff -urNp linux-3.0.3/drivers/staging/hv/channel.c linux-3.0.3/drivers/staging/hv/channel.c | |
31993 | --- linux-3.0.3/drivers/staging/hv/channel.c 2011-08-23 21:44:40.000000000 -0400 | |
31994 | +++ linux-3.0.3/drivers/staging/hv/channel.c 2011-08-23 21:47:56.000000000 -0400 | |
31995 | @@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_c | |
31996 | int ret = 0; | |
31997 | int t; | |
31998 | ||
31999 | - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle); | |
32000 | - atomic_inc(&vmbus_connection.next_gpadl_handle); | |
32001 | + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle); | |
32002 | + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle); | |
32003 | ||
32004 | ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount); | |
32005 | if (ret) | |
32006 | diff -urNp linux-3.0.3/drivers/staging/hv/hv.c linux-3.0.3/drivers/staging/hv/hv.c | |
32007 | --- linux-3.0.3/drivers/staging/hv/hv.c 2011-07-21 22:17:23.000000000 -0400 | |
32008 | +++ linux-3.0.3/drivers/staging/hv/hv.c 2011-08-23 21:47:56.000000000 -0400 | |
32009 | @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, voi | |
32010 | u64 output_address = (output) ? virt_to_phys(output) : 0; | |
32011 | u32 output_address_hi = output_address >> 32; | |
32012 | u32 output_address_lo = output_address & 0xFFFFFFFF; | |
32013 | - volatile void *hypercall_page = hv_context.hypercall_page; | |
32014 | + volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page); | |
32015 | ||
32016 | __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi), | |
32017 | "=a"(hv_status_lo) : "d" (control_hi), | |
32018 | diff -urNp linux-3.0.3/drivers/staging/hv/hv_mouse.c linux-3.0.3/drivers/staging/hv/hv_mouse.c | |
32019 | --- linux-3.0.3/drivers/staging/hv/hv_mouse.c 2011-07-21 22:17:23.000000000 -0400 | |
32020 | +++ linux-3.0.3/drivers/staging/hv/hv_mouse.c 2011-08-23 21:47:56.000000000 -0400 | |
32021 | @@ -879,8 +879,10 @@ static void reportdesc_callback(struct h | |
32022 | if (hid_dev) { | |
32023 | DPRINT_INFO(INPUTVSC_DRV, "hid_device created"); | |
32024 | ||
32025 | - hid_dev->ll_driver->open = mousevsc_hid_open; | |
32026 | - hid_dev->ll_driver->close = mousevsc_hid_close; | |
32027 | + pax_open_kernel(); | |
32028 | + *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open; | |
32029 | + *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close; | |
32030 | + pax_close_kernel(); | |
32031 | ||
32032 | hid_dev->bus = BUS_VIRTUAL; | |
32033 | hid_dev->vendor = input_device_ctx->device_info.vendor; | |
32034 | diff -urNp linux-3.0.3/drivers/staging/hv/hyperv_vmbus.h linux-3.0.3/drivers/staging/hv/hyperv_vmbus.h | |
32035 | --- linux-3.0.3/drivers/staging/hv/hyperv_vmbus.h 2011-07-21 22:17:23.000000000 -0400 | |
32036 | +++ linux-3.0.3/drivers/staging/hv/hyperv_vmbus.h 2011-08-23 21:47:56.000000000 -0400 | |
32037 | @@ -559,7 +559,7 @@ enum vmbus_connect_state { | |
32038 | struct vmbus_connection { | |
32039 | enum vmbus_connect_state conn_state; | |
32040 | ||
32041 | - atomic_t next_gpadl_handle; | |
32042 | + atomic_unchecked_t next_gpadl_handle; | |
32043 | ||
32044 | /* | |
32045 | * Represents channel interrupts. Each bit position represents a | |
32046 | diff -urNp linux-3.0.3/drivers/staging/hv/rndis_filter.c linux-3.0.3/drivers/staging/hv/rndis_filter.c | |
32047 | --- linux-3.0.3/drivers/staging/hv/rndis_filter.c 2011-08-23 21:44:40.000000000 -0400 | |
32048 | +++ linux-3.0.3/drivers/staging/hv/rndis_filter.c 2011-08-23 21:47:56.000000000 -0400 | |
32049 | @@ -43,7 +43,7 @@ struct rndis_device { | |
32050 | ||
32051 | enum rndis_device_state state; | |
32052 | u32 link_stat; | |
32053 | - atomic_t new_req_id; | |
32054 | + atomic_unchecked_t new_req_id; | |
32055 | ||
32056 | spinlock_t request_lock; | |
32057 | struct list_head req_list; | |
32058 | @@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_r | |
32059 | * template | |
32060 | */ | |
32061 | set = &rndis_msg->msg.set_req; | |
32062 | - set->req_id = atomic_inc_return(&dev->new_req_id); | |
32063 | + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id); | |
32064 | ||
32065 | /* Add to the request list */ | |
32066 | spin_lock_irqsave(&dev->request_lock, flags); | |
32067 | @@ -637,7 +637,7 @@ static void rndis_filter_halt_device(str | |
32068 | ||
32069 | /* Setup the rndis set */ | |
32070 | halt = &request->request_msg.msg.halt_req; | |
32071 | - halt->req_id = atomic_inc_return(&dev->new_req_id); | |
32072 | + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id); | |
32073 | ||
32074 | /* Ignore return since this msg is optional. */ | |
32075 | rndis_filter_send_request(dev, request); | |
32076 | diff -urNp linux-3.0.3/drivers/staging/hv/vmbus_drv.c linux-3.0.3/drivers/staging/hv/vmbus_drv.c | |
32077 | --- linux-3.0.3/drivers/staging/hv/vmbus_drv.c 2011-07-21 22:17:23.000000000 -0400 | |
32078 | +++ linux-3.0.3/drivers/staging/hv/vmbus_drv.c 2011-08-23 21:47:56.000000000 -0400 | |
32079 | @@ -668,11 +668,11 @@ int vmbus_child_device_register(struct h | |
32080 | { | |
32081 | int ret = 0; | |
32082 | ||
32083 | - static atomic_t device_num = ATOMIC_INIT(0); | |
32084 | + static atomic_unchecked_t device_num = ATOMIC_INIT(0); | |
32085 | ||
32086 | /* Set the device name. Otherwise, device_register() will fail. */ | |
32087 | dev_set_name(&child_device_obj->device, "vmbus_0_%d", | |
32088 | - atomic_inc_return(&device_num)); | |
32089 | + atomic_inc_return_unchecked(&device_num)); | |
32090 | ||
32091 | /* The new device belongs to this bus */ | |
32092 | child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */ | |
32093 | diff -urNp linux-3.0.3/drivers/staging/iio/ring_generic.h linux-3.0.3/drivers/staging/iio/ring_generic.h | |
32094 | --- linux-3.0.3/drivers/staging/iio/ring_generic.h 2011-07-21 22:17:23.000000000 -0400 | |
32095 | +++ linux-3.0.3/drivers/staging/iio/ring_generic.h 2011-08-23 21:47:56.000000000 -0400 | |
32096 | @@ -62,7 +62,7 @@ struct iio_ring_access_funcs { | |
32097 | ||
32098 | int (*is_enabled)(struct iio_ring_buffer *ring); | |
32099 | int (*enable)(struct iio_ring_buffer *ring); | |
32100 | -}; | |
32101 | +} __no_const; | |
32102 | ||
32103 | struct iio_ring_setup_ops { | |
32104 | int (*preenable)(struct iio_dev *); | |
32105 | diff -urNp linux-3.0.3/drivers/staging/octeon/ethernet.c linux-3.0.3/drivers/staging/octeon/ethernet.c | |
32106 | --- linux-3.0.3/drivers/staging/octeon/ethernet.c 2011-07-21 22:17:23.000000000 -0400 | |
32107 | +++ linux-3.0.3/drivers/staging/octeon/ethernet.c 2011-08-23 21:47:56.000000000 -0400 | |
32108 | @@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_ | |
32109 | * since the RX tasklet also increments it. | |
32110 | */ | |
32111 | #ifdef CONFIG_64BIT | |
32112 | - atomic64_add(rx_status.dropped_packets, | |
32113 | - (atomic64_t *)&priv->stats.rx_dropped); | |
32114 | + atomic64_add_unchecked(rx_status.dropped_packets, | |
32115 | + (atomic64_unchecked_t *)&priv->stats.rx_dropped); | |
32116 | #else | |
32117 | - atomic_add(rx_status.dropped_packets, | |
32118 | - (atomic_t *)&priv->stats.rx_dropped); | |
32119 | + atomic_add_unchecked(rx_status.dropped_packets, | |
32120 | + (atomic_unchecked_t *)&priv->stats.rx_dropped); | |
32121 | #endif | |
32122 | } | |
32123 | ||
32124 | diff -urNp linux-3.0.3/drivers/staging/octeon/ethernet-rx.c linux-3.0.3/drivers/staging/octeon/ethernet-rx.c | |
32125 | --- linux-3.0.3/drivers/staging/octeon/ethernet-rx.c 2011-07-21 22:17:23.000000000 -0400 | |
32126 | +++ linux-3.0.3/drivers/staging/octeon/ethernet-rx.c 2011-08-23 21:47:56.000000000 -0400 | |
32127 | @@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi | |
32128 | /* Increment RX stats for virtual ports */ | |
32129 | if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) { | |
32130 | #ifdef CONFIG_64BIT | |
32131 | - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets); | |
32132 | - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes); | |
32133 | + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets); | |
32134 | + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes); | |
32135 | #else | |
32136 | - atomic_add(1, (atomic_t *)&priv->stats.rx_packets); | |
32137 | - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes); | |
32138 | + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets); | |
32139 | + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes); | |
32140 | #endif | |
32141 | } | |
32142 | netif_receive_skb(skb); | |
32143 | @@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi | |
32144 | dev->name); | |
32145 | */ | |
32146 | #ifdef CONFIG_64BIT | |
32147 | - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped); | |
32148 | + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped); | |
32149 | #else | |
32150 | - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped); | |
32151 | + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped); | |
32152 | #endif | |
32153 | dev_kfree_skb_irq(skb); | |
32154 | } | |
32155 | diff -urNp linux-3.0.3/drivers/staging/pohmelfs/inode.c linux-3.0.3/drivers/staging/pohmelfs/inode.c | |
32156 | --- linux-3.0.3/drivers/staging/pohmelfs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
32157 | +++ linux-3.0.3/drivers/staging/pohmelfs/inode.c 2011-08-23 21:47:56.000000000 -0400 | |
32158 | @@ -1856,7 +1856,7 @@ static int pohmelfs_fill_super(struct su | |
32159 | mutex_init(&psb->mcache_lock); | |
32160 | psb->mcache_root = RB_ROOT; | |
32161 | psb->mcache_timeout = msecs_to_jiffies(5000); | |
32162 | - atomic_long_set(&psb->mcache_gen, 0); | |
32163 | + atomic_long_set_unchecked(&psb->mcache_gen, 0); | |
32164 | ||
32165 | psb->trans_max_pages = 100; | |
32166 | ||
32167 | @@ -1871,7 +1871,7 @@ static int pohmelfs_fill_super(struct su | |
32168 | INIT_LIST_HEAD(&psb->crypto_ready_list); | |
32169 | INIT_LIST_HEAD(&psb->crypto_active_list); | |
32170 | ||
32171 | - atomic_set(&psb->trans_gen, 1); | |
32172 | + atomic_set_unchecked(&psb->trans_gen, 1); | |
32173 | atomic_long_set(&psb->total_inodes, 0); | |
32174 | ||
32175 | mutex_init(&psb->state_lock); | |
32176 | diff -urNp linux-3.0.3/drivers/staging/pohmelfs/mcache.c linux-3.0.3/drivers/staging/pohmelfs/mcache.c | |
32177 | --- linux-3.0.3/drivers/staging/pohmelfs/mcache.c 2011-07-21 22:17:23.000000000 -0400 | |
32178 | +++ linux-3.0.3/drivers/staging/pohmelfs/mcache.c 2011-08-23 21:47:56.000000000 -0400 | |
32179 | @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_ | |
32180 | m->data = data; | |
32181 | m->start = start; | |
32182 | m->size = size; | |
32183 | - m->gen = atomic_long_inc_return(&psb->mcache_gen); | |
32184 | + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen); | |
32185 | ||
32186 | mutex_lock(&psb->mcache_lock); | |
32187 | err = pohmelfs_mcache_insert(psb, m); | |
32188 | diff -urNp linux-3.0.3/drivers/staging/pohmelfs/netfs.h linux-3.0.3/drivers/staging/pohmelfs/netfs.h | |
32189 | --- linux-3.0.3/drivers/staging/pohmelfs/netfs.h 2011-07-21 22:17:23.000000000 -0400 | |
32190 | +++ linux-3.0.3/drivers/staging/pohmelfs/netfs.h 2011-08-23 21:47:56.000000000 -0400 | |
32191 | @@ -571,14 +571,14 @@ struct pohmelfs_config; | |
32192 | struct pohmelfs_sb { | |
32193 | struct rb_root mcache_root; | |
32194 | struct mutex mcache_lock; | |
32195 | - atomic_long_t mcache_gen; | |
32196 | + atomic_long_unchecked_t mcache_gen; | |
32197 | unsigned long mcache_timeout; | |
32198 | ||
32199 | unsigned int idx; | |
32200 | ||
32201 | unsigned int trans_retries; | |
32202 | ||
32203 | - atomic_t trans_gen; | |
32204 | + atomic_unchecked_t trans_gen; | |
32205 | ||
32206 | unsigned int crypto_attached_size; | |
32207 | unsigned int crypto_align_size; | |
32208 | diff -urNp linux-3.0.3/drivers/staging/pohmelfs/trans.c linux-3.0.3/drivers/staging/pohmelfs/trans.c | |
32209 | --- linux-3.0.3/drivers/staging/pohmelfs/trans.c 2011-07-21 22:17:23.000000000 -0400 | |
32210 | +++ linux-3.0.3/drivers/staging/pohmelfs/trans.c 2011-08-23 21:47:56.000000000 -0400 | |
32211 | @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran | |
32212 | int err; | |
32213 | struct netfs_cmd *cmd = t->iovec.iov_base; | |
32214 | ||
32215 | - t->gen = atomic_inc_return(&psb->trans_gen); | |
32216 | + t->gen = atomic_inc_return_unchecked(&psb->trans_gen); | |
32217 | ||
32218 | cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) + | |
32219 | t->attached_size + t->attached_pages * sizeof(struct netfs_cmd); | |
32220 | diff -urNp linux-3.0.3/drivers/staging/rtl8712/rtl871x_io.h linux-3.0.3/drivers/staging/rtl8712/rtl871x_io.h | |
32221 | --- linux-3.0.3/drivers/staging/rtl8712/rtl871x_io.h 2011-07-21 22:17:23.000000000 -0400 | |
32222 | +++ linux-3.0.3/drivers/staging/rtl8712/rtl871x_io.h 2011-08-23 21:47:56.000000000 -0400 | |
32223 | @@ -83,7 +83,7 @@ struct _io_ops { | |
32224 | u8 *pmem); | |
32225 | u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, | |
32226 | u8 *pmem); | |
32227 | -}; | |
32228 | +} __no_const; | |
32229 | ||
32230 | struct io_req { | |
32231 | struct list_head list; | |
32232 | diff -urNp linux-3.0.3/drivers/staging/sbe-2t3e3/netdev.c linux-3.0.3/drivers/staging/sbe-2t3e3/netdev.c | |
32233 | --- linux-3.0.3/drivers/staging/sbe-2t3e3/netdev.c 2011-07-21 22:17:23.000000000 -0400 | |
32234 | +++ linux-3.0.3/drivers/staging/sbe-2t3e3/netdev.c 2011-08-24 18:21:41.000000000 -0400 | |
32235 | @@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, s | |
32236 | t3e3_if_config(sc, cmd_2t3e3, (char *)¶m, &resp, &rlen); | |
32237 | ||
32238 | if (rlen) | |
32239 | - if (copy_to_user(data, &resp, rlen)) | |
32240 | + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen)) | |
32241 | return -EFAULT; | |
32242 | ||
32243 | return 0; | |
32244 | diff -urNp linux-3.0.3/drivers/staging/tty/stallion.c linux-3.0.3/drivers/staging/tty/stallion.c | |
32245 | --- linux-3.0.3/drivers/staging/tty/stallion.c 2011-07-21 22:17:23.000000000 -0400 | |
32246 | +++ linux-3.0.3/drivers/staging/tty/stallion.c 2011-08-23 21:48:14.000000000 -0400 | |
32247 | @@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp | |
32248 | struct stlport stl_dummyport; | |
32249 | struct stlport *portp; | |
32250 | ||
32251 | + pax_track_stack(); | |
32252 | + | |
32253 | if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport))) | |
32254 | return -EFAULT; | |
32255 | portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr, | |
32256 | diff -urNp linux-3.0.3/drivers/staging/usbip/usbip_common.h linux-3.0.3/drivers/staging/usbip/usbip_common.h | |
32257 | --- linux-3.0.3/drivers/staging/usbip/usbip_common.h 2011-07-21 22:17:23.000000000 -0400 | |
32258 | +++ linux-3.0.3/drivers/staging/usbip/usbip_common.h 2011-08-23 21:47:56.000000000 -0400 | |
32259 | @@ -315,7 +315,7 @@ struct usbip_device { | |
32260 | void (*shutdown)(struct usbip_device *); | |
32261 | void (*reset)(struct usbip_device *); | |
32262 | void (*unusable)(struct usbip_device *); | |
32263 | - } eh_ops; | |
32264 | + } __no_const eh_ops; | |
32265 | }; | |
32266 | ||
32267 | void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd, | |
32268 | diff -urNp linux-3.0.3/drivers/staging/usbip/vhci.h linux-3.0.3/drivers/staging/usbip/vhci.h | |
32269 | --- linux-3.0.3/drivers/staging/usbip/vhci.h 2011-07-21 22:17:23.000000000 -0400 | |
32270 | +++ linux-3.0.3/drivers/staging/usbip/vhci.h 2011-08-23 21:47:56.000000000 -0400 | |
32271 | @@ -94,7 +94,7 @@ struct vhci_hcd { | |
32272 | unsigned resuming:1; | |
32273 | unsigned long re_timeout; | |
32274 | ||
32275 | - atomic_t seqnum; | |
32276 | + atomic_unchecked_t seqnum; | |
32277 | ||
32278 | /* | |
32279 | * NOTE: | |
32280 | diff -urNp linux-3.0.3/drivers/staging/usbip/vhci_hcd.c linux-3.0.3/drivers/staging/usbip/vhci_hcd.c | |
32281 | --- linux-3.0.3/drivers/staging/usbip/vhci_hcd.c 2011-08-23 21:44:40.000000000 -0400 | |
32282 | +++ linux-3.0.3/drivers/staging/usbip/vhci_hcd.c 2011-08-23 21:47:56.000000000 -0400 | |
32283 | @@ -511,7 +511,7 @@ static void vhci_tx_urb(struct urb *urb) | |
32284 | return; | |
32285 | } | |
32286 | ||
32287 | - priv->seqnum = atomic_inc_return(&the_controller->seqnum); | |
32288 | + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum); | |
32289 | if (priv->seqnum == 0xffff) | |
32290 | dev_info(&urb->dev->dev, "seqnum max\n"); | |
32291 | ||
32292 | @@ -765,7 +765,7 @@ static int vhci_urb_dequeue(struct usb_h | |
32293 | return -ENOMEM; | |
32294 | } | |
32295 | ||
32296 | - unlink->seqnum = atomic_inc_return(&the_controller->seqnum); | |
32297 | + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum); | |
32298 | if (unlink->seqnum == 0xffff) | |
32299 | pr_info("seqnum max\n"); | |
32300 | ||
32301 | @@ -955,7 +955,7 @@ static int vhci_start(struct usb_hcd *hc | |
32302 | vdev->rhport = rhport; | |
32303 | } | |
32304 | ||
32305 | - atomic_set(&vhci->seqnum, 0); | |
32306 | + atomic_set_unchecked(&vhci->seqnum, 0); | |
32307 | spin_lock_init(&vhci->lock); | |
32308 | ||
32309 | hcd->power_budget = 0; /* no limit */ | |
32310 | diff -urNp linux-3.0.3/drivers/staging/usbip/vhci_rx.c linux-3.0.3/drivers/staging/usbip/vhci_rx.c | |
32311 | --- linux-3.0.3/drivers/staging/usbip/vhci_rx.c 2011-07-21 22:17:23.000000000 -0400 | |
32312 | +++ linux-3.0.3/drivers/staging/usbip/vhci_rx.c 2011-08-23 21:47:56.000000000 -0400 | |
32313 | @@ -76,7 +76,7 @@ static void vhci_recv_ret_submit(struct | |
32314 | if (!urb) { | |
32315 | pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum); | |
32316 | pr_info("max seqnum %d\n", | |
32317 | - atomic_read(&the_controller->seqnum)); | |
32318 | + atomic_read_unchecked(&the_controller->seqnum)); | |
32319 | usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); | |
32320 | return; | |
32321 | } | |
32322 | diff -urNp linux-3.0.3/drivers/staging/vt6655/hostap.c linux-3.0.3/drivers/staging/vt6655/hostap.c | |
32323 | --- linux-3.0.3/drivers/staging/vt6655/hostap.c 2011-07-21 22:17:23.000000000 -0400 | |
32324 | +++ linux-3.0.3/drivers/staging/vt6655/hostap.c 2011-08-23 21:47:56.000000000 -0400 | |
32325 | @@ -79,14 +79,13 @@ static int msglevel | |
32326 | * | |
32327 | */ | |
32328 | ||
32329 | +static net_device_ops_no_const apdev_netdev_ops; | |
32330 | + | |
32331 | static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked) | |
32332 | { | |
32333 | PSDevice apdev_priv; | |
32334 | struct net_device *dev = pDevice->dev; | |
32335 | int ret; | |
32336 | - const struct net_device_ops apdev_netdev_ops = { | |
32337 | - .ndo_start_xmit = pDevice->tx_80211, | |
32338 | - }; | |
32339 | ||
32340 | DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name); | |
32341 | ||
32342 | @@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevic | |
32343 | *apdev_priv = *pDevice; | |
32344 | memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN); | |
32345 | ||
32346 | + /* only half broken now */ | |
32347 | + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211; | |
32348 | pDevice->apdev->netdev_ops = &apdev_netdev_ops; | |
32349 | ||
32350 | pDevice->apdev->type = ARPHRD_IEEE80211; | |
32351 | diff -urNp linux-3.0.3/drivers/staging/vt6656/hostap.c linux-3.0.3/drivers/staging/vt6656/hostap.c | |
32352 | --- linux-3.0.3/drivers/staging/vt6656/hostap.c 2011-07-21 22:17:23.000000000 -0400 | |
32353 | +++ linux-3.0.3/drivers/staging/vt6656/hostap.c 2011-08-23 21:47:56.000000000 -0400 | |
32354 | @@ -80,14 +80,13 @@ static int msglevel | |
32355 | * | |
32356 | */ | |
32357 | ||
32358 | +static net_device_ops_no_const apdev_netdev_ops; | |
32359 | + | |
32360 | static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked) | |
32361 | { | |
32362 | PSDevice apdev_priv; | |
32363 | struct net_device *dev = pDevice->dev; | |
32364 | int ret; | |
32365 | - const struct net_device_ops apdev_netdev_ops = { | |
32366 | - .ndo_start_xmit = pDevice->tx_80211, | |
32367 | - }; | |
32368 | ||
32369 | DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name); | |
32370 | ||
32371 | @@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevic | |
32372 | *apdev_priv = *pDevice; | |
32373 | memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN); | |
32374 | ||
32375 | + /* only half broken now */ | |
32376 | + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211; | |
32377 | pDevice->apdev->netdev_ops = &apdev_netdev_ops; | |
32378 | ||
32379 | pDevice->apdev->type = ARPHRD_IEEE80211; | |
32380 | diff -urNp linux-3.0.3/drivers/staging/wlan-ng/hfa384x_usb.c linux-3.0.3/drivers/staging/wlan-ng/hfa384x_usb.c | |
32381 | --- linux-3.0.3/drivers/staging/wlan-ng/hfa384x_usb.c 2011-07-21 22:17:23.000000000 -0400 | |
32382 | +++ linux-3.0.3/drivers/staging/wlan-ng/hfa384x_usb.c 2011-08-23 21:47:56.000000000 -0400 | |
32383 | @@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hf | |
32384 | ||
32385 | struct usbctlx_completor { | |
32386 | int (*complete) (struct usbctlx_completor *); | |
32387 | -}; | |
32388 | +} __no_const; | |
32389 | ||
32390 | static int | |
32391 | hfa384x_usbctlx_complete_sync(hfa384x_t *hw, | |
32392 | diff -urNp linux-3.0.3/drivers/staging/zcache/tmem.c linux-3.0.3/drivers/staging/zcache/tmem.c | |
32393 | --- linux-3.0.3/drivers/staging/zcache/tmem.c 2011-07-21 22:17:23.000000000 -0400 | |
32394 | +++ linux-3.0.3/drivers/staging/zcache/tmem.c 2011-08-23 21:47:56.000000000 -0400 | |
32395 | @@ -39,7 +39,7 @@ | |
32396 | * A tmem host implementation must use this function to register callbacks | |
32397 | * for memory allocation. | |
32398 | */ | |
32399 | -static struct tmem_hostops tmem_hostops; | |
32400 | +static tmem_hostops_no_const tmem_hostops; | |
32401 | ||
32402 | static void tmem_objnode_tree_init(void); | |
32403 | ||
32404 | @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h | |
32405 | * A tmem host implementation must use this function to register | |
32406 | * callbacks for a page-accessible memory (PAM) implementation | |
32407 | */ | |
32408 | -static struct tmem_pamops tmem_pamops; | |
32409 | +static tmem_pamops_no_const tmem_pamops; | |
32410 | ||
32411 | void tmem_register_pamops(struct tmem_pamops *m) | |
32412 | { | |
32413 | diff -urNp linux-3.0.3/drivers/staging/zcache/tmem.h linux-3.0.3/drivers/staging/zcache/tmem.h | |
32414 | --- linux-3.0.3/drivers/staging/zcache/tmem.h 2011-07-21 22:17:23.000000000 -0400 | |
32415 | +++ linux-3.0.3/drivers/staging/zcache/tmem.h 2011-08-23 21:47:56.000000000 -0400 | |
32416 | @@ -171,6 +171,7 @@ struct tmem_pamops { | |
32417 | int (*get_data)(struct page *, void *, struct tmem_pool *); | |
32418 | void (*free)(void *, struct tmem_pool *); | |
32419 | }; | |
32420 | +typedef struct tmem_pamops __no_const tmem_pamops_no_const; | |
32421 | extern void tmem_register_pamops(struct tmem_pamops *m); | |
32422 | ||
32423 | /* memory allocation methods provided by the host implementation */ | |
32424 | @@ -180,6 +181,7 @@ struct tmem_hostops { | |
32425 | struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *); | |
32426 | void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *); | |
32427 | }; | |
32428 | +typedef struct tmem_hostops __no_const tmem_hostops_no_const; | |
32429 | extern void tmem_register_hostops(struct tmem_hostops *m); | |
32430 | ||
32431 | /* core tmem accessor functions */ | |
32432 | diff -urNp linux-3.0.3/drivers/target/target_core_alua.c linux-3.0.3/drivers/target/target_core_alua.c | |
32433 | --- linux-3.0.3/drivers/target/target_core_alua.c 2011-07-21 22:17:23.000000000 -0400 | |
32434 | +++ linux-3.0.3/drivers/target/target_core_alua.c 2011-08-23 21:48:14.000000000 -0400 | |
32435 | @@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_ | |
32436 | char path[ALUA_METADATA_PATH_LEN]; | |
32437 | int len; | |
32438 | ||
32439 | + pax_track_stack(); | |
32440 | + | |
32441 | memset(path, 0, ALUA_METADATA_PATH_LEN); | |
32442 | ||
32443 | len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len, | |
32444 | @@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar | |
32445 | char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN]; | |
32446 | int len; | |
32447 | ||
32448 | + pax_track_stack(); | |
32449 | + | |
32450 | memset(path, 0, ALUA_METADATA_PATH_LEN); | |
32451 | memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN); | |
32452 | ||
32453 | diff -urNp linux-3.0.3/drivers/target/target_core_cdb.c linux-3.0.3/drivers/target/target_core_cdb.c | |
32454 | --- linux-3.0.3/drivers/target/target_core_cdb.c 2011-07-21 22:17:23.000000000 -0400 | |
32455 | +++ linux-3.0.3/drivers/target/target_core_cdb.c 2011-08-23 21:48:14.000000000 -0400 | |
32456 | @@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd * | |
32457 | int length = 0; | |
32458 | unsigned char buf[SE_MODE_PAGE_BUF]; | |
32459 | ||
32460 | + pax_track_stack(); | |
32461 | + | |
32462 | memset(buf, 0, SE_MODE_PAGE_BUF); | |
32463 | ||
32464 | switch (cdb[2] & 0x3f) { | |
32465 | diff -urNp linux-3.0.3/drivers/target/target_core_configfs.c linux-3.0.3/drivers/target/target_core_configfs.c | |
32466 | --- linux-3.0.3/drivers/target/target_core_configfs.c 2011-07-21 22:17:23.000000000 -0400 | |
32467 | +++ linux-3.0.3/drivers/target/target_core_configfs.c 2011-08-23 21:48:14.000000000 -0400 | |
32468 | @@ -1276,6 +1276,8 @@ static ssize_t target_core_dev_pr_show_a | |
32469 | ssize_t len = 0; | |
32470 | int reg_count = 0, prf_isid; | |
32471 | ||
32472 | + pax_track_stack(); | |
32473 | + | |
32474 | if (!(su_dev->se_dev_ptr)) | |
32475 | return -ENODEV; | |
32476 | ||
32477 | diff -urNp linux-3.0.3/drivers/target/target_core_pr.c linux-3.0.3/drivers/target/target_core_pr.c | |
32478 | --- linux-3.0.3/drivers/target/target_core_pr.c 2011-07-21 22:17:23.000000000 -0400 | |
32479 | +++ linux-3.0.3/drivers/target/target_core_pr.c 2011-08-23 21:48:14.000000000 -0400 | |
32480 | @@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi | |
32481 | unsigned char t_port[PR_APTPL_MAX_TPORT_LEN]; | |
32482 | u16 tpgt; | |
32483 | ||
32484 | + pax_track_stack(); | |
32485 | + | |
32486 | memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN); | |
32487 | memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN); | |
32488 | /* | |
32489 | @@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf | |
32490 | ssize_t len = 0; | |
32491 | int reg_count = 0; | |
32492 | ||
32493 | + pax_track_stack(); | |
32494 | + | |
32495 | memset(buf, 0, pr_aptpl_buf_len); | |
32496 | /* | |
32497 | * Called to clear metadata once APTPL has been deactivated. | |
32498 | @@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f | |
32499 | char path[512]; | |
32500 | int ret; | |
32501 | ||
32502 | + pax_track_stack(); | |
32503 | + | |
32504 | memset(iov, 0, sizeof(struct iovec)); | |
32505 | memset(path, 0, 512); | |
32506 | ||
32507 | diff -urNp linux-3.0.3/drivers/target/target_core_tmr.c linux-3.0.3/drivers/target/target_core_tmr.c | |
32508 | --- linux-3.0.3/drivers/target/target_core_tmr.c 2011-07-21 22:17:23.000000000 -0400 | |
32509 | +++ linux-3.0.3/drivers/target/target_core_tmr.c 2011-08-23 21:47:56.000000000 -0400 | |
32510 | @@ -269,7 +269,7 @@ int core_tmr_lun_reset( | |
32511 | CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key, | |
32512 | T_TASK(cmd)->t_task_cdbs, | |
32513 | atomic_read(&T_TASK(cmd)->t_task_cdbs_left), | |
32514 | - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent), | |
32515 | + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent), | |
32516 | atomic_read(&T_TASK(cmd)->t_transport_active), | |
32517 | atomic_read(&T_TASK(cmd)->t_transport_stop), | |
32518 | atomic_read(&T_TASK(cmd)->t_transport_sent)); | |
32519 | @@ -311,7 +311,7 @@ int core_tmr_lun_reset( | |
32520 | DEBUG_LR("LUN_RESET: got t_transport_active = 1 for" | |
32521 | " task: %p, t_fe_count: %d dev: %p\n", task, | |
32522 | fe_count, dev); | |
32523 | - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1); | |
32524 | + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1); | |
32525 | spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, | |
32526 | flags); | |
32527 | core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count); | |
32528 | @@ -321,7 +321,7 @@ int core_tmr_lun_reset( | |
32529 | } | |
32530 | DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p," | |
32531 | " t_fe_count: %d dev: %p\n", task, fe_count, dev); | |
32532 | - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1); | |
32533 | + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1); | |
32534 | spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags); | |
32535 | core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count); | |
32536 | ||
32537 | diff -urNp linux-3.0.3/drivers/target/target_core_transport.c linux-3.0.3/drivers/target/target_core_transport.c | |
32538 | --- linux-3.0.3/drivers/target/target_core_transport.c 2011-07-21 22:17:23.000000000 -0400 | |
32539 | +++ linux-3.0.3/drivers/target/target_core_transport.c 2011-08-23 21:47:56.000000000 -0400 | |
32540 | @@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t | |
32541 | ||
32542 | dev->queue_depth = dev_limits->queue_depth; | |
32543 | atomic_set(&dev->depth_left, dev->queue_depth); | |
32544 | - atomic_set(&dev->dev_ordered_id, 0); | |
32545 | + atomic_set_unchecked(&dev->dev_ordered_id, 0); | |
32546 | ||
32547 | se_dev_set_default_attribs(dev, dev_limits); | |
32548 | ||
32549 | @@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at | |
32550 | * Used to determine when ORDERED commands should go from | |
32551 | * Dormant to Active status. | |
32552 | */ | |
32553 | - cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id); | |
32554 | + cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id); | |
32555 | smp_mb__after_atomic_inc(); | |
32556 | DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n", | |
32557 | cmd->se_ordered_id, cmd->sam_task_attr, | |
32558 | @@ -2169,7 +2169,7 @@ static void transport_generic_request_fa | |
32559 | " t_transport_active: %d t_transport_stop: %d" | |
32560 | " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs, | |
32561 | atomic_read(&T_TASK(cmd)->t_task_cdbs_left), | |
32562 | - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent), | |
32563 | + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent), | |
32564 | atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left), | |
32565 | atomic_read(&T_TASK(cmd)->t_transport_active), | |
32566 | atomic_read(&T_TASK(cmd)->t_transport_stop), | |
32567 | @@ -2673,9 +2673,9 @@ check_depth: | |
32568 | spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags); | |
32569 | atomic_set(&task->task_active, 1); | |
32570 | atomic_set(&task->task_sent, 1); | |
32571 | - atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent); | |
32572 | + atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent); | |
32573 | ||
32574 | - if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) == | |
32575 | + if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) == | |
32576 | T_TASK(cmd)->t_task_cdbs) | |
32577 | atomic_set(&cmd->transport_sent, 1); | |
32578 | ||
32579 | @@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t | |
32580 | atomic_set(&T_TASK(cmd)->transport_lun_stop, 0); | |
32581 | } | |
32582 | if (!atomic_read(&T_TASK(cmd)->t_transport_active) || | |
32583 | - atomic_read(&T_TASK(cmd)->t_transport_aborted)) | |
32584 | + atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted)) | |
32585 | goto remove; | |
32586 | ||
32587 | atomic_set(&T_TASK(cmd)->t_transport_stop, 1); | |
32588 | @@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc | |
32589 | { | |
32590 | int ret = 0; | |
32591 | ||
32592 | - if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) { | |
32593 | + if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) { | |
32594 | if (!(send_status) || | |
32595 | (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS)) | |
32596 | return 1; | |
32597 | @@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se | |
32598 | */ | |
32599 | if (cmd->data_direction == DMA_TO_DEVICE) { | |
32600 | if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) { | |
32601 | - atomic_inc(&T_TASK(cmd)->t_transport_aborted); | |
32602 | + atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted); | |
32603 | smp_mb__after_atomic_inc(); | |
32604 | cmd->scsi_status = SAM_STAT_TASK_ABORTED; | |
32605 | transport_new_cmd_failure(cmd); | |
32606 | @@ -5949,7 +5949,7 @@ static void transport_processing_shutdow | |
32607 | CMD_TFO(cmd)->get_task_tag(cmd), | |
32608 | T_TASK(cmd)->t_task_cdbs, | |
32609 | atomic_read(&T_TASK(cmd)->t_task_cdbs_left), | |
32610 | - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent), | |
32611 | + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent), | |
32612 | atomic_read(&T_TASK(cmd)->t_transport_active), | |
32613 | atomic_read(&T_TASK(cmd)->t_transport_stop), | |
32614 | atomic_read(&T_TASK(cmd)->t_transport_sent)); | |
32615 | diff -urNp linux-3.0.3/drivers/telephony/ixj.c linux-3.0.3/drivers/telephony/ixj.c | |
32616 | --- linux-3.0.3/drivers/telephony/ixj.c 2011-07-21 22:17:23.000000000 -0400 | |
32617 | +++ linux-3.0.3/drivers/telephony/ixj.c 2011-08-23 21:48:14.000000000 -0400 | |
32618 | @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j) | |
32619 | bool mContinue; | |
32620 | char *pIn, *pOut; | |
32621 | ||
32622 | + pax_track_stack(); | |
32623 | + | |
32624 | if (!SCI_Prepare(j)) | |
32625 | return 0; | |
32626 | ||
32627 | diff -urNp linux-3.0.3/drivers/tty/hvc/hvcs.c linux-3.0.3/drivers/tty/hvc/hvcs.c | |
32628 | --- linux-3.0.3/drivers/tty/hvc/hvcs.c 2011-07-21 22:17:23.000000000 -0400 | |
32629 | +++ linux-3.0.3/drivers/tty/hvc/hvcs.c 2011-08-23 21:47:56.000000000 -0400 | |
32630 | @@ -83,6 +83,7 @@ | |
32631 | #include <asm/hvcserver.h> | |
32632 | #include <asm/uaccess.h> | |
32633 | #include <asm/vio.h> | |
32634 | +#include <asm/local.h> | |
32635 | ||
32636 | /* | |
32637 | * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00). | |
32638 | @@ -270,7 +271,7 @@ struct hvcs_struct { | |
32639 | unsigned int index; | |
32640 | ||
32641 | struct tty_struct *tty; | |
32642 | - int open_count; | |
32643 | + local_t open_count; | |
32644 | ||
32645 | /* | |
32646 | * Used to tell the driver kernel_thread what operations need to take | |
32647 | @@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st | |
32648 | ||
32649 | spin_lock_irqsave(&hvcsd->lock, flags); | |
32650 | ||
32651 | - if (hvcsd->open_count > 0) { | |
32652 | + if (local_read(&hvcsd->open_count) > 0) { | |
32653 | spin_unlock_irqrestore(&hvcsd->lock, flags); | |
32654 | printk(KERN_INFO "HVCS: vterm state unchanged. " | |
32655 | "The hvcs device node is still in use.\n"); | |
32656 | @@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct * | |
32657 | if ((retval = hvcs_partner_connect(hvcsd))) | |
32658 | goto error_release; | |
32659 | ||
32660 | - hvcsd->open_count = 1; | |
32661 | + local_set(&hvcsd->open_count, 1); | |
32662 | hvcsd->tty = tty; | |
32663 | tty->driver_data = hvcsd; | |
32664 | ||
32665 | @@ -1179,7 +1180,7 @@ fast_open: | |
32666 | ||
32667 | spin_lock_irqsave(&hvcsd->lock, flags); | |
32668 | kref_get(&hvcsd->kref); | |
32669 | - hvcsd->open_count++; | |
32670 | + local_inc(&hvcsd->open_count); | |
32671 | hvcsd->todo_mask |= HVCS_SCHED_READ; | |
32672 | spin_unlock_irqrestore(&hvcsd->lock, flags); | |
32673 | ||
32674 | @@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct | |
32675 | hvcsd = tty->driver_data; | |
32676 | ||
32677 | spin_lock_irqsave(&hvcsd->lock, flags); | |
32678 | - if (--hvcsd->open_count == 0) { | |
32679 | + if (local_dec_and_test(&hvcsd->open_count)) { | |
32680 | ||
32681 | vio_disable_interrupts(hvcsd->vdev); | |
32682 | ||
32683 | @@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct | |
32684 | free_irq(irq, hvcsd); | |
32685 | kref_put(&hvcsd->kref, destroy_hvcs_struct); | |
32686 | return; | |
32687 | - } else if (hvcsd->open_count < 0) { | |
32688 | + } else if (local_read(&hvcsd->open_count) < 0) { | |
32689 | printk(KERN_ERR "HVCS: vty-server@%X open_count: %d" | |
32690 | " is missmanaged.\n", | |
32691 | - hvcsd->vdev->unit_address, hvcsd->open_count); | |
32692 | + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count)); | |
32693 | } | |
32694 | ||
32695 | spin_unlock_irqrestore(&hvcsd->lock, flags); | |
32696 | @@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc | |
32697 | ||
32698 | spin_lock_irqsave(&hvcsd->lock, flags); | |
32699 | /* Preserve this so that we know how many kref refs to put */ | |
32700 | - temp_open_count = hvcsd->open_count; | |
32701 | + temp_open_count = local_read(&hvcsd->open_count); | |
32702 | ||
32703 | /* | |
32704 | * Don't kref put inside the spinlock because the destruction | |
32705 | @@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc | |
32706 | hvcsd->tty->driver_data = NULL; | |
32707 | hvcsd->tty = NULL; | |
32708 | ||
32709 | - hvcsd->open_count = 0; | |
32710 | + local_set(&hvcsd->open_count, 0); | |
32711 | ||
32712 | /* This will drop any buffered data on the floor which is OK in a hangup | |
32713 | * scenario. */ | |
32714 | @@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct | |
32715 | * the middle of a write operation? This is a crummy place to do this | |
32716 | * but we want to keep it all in the spinlock. | |
32717 | */ | |
32718 | - if (hvcsd->open_count <= 0) { | |
32719 | + if (local_read(&hvcsd->open_count) <= 0) { | |
32720 | spin_unlock_irqrestore(&hvcsd->lock, flags); | |
32721 | return -ENODEV; | |
32722 | } | |
32723 | @@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st | |
32724 | { | |
32725 | struct hvcs_struct *hvcsd = tty->driver_data; | |
32726 | ||
32727 | - if (!hvcsd || hvcsd->open_count <= 0) | |
32728 | + if (!hvcsd || local_read(&hvcsd->open_count) <= 0) | |
32729 | return 0; | |
32730 | ||
32731 | return HVCS_BUFF_LEN - hvcsd->chars_in_buffer; | |
32732 | diff -urNp linux-3.0.3/drivers/tty/ipwireless/tty.c linux-3.0.3/drivers/tty/ipwireless/tty.c | |
32733 | --- linux-3.0.3/drivers/tty/ipwireless/tty.c 2011-07-21 22:17:23.000000000 -0400 | |
32734 | +++ linux-3.0.3/drivers/tty/ipwireless/tty.c 2011-08-23 21:47:56.000000000 -0400 | |
32735 | @@ -29,6 +29,7 @@ | |
32736 | #include <linux/tty_driver.h> | |
32737 | #include <linux/tty_flip.h> | |
32738 | #include <linux/uaccess.h> | |
32739 | +#include <asm/local.h> | |
32740 | ||
32741 | #include "tty.h" | |
32742 | #include "network.h" | |
32743 | @@ -51,7 +52,7 @@ struct ipw_tty { | |
32744 | int tty_type; | |
32745 | struct ipw_network *network; | |
32746 | struct tty_struct *linux_tty; | |
32747 | - int open_count; | |
32748 | + local_t open_count; | |
32749 | unsigned int control_lines; | |
32750 | struct mutex ipw_tty_mutex; | |
32751 | int tx_bytes_queued; | |
32752 | @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l | |
32753 | mutex_unlock(&tty->ipw_tty_mutex); | |
32754 | return -ENODEV; | |
32755 | } | |
32756 | - if (tty->open_count == 0) | |
32757 | + if (local_read(&tty->open_count) == 0) | |
32758 | tty->tx_bytes_queued = 0; | |
32759 | ||
32760 | - tty->open_count++; | |
32761 | + local_inc(&tty->open_count); | |
32762 | ||
32763 | tty->linux_tty = linux_tty; | |
32764 | linux_tty->driver_data = tty; | |
32765 | @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l | |
32766 | ||
32767 | static void do_ipw_close(struct ipw_tty *tty) | |
32768 | { | |
32769 | - tty->open_count--; | |
32770 | - | |
32771 | - if (tty->open_count == 0) { | |
32772 | + if (local_dec_return(&tty->open_count) == 0) { | |
32773 | struct tty_struct *linux_tty = tty->linux_tty; | |
32774 | ||
32775 | if (linux_tty != NULL) { | |
32776 | @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct | |
32777 | return; | |
32778 | ||
32779 | mutex_lock(&tty->ipw_tty_mutex); | |
32780 | - if (tty->open_count == 0) { | |
32781 | + if (local_read(&tty->open_count) == 0) { | |
32782 | mutex_unlock(&tty->ipw_tty_mutex); | |
32783 | return; | |
32784 | } | |
32785 | @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_ | |
32786 | return; | |
32787 | } | |
32788 | ||
32789 | - if (!tty->open_count) { | |
32790 | + if (!local_read(&tty->open_count)) { | |
32791 | mutex_unlock(&tty->ipw_tty_mutex); | |
32792 | return; | |
32793 | } | |
32794 | @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct * | |
32795 | return -ENODEV; | |
32796 | ||
32797 | mutex_lock(&tty->ipw_tty_mutex); | |
32798 | - if (!tty->open_count) { | |
32799 | + if (!local_read(&tty->open_count)) { | |
32800 | mutex_unlock(&tty->ipw_tty_mutex); | |
32801 | return -EINVAL; | |
32802 | } | |
32803 | @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str | |
32804 | if (!tty) | |
32805 | return -ENODEV; | |
32806 | ||
32807 | - if (!tty->open_count) | |
32808 | + if (!local_read(&tty->open_count)) | |
32809 | return -EINVAL; | |
32810 | ||
32811 | room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued; | |
32812 | @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt | |
32813 | if (!tty) | |
32814 | return 0; | |
32815 | ||
32816 | - if (!tty->open_count) | |
32817 | + if (!local_read(&tty->open_count)) | |
32818 | return 0; | |
32819 | ||
32820 | return tty->tx_bytes_queued; | |
32821 | @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc | |
32822 | if (!tty) | |
32823 | return -ENODEV; | |
32824 | ||
32825 | - if (!tty->open_count) | |
32826 | + if (!local_read(&tty->open_count)) | |
32827 | return -EINVAL; | |
32828 | ||
32829 | return get_control_lines(tty); | |
32830 | @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt | |
32831 | if (!tty) | |
32832 | return -ENODEV; | |
32833 | ||
32834 | - if (!tty->open_count) | |
32835 | + if (!local_read(&tty->open_count)) | |
32836 | return -EINVAL; | |
32837 | ||
32838 | return set_control_lines(tty, set, clear); | |
32839 | @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct * | |
32840 | if (!tty) | |
32841 | return -ENODEV; | |
32842 | ||
32843 | - if (!tty->open_count) | |
32844 | + if (!local_read(&tty->open_count)) | |
32845 | return -EINVAL; | |
32846 | ||
32847 | /* FIXME: Exactly how is the tty object locked here .. */ | |
32848 | @@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty | |
32849 | against a parallel ioctl etc */ | |
32850 | mutex_lock(&ttyj->ipw_tty_mutex); | |
32851 | } | |
32852 | - while (ttyj->open_count) | |
32853 | + while (local_read(&ttyj->open_count)) | |
32854 | do_ipw_close(ttyj); | |
32855 | ipwireless_disassociate_network_ttys(network, | |
32856 | ttyj->channel_idx); | |
32857 | diff -urNp linux-3.0.3/drivers/tty/n_gsm.c linux-3.0.3/drivers/tty/n_gsm.c | |
32858 | --- linux-3.0.3/drivers/tty/n_gsm.c 2011-08-23 21:44:40.000000000 -0400 | |
32859 | +++ linux-3.0.3/drivers/tty/n_gsm.c 2011-08-23 21:47:56.000000000 -0400 | |
32860 | @@ -1589,7 +1589,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s | |
32861 | return NULL; | |
32862 | spin_lock_init(&dlci->lock); | |
32863 | dlci->fifo = &dlci->_fifo; | |
32864 | - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) { | |
32865 | + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) { | |
32866 | kfree(dlci); | |
32867 | return NULL; | |
32868 | } | |
32869 | diff -urNp linux-3.0.3/drivers/tty/n_tty.c linux-3.0.3/drivers/tty/n_tty.c | |
32870 | --- linux-3.0.3/drivers/tty/n_tty.c 2011-07-21 22:17:23.000000000 -0400 | |
32871 | +++ linux-3.0.3/drivers/tty/n_tty.c 2011-08-23 21:47:56.000000000 -0400 | |
32872 | @@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ | |
32873 | { | |
32874 | *ops = tty_ldisc_N_TTY; | |
32875 | ops->owner = NULL; | |
32876 | - ops->refcount = ops->flags = 0; | |
32877 | + atomic_set(&ops->refcount, 0); | |
32878 | + ops->flags = 0; | |
32879 | } | |
32880 | EXPORT_SYMBOL_GPL(n_tty_inherit_ops); | |
32881 | diff -urNp linux-3.0.3/drivers/tty/pty.c linux-3.0.3/drivers/tty/pty.c | |
32882 | --- linux-3.0.3/drivers/tty/pty.c 2011-07-21 22:17:23.000000000 -0400 | |
32883 | +++ linux-3.0.3/drivers/tty/pty.c 2011-08-23 21:47:56.000000000 -0400 | |
32884 | @@ -754,8 +754,10 @@ static void __init unix98_pty_init(void) | |
32885 | register_sysctl_table(pty_root_table); | |
32886 | ||
32887 | /* Now create the /dev/ptmx special device */ | |
32888 | + pax_open_kernel(); | |
32889 | tty_default_fops(&ptmx_fops); | |
32890 | - ptmx_fops.open = ptmx_open; | |
32891 | + *(void **)&ptmx_fops.open = ptmx_open; | |
32892 | + pax_close_kernel(); | |
32893 | ||
32894 | cdev_init(&ptmx_cdev, &ptmx_fops); | |
32895 | if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) || | |
32896 | diff -urNp linux-3.0.3/drivers/tty/rocket.c linux-3.0.3/drivers/tty/rocket.c | |
32897 | --- linux-3.0.3/drivers/tty/rocket.c 2011-07-21 22:17:23.000000000 -0400 | |
32898 | +++ linux-3.0.3/drivers/tty/rocket.c 2011-08-23 21:48:14.000000000 -0400 | |
32899 | @@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info | |
32900 | struct rocket_ports tmp; | |
32901 | int board; | |
32902 | ||
32903 | + pax_track_stack(); | |
32904 | + | |
32905 | if (!retports) | |
32906 | return -EFAULT; | |
32907 | memset(&tmp, 0, sizeof (tmp)); | |
32908 | diff -urNp linux-3.0.3/drivers/tty/serial/kgdboc.c linux-3.0.3/drivers/tty/serial/kgdboc.c | |
32909 | --- linux-3.0.3/drivers/tty/serial/kgdboc.c 2011-07-21 22:17:23.000000000 -0400 | |
32910 | +++ linux-3.0.3/drivers/tty/serial/kgdboc.c 2011-08-23 21:47:56.000000000 -0400 | |
32911 | @@ -23,8 +23,9 @@ | |
32912 | #define MAX_CONFIG_LEN 40 | |
32913 | ||
32914 | static struct kgdb_io kgdboc_io_ops; | |
32915 | +static struct kgdb_io kgdboc_io_ops_console; | |
32916 | ||
32917 | -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */ | |
32918 | +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */ | |
32919 | static int configured = -1; | |
32920 | ||
32921 | static char config[MAX_CONFIG_LEN]; | |
32922 | @@ -147,6 +148,8 @@ static void cleanup_kgdboc(void) | |
32923 | kgdboc_unregister_kbd(); | |
32924 | if (configured == 1) | |
32925 | kgdb_unregister_io_module(&kgdboc_io_ops); | |
32926 | + else if (configured == 2) | |
32927 | + kgdb_unregister_io_module(&kgdboc_io_ops_console); | |
32928 | } | |
32929 | ||
32930 | static int configure_kgdboc(void) | |
32931 | @@ -156,13 +159,13 @@ static int configure_kgdboc(void) | |
32932 | int err; | |
32933 | char *cptr = config; | |
32934 | struct console *cons; | |
32935 | + int is_console = 0; | |
32936 | ||
32937 | err = kgdboc_option_setup(config); | |
32938 | if (err || !strlen(config) || isspace(config[0])) | |
32939 | goto noconfig; | |
32940 | ||
32941 | err = -ENODEV; | |
32942 | - kgdboc_io_ops.is_console = 0; | |
32943 | kgdb_tty_driver = NULL; | |
32944 | ||
32945 | kgdboc_use_kms = 0; | |
32946 | @@ -183,7 +186,7 @@ static int configure_kgdboc(void) | |
32947 | int idx; | |
32948 | if (cons->device && cons->device(cons, &idx) == p && | |
32949 | idx == tty_line) { | |
32950 | - kgdboc_io_ops.is_console = 1; | |
32951 | + is_console = 1; | |
32952 | break; | |
32953 | } | |
32954 | cons = cons->next; | |
32955 | @@ -193,12 +196,16 @@ static int configure_kgdboc(void) | |
32956 | kgdb_tty_line = tty_line; | |
32957 | ||
32958 | do_register: | |
32959 | - err = kgdb_register_io_module(&kgdboc_io_ops); | |
32960 | + if (is_console) { | |
32961 | + err = kgdb_register_io_module(&kgdboc_io_ops_console); | |
32962 | + configured = 2; | |
32963 | + } else { | |
32964 | + err = kgdb_register_io_module(&kgdboc_io_ops); | |
32965 | + configured = 1; | |
32966 | + } | |
32967 | if (err) | |
32968 | goto noconfig; | |
32969 | ||
32970 | - configured = 1; | |
32971 | - | |
32972 | return 0; | |
32973 | ||
32974 | noconfig: | |
32975 | @@ -212,7 +219,7 @@ noconfig: | |
32976 | static int __init init_kgdboc(void) | |
32977 | { | |
32978 | /* Already configured? */ | |
32979 | - if (configured == 1) | |
32980 | + if (configured >= 1) | |
32981 | return 0; | |
32982 | ||
32983 | return configure_kgdboc(); | |
32984 | @@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const ch | |
32985 | if (config[len - 1] == '\n') | |
32986 | config[len - 1] = '\0'; | |
32987 | ||
32988 | - if (configured == 1) | |
32989 | + if (configured >= 1) | |
32990 | cleanup_kgdboc(); | |
32991 | ||
32992 | /* Go and configure with the new params. */ | |
32993 | @@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = { | |
32994 | .post_exception = kgdboc_post_exp_handler, | |
32995 | }; | |
32996 | ||
32997 | +static struct kgdb_io kgdboc_io_ops_console = { | |
32998 | + .name = "kgdboc", | |
32999 | + .read_char = kgdboc_get_char, | |
33000 | + .write_char = kgdboc_put_char, | |
33001 | + .pre_exception = kgdboc_pre_exp_handler, | |
33002 | + .post_exception = kgdboc_post_exp_handler, | |
33003 | + .is_console = 1 | |
33004 | +}; | |
33005 | + | |
33006 | #ifdef CONFIG_KGDB_SERIAL_CONSOLE | |
33007 | /* This is only available if kgdboc is a built in for early debugging */ | |
33008 | static int __init kgdboc_early_init(char *opt) | |
33009 | diff -urNp linux-3.0.3/drivers/tty/serial/mrst_max3110.c linux-3.0.3/drivers/tty/serial/mrst_max3110.c | |
33010 | --- linux-3.0.3/drivers/tty/serial/mrst_max3110.c 2011-07-21 22:17:23.000000000 -0400 | |
33011 | +++ linux-3.0.3/drivers/tty/serial/mrst_max3110.c 2011-08-23 21:48:14.000000000 -0400 | |
33012 | @@ -393,6 +393,8 @@ static void max3110_con_receive(struct u | |
33013 | int loop = 1, num, total = 0; | |
33014 | u8 recv_buf[512], *pbuf; | |
33015 | ||
33016 | + pax_track_stack(); | |
33017 | + | |
33018 | pbuf = recv_buf; | |
33019 | do { | |
33020 | num = max3110_read_multi(max, pbuf); | |
33021 | diff -urNp linux-3.0.3/drivers/tty/tty_io.c linux-3.0.3/drivers/tty/tty_io.c | |
33022 | --- linux-3.0.3/drivers/tty/tty_io.c 2011-07-21 22:17:23.000000000 -0400 | |
33023 | +++ linux-3.0.3/drivers/tty/tty_io.c 2011-08-23 21:47:56.000000000 -0400 | |
33024 | @@ -3215,7 +3215,7 @@ EXPORT_SYMBOL_GPL(get_current_tty); | |
33025 | ||
33026 | void tty_default_fops(struct file_operations *fops) | |
33027 | { | |
33028 | - *fops = tty_fops; | |
33029 | + memcpy((void *)fops, &tty_fops, sizeof(tty_fops)); | |
33030 | } | |
33031 | ||
33032 | /* | |
33033 | diff -urNp linux-3.0.3/drivers/tty/tty_ldisc.c linux-3.0.3/drivers/tty/tty_ldisc.c | |
33034 | --- linux-3.0.3/drivers/tty/tty_ldisc.c 2011-07-21 22:17:23.000000000 -0400 | |
33035 | +++ linux-3.0.3/drivers/tty/tty_ldisc.c 2011-08-23 21:47:56.000000000 -0400 | |
33036 | @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc * | |
33037 | if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) { | |
33038 | struct tty_ldisc_ops *ldo = ld->ops; | |
33039 | ||
33040 | - ldo->refcount--; | |
33041 | + atomic_dec(&ldo->refcount); | |
33042 | module_put(ldo->owner); | |
33043 | spin_unlock_irqrestore(&tty_ldisc_lock, flags); | |
33044 | ||
33045 | @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct | |
33046 | spin_lock_irqsave(&tty_ldisc_lock, flags); | |
33047 | tty_ldiscs[disc] = new_ldisc; | |
33048 | new_ldisc->num = disc; | |
33049 | - new_ldisc->refcount = 0; | |
33050 | + atomic_set(&new_ldisc->refcount, 0); | |
33051 | spin_unlock_irqrestore(&tty_ldisc_lock, flags); | |
33052 | ||
33053 | return ret; | |
33054 | @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc) | |
33055 | return -EINVAL; | |
33056 | ||
33057 | spin_lock_irqsave(&tty_ldisc_lock, flags); | |
33058 | - if (tty_ldiscs[disc]->refcount) | |
33059 | + if (atomic_read(&tty_ldiscs[disc]->refcount)) | |
33060 | ret = -EBUSY; | |
33061 | else | |
33062 | tty_ldiscs[disc] = NULL; | |
33063 | @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i | |
33064 | if (ldops) { | |
33065 | ret = ERR_PTR(-EAGAIN); | |
33066 | if (try_module_get(ldops->owner)) { | |
33067 | - ldops->refcount++; | |
33068 | + atomic_inc(&ldops->refcount); | |
33069 | ret = ldops; | |
33070 | } | |
33071 | } | |
33072 | @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o | |
33073 | unsigned long flags; | |
33074 | ||
33075 | spin_lock_irqsave(&tty_ldisc_lock, flags); | |
33076 | - ldops->refcount--; | |
33077 | + atomic_dec(&ldops->refcount); | |
33078 | module_put(ldops->owner); | |
33079 | spin_unlock_irqrestore(&tty_ldisc_lock, flags); | |
33080 | } | |
33081 | diff -urNp linux-3.0.3/drivers/tty/vt/keyboard.c linux-3.0.3/drivers/tty/vt/keyboard.c | |
33082 | --- linux-3.0.3/drivers/tty/vt/keyboard.c 2011-07-21 22:17:23.000000000 -0400 | |
33083 | +++ linux-3.0.3/drivers/tty/vt/keyboard.c 2011-08-23 21:48:14.000000000 -0400 | |
33084 | @@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, u | |
33085 | kbd->kbdmode == VC_OFF) && | |
33086 | value != KVAL(K_SAK)) | |
33087 | return; /* SAK is allowed even in raw mode */ | |
33088 | + | |
33089 | +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP) | |
33090 | + { | |
33091 | + void *func = fn_handler[value]; | |
33092 | + if (func == fn_show_state || func == fn_show_ptregs || | |
33093 | + func == fn_show_mem) | |
33094 | + return; | |
33095 | + } | |
33096 | +#endif | |
33097 | + | |
33098 | fn_handler[value](vc); | |
33099 | } | |
33100 | ||
33101 | diff -urNp linux-3.0.3/drivers/tty/vt/vt.c linux-3.0.3/drivers/tty/vt/vt.c | |
33102 | --- linux-3.0.3/drivers/tty/vt/vt.c 2011-07-21 22:17:23.000000000 -0400 | |
33103 | +++ linux-3.0.3/drivers/tty/vt/vt.c 2011-08-23 21:47:56.000000000 -0400 | |
33104 | @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier | |
33105 | ||
33106 | static void notify_write(struct vc_data *vc, unsigned int unicode) | |
33107 | { | |
33108 | - struct vt_notifier_param param = { .vc = vc, unicode = unicode }; | |
33109 | + struct vt_notifier_param param = { .vc = vc, .c = unicode }; | |
33110 | atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m); | |
33111 | } | |
33112 | ||
33113 | diff -urNp linux-3.0.3/drivers/tty/vt/vt_ioctl.c linux-3.0.3/drivers/tty/vt/vt_ioctl.c | |
33114 | --- linux-3.0.3/drivers/tty/vt/vt_ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
33115 | +++ linux-3.0.3/drivers/tty/vt/vt_ioctl.c 2011-08-23 21:48:14.000000000 -0400 | |
33116 | @@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __ | |
33117 | if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry))) | |
33118 | return -EFAULT; | |
33119 | ||
33120 | - if (!capable(CAP_SYS_TTY_CONFIG)) | |
33121 | - perm = 0; | |
33122 | - | |
33123 | switch (cmd) { | |
33124 | case KDGKBENT: | |
33125 | key_map = key_maps[s]; | |
33126 | @@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __ | |
33127 | val = (i ? K_HOLE : K_NOSUCHMAP); | |
33128 | return put_user(val, &user_kbe->kb_value); | |
33129 | case KDSKBENT: | |
33130 | + if (!capable(CAP_SYS_TTY_CONFIG)) | |
33131 | + perm = 0; | |
33132 | + | |
33133 | if (!perm) | |
33134 | return -EPERM; | |
33135 | if (!i && v == K_NOSUCHMAP) { | |
33136 | @@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry | |
33137 | int i, j, k; | |
33138 | int ret; | |
33139 | ||
33140 | - if (!capable(CAP_SYS_TTY_CONFIG)) | |
33141 | - perm = 0; | |
33142 | - | |
33143 | kbs = kmalloc(sizeof(*kbs), GFP_KERNEL); | |
33144 | if (!kbs) { | |
33145 | ret = -ENOMEM; | |
33146 | @@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry | |
33147 | kfree(kbs); | |
33148 | return ((p && *p) ? -EOVERFLOW : 0); | |
33149 | case KDSKBSENT: | |
33150 | + if (!capable(CAP_SYS_TTY_CONFIG)) | |
33151 | + perm = 0; | |
33152 | + | |
33153 | if (!perm) { | |
33154 | ret = -EPERM; | |
33155 | goto reterr; | |
33156 | diff -urNp linux-3.0.3/drivers/uio/uio.c linux-3.0.3/drivers/uio/uio.c | |
33157 | --- linux-3.0.3/drivers/uio/uio.c 2011-07-21 22:17:23.000000000 -0400 | |
33158 | +++ linux-3.0.3/drivers/uio/uio.c 2011-08-23 21:47:56.000000000 -0400 | |
33159 | @@ -25,6 +25,7 @@ | |
33160 | #include <linux/kobject.h> | |
33161 | #include <linux/cdev.h> | |
33162 | #include <linux/uio_driver.h> | |
33163 | +#include <asm/local.h> | |
33164 | ||
33165 | #define UIO_MAX_DEVICES (1U << MINORBITS) | |
33166 | ||
33167 | @@ -32,10 +33,10 @@ struct uio_device { | |
33168 | struct module *owner; | |
33169 | struct device *dev; | |
33170 | int minor; | |
33171 | - atomic_t event; | |
33172 | + atomic_unchecked_t event; | |
33173 | struct fasync_struct *async_queue; | |
33174 | wait_queue_head_t wait; | |
33175 | - int vma_count; | |
33176 | + local_t vma_count; | |
33177 | struct uio_info *info; | |
33178 | struct kobject *map_dir; | |
33179 | struct kobject *portio_dir; | |
33180 | @@ -242,7 +243,7 @@ static ssize_t show_event(struct device | |
33181 | struct device_attribute *attr, char *buf) | |
33182 | { | |
33183 | struct uio_device *idev = dev_get_drvdata(dev); | |
33184 | - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event)); | |
33185 | + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event)); | |
33186 | } | |
33187 | ||
33188 | static struct device_attribute uio_class_attributes[] = { | |
33189 | @@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *i | |
33190 | { | |
33191 | struct uio_device *idev = info->uio_dev; | |
33192 | ||
33193 | - atomic_inc(&idev->event); | |
33194 | + atomic_inc_unchecked(&idev->event); | |
33195 | wake_up_interruptible(&idev->wait); | |
33196 | kill_fasync(&idev->async_queue, SIGIO, POLL_IN); | |
33197 | } | |
33198 | @@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, | |
33199 | } | |
33200 | ||
33201 | listener->dev = idev; | |
33202 | - listener->event_count = atomic_read(&idev->event); | |
33203 | + listener->event_count = atomic_read_unchecked(&idev->event); | |
33204 | filep->private_data = listener; | |
33205 | ||
33206 | if (idev->info->open) { | |
33207 | @@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file | |
33208 | return -EIO; | |
33209 | ||
33210 | poll_wait(filep, &idev->wait, wait); | |
33211 | - if (listener->event_count != atomic_read(&idev->event)) | |
33212 | + if (listener->event_count != atomic_read_unchecked(&idev->event)) | |
33213 | return POLLIN | POLLRDNORM; | |
33214 | return 0; | |
33215 | } | |
33216 | @@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *fil | |
33217 | do { | |
33218 | set_current_state(TASK_INTERRUPTIBLE); | |
33219 | ||
33220 | - event_count = atomic_read(&idev->event); | |
33221 | + event_count = atomic_read_unchecked(&idev->event); | |
33222 | if (event_count != listener->event_count) { | |
33223 | if (copy_to_user(buf, &event_count, count)) | |
33224 | retval = -EFAULT; | |
33225 | @@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_ | |
33226 | static void uio_vma_open(struct vm_area_struct *vma) | |
33227 | { | |
33228 | struct uio_device *idev = vma->vm_private_data; | |
33229 | - idev->vma_count++; | |
33230 | + local_inc(&idev->vma_count); | |
33231 | } | |
33232 | ||
33233 | static void uio_vma_close(struct vm_area_struct *vma) | |
33234 | { | |
33235 | struct uio_device *idev = vma->vm_private_data; | |
33236 | - idev->vma_count--; | |
33237 | + local_dec(&idev->vma_count); | |
33238 | } | |
33239 | ||
33240 | static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf) | |
33241 | @@ -823,7 +824,7 @@ int __uio_register_device(struct module | |
33242 | idev->owner = owner; | |
33243 | idev->info = info; | |
33244 | init_waitqueue_head(&idev->wait); | |
33245 | - atomic_set(&idev->event, 0); | |
33246 | + atomic_set_unchecked(&idev->event, 0); | |
33247 | ||
33248 | ret = uio_get_minor(idev); | |
33249 | if (ret) | |
33250 | diff -urNp linux-3.0.3/drivers/usb/atm/cxacru.c linux-3.0.3/drivers/usb/atm/cxacru.c | |
33251 | --- linux-3.0.3/drivers/usb/atm/cxacru.c 2011-07-21 22:17:23.000000000 -0400 | |
33252 | +++ linux-3.0.3/drivers/usb/atm/cxacru.c 2011-08-23 21:47:56.000000000 -0400 | |
33253 | @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c | |
33254 | ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp); | |
33255 | if (ret < 2) | |
33256 | return -EINVAL; | |
33257 | - if (index < 0 || index > 0x7f) | |
33258 | + if (index > 0x7f) | |
33259 | return -EINVAL; | |
33260 | pos += tmp; | |
33261 | ||
33262 | diff -urNp linux-3.0.3/drivers/usb/atm/usbatm.c linux-3.0.3/drivers/usb/atm/usbatm.c | |
33263 | --- linux-3.0.3/drivers/usb/atm/usbatm.c 2011-07-21 22:17:23.000000000 -0400 | |
33264 | +++ linux-3.0.3/drivers/usb/atm/usbatm.c 2011-08-23 21:47:56.000000000 -0400 | |
33265 | @@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru | |
33266 | if (printk_ratelimit()) | |
33267 | atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n", | |
33268 | __func__, vpi, vci); | |
33269 | - atomic_inc(&vcc->stats->rx_err); | |
33270 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
33271 | return; | |
33272 | } | |
33273 | ||
33274 | @@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru | |
33275 | if (length > ATM_MAX_AAL5_PDU) { | |
33276 | atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n", | |
33277 | __func__, length, vcc); | |
33278 | - atomic_inc(&vcc->stats->rx_err); | |
33279 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
33280 | goto out; | |
33281 | } | |
33282 | ||
33283 | @@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru | |
33284 | if (sarb->len < pdu_length) { | |
33285 | atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n", | |
33286 | __func__, pdu_length, sarb->len, vcc); | |
33287 | - atomic_inc(&vcc->stats->rx_err); | |
33288 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
33289 | goto out; | |
33290 | } | |
33291 | ||
33292 | if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) { | |
33293 | atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n", | |
33294 | __func__, vcc); | |
33295 | - atomic_inc(&vcc->stats->rx_err); | |
33296 | + atomic_inc_unchecked(&vcc->stats->rx_err); | |
33297 | goto out; | |
33298 | } | |
33299 | ||
33300 | @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru | |
33301 | if (printk_ratelimit()) | |
33302 | atm_err(instance, "%s: no memory for skb (length: %u)!\n", | |
33303 | __func__, length); | |
33304 | - atomic_inc(&vcc->stats->rx_drop); | |
33305 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
33306 | goto out; | |
33307 | } | |
33308 | ||
33309 | @@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru | |
33310 | ||
33311 | vcc->push(vcc, skb); | |
33312 | ||
33313 | - atomic_inc(&vcc->stats->rx); | |
33314 | + atomic_inc_unchecked(&vcc->stats->rx); | |
33315 | out: | |
33316 | skb_trim(sarb, 0); | |
33317 | } | |
33318 | @@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l | |
33319 | struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc; | |
33320 | ||
33321 | usbatm_pop(vcc, skb); | |
33322 | - atomic_inc(&vcc->stats->tx); | |
33323 | + atomic_inc_unchecked(&vcc->stats->tx); | |
33324 | ||
33325 | skb = skb_dequeue(&instance->sndqueue); | |
33326 | } | |
33327 | @@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a | |
33328 | if (!left--) | |
33329 | return sprintf(page, | |
33330 | "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n", | |
33331 | - atomic_read(&atm_dev->stats.aal5.tx), | |
33332 | - atomic_read(&atm_dev->stats.aal5.tx_err), | |
33333 | - atomic_read(&atm_dev->stats.aal5.rx), | |
33334 | - atomic_read(&atm_dev->stats.aal5.rx_err), | |
33335 | - atomic_read(&atm_dev->stats.aal5.rx_drop)); | |
33336 | + atomic_read_unchecked(&atm_dev->stats.aal5.tx), | |
33337 | + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err), | |
33338 | + atomic_read_unchecked(&atm_dev->stats.aal5.rx), | |
33339 | + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err), | |
33340 | + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop)); | |
33341 | ||
33342 | if (!left--) { | |
33343 | if (instance->disconnected) | |
33344 | diff -urNp linux-3.0.3/drivers/usb/core/devices.c linux-3.0.3/drivers/usb/core/devices.c | |
33345 | --- linux-3.0.3/drivers/usb/core/devices.c 2011-07-21 22:17:23.000000000 -0400 | |
33346 | +++ linux-3.0.3/drivers/usb/core/devices.c 2011-08-23 21:47:56.000000000 -0400 | |
33347 | @@ -126,7 +126,7 @@ static const char format_endpt[] = | |
33348 | * time it gets called. | |
33349 | */ | |
33350 | static struct device_connect_event { | |
33351 | - atomic_t count; | |
33352 | + atomic_unchecked_t count; | |
33353 | wait_queue_head_t wait; | |
33354 | } device_event = { | |
33355 | .count = ATOMIC_INIT(1), | |
33356 | @@ -164,7 +164,7 @@ static const struct class_info clas_info | |
33357 | ||
33358 | void usbfs_conn_disc_event(void) | |
33359 | { | |
33360 | - atomic_add(2, &device_event.count); | |
33361 | + atomic_add_unchecked(2, &device_event.count); | |
33362 | wake_up(&device_event.wait); | |
33363 | } | |
33364 | ||
33365 | @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru | |
33366 | ||
33367 | poll_wait(file, &device_event.wait, wait); | |
33368 | ||
33369 | - event_count = atomic_read(&device_event.count); | |
33370 | + event_count = atomic_read_unchecked(&device_event.count); | |
33371 | if (file->f_version != event_count) { | |
33372 | file->f_version = event_count; | |
33373 | return POLLIN | POLLRDNORM; | |
33374 | diff -urNp linux-3.0.3/drivers/usb/core/message.c linux-3.0.3/drivers/usb/core/message.c | |
33375 | --- linux-3.0.3/drivers/usb/core/message.c 2011-07-21 22:17:23.000000000 -0400 | |
33376 | +++ linux-3.0.3/drivers/usb/core/message.c 2011-08-23 21:47:56.000000000 -0400 | |
33377 | @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device | |
33378 | buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO); | |
33379 | if (buf) { | |
33380 | len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE); | |
33381 | - if (len > 0) { | |
33382 | - smallbuf = kmalloc(++len, GFP_NOIO); | |
33383 | + if (len++ > 0) { | |
33384 | + smallbuf = kmalloc(len, GFP_NOIO); | |
33385 | if (!smallbuf) | |
33386 | return buf; | |
33387 | memcpy(smallbuf, buf, len); | |
33388 | diff -urNp linux-3.0.3/drivers/usb/early/ehci-dbgp.c linux-3.0.3/drivers/usb/early/ehci-dbgp.c | |
33389 | --- linux-3.0.3/drivers/usb/early/ehci-dbgp.c 2011-07-21 22:17:23.000000000 -0400 | |
33390 | +++ linux-3.0.3/drivers/usb/early/ehci-dbgp.c 2011-08-23 21:47:56.000000000 -0400 | |
33391 | @@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, | |
33392 | ||
33393 | #ifdef CONFIG_KGDB | |
33394 | static struct kgdb_io kgdbdbgp_io_ops; | |
33395 | -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops) | |
33396 | +static struct kgdb_io kgdbdbgp_io_ops_console; | |
33397 | +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console) | |
33398 | #else | |
33399 | #define dbgp_kgdb_mode (0) | |
33400 | #endif | |
33401 | @@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = | |
33402 | .write_char = kgdbdbgp_write_char, | |
33403 | }; | |
33404 | ||
33405 | +static struct kgdb_io kgdbdbgp_io_ops_console = { | |
33406 | + .name = "kgdbdbgp", | |
33407 | + .read_char = kgdbdbgp_read_char, | |
33408 | + .write_char = kgdbdbgp_write_char, | |
33409 | + .is_console = 1 | |
33410 | +}; | |
33411 | + | |
33412 | static int kgdbdbgp_wait_time; | |
33413 | ||
33414 | static int __init kgdbdbgp_parse_config(char *str) | |
33415 | @@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config( | |
33416 | ptr++; | |
33417 | kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10); | |
33418 | } | |
33419 | - kgdb_register_io_module(&kgdbdbgp_io_ops); | |
33420 | - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1; | |
33421 | + if (early_dbgp_console.index != -1) | |
33422 | + kgdb_register_io_module(&kgdbdbgp_io_ops_console); | |
33423 | + else | |
33424 | + kgdb_register_io_module(&kgdbdbgp_io_ops); | |
33425 | ||
33426 | return 0; | |
33427 | } | |
33428 | diff -urNp linux-3.0.3/drivers/usb/host/xhci-mem.c linux-3.0.3/drivers/usb/host/xhci-mem.c | |
33429 | --- linux-3.0.3/drivers/usb/host/xhci-mem.c 2011-07-21 22:17:23.000000000 -0400 | |
33430 | +++ linux-3.0.3/drivers/usb/host/xhci-mem.c 2011-08-23 21:48:14.000000000 -0400 | |
33431 | @@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(str | |
33432 | unsigned int num_tests; | |
33433 | int i, ret; | |
33434 | ||
33435 | + pax_track_stack(); | |
33436 | + | |
33437 | num_tests = ARRAY_SIZE(simple_test_vector); | |
33438 | for (i = 0; i < num_tests; i++) { | |
33439 | ret = xhci_test_trb_in_td(xhci, | |
33440 | diff -urNp linux-3.0.3/drivers/usb/wusbcore/wa-hc.h linux-3.0.3/drivers/usb/wusbcore/wa-hc.h | |
33441 | --- linux-3.0.3/drivers/usb/wusbcore/wa-hc.h 2011-07-21 22:17:23.000000000 -0400 | |
33442 | +++ linux-3.0.3/drivers/usb/wusbcore/wa-hc.h 2011-08-23 21:47:56.000000000 -0400 | |
33443 | @@ -192,7 +192,7 @@ struct wahc { | |
33444 | struct list_head xfer_delayed_list; | |
33445 | spinlock_t xfer_list_lock; | |
33446 | struct work_struct xfer_work; | |
33447 | - atomic_t xfer_id_count; | |
33448 | + atomic_unchecked_t xfer_id_count; | |
33449 | }; | |
33450 | ||
33451 | ||
33452 | @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc * | |
33453 | INIT_LIST_HEAD(&wa->xfer_delayed_list); | |
33454 | spin_lock_init(&wa->xfer_list_lock); | |
33455 | INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run); | |
33456 | - atomic_set(&wa->xfer_id_count, 1); | |
33457 | + atomic_set_unchecked(&wa->xfer_id_count, 1); | |
33458 | } | |
33459 | ||
33460 | /** | |
33461 | diff -urNp linux-3.0.3/drivers/usb/wusbcore/wa-xfer.c linux-3.0.3/drivers/usb/wusbcore/wa-xfer.c | |
33462 | --- linux-3.0.3/drivers/usb/wusbcore/wa-xfer.c 2011-07-21 22:17:23.000000000 -0400 | |
33463 | +++ linux-3.0.3/drivers/usb/wusbcore/wa-xfer.c 2011-08-23 21:47:56.000000000 -0400 | |
33464 | @@ -294,7 +294,7 @@ out: | |
33465 | */ | |
33466 | static void wa_xfer_id_init(struct wa_xfer *xfer) | |
33467 | { | |
33468 | - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count); | |
33469 | + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count); | |
33470 | } | |
33471 | ||
33472 | /* | |
33473 | diff -urNp linux-3.0.3/drivers/vhost/vhost.c linux-3.0.3/drivers/vhost/vhost.c | |
33474 | --- linux-3.0.3/drivers/vhost/vhost.c 2011-07-21 22:17:23.000000000 -0400 | |
33475 | +++ linux-3.0.3/drivers/vhost/vhost.c 2011-08-23 21:47:56.000000000 -0400 | |
33476 | @@ -589,7 +589,7 @@ static int init_used(struct vhost_virtqu | |
33477 | return get_user(vq->last_used_idx, &used->idx); | |
33478 | } | |
33479 | ||
33480 | -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp) | |
33481 | +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp) | |
33482 | { | |
33483 | struct file *eventfp, *filep = NULL, | |
33484 | *pollstart = NULL, *pollstop = NULL; | |
33485 | diff -urNp linux-3.0.3/drivers/video/fbcmap.c linux-3.0.3/drivers/video/fbcmap.c | |
33486 | --- linux-3.0.3/drivers/video/fbcmap.c 2011-07-21 22:17:23.000000000 -0400 | |
33487 | +++ linux-3.0.3/drivers/video/fbcmap.c 2011-08-23 21:47:56.000000000 -0400 | |
33488 | @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user | |
33489 | rc = -ENODEV; | |
33490 | goto out; | |
33491 | } | |
33492 | - if (cmap->start < 0 || (!info->fbops->fb_setcolreg && | |
33493 | - !info->fbops->fb_setcmap)) { | |
33494 | + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) { | |
33495 | rc = -EINVAL; | |
33496 | goto out1; | |
33497 | } | |
33498 | diff -urNp linux-3.0.3/drivers/video/fbmem.c linux-3.0.3/drivers/video/fbmem.c | |
33499 | --- linux-3.0.3/drivers/video/fbmem.c 2011-07-21 22:17:23.000000000 -0400 | |
33500 | +++ linux-3.0.3/drivers/video/fbmem.c 2011-08-23 21:48:14.000000000 -0400 | |
33501 | @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in | |
33502 | image->dx += image->width + 8; | |
33503 | } | |
33504 | } else if (rotate == FB_ROTATE_UD) { | |
33505 | - for (x = 0; x < num && image->dx >= 0; x++) { | |
33506 | + for (x = 0; x < num && (__s32)image->dx >= 0; x++) { | |
33507 | info->fbops->fb_imageblit(info, image); | |
33508 | image->dx -= image->width + 8; | |
33509 | } | |
33510 | @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in | |
33511 | image->dy += image->height + 8; | |
33512 | } | |
33513 | } else if (rotate == FB_ROTATE_CCW) { | |
33514 | - for (x = 0; x < num && image->dy >= 0; x++) { | |
33515 | + for (x = 0; x < num && (__s32)image->dy >= 0; x++) { | |
33516 | info->fbops->fb_imageblit(info, image); | |
33517 | image->dy -= image->height + 8; | |
33518 | } | |
33519 | @@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct | |
33520 | int flags = info->flags; | |
33521 | int ret = 0; | |
33522 | ||
33523 | + pax_track_stack(); | |
33524 | + | |
33525 | if (var->activate & FB_ACTIVATE_INV_MODE) { | |
33526 | struct fb_videomode mode1, mode2; | |
33527 | ||
33528 | @@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info * | |
33529 | void __user *argp = (void __user *)arg; | |
33530 | long ret = 0; | |
33531 | ||
33532 | + pax_track_stack(); | |
33533 | + | |
33534 | switch (cmd) { | |
33535 | case FBIOGET_VSCREENINFO: | |
33536 | if (!lock_fb_info(info)) | |
33537 | @@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info * | |
33538 | return -EFAULT; | |
33539 | if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES) | |
33540 | return -EINVAL; | |
33541 | - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX) | |
33542 | + if (con2fb.framebuffer >= FB_MAX) | |
33543 | return -EINVAL; | |
33544 | if (!registered_fb[con2fb.framebuffer]) | |
33545 | request_module("fb%d", con2fb.framebuffer); | |
33546 | diff -urNp linux-3.0.3/drivers/video/i810/i810_accel.c linux-3.0.3/drivers/video/i810/i810_accel.c | |
33547 | --- linux-3.0.3/drivers/video/i810/i810_accel.c 2011-07-21 22:17:23.000000000 -0400 | |
33548 | +++ linux-3.0.3/drivers/video/i810/i810_accel.c 2011-08-23 21:47:56.000000000 -0400 | |
33549 | @@ -73,6 +73,7 @@ static inline int wait_for_space(struct | |
33550 | } | |
33551 | } | |
33552 | printk("ringbuffer lockup!!!\n"); | |
33553 | + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space); | |
33554 | i810_report_error(mmio); | |
33555 | par->dev_flags |= LOCKUP; | |
33556 | info->pixmap.scan_align = 1; | |
33557 | diff -urNp linux-3.0.3/drivers/video/udlfb.c linux-3.0.3/drivers/video/udlfb.c | |
33558 | --- linux-3.0.3/drivers/video/udlfb.c 2011-07-21 22:17:23.000000000 -0400 | |
33559 | +++ linux-3.0.3/drivers/video/udlfb.c 2011-08-23 21:47:56.000000000 -0400 | |
33560 | @@ -586,11 +586,11 @@ int dlfb_handle_damage(struct dlfb_data | |
33561 | dlfb_urb_completion(urb); | |
33562 | ||
33563 | error: | |
33564 | - atomic_add(bytes_sent, &dev->bytes_sent); | |
33565 | - atomic_add(bytes_identical, &dev->bytes_identical); | |
33566 | - atomic_add(width*height*2, &dev->bytes_rendered); | |
33567 | + atomic_add_unchecked(bytes_sent, &dev->bytes_sent); | |
33568 | + atomic_add_unchecked(bytes_identical, &dev->bytes_identical); | |
33569 | + atomic_add_unchecked(width*height*2, &dev->bytes_rendered); | |
33570 | end_cycles = get_cycles(); | |
33571 | - atomic_add(((unsigned int) ((end_cycles - start_cycles) | |
33572 | + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles) | |
33573 | >> 10)), /* Kcycles */ | |
33574 | &dev->cpu_kcycles_used); | |
33575 | ||
33576 | @@ -711,11 +711,11 @@ static void dlfb_dpy_deferred_io(struct | |
33577 | dlfb_urb_completion(urb); | |
33578 | ||
33579 | error: | |
33580 | - atomic_add(bytes_sent, &dev->bytes_sent); | |
33581 | - atomic_add(bytes_identical, &dev->bytes_identical); | |
33582 | - atomic_add(bytes_rendered, &dev->bytes_rendered); | |
33583 | + atomic_add_unchecked(bytes_sent, &dev->bytes_sent); | |
33584 | + atomic_add_unchecked(bytes_identical, &dev->bytes_identical); | |
33585 | + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered); | |
33586 | end_cycles = get_cycles(); | |
33587 | - atomic_add(((unsigned int) ((end_cycles - start_cycles) | |
33588 | + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles) | |
33589 | >> 10)), /* Kcycles */ | |
33590 | &dev->cpu_kcycles_used); | |
33591 | } | |
33592 | @@ -1307,7 +1307,7 @@ static ssize_t metrics_bytes_rendered_sh | |
33593 | struct fb_info *fb_info = dev_get_drvdata(fbdev); | |
33594 | struct dlfb_data *dev = fb_info->par; | |
33595 | return snprintf(buf, PAGE_SIZE, "%u\n", | |
33596 | - atomic_read(&dev->bytes_rendered)); | |
33597 | + atomic_read_unchecked(&dev->bytes_rendered)); | |
33598 | } | |
33599 | ||
33600 | static ssize_t metrics_bytes_identical_show(struct device *fbdev, | |
33601 | @@ -1315,7 +1315,7 @@ static ssize_t metrics_bytes_identical_s | |
33602 | struct fb_info *fb_info = dev_get_drvdata(fbdev); | |
33603 | struct dlfb_data *dev = fb_info->par; | |
33604 | return snprintf(buf, PAGE_SIZE, "%u\n", | |
33605 | - atomic_read(&dev->bytes_identical)); | |
33606 | + atomic_read_unchecked(&dev->bytes_identical)); | |
33607 | } | |
33608 | ||
33609 | static ssize_t metrics_bytes_sent_show(struct device *fbdev, | |
33610 | @@ -1323,7 +1323,7 @@ static ssize_t metrics_bytes_sent_show(s | |
33611 | struct fb_info *fb_info = dev_get_drvdata(fbdev); | |
33612 | struct dlfb_data *dev = fb_info->par; | |
33613 | return snprintf(buf, PAGE_SIZE, "%u\n", | |
33614 | - atomic_read(&dev->bytes_sent)); | |
33615 | + atomic_read_unchecked(&dev->bytes_sent)); | |
33616 | } | |
33617 | ||
33618 | static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, | |
33619 | @@ -1331,7 +1331,7 @@ static ssize_t metrics_cpu_kcycles_used_ | |
33620 | struct fb_info *fb_info = dev_get_drvdata(fbdev); | |
33621 | struct dlfb_data *dev = fb_info->par; | |
33622 | return snprintf(buf, PAGE_SIZE, "%u\n", | |
33623 | - atomic_read(&dev->cpu_kcycles_used)); | |
33624 | + atomic_read_unchecked(&dev->cpu_kcycles_used)); | |
33625 | } | |
33626 | ||
33627 | static ssize_t edid_show( | |
33628 | @@ -1388,10 +1388,10 @@ static ssize_t metrics_reset_store(struc | |
33629 | struct fb_info *fb_info = dev_get_drvdata(fbdev); | |
33630 | struct dlfb_data *dev = fb_info->par; | |
33631 | ||
33632 | - atomic_set(&dev->bytes_rendered, 0); | |
33633 | - atomic_set(&dev->bytes_identical, 0); | |
33634 | - atomic_set(&dev->bytes_sent, 0); | |
33635 | - atomic_set(&dev->cpu_kcycles_used, 0); | |
33636 | + atomic_set_unchecked(&dev->bytes_rendered, 0); | |
33637 | + atomic_set_unchecked(&dev->bytes_identical, 0); | |
33638 | + atomic_set_unchecked(&dev->bytes_sent, 0); | |
33639 | + atomic_set_unchecked(&dev->cpu_kcycles_used, 0); | |
33640 | ||
33641 | return count; | |
33642 | } | |
33643 | diff -urNp linux-3.0.3/drivers/video/uvesafb.c linux-3.0.3/drivers/video/uvesafb.c | |
33644 | --- linux-3.0.3/drivers/video/uvesafb.c 2011-07-21 22:17:23.000000000 -0400 | |
33645 | +++ linux-3.0.3/drivers/video/uvesafb.c 2011-08-23 21:47:56.000000000 -0400 | |
33646 | @@ -19,6 +19,7 @@ | |
33647 | #include <linux/io.h> | |
33648 | #include <linux/mutex.h> | |
33649 | #include <linux/slab.h> | |
33650 | +#include <linux/moduleloader.h> | |
33651 | #include <video/edid.h> | |
33652 | #include <video/uvesafb.h> | |
33653 | #ifdef CONFIG_X86 | |
33654 | @@ -121,7 +122,7 @@ static int uvesafb_helper_start(void) | |
33655 | NULL, | |
33656 | }; | |
33657 | ||
33658 | - return call_usermodehelper(v86d_path, argv, envp, 1); | |
33659 | + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC); | |
33660 | } | |
33661 | ||
33662 | /* | |
33663 | @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi( | |
33664 | if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) { | |
33665 | par->pmi_setpal = par->ypan = 0; | |
33666 | } else { | |
33667 | + | |
33668 | +#ifdef CONFIG_PAX_KERNEXEC | |
33669 | +#ifdef CONFIG_MODULES | |
33670 | + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx); | |
33671 | +#endif | |
33672 | + if (!par->pmi_code) { | |
33673 | + par->pmi_setpal = par->ypan = 0; | |
33674 | + return 0; | |
33675 | + } | |
33676 | +#endif | |
33677 | + | |
33678 | par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4) | |
33679 | + task->t.regs.edi); | |
33680 | + | |
33681 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33682 | + pax_open_kernel(); | |
33683 | + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx); | |
33684 | + pax_close_kernel(); | |
33685 | + | |
33686 | + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]); | |
33687 | + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]); | |
33688 | +#else | |
33689 | par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1]; | |
33690 | par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2]; | |
33691 | +#endif | |
33692 | + | |
33693 | printk(KERN_INFO "uvesafb: protected mode interface info at " | |
33694 | "%04x:%04x\n", | |
33695 | (u16)task->t.regs.es, (u16)task->t.regs.edi); | |
33696 | @@ -1821,6 +1844,11 @@ out: | |
33697 | if (par->vbe_modes) | |
33698 | kfree(par->vbe_modes); | |
33699 | ||
33700 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33701 | + if (par->pmi_code) | |
33702 | + module_free_exec(NULL, par->pmi_code); | |
33703 | +#endif | |
33704 | + | |
33705 | framebuffer_release(info); | |
33706 | return err; | |
33707 | } | |
33708 | @@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor | |
33709 | kfree(par->vbe_state_orig); | |
33710 | if (par->vbe_state_saved) | |
33711 | kfree(par->vbe_state_saved); | |
33712 | + | |
33713 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33714 | + if (par->pmi_code) | |
33715 | + module_free_exec(NULL, par->pmi_code); | |
33716 | +#endif | |
33717 | + | |
33718 | } | |
33719 | ||
33720 | framebuffer_release(info); | |
33721 | diff -urNp linux-3.0.3/drivers/video/vesafb.c linux-3.0.3/drivers/video/vesafb.c | |
33722 | --- linux-3.0.3/drivers/video/vesafb.c 2011-07-21 22:17:23.000000000 -0400 | |
33723 | +++ linux-3.0.3/drivers/video/vesafb.c 2011-08-23 21:47:56.000000000 -0400 | |
33724 | @@ -9,6 +9,7 @@ | |
33725 | */ | |
33726 | ||
33727 | #include <linux/module.h> | |
33728 | +#include <linux/moduleloader.h> | |
33729 | #include <linux/kernel.h> | |
33730 | #include <linux/errno.h> | |
33731 | #include <linux/string.h> | |
33732 | @@ -52,8 +53,8 @@ static int vram_remap __initdata; /* | |
33733 | static int vram_total __initdata; /* Set total amount of memory */ | |
33734 | static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */ | |
33735 | static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */ | |
33736 | -static void (*pmi_start)(void) __read_mostly; | |
33737 | -static void (*pmi_pal) (void) __read_mostly; | |
33738 | +static void (*pmi_start)(void) __read_only; | |
33739 | +static void (*pmi_pal) (void) __read_only; | |
33740 | static int depth __read_mostly; | |
33741 | static int vga_compat __read_mostly; | |
33742 | /* --------------------------------------------------------------------- */ | |
33743 | @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl | |
33744 | unsigned int size_vmode; | |
33745 | unsigned int size_remap; | |
33746 | unsigned int size_total; | |
33747 | + void *pmi_code = NULL; | |
33748 | ||
33749 | if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB) | |
33750 | return -ENODEV; | |
33751 | @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl | |
33752 | size_remap = size_total; | |
33753 | vesafb_fix.smem_len = size_remap; | |
33754 | ||
33755 | -#ifndef __i386__ | |
33756 | - screen_info.vesapm_seg = 0; | |
33757 | -#endif | |
33758 | - | |
33759 | if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) { | |
33760 | printk(KERN_WARNING | |
33761 | "vesafb: cannot reserve video memory at 0x%lx\n", | |
33762 | @@ -307,9 +305,21 @@ static int __init vesafb_probe(struct pl | |
33763 | printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n", | |
33764 | vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages); | |
33765 | ||
33766 | +#ifdef __i386__ | |
33767 | + | |
33768 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33769 | + pmi_code = module_alloc_exec(screen_info.vesapm_size); | |
33770 | + if (!pmi_code) | |
33771 | +#elif !defined(CONFIG_PAX_KERNEXEC) | |
33772 | + if (0) | |
33773 | +#endif | |
33774 | + | |
33775 | +#endif | |
33776 | + screen_info.vesapm_seg = 0; | |
33777 | + | |
33778 | if (screen_info.vesapm_seg) { | |
33779 | - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n", | |
33780 | - screen_info.vesapm_seg,screen_info.vesapm_off); | |
33781 | + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n", | |
33782 | + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size); | |
33783 | } | |
33784 | ||
33785 | if (screen_info.vesapm_seg < 0xc000) | |
33786 | @@ -317,9 +327,25 @@ static int __init vesafb_probe(struct pl | |
33787 | ||
33788 | if (ypan || pmi_setpal) { | |
33789 | unsigned short *pmi_base; | |
33790 | + | |
33791 | pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off); | |
33792 | - pmi_start = (void*)((char*)pmi_base + pmi_base[1]); | |
33793 | - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]); | |
33794 | + | |
33795 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33796 | + pax_open_kernel(); | |
33797 | + memcpy(pmi_code, pmi_base, screen_info.vesapm_size); | |
33798 | +#else | |
33799 | + pmi_code = pmi_base; | |
33800 | +#endif | |
33801 | + | |
33802 | + pmi_start = (void*)((char*)pmi_code + pmi_base[1]); | |
33803 | + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]); | |
33804 | + | |
33805 | +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33806 | + pmi_start = ktva_ktla(pmi_start); | |
33807 | + pmi_pal = ktva_ktla(pmi_pal); | |
33808 | + pax_close_kernel(); | |
33809 | +#endif | |
33810 | + | |
33811 | printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal); | |
33812 | if (pmi_base[3]) { | |
33813 | printk(KERN_INFO "vesafb: pmi: ports = "); | |
33814 | @@ -488,6 +514,11 @@ static int __init vesafb_probe(struct pl | |
33815 | info->node, info->fix.id); | |
33816 | return 0; | |
33817 | err: | |
33818 | + | |
33819 | +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC) | |
33820 | + module_free_exec(NULL, pmi_code); | |
33821 | +#endif | |
33822 | + | |
33823 | if (info->screen_base) | |
33824 | iounmap(info->screen_base); | |
33825 | framebuffer_release(info); | |
33826 | diff -urNp linux-3.0.3/drivers/video/via/via_clock.h linux-3.0.3/drivers/video/via/via_clock.h | |
33827 | --- linux-3.0.3/drivers/video/via/via_clock.h 2011-07-21 22:17:23.000000000 -0400 | |
33828 | +++ linux-3.0.3/drivers/video/via/via_clock.h 2011-08-23 21:47:56.000000000 -0400 | |
33829 | @@ -56,7 +56,7 @@ struct via_clock { | |
33830 | ||
33831 | void (*set_engine_pll_state)(u8 state); | |
33832 | void (*set_engine_pll)(struct via_pll_config config); | |
33833 | -}; | |
33834 | +} __no_const; | |
33835 | ||
33836 | ||
33837 | static inline u32 get_pll_internal_frequency(u32 ref_freq, | |
33838 | diff -urNp linux-3.0.3/drivers/virtio/virtio_balloon.c linux-3.0.3/drivers/virtio/virtio_balloon.c | |
33839 | --- linux-3.0.3/drivers/virtio/virtio_balloon.c 2011-07-21 22:17:23.000000000 -0400 | |
33840 | +++ linux-3.0.3/drivers/virtio/virtio_balloon.c 2011-08-23 21:48:14.000000000 -0400 | |
33841 | @@ -174,6 +174,8 @@ static void update_balloon_stats(struct | |
33842 | struct sysinfo i; | |
33843 | int idx = 0; | |
33844 | ||
33845 | + pax_track_stack(); | |
33846 | + | |
33847 | all_vm_events(events); | |
33848 | si_meminfo(&i); | |
33849 | ||
33850 | diff -urNp linux-3.0.3/fs/9p/vfs_inode.c linux-3.0.3/fs/9p/vfs_inode.c | |
33851 | --- linux-3.0.3/fs/9p/vfs_inode.c 2011-07-21 22:17:23.000000000 -0400 | |
33852 | +++ linux-3.0.3/fs/9p/vfs_inode.c 2011-08-23 21:47:56.000000000 -0400 | |
33853 | @@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct | |
33854 | void | |
33855 | v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p) | |
33856 | { | |
33857 | - char *s = nd_get_link(nd); | |
33858 | + const char *s = nd_get_link(nd); | |
33859 | ||
33860 | P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name, | |
33861 | IS_ERR(s) ? "<error>" : s); | |
33862 | diff -urNp linux-3.0.3/fs/aio.c linux-3.0.3/fs/aio.c | |
33863 | --- linux-3.0.3/fs/aio.c 2011-07-21 22:17:23.000000000 -0400 | |
33864 | +++ linux-3.0.3/fs/aio.c 2011-08-23 21:48:14.000000000 -0400 | |
33865 | @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx | |
33866 | size += sizeof(struct io_event) * nr_events; | |
33867 | nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT; | |
33868 | ||
33869 | - if (nr_pages < 0) | |
33870 | + if (nr_pages <= 0) | |
33871 | return -EINVAL; | |
33872 | ||
33873 | nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event); | |
33874 | @@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct | |
33875 | struct aio_timeout to; | |
33876 | int retry = 0; | |
33877 | ||
33878 | + pax_track_stack(); | |
33879 | + | |
33880 | /* needed to zero any padding within an entry (there shouldn't be | |
33881 | * any, but C is fun! | |
33882 | */ | |
33883 | @@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i | |
33884 | static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) | |
33885 | { | |
33886 | ssize_t ret; | |
33887 | + struct iovec iovstack; | |
33888 | ||
33889 | #ifdef CONFIG_COMPAT | |
33890 | if (compat) | |
33891 | ret = compat_rw_copy_check_uvector(type, | |
33892 | (struct compat_iovec __user *)kiocb->ki_buf, | |
33893 | - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, | |
33894 | + kiocb->ki_nbytes, 1, &iovstack, | |
33895 | &kiocb->ki_iovec); | |
33896 | else | |
33897 | #endif | |
33898 | ret = rw_copy_check_uvector(type, | |
33899 | (struct iovec __user *)kiocb->ki_buf, | |
33900 | - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, | |
33901 | + kiocb->ki_nbytes, 1, &iovstack, | |
33902 | &kiocb->ki_iovec); | |
33903 | if (ret < 0) | |
33904 | goto out; | |
33905 | ||
33906 | + if (kiocb->ki_iovec == &iovstack) { | |
33907 | + kiocb->ki_inline_vec = iovstack; | |
33908 | + kiocb->ki_iovec = &kiocb->ki_inline_vec; | |
33909 | + } | |
33910 | kiocb->ki_nr_segs = kiocb->ki_nbytes; | |
33911 | kiocb->ki_cur_seg = 0; | |
33912 | /* ki_nbytes/left now reflect bytes instead of segs */ | |
33913 | diff -urNp linux-3.0.3/fs/attr.c linux-3.0.3/fs/attr.c | |
33914 | --- linux-3.0.3/fs/attr.c 2011-07-21 22:17:23.000000000 -0400 | |
33915 | +++ linux-3.0.3/fs/attr.c 2011-08-23 21:48:14.000000000 -0400 | |
33916 | @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode | |
33917 | unsigned long limit; | |
33918 | ||
33919 | limit = rlimit(RLIMIT_FSIZE); | |
33920 | + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1); | |
33921 | if (limit != RLIM_INFINITY && offset > limit) | |
33922 | goto out_sig; | |
33923 | if (offset > inode->i_sb->s_maxbytes) | |
33924 | diff -urNp linux-3.0.3/fs/befs/linuxvfs.c linux-3.0.3/fs/befs/linuxvfs.c | |
33925 | --- linux-3.0.3/fs/befs/linuxvfs.c 2011-07-21 22:17:23.000000000 -0400 | |
33926 | +++ linux-3.0.3/fs/befs/linuxvfs.c 2011-08-23 21:47:56.000000000 -0400 | |
33927 | @@ -498,7 +498,7 @@ static void befs_put_link(struct dentry | |
33928 | { | |
33929 | befs_inode_info *befs_ino = BEFS_I(dentry->d_inode); | |
33930 | if (befs_ino->i_flags & BEFS_LONG_SYMLINK) { | |
33931 | - char *link = nd_get_link(nd); | |
33932 | + const char *link = nd_get_link(nd); | |
33933 | if (!IS_ERR(link)) | |
33934 | kfree(link); | |
33935 | } | |
33936 | diff -urNp linux-3.0.3/fs/binfmt_aout.c linux-3.0.3/fs/binfmt_aout.c | |
33937 | --- linux-3.0.3/fs/binfmt_aout.c 2011-07-21 22:17:23.000000000 -0400 | |
33938 | +++ linux-3.0.3/fs/binfmt_aout.c 2011-08-23 21:48:14.000000000 -0400 | |
33939 | @@ -16,6 +16,7 @@ | |
33940 | #include <linux/string.h> | |
33941 | #include <linux/fs.h> | |
33942 | #include <linux/file.h> | |
33943 | +#include <linux/security.h> | |
33944 | #include <linux/stat.h> | |
33945 | #include <linux/fcntl.h> | |
33946 | #include <linux/ptrace.h> | |
33947 | @@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum | |
33948 | #endif | |
33949 | # define START_STACK(u) ((void __user *)u.start_stack) | |
33950 | ||
33951 | + memset(&dump, 0, sizeof(dump)); | |
33952 | + | |
33953 | fs = get_fs(); | |
33954 | set_fs(KERNEL_DS); | |
33955 | has_dumped = 1; | |
33956 | @@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum | |
33957 | ||
33958 | /* If the size of the dump file exceeds the rlimit, then see what would happen | |
33959 | if we wrote the stack, but not the data area. */ | |
33960 | + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1); | |
33961 | if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit) | |
33962 | dump.u_dsize = 0; | |
33963 | ||
33964 | /* Make sure we have enough room to write the stack and data areas. */ | |
33965 | + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1); | |
33966 | if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit) | |
33967 | dump.u_ssize = 0; | |
33968 | ||
33969 | @@ -234,6 +239,8 @@ static int load_aout_binary(struct linux | |
33970 | rlim = rlimit(RLIMIT_DATA); | |
33971 | if (rlim >= RLIM_INFINITY) | |
33972 | rlim = ~0; | |
33973 | + | |
33974 | + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1); | |
33975 | if (ex.a_data + ex.a_bss > rlim) | |
33976 | return -ENOMEM; | |
33977 | ||
33978 | @@ -262,6 +269,27 @@ static int load_aout_binary(struct linux | |
33979 | install_exec_creds(bprm); | |
33980 | current->flags &= ~PF_FORKNOEXEC; | |
33981 | ||
33982 | +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
33983 | + current->mm->pax_flags = 0UL; | |
33984 | +#endif | |
33985 | + | |
33986 | +#ifdef CONFIG_PAX_PAGEEXEC | |
33987 | + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) { | |
33988 | + current->mm->pax_flags |= MF_PAX_PAGEEXEC; | |
33989 | + | |
33990 | +#ifdef CONFIG_PAX_EMUTRAMP | |
33991 | + if (N_FLAGS(ex) & F_PAX_EMUTRAMP) | |
33992 | + current->mm->pax_flags |= MF_PAX_EMUTRAMP; | |
33993 | +#endif | |
33994 | + | |
33995 | +#ifdef CONFIG_PAX_MPROTECT | |
33996 | + if (!(N_FLAGS(ex) & F_PAX_MPROTECT)) | |
33997 | + current->mm->pax_flags |= MF_PAX_MPROTECT; | |
33998 | +#endif | |
33999 | + | |
34000 | + } | |
34001 | +#endif | |
34002 | + | |
34003 | if (N_MAGIC(ex) == OMAGIC) { | |
34004 | unsigned long text_addr, map_size; | |
34005 | loff_t pos; | |
34006 | @@ -334,7 +362,7 @@ static int load_aout_binary(struct linux | |
34007 | ||
34008 | down_write(¤t->mm->mmap_sem); | |
34009 | error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data, | |
34010 | - PROT_READ | PROT_WRITE | PROT_EXEC, | |
34011 | + PROT_READ | PROT_WRITE, | |
34012 | MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE, | |
34013 | fd_offset + ex.a_text); | |
34014 | up_write(¤t->mm->mmap_sem); | |
34015 | diff -urNp linux-3.0.3/fs/binfmt_elf.c linux-3.0.3/fs/binfmt_elf.c | |
34016 | --- linux-3.0.3/fs/binfmt_elf.c 2011-07-21 22:17:23.000000000 -0400 | |
34017 | +++ linux-3.0.3/fs/binfmt_elf.c 2011-08-23 21:48:14.000000000 -0400 | |
34018 | @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump | |
34019 | #define elf_core_dump NULL | |
34020 | #endif | |
34021 | ||
34022 | +#ifdef CONFIG_PAX_MPROTECT | |
34023 | +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags); | |
34024 | +#endif | |
34025 | + | |
34026 | #if ELF_EXEC_PAGESIZE > PAGE_SIZE | |
34027 | #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE | |
34028 | #else | |
34029 | @@ -70,6 +74,11 @@ static struct linux_binfmt elf_format = | |
34030 | .load_binary = load_elf_binary, | |
34031 | .load_shlib = load_elf_library, | |
34032 | .core_dump = elf_core_dump, | |
34033 | + | |
34034 | +#ifdef CONFIG_PAX_MPROTECT | |
34035 | + .handle_mprotect= elf_handle_mprotect, | |
34036 | +#endif | |
34037 | + | |
34038 | .min_coredump = ELF_EXEC_PAGESIZE, | |
34039 | }; | |
34040 | ||
34041 | @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = | |
34042 | ||
34043 | static int set_brk(unsigned long start, unsigned long end) | |
34044 | { | |
34045 | + unsigned long e = end; | |
34046 | + | |
34047 | start = ELF_PAGEALIGN(start); | |
34048 | end = ELF_PAGEALIGN(end); | |
34049 | if (end > start) { | |
34050 | @@ -87,7 +98,7 @@ static int set_brk(unsigned long start, | |
34051 | if (BAD_ADDR(addr)) | |
34052 | return addr; | |
34053 | } | |
34054 | - current->mm->start_brk = current->mm->brk = end; | |
34055 | + current->mm->start_brk = current->mm->brk = e; | |
34056 | return 0; | |
34057 | } | |
34058 | ||
34059 | @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b | |
34060 | elf_addr_t __user *u_rand_bytes; | |
34061 | const char *k_platform = ELF_PLATFORM; | |
34062 | const char *k_base_platform = ELF_BASE_PLATFORM; | |
34063 | - unsigned char k_rand_bytes[16]; | |
34064 | + u32 k_rand_bytes[4]; | |
34065 | int items; | |
34066 | elf_addr_t *elf_info; | |
34067 | int ei_index = 0; | |
34068 | const struct cred *cred = current_cred(); | |
34069 | struct vm_area_struct *vma; | |
34070 | + unsigned long saved_auxv[AT_VECTOR_SIZE]; | |
34071 | + | |
34072 | + pax_track_stack(); | |
34073 | ||
34074 | /* | |
34075 | * In some cases (e.g. Hyper-Threading), we want to avoid L1 | |
34076 | @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b | |
34077 | * Generate 16 random bytes for userspace PRNG seeding. | |
34078 | */ | |
34079 | get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); | |
34080 | - u_rand_bytes = (elf_addr_t __user *) | |
34081 | - STACK_ALLOC(p, sizeof(k_rand_bytes)); | |
34082 | + srandom32(k_rand_bytes[0] ^ random32()); | |
34083 | + srandom32(k_rand_bytes[1] ^ random32()); | |
34084 | + srandom32(k_rand_bytes[2] ^ random32()); | |
34085 | + srandom32(k_rand_bytes[3] ^ random32()); | |
34086 | + p = STACK_ROUND(p, sizeof(k_rand_bytes)); | |
34087 | + u_rand_bytes = (elf_addr_t __user *) p; | |
34088 | if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) | |
34089 | return -EFAULT; | |
34090 | ||
34091 | @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b | |
34092 | return -EFAULT; | |
34093 | current->mm->env_end = p; | |
34094 | ||
34095 | + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t)); | |
34096 | + | |
34097 | /* Put the elf_info on the stack in the right place. */ | |
34098 | sp = (elf_addr_t __user *)envp + 1; | |
34099 | - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) | |
34100 | + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t))) | |
34101 | return -EFAULT; | |
34102 | return 0; | |
34103 | } | |
34104 | @@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str | |
34105 | { | |
34106 | struct elf_phdr *elf_phdata; | |
34107 | struct elf_phdr *eppnt; | |
34108 | - unsigned long load_addr = 0; | |
34109 | + unsigned long load_addr = 0, pax_task_size = TASK_SIZE; | |
34110 | int load_addr_set = 0; | |
34111 | unsigned long last_bss = 0, elf_bss = 0; | |
34112 | - unsigned long error = ~0UL; | |
34113 | + unsigned long error = -EINVAL; | |
34114 | unsigned long total_size; | |
34115 | int retval, i, size; | |
34116 | ||
34117 | @@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str | |
34118 | goto out_close; | |
34119 | } | |
34120 | ||
34121 | +#ifdef CONFIG_PAX_SEGMEXEC | |
34122 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) | |
34123 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
34124 | +#endif | |
34125 | + | |
34126 | eppnt = elf_phdata; | |
34127 | for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { | |
34128 | if (eppnt->p_type == PT_LOAD) { | |
34129 | @@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str | |
34130 | k = load_addr + eppnt->p_vaddr; | |
34131 | if (BAD_ADDR(k) || | |
34132 | eppnt->p_filesz > eppnt->p_memsz || | |
34133 | - eppnt->p_memsz > TASK_SIZE || | |
34134 | - TASK_SIZE - eppnt->p_memsz < k) { | |
34135 | + eppnt->p_memsz > pax_task_size || | |
34136 | + pax_task_size - eppnt->p_memsz < k) { | |
34137 | error = -ENOMEM; | |
34138 | goto out_close; | |
34139 | } | |
34140 | @@ -528,6 +553,193 @@ out: | |
34141 | return error; | |
34142 | } | |
34143 | ||
34144 | +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE) | |
34145 | +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata) | |
34146 | +{ | |
34147 | + unsigned long pax_flags = 0UL; | |
34148 | + | |
34149 | +#ifdef CONFIG_PAX_PAGEEXEC | |
34150 | + if (elf_phdata->p_flags & PF_PAGEEXEC) | |
34151 | + pax_flags |= MF_PAX_PAGEEXEC; | |
34152 | +#endif | |
34153 | + | |
34154 | +#ifdef CONFIG_PAX_SEGMEXEC | |
34155 | + if (elf_phdata->p_flags & PF_SEGMEXEC) | |
34156 | + pax_flags |= MF_PAX_SEGMEXEC; | |
34157 | +#endif | |
34158 | + | |
34159 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC) | |
34160 | + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
34161 | + if ((__supported_pte_mask & _PAGE_NX)) | |
34162 | + pax_flags &= ~MF_PAX_SEGMEXEC; | |
34163 | + else | |
34164 | + pax_flags &= ~MF_PAX_PAGEEXEC; | |
34165 | + } | |
34166 | +#endif | |
34167 | + | |
34168 | +#ifdef CONFIG_PAX_EMUTRAMP | |
34169 | + if (elf_phdata->p_flags & PF_EMUTRAMP) | |
34170 | + pax_flags |= MF_PAX_EMUTRAMP; | |
34171 | +#endif | |
34172 | + | |
34173 | +#ifdef CONFIG_PAX_MPROTECT | |
34174 | + if (elf_phdata->p_flags & PF_MPROTECT) | |
34175 | + pax_flags |= MF_PAX_MPROTECT; | |
34176 | +#endif | |
34177 | + | |
34178 | +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK) | |
34179 | + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP)) | |
34180 | + pax_flags |= MF_PAX_RANDMMAP; | |
34181 | +#endif | |
34182 | + | |
34183 | + return pax_flags; | |
34184 | +} | |
34185 | +#endif | |
34186 | + | |
34187 | +#ifdef CONFIG_PAX_PT_PAX_FLAGS | |
34188 | +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata) | |
34189 | +{ | |
34190 | + unsigned long pax_flags = 0UL; | |
34191 | + | |
34192 | +#ifdef CONFIG_PAX_PAGEEXEC | |
34193 | + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC)) | |
34194 | + pax_flags |= MF_PAX_PAGEEXEC; | |
34195 | +#endif | |
34196 | + | |
34197 | +#ifdef CONFIG_PAX_SEGMEXEC | |
34198 | + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC)) | |
34199 | + pax_flags |= MF_PAX_SEGMEXEC; | |
34200 | +#endif | |
34201 | + | |
34202 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC) | |
34203 | + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
34204 | + if ((__supported_pte_mask & _PAGE_NX)) | |
34205 | + pax_flags &= ~MF_PAX_SEGMEXEC; | |
34206 | + else | |
34207 | + pax_flags &= ~MF_PAX_PAGEEXEC; | |
34208 | + } | |
34209 | +#endif | |
34210 | + | |
34211 | +#ifdef CONFIG_PAX_EMUTRAMP | |
34212 | + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP)) | |
34213 | + pax_flags |= MF_PAX_EMUTRAMP; | |
34214 | +#endif | |
34215 | + | |
34216 | +#ifdef CONFIG_PAX_MPROTECT | |
34217 | + if (!(elf_phdata->p_flags & PF_NOMPROTECT)) | |
34218 | + pax_flags |= MF_PAX_MPROTECT; | |
34219 | +#endif | |
34220 | + | |
34221 | +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK) | |
34222 | + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP)) | |
34223 | + pax_flags |= MF_PAX_RANDMMAP; | |
34224 | +#endif | |
34225 | + | |
34226 | + return pax_flags; | |
34227 | +} | |
34228 | +#endif | |
34229 | + | |
34230 | +#ifdef CONFIG_PAX_EI_PAX | |
34231 | +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex) | |
34232 | +{ | |
34233 | + unsigned long pax_flags = 0UL; | |
34234 | + | |
34235 | +#ifdef CONFIG_PAX_PAGEEXEC | |
34236 | + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC)) | |
34237 | + pax_flags |= MF_PAX_PAGEEXEC; | |
34238 | +#endif | |
34239 | + | |
34240 | +#ifdef CONFIG_PAX_SEGMEXEC | |
34241 | + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC)) | |
34242 | + pax_flags |= MF_PAX_SEGMEXEC; | |
34243 | +#endif | |
34244 | + | |
34245 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC) | |
34246 | + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
34247 | + if ((__supported_pte_mask & _PAGE_NX)) | |
34248 | + pax_flags &= ~MF_PAX_SEGMEXEC; | |
34249 | + else | |
34250 | + pax_flags &= ~MF_PAX_PAGEEXEC; | |
34251 | + } | |
34252 | +#endif | |
34253 | + | |
34254 | +#ifdef CONFIG_PAX_EMUTRAMP | |
34255 | + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP)) | |
34256 | + pax_flags |= MF_PAX_EMUTRAMP; | |
34257 | +#endif | |
34258 | + | |
34259 | +#ifdef CONFIG_PAX_MPROTECT | |
34260 | + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT)) | |
34261 | + pax_flags |= MF_PAX_MPROTECT; | |
34262 | +#endif | |
34263 | + | |
34264 | +#ifdef CONFIG_PAX_ASLR | |
34265 | + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP)) | |
34266 | + pax_flags |= MF_PAX_RANDMMAP; | |
34267 | +#endif | |
34268 | + | |
34269 | + return pax_flags; | |
34270 | +} | |
34271 | +#endif | |
34272 | + | |
34273 | +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) | |
34274 | +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata) | |
34275 | +{ | |
34276 | + unsigned long pax_flags = 0UL; | |
34277 | + | |
34278 | +#ifdef CONFIG_PAX_PT_PAX_FLAGS | |
34279 | + unsigned long i; | |
34280 | + int found_flags = 0; | |
34281 | +#endif | |
34282 | + | |
34283 | +#ifdef CONFIG_PAX_EI_PAX | |
34284 | + pax_flags = pax_parse_ei_pax(elf_ex); | |
34285 | +#endif | |
34286 | + | |
34287 | +#ifdef CONFIG_PAX_PT_PAX_FLAGS | |
34288 | + for (i = 0UL; i < elf_ex->e_phnum; i++) | |
34289 | + if (elf_phdata[i].p_type == PT_PAX_FLAGS) { | |
34290 | + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) || | |
34291 | + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) || | |
34292 | + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) || | |
34293 | + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) || | |
34294 | + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP))) | |
34295 | + return -EINVAL; | |
34296 | + | |
34297 | +#ifdef CONFIG_PAX_SOFTMODE | |
34298 | + if (pax_softmode) | |
34299 | + pax_flags = pax_parse_softmode(&elf_phdata[i]); | |
34300 | + else | |
34301 | +#endif | |
34302 | + | |
34303 | + pax_flags = pax_parse_hardmode(&elf_phdata[i]); | |
34304 | + found_flags = 1; | |
34305 | + break; | |
34306 | + } | |
34307 | +#endif | |
34308 | + | |
34309 | +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS) | |
34310 | + if (found_flags == 0) { | |
34311 | + struct elf_phdr phdr; | |
34312 | + memset(&phdr, 0, sizeof(phdr)); | |
34313 | + phdr.p_flags = PF_NOEMUTRAMP; | |
34314 | +#ifdef CONFIG_PAX_SOFTMODE | |
34315 | + if (pax_softmode) | |
34316 | + pax_flags = pax_parse_softmode(&phdr); | |
34317 | + else | |
34318 | +#endif | |
34319 | + pax_flags = pax_parse_hardmode(&phdr); | |
34320 | + } | |
34321 | +#endif | |
34322 | + | |
34323 | + if (0 > pax_check_flags(&pax_flags)) | |
34324 | + return -EINVAL; | |
34325 | + | |
34326 | + current->mm->pax_flags = pax_flags; | |
34327 | + return 0; | |
34328 | +} | |
34329 | +#endif | |
34330 | + | |
34331 | /* | |
34332 | * These are the functions used to load ELF style executables and shared | |
34333 | * libraries. There is no binary dependent code anywhere else. | |
34334 | @@ -544,6 +756,11 @@ static unsigned long randomize_stack_top | |
34335 | { | |
34336 | unsigned int random_variable = 0; | |
34337 | ||
34338 | +#ifdef CONFIG_PAX_RANDUSTACK | |
34339 | + if (randomize_va_space) | |
34340 | + return stack_top - current->mm->delta_stack; | |
34341 | +#endif | |
34342 | + | |
34343 | if ((current->flags & PF_RANDOMIZE) && | |
34344 | !(current->personality & ADDR_NO_RANDOMIZE)) { | |
34345 | random_variable = get_random_int() & STACK_RND_MASK; | |
34346 | @@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_ | |
34347 | unsigned long load_addr = 0, load_bias = 0; | |
34348 | int load_addr_set = 0; | |
34349 | char * elf_interpreter = NULL; | |
34350 | - unsigned long error; | |
34351 | + unsigned long error = 0; | |
34352 | struct elf_phdr *elf_ppnt, *elf_phdata; | |
34353 | unsigned long elf_bss, elf_brk; | |
34354 | int retval, i; | |
34355 | @@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_ | |
34356 | unsigned long start_code, end_code, start_data, end_data; | |
34357 | unsigned long reloc_func_desc __maybe_unused = 0; | |
34358 | int executable_stack = EXSTACK_DEFAULT; | |
34359 | - unsigned long def_flags = 0; | |
34360 | struct { | |
34361 | struct elfhdr elf_ex; | |
34362 | struct elfhdr interp_elf_ex; | |
34363 | } *loc; | |
34364 | + unsigned long pax_task_size = TASK_SIZE; | |
34365 | ||
34366 | loc = kmalloc(sizeof(*loc), GFP_KERNEL); | |
34367 | if (!loc) { | |
34368 | @@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_ | |
34369 | ||
34370 | /* OK, This is the point of no return */ | |
34371 | current->flags &= ~PF_FORKNOEXEC; | |
34372 | - current->mm->def_flags = def_flags; | |
34373 | + | |
34374 | +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
34375 | + current->mm->pax_flags = 0UL; | |
34376 | +#endif | |
34377 | + | |
34378 | +#ifdef CONFIG_PAX_DLRESOLVE | |
34379 | + current->mm->call_dl_resolve = 0UL; | |
34380 | +#endif | |
34381 | + | |
34382 | +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT) | |
34383 | + current->mm->call_syscall = 0UL; | |
34384 | +#endif | |
34385 | + | |
34386 | +#ifdef CONFIG_PAX_ASLR | |
34387 | + current->mm->delta_mmap = 0UL; | |
34388 | + current->mm->delta_stack = 0UL; | |
34389 | +#endif | |
34390 | + | |
34391 | + current->mm->def_flags = 0; | |
34392 | + | |
34393 | +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) | |
34394 | + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) { | |
34395 | + send_sig(SIGKILL, current, 0); | |
34396 | + goto out_free_dentry; | |
34397 | + } | |
34398 | +#endif | |
34399 | + | |
34400 | +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS | |
34401 | + pax_set_initial_flags(bprm); | |
34402 | +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS) | |
34403 | + if (pax_set_initial_flags_func) | |
34404 | + (pax_set_initial_flags_func)(bprm); | |
34405 | +#endif | |
34406 | + | |
34407 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
34408 | + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) { | |
34409 | + current->mm->context.user_cs_limit = PAGE_SIZE; | |
34410 | + current->mm->def_flags |= VM_PAGEEXEC; | |
34411 | + } | |
34412 | +#endif | |
34413 | + | |
34414 | +#ifdef CONFIG_PAX_SEGMEXEC | |
34415 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) { | |
34416 | + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE; | |
34417 | + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE; | |
34418 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
34419 | + current->mm->def_flags |= VM_NOHUGEPAGE; | |
34420 | + } | |
34421 | +#endif | |
34422 | + | |
34423 | +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC) | |
34424 | + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
34425 | + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu()); | |
34426 | + put_cpu(); | |
34427 | + } | |
34428 | +#endif | |
34429 | ||
34430 | /* Do this immediately, since STACK_TOP as used in setup_arg_pages | |
34431 | may depend on the personality. */ | |
34432 | SET_PERSONALITY(loc->elf_ex); | |
34433 | + | |
34434 | +#ifdef CONFIG_PAX_ASLR | |
34435 | + if (current->mm->pax_flags & MF_PAX_RANDMMAP) { | |
34436 | + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT; | |
34437 | + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT; | |
34438 | + } | |
34439 | +#endif | |
34440 | + | |
34441 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
34442 | + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
34443 | + executable_stack = EXSTACK_DISABLE_X; | |
34444 | + current->personality &= ~READ_IMPLIES_EXEC; | |
34445 | + } else | |
34446 | +#endif | |
34447 | + | |
34448 | if (elf_read_implies_exec(loc->elf_ex, executable_stack)) | |
34449 | current->personality |= READ_IMPLIES_EXEC; | |
34450 | ||
34451 | @@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_ | |
34452 | #else | |
34453 | load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); | |
34454 | #endif | |
34455 | + | |
34456 | +#ifdef CONFIG_PAX_RANDMMAP | |
34457 | + /* PaX: randomize base address at the default exe base if requested */ | |
34458 | + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) { | |
34459 | +#ifdef CONFIG_SPARC64 | |
34460 | + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1); | |
34461 | +#else | |
34462 | + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT; | |
34463 | +#endif | |
34464 | + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias); | |
34465 | + elf_flags |= MAP_FIXED; | |
34466 | + } | |
34467 | +#endif | |
34468 | + | |
34469 | } | |
34470 | ||
34471 | error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, | |
34472 | @@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_ | |
34473 | * allowed task size. Note that p_filesz must always be | |
34474 | * <= p_memsz so it is only necessary to check p_memsz. | |
34475 | */ | |
34476 | - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || | |
34477 | - elf_ppnt->p_memsz > TASK_SIZE || | |
34478 | - TASK_SIZE - elf_ppnt->p_memsz < k) { | |
34479 | + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz || | |
34480 | + elf_ppnt->p_memsz > pax_task_size || | |
34481 | + pax_task_size - elf_ppnt->p_memsz < k) { | |
34482 | /* set_brk can never work. Avoid overflows. */ | |
34483 | send_sig(SIGKILL, current, 0); | |
34484 | retval = -EINVAL; | |
34485 | @@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_ | |
34486 | start_data += load_bias; | |
34487 | end_data += load_bias; | |
34488 | ||
34489 | +#ifdef CONFIG_PAX_RANDMMAP | |
34490 | + if (current->mm->pax_flags & MF_PAX_RANDMMAP) | |
34491 | + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4); | |
34492 | +#endif | |
34493 | + | |
34494 | /* Calling set_brk effectively mmaps the pages that we need | |
34495 | * for the bss and break sections. We must do this before | |
34496 | * mapping in the interpreter, to make sure it doesn't wind | |
34497 | @@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_ | |
34498 | goto out_free_dentry; | |
34499 | } | |
34500 | if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { | |
34501 | - send_sig(SIGSEGV, current, 0); | |
34502 | - retval = -EFAULT; /* Nobody gets to see this, but.. */ | |
34503 | - goto out_free_dentry; | |
34504 | + /* | |
34505 | + * This bss-zeroing can fail if the ELF | |
34506 | + * file specifies odd protections. So | |
34507 | + * we don't check the return value | |
34508 | + */ | |
34509 | } | |
34510 | ||
34511 | if (elf_interpreter) { | |
34512 | @@ -1090,7 +1398,7 @@ out: | |
34513 | * Decide what to dump of a segment, part, all or none. | |
34514 | */ | |
34515 | static unsigned long vma_dump_size(struct vm_area_struct *vma, | |
34516 | - unsigned long mm_flags) | |
34517 | + unsigned long mm_flags, long signr) | |
34518 | { | |
34519 | #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) | |
34520 | ||
34521 | @@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc | |
34522 | if (vma->vm_file == NULL) | |
34523 | return 0; | |
34524 | ||
34525 | - if (FILTER(MAPPED_PRIVATE)) | |
34526 | + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE)) | |
34527 | goto whole; | |
34528 | ||
34529 | /* | |
34530 | @@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf | |
34531 | { | |
34532 | elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; | |
34533 | int i = 0; | |
34534 | - do | |
34535 | + do { | |
34536 | i += 2; | |
34537 | - while (auxv[i - 2] != AT_NULL); | |
34538 | + } while (auxv[i - 2] != AT_NULL); | |
34539 | fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); | |
34540 | } | |
34541 | ||
34542 | @@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh | |
34543 | } | |
34544 | ||
34545 | static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma, | |
34546 | - unsigned long mm_flags) | |
34547 | + struct coredump_params *cprm) | |
34548 | { | |
34549 | struct vm_area_struct *vma; | |
34550 | size_t size = 0; | |
34551 | ||
34552 | for (vma = first_vma(current, gate_vma); vma != NULL; | |
34553 | vma = next_vma(vma, gate_vma)) | |
34554 | - size += vma_dump_size(vma, mm_flags); | |
34555 | + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr); | |
34556 | return size; | |
34557 | } | |
34558 | ||
34559 | @@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump | |
34560 | ||
34561 | dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); | |
34562 | ||
34563 | - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags); | |
34564 | + offset += elf_core_vma_data_size(gate_vma, cprm); | |
34565 | offset += elf_core_extra_data_size(); | |
34566 | e_shoff = offset; | |
34567 | ||
34568 | @@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump | |
34569 | offset = dataoff; | |
34570 | ||
34571 | size += sizeof(*elf); | |
34572 | + gr_learn_resource(current, RLIMIT_CORE, size, 1); | |
34573 | if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf))) | |
34574 | goto end_coredump; | |
34575 | ||
34576 | size += sizeof(*phdr4note); | |
34577 | + gr_learn_resource(current, RLIMIT_CORE, size, 1); | |
34578 | if (size > cprm->limit | |
34579 | || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note))) | |
34580 | goto end_coredump; | |
34581 | @@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump | |
34582 | phdr.p_offset = offset; | |
34583 | phdr.p_vaddr = vma->vm_start; | |
34584 | phdr.p_paddr = 0; | |
34585 | - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags); | |
34586 | + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr); | |
34587 | phdr.p_memsz = vma->vm_end - vma->vm_start; | |
34588 | offset += phdr.p_filesz; | |
34589 | phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; | |
34590 | @@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump | |
34591 | phdr.p_align = ELF_EXEC_PAGESIZE; | |
34592 | ||
34593 | size += sizeof(phdr); | |
34594 | + gr_learn_resource(current, RLIMIT_CORE, size, 1); | |
34595 | if (size > cprm->limit | |
34596 | || !dump_write(cprm->file, &phdr, sizeof(phdr))) | |
34597 | goto end_coredump; | |
34598 | @@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump | |
34599 | unsigned long addr; | |
34600 | unsigned long end; | |
34601 | ||
34602 | - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags); | |
34603 | + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr); | |
34604 | ||
34605 | for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { | |
34606 | struct page *page; | |
34607 | @@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump | |
34608 | page = get_dump_page(addr); | |
34609 | if (page) { | |
34610 | void *kaddr = kmap(page); | |
34611 | + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1); | |
34612 | stop = ((size += PAGE_SIZE) > cprm->limit) || | |
34613 | !dump_write(cprm->file, kaddr, | |
34614 | PAGE_SIZE); | |
34615 | @@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump | |
34616 | ||
34617 | if (e_phnum == PN_XNUM) { | |
34618 | size += sizeof(*shdr4extnum); | |
34619 | + gr_learn_resource(current, RLIMIT_CORE, size, 1); | |
34620 | if (size > cprm->limit | |
34621 | || !dump_write(cprm->file, shdr4extnum, | |
34622 | sizeof(*shdr4extnum))) | |
34623 | @@ -2067,6 +2380,97 @@ out: | |
34624 | ||
34625 | #endif /* CONFIG_ELF_CORE */ | |
34626 | ||
34627 | +#ifdef CONFIG_PAX_MPROTECT | |
34628 | +/* PaX: non-PIC ELF libraries need relocations on their executable segments | |
34629 | + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly | |
34630 | + * we'll remove VM_MAYWRITE for good on RELRO segments. | |
34631 | + * | |
34632 | + * The checks favour ld-linux.so behaviour which operates on a per ELF segment | |
34633 | + * basis because we want to allow the common case and not the special ones. | |
34634 | + */ | |
34635 | +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags) | |
34636 | +{ | |
34637 | + struct elfhdr elf_h; | |
34638 | + struct elf_phdr elf_p; | |
34639 | + unsigned long i; | |
34640 | + unsigned long oldflags; | |
34641 | + bool is_textrel_rw, is_textrel_rx, is_relro; | |
34642 | + | |
34643 | + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT)) | |
34644 | + return; | |
34645 | + | |
34646 | + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ); | |
34647 | + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ; | |
34648 | + | |
34649 | +#ifdef CONFIG_PAX_ELFRELOCS | |
34650 | + /* possible TEXTREL */ | |
34651 | + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ); | |
34652 | + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ); | |
34653 | +#else | |
34654 | + is_textrel_rw = false; | |
34655 | + is_textrel_rx = false; | |
34656 | +#endif | |
34657 | + | |
34658 | + /* possible RELRO */ | |
34659 | + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ); | |
34660 | + | |
34661 | + if (!is_textrel_rw && !is_textrel_rx && !is_relro) | |
34662 | + return; | |
34663 | + | |
34664 | + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) || | |
34665 | + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) || | |
34666 | + | |
34667 | +#ifdef CONFIG_PAX_ETEXECRELOCS | |
34668 | + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) || | |
34669 | +#else | |
34670 | + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) || | |
34671 | +#endif | |
34672 | + | |
34673 | + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) || | |
34674 | + !elf_check_arch(&elf_h) || | |
34675 | + elf_h.e_phentsize != sizeof(struct elf_phdr) || | |
34676 | + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr)) | |
34677 | + return; | |
34678 | + | |
34679 | + for (i = 0UL; i < elf_h.e_phnum; i++) { | |
34680 | + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p))) | |
34681 | + return; | |
34682 | + switch (elf_p.p_type) { | |
34683 | + case PT_DYNAMIC: | |
34684 | + if (!is_textrel_rw && !is_textrel_rx) | |
34685 | + continue; | |
34686 | + i = 0UL; | |
34687 | + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) { | |
34688 | + elf_dyn dyn; | |
34689 | + | |
34690 | + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn))) | |
34691 | + return; | |
34692 | + if (dyn.d_tag == DT_NULL) | |
34693 | + return; | |
34694 | + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) { | |
34695 | + gr_log_textrel(vma); | |
34696 | + if (is_textrel_rw) | |
34697 | + vma->vm_flags |= VM_MAYWRITE; | |
34698 | + else | |
34699 | + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */ | |
34700 | + vma->vm_flags &= ~VM_MAYWRITE; | |
34701 | + return; | |
34702 | + } | |
34703 | + i++; | |
34704 | + } | |
34705 | + return; | |
34706 | + | |
34707 | + case PT_GNU_RELRO: | |
34708 | + if (!is_relro) | |
34709 | + continue; | |
34710 | + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start) | |
34711 | + vma->vm_flags &= ~VM_MAYWRITE; | |
34712 | + return; | |
34713 | + } | |
34714 | + } | |
34715 | +} | |
34716 | +#endif | |
34717 | + | |
34718 | static int __init init_elf_binfmt(void) | |
34719 | { | |
34720 | return register_binfmt(&elf_format); | |
34721 | diff -urNp linux-3.0.3/fs/binfmt_flat.c linux-3.0.3/fs/binfmt_flat.c | |
34722 | --- linux-3.0.3/fs/binfmt_flat.c 2011-07-21 22:17:23.000000000 -0400 | |
34723 | +++ linux-3.0.3/fs/binfmt_flat.c 2011-08-23 21:47:56.000000000 -0400 | |
34724 | @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b | |
34725 | realdatastart = (unsigned long) -ENOMEM; | |
34726 | printk("Unable to allocate RAM for process data, errno %d\n", | |
34727 | (int)-realdatastart); | |
34728 | + down_write(¤t->mm->mmap_sem); | |
34729 | do_munmap(current->mm, textpos, text_len); | |
34730 | + up_write(¤t->mm->mmap_sem); | |
34731 | ret = realdatastart; | |
34732 | goto err; | |
34733 | } | |
34734 | @@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b | |
34735 | } | |
34736 | if (IS_ERR_VALUE(result)) { | |
34737 | printk("Unable to read data+bss, errno %d\n", (int)-result); | |
34738 | + down_write(¤t->mm->mmap_sem); | |
34739 | do_munmap(current->mm, textpos, text_len); | |
34740 | do_munmap(current->mm, realdatastart, len); | |
34741 | + up_write(¤t->mm->mmap_sem); | |
34742 | ret = result; | |
34743 | goto err; | |
34744 | } | |
34745 | @@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b | |
34746 | } | |
34747 | if (IS_ERR_VALUE(result)) { | |
34748 | printk("Unable to read code+data+bss, errno %d\n",(int)-result); | |
34749 | + down_write(¤t->mm->mmap_sem); | |
34750 | do_munmap(current->mm, textpos, text_len + data_len + extra + | |
34751 | MAX_SHARED_LIBS * sizeof(unsigned long)); | |
34752 | + up_write(¤t->mm->mmap_sem); | |
34753 | ret = result; | |
34754 | goto err; | |
34755 | } | |
34756 | diff -urNp linux-3.0.3/fs/bio.c linux-3.0.3/fs/bio.c | |
34757 | --- linux-3.0.3/fs/bio.c 2011-07-21 22:17:23.000000000 -0400 | |
34758 | +++ linux-3.0.3/fs/bio.c 2011-08-23 21:47:56.000000000 -0400 | |
34759 | @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b | |
34760 | const int read = bio_data_dir(bio) == READ; | |
34761 | struct bio_map_data *bmd = bio->bi_private; | |
34762 | int i; | |
34763 | - char *p = bmd->sgvecs[0].iov_base; | |
34764 | + char *p = (__force char *)bmd->sgvecs[0].iov_base; | |
34765 | ||
34766 | __bio_for_each_segment(bvec, bio, i, 0) { | |
34767 | char *addr = page_address(bvec->bv_page); | |
34768 | diff -urNp linux-3.0.3/fs/block_dev.c linux-3.0.3/fs/block_dev.c | |
34769 | --- linux-3.0.3/fs/block_dev.c 2011-07-21 22:17:23.000000000 -0400 | |
34770 | +++ linux-3.0.3/fs/block_dev.c 2011-08-23 21:47:56.000000000 -0400 | |
34771 | @@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de | |
34772 | else if (bdev->bd_contains == bdev) | |
34773 | return true; /* is a whole device which isn't held */ | |
34774 | ||
34775 | - else if (whole->bd_holder == bd_may_claim) | |
34776 | + else if (whole->bd_holder == (void *)bd_may_claim) | |
34777 | return true; /* is a partition of a device that is being partitioned */ | |
34778 | else if (whole->bd_holder != NULL) | |
34779 | return false; /* is a partition of a held device */ | |
34780 | diff -urNp linux-3.0.3/fs/btrfs/ctree.c linux-3.0.3/fs/btrfs/ctree.c | |
34781 | --- linux-3.0.3/fs/btrfs/ctree.c 2011-07-21 22:17:23.000000000 -0400 | |
34782 | +++ linux-3.0.3/fs/btrfs/ctree.c 2011-08-23 21:47:56.000000000 -0400 | |
34783 | @@ -454,9 +454,12 @@ static noinline int __btrfs_cow_block(st | |
34784 | free_extent_buffer(buf); | |
34785 | add_root_to_dirty_list(root); | |
34786 | } else { | |
34787 | - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) | |
34788 | - parent_start = parent->start; | |
34789 | - else | |
34790 | + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) { | |
34791 | + if (parent) | |
34792 | + parent_start = parent->start; | |
34793 | + else | |
34794 | + parent_start = 0; | |
34795 | + } else | |
34796 | parent_start = 0; | |
34797 | ||
34798 | WARN_ON(trans->transid != btrfs_header_generation(parent)); | |
34799 | diff -urNp linux-3.0.3/fs/btrfs/inode.c linux-3.0.3/fs/btrfs/inode.c | |
34800 | --- linux-3.0.3/fs/btrfs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
34801 | +++ linux-3.0.3/fs/btrfs/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
34802 | @@ -6895,7 +6895,7 @@ fail: | |
34803 | return -ENOMEM; | |
34804 | } | |
34805 | ||
34806 | -static int btrfs_getattr(struct vfsmount *mnt, | |
34807 | +int btrfs_getattr(struct vfsmount *mnt, | |
34808 | struct dentry *dentry, struct kstat *stat) | |
34809 | { | |
34810 | struct inode *inode = dentry->d_inode; | |
34811 | @@ -6907,6 +6907,14 @@ static int btrfs_getattr(struct vfsmount | |
34812 | return 0; | |
34813 | } | |
34814 | ||
34815 | +EXPORT_SYMBOL(btrfs_getattr); | |
34816 | + | |
34817 | +dev_t get_btrfs_dev_from_inode(struct inode *inode) | |
34818 | +{ | |
34819 | + return BTRFS_I(inode)->root->anon_super.s_dev; | |
34820 | +} | |
34821 | +EXPORT_SYMBOL(get_btrfs_dev_from_inode); | |
34822 | + | |
34823 | /* | |
34824 | * If a file is moved, it will inherit the cow and compression flags of the new | |
34825 | * directory. | |
34826 | diff -urNp linux-3.0.3/fs/btrfs/ioctl.c linux-3.0.3/fs/btrfs/ioctl.c | |
34827 | --- linux-3.0.3/fs/btrfs/ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
34828 | +++ linux-3.0.3/fs/btrfs/ioctl.c 2011-08-23 21:48:14.000000000 -0400 | |
34829 | @@ -2676,9 +2676,12 @@ long btrfs_ioctl_space_info(struct btrfs | |
34830 | for (i = 0; i < num_types; i++) { | |
34831 | struct btrfs_space_info *tmp; | |
34832 | ||
34833 | + /* Don't copy in more than we allocated */ | |
34834 | if (!slot_count) | |
34835 | break; | |
34836 | ||
34837 | + slot_count--; | |
34838 | + | |
34839 | info = NULL; | |
34840 | rcu_read_lock(); | |
34841 | list_for_each_entry_rcu(tmp, &root->fs_info->space_info, | |
34842 | @@ -2700,10 +2703,7 @@ long btrfs_ioctl_space_info(struct btrfs | |
34843 | memcpy(dest, &space, sizeof(space)); | |
34844 | dest++; | |
34845 | space_args.total_spaces++; | |
34846 | - slot_count--; | |
34847 | } | |
34848 | - if (!slot_count) | |
34849 | - break; | |
34850 | } | |
34851 | up_read(&info->groups_sem); | |
34852 | } | |
34853 | diff -urNp linux-3.0.3/fs/btrfs/relocation.c linux-3.0.3/fs/btrfs/relocation.c | |
34854 | --- linux-3.0.3/fs/btrfs/relocation.c 2011-07-21 22:17:23.000000000 -0400 | |
34855 | +++ linux-3.0.3/fs/btrfs/relocation.c 2011-08-23 21:47:56.000000000 -0400 | |
34856 | @@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct bt | |
34857 | } | |
34858 | spin_unlock(&rc->reloc_root_tree.lock); | |
34859 | ||
34860 | - BUG_ON((struct btrfs_root *)node->data != root); | |
34861 | + BUG_ON(!node || (struct btrfs_root *)node->data != root); | |
34862 | ||
34863 | if (!del) { | |
34864 | spin_lock(&rc->reloc_root_tree.lock); | |
34865 | diff -urNp linux-3.0.3/fs/cachefiles/bind.c linux-3.0.3/fs/cachefiles/bind.c | |
34866 | --- linux-3.0.3/fs/cachefiles/bind.c 2011-07-21 22:17:23.000000000 -0400 | |
34867 | +++ linux-3.0.3/fs/cachefiles/bind.c 2011-08-23 21:47:56.000000000 -0400 | |
34868 | @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef | |
34869 | args); | |
34870 | ||
34871 | /* start by checking things over */ | |
34872 | - ASSERT(cache->fstop_percent >= 0 && | |
34873 | - cache->fstop_percent < cache->fcull_percent && | |
34874 | + ASSERT(cache->fstop_percent < cache->fcull_percent && | |
34875 | cache->fcull_percent < cache->frun_percent && | |
34876 | cache->frun_percent < 100); | |
34877 | ||
34878 | - ASSERT(cache->bstop_percent >= 0 && | |
34879 | - cache->bstop_percent < cache->bcull_percent && | |
34880 | + ASSERT(cache->bstop_percent < cache->bcull_percent && | |
34881 | cache->bcull_percent < cache->brun_percent && | |
34882 | cache->brun_percent < 100); | |
34883 | ||
34884 | diff -urNp linux-3.0.3/fs/cachefiles/daemon.c linux-3.0.3/fs/cachefiles/daemon.c | |
34885 | --- linux-3.0.3/fs/cachefiles/daemon.c 2011-07-21 22:17:23.000000000 -0400 | |
34886 | +++ linux-3.0.3/fs/cachefiles/daemon.c 2011-08-23 21:47:56.000000000 -0400 | |
34887 | @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st | |
34888 | if (n > buflen) | |
34889 | return -EMSGSIZE; | |
34890 | ||
34891 | - if (copy_to_user(_buffer, buffer, n) != 0) | |
34892 | + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0) | |
34893 | return -EFAULT; | |
34894 | ||
34895 | return n; | |
34896 | @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s | |
34897 | if (test_bit(CACHEFILES_DEAD, &cache->flags)) | |
34898 | return -EIO; | |
34899 | ||
34900 | - if (datalen < 0 || datalen > PAGE_SIZE - 1) | |
34901 | + if (datalen > PAGE_SIZE - 1) | |
34902 | return -EOPNOTSUPP; | |
34903 | ||
34904 | /* drag the command string into the kernel so we can parse it */ | |
34905 | @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc | |
34906 | if (args[0] != '%' || args[1] != '\0') | |
34907 | return -EINVAL; | |
34908 | ||
34909 | - if (fstop < 0 || fstop >= cache->fcull_percent) | |
34910 | + if (fstop >= cache->fcull_percent) | |
34911 | return cachefiles_daemon_range_error(cache, args); | |
34912 | ||
34913 | cache->fstop_percent = fstop; | |
34914 | @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc | |
34915 | if (args[0] != '%' || args[1] != '\0') | |
34916 | return -EINVAL; | |
34917 | ||
34918 | - if (bstop < 0 || bstop >= cache->bcull_percent) | |
34919 | + if (bstop >= cache->bcull_percent) | |
34920 | return cachefiles_daemon_range_error(cache, args); | |
34921 | ||
34922 | cache->bstop_percent = bstop; | |
34923 | diff -urNp linux-3.0.3/fs/cachefiles/internal.h linux-3.0.3/fs/cachefiles/internal.h | |
34924 | --- linux-3.0.3/fs/cachefiles/internal.h 2011-07-21 22:17:23.000000000 -0400 | |
34925 | +++ linux-3.0.3/fs/cachefiles/internal.h 2011-08-23 21:47:56.000000000 -0400 | |
34926 | @@ -57,7 +57,7 @@ struct cachefiles_cache { | |
34927 | wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */ | |
34928 | struct rb_root active_nodes; /* active nodes (can't be culled) */ | |
34929 | rwlock_t active_lock; /* lock for active_nodes */ | |
34930 | - atomic_t gravecounter; /* graveyard uniquifier */ | |
34931 | + atomic_unchecked_t gravecounter; /* graveyard uniquifier */ | |
34932 | unsigned frun_percent; /* when to stop culling (% files) */ | |
34933 | unsigned fcull_percent; /* when to start culling (% files) */ | |
34934 | unsigned fstop_percent; /* when to stop allocating (% files) */ | |
34935 | @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc | |
34936 | * proc.c | |
34937 | */ | |
34938 | #ifdef CONFIG_CACHEFILES_HISTOGRAM | |
34939 | -extern atomic_t cachefiles_lookup_histogram[HZ]; | |
34940 | -extern atomic_t cachefiles_mkdir_histogram[HZ]; | |
34941 | -extern atomic_t cachefiles_create_histogram[HZ]; | |
34942 | +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ]; | |
34943 | +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ]; | |
34944 | +extern atomic_unchecked_t cachefiles_create_histogram[HZ]; | |
34945 | ||
34946 | extern int __init cachefiles_proc_init(void); | |
34947 | extern void cachefiles_proc_cleanup(void); | |
34948 | static inline | |
34949 | -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif) | |
34950 | +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif) | |
34951 | { | |
34952 | unsigned long jif = jiffies - start_jif; | |
34953 | if (jif >= HZ) | |
34954 | jif = HZ - 1; | |
34955 | - atomic_inc(&histogram[jif]); | |
34956 | + atomic_inc_unchecked(&histogram[jif]); | |
34957 | } | |
34958 | ||
34959 | #else | |
34960 | diff -urNp linux-3.0.3/fs/cachefiles/namei.c linux-3.0.3/fs/cachefiles/namei.c | |
34961 | --- linux-3.0.3/fs/cachefiles/namei.c 2011-07-21 22:17:23.000000000 -0400 | |
34962 | +++ linux-3.0.3/fs/cachefiles/namei.c 2011-08-23 21:47:56.000000000 -0400 | |
34963 | @@ -318,7 +318,7 @@ try_again: | |
34964 | /* first step is to make up a grave dentry in the graveyard */ | |
34965 | sprintf(nbuffer, "%08x%08x", | |
34966 | (uint32_t) get_seconds(), | |
34967 | - (uint32_t) atomic_inc_return(&cache->gravecounter)); | |
34968 | + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter)); | |
34969 | ||
34970 | /* do the multiway lock magic */ | |
34971 | trap = lock_rename(cache->graveyard, dir); | |
34972 | diff -urNp linux-3.0.3/fs/cachefiles/proc.c linux-3.0.3/fs/cachefiles/proc.c | |
34973 | --- linux-3.0.3/fs/cachefiles/proc.c 2011-07-21 22:17:23.000000000 -0400 | |
34974 | +++ linux-3.0.3/fs/cachefiles/proc.c 2011-08-23 21:47:56.000000000 -0400 | |
34975 | @@ -14,9 +14,9 @@ | |
34976 | #include <linux/seq_file.h> | |
34977 | #include "internal.h" | |
34978 | ||
34979 | -atomic_t cachefiles_lookup_histogram[HZ]; | |
34980 | -atomic_t cachefiles_mkdir_histogram[HZ]; | |
34981 | -atomic_t cachefiles_create_histogram[HZ]; | |
34982 | +atomic_unchecked_t cachefiles_lookup_histogram[HZ]; | |
34983 | +atomic_unchecked_t cachefiles_mkdir_histogram[HZ]; | |
34984 | +atomic_unchecked_t cachefiles_create_histogram[HZ]; | |
34985 | ||
34986 | /* | |
34987 | * display the latency histogram | |
34988 | @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str | |
34989 | return 0; | |
34990 | default: | |
34991 | index = (unsigned long) v - 3; | |
34992 | - x = atomic_read(&cachefiles_lookup_histogram[index]); | |
34993 | - y = atomic_read(&cachefiles_mkdir_histogram[index]); | |
34994 | - z = atomic_read(&cachefiles_create_histogram[index]); | |
34995 | + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]); | |
34996 | + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]); | |
34997 | + z = atomic_read_unchecked(&cachefiles_create_histogram[index]); | |
34998 | if (x == 0 && y == 0 && z == 0) | |
34999 | return 0; | |
35000 | ||
35001 | diff -urNp linux-3.0.3/fs/cachefiles/rdwr.c linux-3.0.3/fs/cachefiles/rdwr.c | |
35002 | --- linux-3.0.3/fs/cachefiles/rdwr.c 2011-07-21 22:17:23.000000000 -0400 | |
35003 | +++ linux-3.0.3/fs/cachefiles/rdwr.c 2011-08-23 21:47:56.000000000 -0400 | |
35004 | @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache | |
35005 | old_fs = get_fs(); | |
35006 | set_fs(KERNEL_DS); | |
35007 | ret = file->f_op->write( | |
35008 | - file, (const void __user *) data, len, &pos); | |
35009 | + file, (__force const void __user *) data, len, &pos); | |
35010 | set_fs(old_fs); | |
35011 | kunmap(page); | |
35012 | if (ret != len) | |
35013 | diff -urNp linux-3.0.3/fs/ceph/dir.c linux-3.0.3/fs/ceph/dir.c | |
35014 | --- linux-3.0.3/fs/ceph/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
35015 | +++ linux-3.0.3/fs/ceph/dir.c 2011-08-23 21:47:56.000000000 -0400 | |
35016 | @@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil | |
35017 | struct ceph_fs_client *fsc = ceph_inode_to_client(inode); | |
35018 | struct ceph_mds_client *mdsc = fsc->mdsc; | |
35019 | unsigned frag = fpos_frag(filp->f_pos); | |
35020 | - int off = fpos_off(filp->f_pos); | |
35021 | + unsigned int off = fpos_off(filp->f_pos); | |
35022 | int err; | |
35023 | u32 ftype; | |
35024 | struct ceph_mds_reply_info_parsed *rinfo; | |
35025 | diff -urNp linux-3.0.3/fs/cifs/cifs_debug.c linux-3.0.3/fs/cifs/cifs_debug.c | |
35026 | --- linux-3.0.3/fs/cifs/cifs_debug.c 2011-07-21 22:17:23.000000000 -0400 | |
35027 | +++ linux-3.0.3/fs/cifs/cifs_debug.c 2011-08-25 17:18:05.000000000 -0400 | |
35028 | @@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(str | |
35029 | ||
35030 | if (c == '1' || c == 'y' || c == 'Y' || c == '0') { | |
35031 | #ifdef CONFIG_CIFS_STATS2 | |
35032 | - atomic_set(&totBufAllocCount, 0); | |
35033 | - atomic_set(&totSmBufAllocCount, 0); | |
35034 | + atomic_set_unchecked(&totBufAllocCount, 0); | |
35035 | + atomic_set_unchecked(&totSmBufAllocCount, 0); | |
35036 | #endif /* CONFIG_CIFS_STATS2 */ | |
35037 | spin_lock(&cifs_tcp_ses_lock); | |
35038 | list_for_each(tmp1, &cifs_tcp_ses_list) { | |
35039 | @@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str | |
35040 | tcon = list_entry(tmp3, | |
35041 | struct cifs_tcon, | |
35042 | tcon_list); | |
35043 | - atomic_set(&tcon->num_smbs_sent, 0); | |
35044 | - atomic_set(&tcon->num_writes, 0); | |
35045 | - atomic_set(&tcon->num_reads, 0); | |
35046 | - atomic_set(&tcon->num_oplock_brks, 0); | |
35047 | - atomic_set(&tcon->num_opens, 0); | |
35048 | - atomic_set(&tcon->num_posixopens, 0); | |
35049 | - atomic_set(&tcon->num_posixmkdirs, 0); | |
35050 | - atomic_set(&tcon->num_closes, 0); | |
35051 | - atomic_set(&tcon->num_deletes, 0); | |
35052 | - atomic_set(&tcon->num_mkdirs, 0); | |
35053 | - atomic_set(&tcon->num_rmdirs, 0); | |
35054 | - atomic_set(&tcon->num_renames, 0); | |
35055 | - atomic_set(&tcon->num_t2renames, 0); | |
35056 | - atomic_set(&tcon->num_ffirst, 0); | |
35057 | - atomic_set(&tcon->num_fnext, 0); | |
35058 | - atomic_set(&tcon->num_fclose, 0); | |
35059 | - atomic_set(&tcon->num_hardlinks, 0); | |
35060 | - atomic_set(&tcon->num_symlinks, 0); | |
35061 | - atomic_set(&tcon->num_locks, 0); | |
35062 | + atomic_set_unchecked(&tcon->num_smbs_sent, 0); | |
35063 | + atomic_set_unchecked(&tcon->num_writes, 0); | |
35064 | + atomic_set_unchecked(&tcon->num_reads, 0); | |
35065 | + atomic_set_unchecked(&tcon->num_oplock_brks, 0); | |
35066 | + atomic_set_unchecked(&tcon->num_opens, 0); | |
35067 | + atomic_set_unchecked(&tcon->num_posixopens, 0); | |
35068 | + atomic_set_unchecked(&tcon->num_posixmkdirs, 0); | |
35069 | + atomic_set_unchecked(&tcon->num_closes, 0); | |
35070 | + atomic_set_unchecked(&tcon->num_deletes, 0); | |
35071 | + atomic_set_unchecked(&tcon->num_mkdirs, 0); | |
35072 | + atomic_set_unchecked(&tcon->num_rmdirs, 0); | |
35073 | + atomic_set_unchecked(&tcon->num_renames, 0); | |
35074 | + atomic_set_unchecked(&tcon->num_t2renames, 0); | |
35075 | + atomic_set_unchecked(&tcon->num_ffirst, 0); | |
35076 | + atomic_set_unchecked(&tcon->num_fnext, 0); | |
35077 | + atomic_set_unchecked(&tcon->num_fclose, 0); | |
35078 | + atomic_set_unchecked(&tcon->num_hardlinks, 0); | |
35079 | + atomic_set_unchecked(&tcon->num_symlinks, 0); | |
35080 | + atomic_set_unchecked(&tcon->num_locks, 0); | |
35081 | } | |
35082 | } | |
35083 | } | |
35084 | @@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct s | |
35085 | smBufAllocCount.counter, cifs_min_small); | |
35086 | #ifdef CONFIG_CIFS_STATS2 | |
35087 | seq_printf(m, "Total Large %d Small %d Allocations\n", | |
35088 | - atomic_read(&totBufAllocCount), | |
35089 | - atomic_read(&totSmBufAllocCount)); | |
35090 | + atomic_read_unchecked(&totBufAllocCount), | |
35091 | + atomic_read_unchecked(&totSmBufAllocCount)); | |
35092 | #endif /* CONFIG_CIFS_STATS2 */ | |
35093 | ||
35094 | seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount)); | |
35095 | @@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s | |
35096 | if (tcon->need_reconnect) | |
35097 | seq_puts(m, "\tDISCONNECTED "); | |
35098 | seq_printf(m, "\nSMBs: %d Oplock Breaks: %d", | |
35099 | - atomic_read(&tcon->num_smbs_sent), | |
35100 | - atomic_read(&tcon->num_oplock_brks)); | |
35101 | + atomic_read_unchecked(&tcon->num_smbs_sent), | |
35102 | + atomic_read_unchecked(&tcon->num_oplock_brks)); | |
35103 | seq_printf(m, "\nReads: %d Bytes: %lld", | |
35104 | - atomic_read(&tcon->num_reads), | |
35105 | + atomic_read_unchecked(&tcon->num_reads), | |
35106 | (long long)(tcon->bytes_read)); | |
35107 | seq_printf(m, "\nWrites: %d Bytes: %lld", | |
35108 | - atomic_read(&tcon->num_writes), | |
35109 | + atomic_read_unchecked(&tcon->num_writes), | |
35110 | (long long)(tcon->bytes_written)); | |
35111 | seq_printf(m, "\nFlushes: %d", | |
35112 | - atomic_read(&tcon->num_flushes)); | |
35113 | + atomic_read_unchecked(&tcon->num_flushes)); | |
35114 | seq_printf(m, "\nLocks: %d HardLinks: %d " | |
35115 | "Symlinks: %d", | |
35116 | - atomic_read(&tcon->num_locks), | |
35117 | - atomic_read(&tcon->num_hardlinks), | |
35118 | - atomic_read(&tcon->num_symlinks)); | |
35119 | + atomic_read_unchecked(&tcon->num_locks), | |
35120 | + atomic_read_unchecked(&tcon->num_hardlinks), | |
35121 | + atomic_read_unchecked(&tcon->num_symlinks)); | |
35122 | seq_printf(m, "\nOpens: %d Closes: %d " | |
35123 | "Deletes: %d", | |
35124 | - atomic_read(&tcon->num_opens), | |
35125 | - atomic_read(&tcon->num_closes), | |
35126 | - atomic_read(&tcon->num_deletes)); | |
35127 | + atomic_read_unchecked(&tcon->num_opens), | |
35128 | + atomic_read_unchecked(&tcon->num_closes), | |
35129 | + atomic_read_unchecked(&tcon->num_deletes)); | |
35130 | seq_printf(m, "\nPosix Opens: %d " | |
35131 | "Posix Mkdirs: %d", | |
35132 | - atomic_read(&tcon->num_posixopens), | |
35133 | - atomic_read(&tcon->num_posixmkdirs)); | |
35134 | + atomic_read_unchecked(&tcon->num_posixopens), | |
35135 | + atomic_read_unchecked(&tcon->num_posixmkdirs)); | |
35136 | seq_printf(m, "\nMkdirs: %d Rmdirs: %d", | |
35137 | - atomic_read(&tcon->num_mkdirs), | |
35138 | - atomic_read(&tcon->num_rmdirs)); | |
35139 | + atomic_read_unchecked(&tcon->num_mkdirs), | |
35140 | + atomic_read_unchecked(&tcon->num_rmdirs)); | |
35141 | seq_printf(m, "\nRenames: %d T2 Renames %d", | |
35142 | - atomic_read(&tcon->num_renames), | |
35143 | - atomic_read(&tcon->num_t2renames)); | |
35144 | + atomic_read_unchecked(&tcon->num_renames), | |
35145 | + atomic_read_unchecked(&tcon->num_t2renames)); | |
35146 | seq_printf(m, "\nFindFirst: %d FNext %d " | |
35147 | "FClose %d", | |
35148 | - atomic_read(&tcon->num_ffirst), | |
35149 | - atomic_read(&tcon->num_fnext), | |
35150 | - atomic_read(&tcon->num_fclose)); | |
35151 | + atomic_read_unchecked(&tcon->num_ffirst), | |
35152 | + atomic_read_unchecked(&tcon->num_fnext), | |
35153 | + atomic_read_unchecked(&tcon->num_fclose)); | |
35154 | } | |
35155 | } | |
35156 | } | |
35157 | diff -urNp linux-3.0.3/fs/cifs/cifsfs.c linux-3.0.3/fs/cifs/cifsfs.c | |
35158 | --- linux-3.0.3/fs/cifs/cifsfs.c 2011-08-23 21:44:40.000000000 -0400 | |
35159 | +++ linux-3.0.3/fs/cifs/cifsfs.c 2011-08-25 17:18:05.000000000 -0400 | |
35160 | @@ -994,7 +994,7 @@ cifs_init_request_bufs(void) | |
35161 | cifs_req_cachep = kmem_cache_create("cifs_request", | |
35162 | CIFSMaxBufSize + | |
35163 | MAX_CIFS_HDR_SIZE, 0, | |
35164 | - SLAB_HWCACHE_ALIGN, NULL); | |
35165 | + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL); | |
35166 | if (cifs_req_cachep == NULL) | |
35167 | return -ENOMEM; | |
35168 | ||
35169 | @@ -1021,7 +1021,7 @@ cifs_init_request_bufs(void) | |
35170 | efficient to alloc 1 per page off the slab compared to 17K (5page) | |
35171 | alloc of large cifs buffers even when page debugging is on */ | |
35172 | cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq", | |
35173 | - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN, | |
35174 | + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, | |
35175 | NULL); | |
35176 | if (cifs_sm_req_cachep == NULL) { | |
35177 | mempool_destroy(cifs_req_poolp); | |
35178 | @@ -1106,8 +1106,8 @@ init_cifs(void) | |
35179 | atomic_set(&bufAllocCount, 0); | |
35180 | atomic_set(&smBufAllocCount, 0); | |
35181 | #ifdef CONFIG_CIFS_STATS2 | |
35182 | - atomic_set(&totBufAllocCount, 0); | |
35183 | - atomic_set(&totSmBufAllocCount, 0); | |
35184 | + atomic_set_unchecked(&totBufAllocCount, 0); | |
35185 | + atomic_set_unchecked(&totSmBufAllocCount, 0); | |
35186 | #endif /* CONFIG_CIFS_STATS2 */ | |
35187 | ||
35188 | atomic_set(&midCount, 0); | |
35189 | diff -urNp linux-3.0.3/fs/cifs/cifsglob.h linux-3.0.3/fs/cifs/cifsglob.h | |
35190 | --- linux-3.0.3/fs/cifs/cifsglob.h 2011-07-21 22:17:23.000000000 -0400 | |
35191 | +++ linux-3.0.3/fs/cifs/cifsglob.h 2011-08-25 17:18:05.000000000 -0400 | |
35192 | @@ -381,28 +381,28 @@ struct cifs_tcon { | |
35193 | __u16 Flags; /* optional support bits */ | |
35194 | enum statusEnum tidStatus; | |
35195 | #ifdef CONFIG_CIFS_STATS | |
35196 | - atomic_t num_smbs_sent; | |
35197 | - atomic_t num_writes; | |
35198 | - atomic_t num_reads; | |
35199 | - atomic_t num_flushes; | |
35200 | - atomic_t num_oplock_brks; | |
35201 | - atomic_t num_opens; | |
35202 | - atomic_t num_closes; | |
35203 | - atomic_t num_deletes; | |
35204 | - atomic_t num_mkdirs; | |
35205 | - atomic_t num_posixopens; | |
35206 | - atomic_t num_posixmkdirs; | |
35207 | - atomic_t num_rmdirs; | |
35208 | - atomic_t num_renames; | |
35209 | - atomic_t num_t2renames; | |
35210 | - atomic_t num_ffirst; | |
35211 | - atomic_t num_fnext; | |
35212 | - atomic_t num_fclose; | |
35213 | - atomic_t num_hardlinks; | |
35214 | - atomic_t num_symlinks; | |
35215 | - atomic_t num_locks; | |
35216 | - atomic_t num_acl_get; | |
35217 | - atomic_t num_acl_set; | |
35218 | + atomic_unchecked_t num_smbs_sent; | |
35219 | + atomic_unchecked_t num_writes; | |
35220 | + atomic_unchecked_t num_reads; | |
35221 | + atomic_unchecked_t num_flushes; | |
35222 | + atomic_unchecked_t num_oplock_brks; | |
35223 | + atomic_unchecked_t num_opens; | |
35224 | + atomic_unchecked_t num_closes; | |
35225 | + atomic_unchecked_t num_deletes; | |
35226 | + atomic_unchecked_t num_mkdirs; | |
35227 | + atomic_unchecked_t num_posixopens; | |
35228 | + atomic_unchecked_t num_posixmkdirs; | |
35229 | + atomic_unchecked_t num_rmdirs; | |
35230 | + atomic_unchecked_t num_renames; | |
35231 | + atomic_unchecked_t num_t2renames; | |
35232 | + atomic_unchecked_t num_ffirst; | |
35233 | + atomic_unchecked_t num_fnext; | |
35234 | + atomic_unchecked_t num_fclose; | |
35235 | + atomic_unchecked_t num_hardlinks; | |
35236 | + atomic_unchecked_t num_symlinks; | |
35237 | + atomic_unchecked_t num_locks; | |
35238 | + atomic_unchecked_t num_acl_get; | |
35239 | + atomic_unchecked_t num_acl_set; | |
35240 | #ifdef CONFIG_CIFS_STATS2 | |
35241 | unsigned long long time_writes; | |
35242 | unsigned long long time_reads; | |
35243 | @@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim | |
35244 | } | |
35245 | ||
35246 | #ifdef CONFIG_CIFS_STATS | |
35247 | -#define cifs_stats_inc atomic_inc | |
35248 | +#define cifs_stats_inc atomic_inc_unchecked | |
35249 | ||
35250 | static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon, | |
35251 | unsigned int bytes) | |
35252 | @@ -911,8 +911,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect | |
35253 | /* Various Debug counters */ | |
35254 | GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */ | |
35255 | #ifdef CONFIG_CIFS_STATS2 | |
35256 | -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */ | |
35257 | -GLOBAL_EXTERN atomic_t totSmBufAllocCount; | |
35258 | +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */ | |
35259 | +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount; | |
35260 | #endif | |
35261 | GLOBAL_EXTERN atomic_t smBufAllocCount; | |
35262 | GLOBAL_EXTERN atomic_t midCount; | |
35263 | diff -urNp linux-3.0.3/fs/cifs/link.c linux-3.0.3/fs/cifs/link.c | |
35264 | --- linux-3.0.3/fs/cifs/link.c 2011-07-21 22:17:23.000000000 -0400 | |
35265 | +++ linux-3.0.3/fs/cifs/link.c 2011-08-23 21:47:56.000000000 -0400 | |
35266 | @@ -587,7 +587,7 @@ symlink_exit: | |
35267 | ||
35268 | void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie) | |
35269 | { | |
35270 | - char *p = nd_get_link(nd); | |
35271 | + const char *p = nd_get_link(nd); | |
35272 | if (!IS_ERR(p)) | |
35273 | kfree(p); | |
35274 | } | |
35275 | diff -urNp linux-3.0.3/fs/cifs/misc.c linux-3.0.3/fs/cifs/misc.c | |
35276 | --- linux-3.0.3/fs/cifs/misc.c 2011-07-21 22:17:23.000000000 -0400 | |
35277 | +++ linux-3.0.3/fs/cifs/misc.c 2011-08-25 17:18:05.000000000 -0400 | |
35278 | @@ -156,7 +156,7 @@ cifs_buf_get(void) | |
35279 | memset(ret_buf, 0, sizeof(struct smb_hdr) + 3); | |
35280 | atomic_inc(&bufAllocCount); | |
35281 | #ifdef CONFIG_CIFS_STATS2 | |
35282 | - atomic_inc(&totBufAllocCount); | |
35283 | + atomic_inc_unchecked(&totBufAllocCount); | |
35284 | #endif /* CONFIG_CIFS_STATS2 */ | |
35285 | } | |
35286 | ||
35287 | @@ -191,7 +191,7 @@ cifs_small_buf_get(void) | |
35288 | /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/ | |
35289 | atomic_inc(&smBufAllocCount); | |
35290 | #ifdef CONFIG_CIFS_STATS2 | |
35291 | - atomic_inc(&totSmBufAllocCount); | |
35292 | + atomic_inc_unchecked(&totSmBufAllocCount); | |
35293 | #endif /* CONFIG_CIFS_STATS2 */ | |
35294 | ||
35295 | } | |
35296 | diff -urNp linux-3.0.3/fs/coda/cache.c linux-3.0.3/fs/coda/cache.c | |
35297 | --- linux-3.0.3/fs/coda/cache.c 2011-07-21 22:17:23.000000000 -0400 | |
35298 | +++ linux-3.0.3/fs/coda/cache.c 2011-08-23 21:47:56.000000000 -0400 | |
35299 | @@ -24,7 +24,7 @@ | |
35300 | #include "coda_linux.h" | |
35301 | #include "coda_cache.h" | |
35302 | ||
35303 | -static atomic_t permission_epoch = ATOMIC_INIT(0); | |
35304 | +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0); | |
35305 | ||
35306 | /* replace or extend an acl cache hit */ | |
35307 | void coda_cache_enter(struct inode *inode, int mask) | |
35308 | @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod | |
35309 | struct coda_inode_info *cii = ITOC(inode); | |
35310 | ||
35311 | spin_lock(&cii->c_lock); | |
35312 | - cii->c_cached_epoch = atomic_read(&permission_epoch); | |
35313 | + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch); | |
35314 | if (cii->c_uid != current_fsuid()) { | |
35315 | cii->c_uid = current_fsuid(); | |
35316 | cii->c_cached_perm = mask; | |
35317 | @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode | |
35318 | { | |
35319 | struct coda_inode_info *cii = ITOC(inode); | |
35320 | spin_lock(&cii->c_lock); | |
35321 | - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1; | |
35322 | + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1; | |
35323 | spin_unlock(&cii->c_lock); | |
35324 | } | |
35325 | ||
35326 | /* remove all acl caches */ | |
35327 | void coda_cache_clear_all(struct super_block *sb) | |
35328 | { | |
35329 | - atomic_inc(&permission_epoch); | |
35330 | + atomic_inc_unchecked(&permission_epoch); | |
35331 | } | |
35332 | ||
35333 | ||
35334 | @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode | |
35335 | spin_lock(&cii->c_lock); | |
35336 | hit = (mask & cii->c_cached_perm) == mask && | |
35337 | cii->c_uid == current_fsuid() && | |
35338 | - cii->c_cached_epoch == atomic_read(&permission_epoch); | |
35339 | + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch); | |
35340 | spin_unlock(&cii->c_lock); | |
35341 | ||
35342 | return hit; | |
35343 | diff -urNp linux-3.0.3/fs/compat_binfmt_elf.c linux-3.0.3/fs/compat_binfmt_elf.c | |
35344 | --- linux-3.0.3/fs/compat_binfmt_elf.c 2011-07-21 22:17:23.000000000 -0400 | |
35345 | +++ linux-3.0.3/fs/compat_binfmt_elf.c 2011-08-23 21:47:56.000000000 -0400 | |
35346 | @@ -30,11 +30,13 @@ | |
35347 | #undef elf_phdr | |
35348 | #undef elf_shdr | |
35349 | #undef elf_note | |
35350 | +#undef elf_dyn | |
35351 | #undef elf_addr_t | |
35352 | #define elfhdr elf32_hdr | |
35353 | #define elf_phdr elf32_phdr | |
35354 | #define elf_shdr elf32_shdr | |
35355 | #define elf_note elf32_note | |
35356 | +#define elf_dyn Elf32_Dyn | |
35357 | #define elf_addr_t Elf32_Addr | |
35358 | ||
35359 | /* | |
35360 | diff -urNp linux-3.0.3/fs/compat.c linux-3.0.3/fs/compat.c | |
35361 | --- linux-3.0.3/fs/compat.c 2011-07-21 22:17:23.000000000 -0400 | |
35362 | +++ linux-3.0.3/fs/compat.c 2011-08-23 22:49:33.000000000 -0400 | |
35363 | @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int | |
35364 | goto out; | |
35365 | ||
35366 | ret = -EINVAL; | |
35367 | - if (nr_segs > UIO_MAXIOV || nr_segs < 0) | |
35368 | + if (nr_segs > UIO_MAXIOV) | |
35369 | goto out; | |
35370 | if (nr_segs > fast_segs) { | |
35371 | ret = -ENOMEM; | |
35372 | @@ -848,6 +848,7 @@ struct compat_old_linux_dirent { | |
35373 | ||
35374 | struct compat_readdir_callback { | |
35375 | struct compat_old_linux_dirent __user *dirent; | |
35376 | + struct file * file; | |
35377 | int result; | |
35378 | }; | |
35379 | ||
35380 | @@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf | |
35381 | buf->result = -EOVERFLOW; | |
35382 | return -EOVERFLOW; | |
35383 | } | |
35384 | + | |
35385 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
35386 | + return 0; | |
35387 | + | |
35388 | buf->result++; | |
35389 | dirent = buf->dirent; | |
35390 | if (!access_ok(VERIFY_WRITE, dirent, | |
35391 | @@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u | |
35392 | ||
35393 | buf.result = 0; | |
35394 | buf.dirent = dirent; | |
35395 | + buf.file = file; | |
35396 | ||
35397 | error = vfs_readdir(file, compat_fillonedir, &buf); | |
35398 | if (buf.result) | |
35399 | @@ -917,6 +923,7 @@ struct compat_linux_dirent { | |
35400 | struct compat_getdents_callback { | |
35401 | struct compat_linux_dirent __user *current_dir; | |
35402 | struct compat_linux_dirent __user *previous; | |
35403 | + struct file * file; | |
35404 | int count; | |
35405 | int error; | |
35406 | }; | |
35407 | @@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c | |
35408 | buf->error = -EOVERFLOW; | |
35409 | return -EOVERFLOW; | |
35410 | } | |
35411 | + | |
35412 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
35413 | + return 0; | |
35414 | + | |
35415 | dirent = buf->previous; | |
35416 | if (dirent) { | |
35417 | if (__put_user(offset, &dirent->d_off)) | |
35418 | @@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi | |
35419 | buf.previous = NULL; | |
35420 | buf.count = count; | |
35421 | buf.error = 0; | |
35422 | + buf.file = file; | |
35423 | ||
35424 | error = vfs_readdir(file, compat_filldir, &buf); | |
35425 | if (error >= 0) | |
35426 | @@ -1006,6 +1018,7 @@ out: | |
35427 | struct compat_getdents_callback64 { | |
35428 | struct linux_dirent64 __user *current_dir; | |
35429 | struct linux_dirent64 __user *previous; | |
35430 | + struct file * file; | |
35431 | int count; | |
35432 | int error; | |
35433 | }; | |
35434 | @@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf | |
35435 | buf->error = -EINVAL; /* only used if we fail.. */ | |
35436 | if (reclen > buf->count) | |
35437 | return -EINVAL; | |
35438 | + | |
35439 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
35440 | + return 0; | |
35441 | + | |
35442 | dirent = buf->previous; | |
35443 | ||
35444 | if (dirent) { | |
35445 | @@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un | |
35446 | buf.previous = NULL; | |
35447 | buf.count = count; | |
35448 | buf.error = 0; | |
35449 | + buf.file = file; | |
35450 | ||
35451 | error = vfs_readdir(file, compat_filldir64, &buf); | |
35452 | if (error >= 0) | |
35453 | @@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat | |
35454 | struct fdtable *fdt; | |
35455 | long stack_fds[SELECT_STACK_ALLOC/sizeof(long)]; | |
35456 | ||
35457 | + pax_track_stack(); | |
35458 | + | |
35459 | if (n < 0) | |
35460 | goto out_nofds; | |
35461 | ||
35462 | diff -urNp linux-3.0.3/fs/compat_ioctl.c linux-3.0.3/fs/compat_ioctl.c | |
35463 | --- linux-3.0.3/fs/compat_ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
35464 | +++ linux-3.0.3/fs/compat_ioctl.c 2011-08-23 21:47:56.000000000 -0400 | |
35465 | @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi | |
35466 | ||
35467 | err = get_user(palp, &up->palette); | |
35468 | err |= get_user(length, &up->length); | |
35469 | + if (err) | |
35470 | + return -EFAULT; | |
35471 | ||
35472 | up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); | |
35473 | err = put_user(compat_ptr(palp), &up_native->palette); | |
35474 | @@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne | |
35475 | static int __init init_sys32_ioctl_cmp(const void *p, const void *q) | |
35476 | { | |
35477 | unsigned int a, b; | |
35478 | - a = *(unsigned int *)p; | |
35479 | - b = *(unsigned int *)q; | |
35480 | + a = *(const unsigned int *)p; | |
35481 | + b = *(const unsigned int *)q; | |
35482 | if (a > b) | |
35483 | return 1; | |
35484 | if (a < b) | |
35485 | diff -urNp linux-3.0.3/fs/configfs/dir.c linux-3.0.3/fs/configfs/dir.c | |
35486 | --- linux-3.0.3/fs/configfs/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
35487 | +++ linux-3.0.3/fs/configfs/dir.c 2011-08-23 21:47:56.000000000 -0400 | |
35488 | @@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file | |
35489 | } | |
35490 | for (p=q->next; p!= &parent_sd->s_children; p=p->next) { | |
35491 | struct configfs_dirent *next; | |
35492 | - const char * name; | |
35493 | + const unsigned char * name; | |
35494 | + char d_name[sizeof(next->s_dentry->d_iname)]; | |
35495 | int len; | |
35496 | struct inode *inode = NULL; | |
35497 | ||
35498 | @@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file | |
35499 | continue; | |
35500 | ||
35501 | name = configfs_get_name(next); | |
35502 | - len = strlen(name); | |
35503 | + if (next->s_dentry && name == next->s_dentry->d_iname) { | |
35504 | + len = next->s_dentry->d_name.len; | |
35505 | + memcpy(d_name, name, len); | |
35506 | + name = d_name; | |
35507 | + } else | |
35508 | + len = strlen(name); | |
35509 | ||
35510 | /* | |
35511 | * We'll have a dentry and an inode for | |
35512 | diff -urNp linux-3.0.3/fs/dcache.c linux-3.0.3/fs/dcache.c | |
35513 | --- linux-3.0.3/fs/dcache.c 2011-07-21 22:17:23.000000000 -0400 | |
35514 | +++ linux-3.0.3/fs/dcache.c 2011-08-23 21:47:56.000000000 -0400 | |
35515 | @@ -3089,7 +3089,7 @@ void __init vfs_caches_init(unsigned lon | |
35516 | mempages -= reserve; | |
35517 | ||
35518 | names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, | |
35519 | - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); | |
35520 | + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL); | |
35521 | ||
35522 | dcache_init(); | |
35523 | inode_init(); | |
35524 | diff -urNp linux-3.0.3/fs/ecryptfs/inode.c linux-3.0.3/fs/ecryptfs/inode.c | |
35525 | --- linux-3.0.3/fs/ecryptfs/inode.c 2011-08-23 21:44:40.000000000 -0400 | |
35526 | +++ linux-3.0.3/fs/ecryptfs/inode.c 2011-08-23 21:47:56.000000000 -0400 | |
35527 | @@ -704,7 +704,7 @@ static int ecryptfs_readlink_lower(struc | |
35528 | old_fs = get_fs(); | |
35529 | set_fs(get_ds()); | |
35530 | rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, | |
35531 | - (char __user *)lower_buf, | |
35532 | + (__force char __user *)lower_buf, | |
35533 | lower_bufsiz); | |
35534 | set_fs(old_fs); | |
35535 | if (rc < 0) | |
35536 | @@ -750,7 +750,7 @@ static void *ecryptfs_follow_link(struct | |
35537 | } | |
35538 | old_fs = get_fs(); | |
35539 | set_fs(get_ds()); | |
35540 | - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); | |
35541 | + rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len); | |
35542 | set_fs(old_fs); | |
35543 | if (rc < 0) { | |
35544 | kfree(buf); | |
35545 | @@ -765,7 +765,7 @@ out: | |
35546 | static void | |
35547 | ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr) | |
35548 | { | |
35549 | - char *buf = nd_get_link(nd); | |
35550 | + const char *buf = nd_get_link(nd); | |
35551 | if (!IS_ERR(buf)) { | |
35552 | /* Free the char* */ | |
35553 | kfree(buf); | |
35554 | diff -urNp linux-3.0.3/fs/ecryptfs/miscdev.c linux-3.0.3/fs/ecryptfs/miscdev.c | |
35555 | --- linux-3.0.3/fs/ecryptfs/miscdev.c 2011-07-21 22:17:23.000000000 -0400 | |
35556 | +++ linux-3.0.3/fs/ecryptfs/miscdev.c 2011-08-23 21:47:56.000000000 -0400 | |
35557 | @@ -328,7 +328,7 @@ check_list: | |
35558 | goto out_unlock_msg_ctx; | |
35559 | i = 5; | |
35560 | if (msg_ctx->msg) { | |
35561 | - if (copy_to_user(&buf[i], packet_length, packet_length_size)) | |
35562 | + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size)) | |
35563 | goto out_unlock_msg_ctx; | |
35564 | i += packet_length_size; | |
35565 | if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size)) | |
35566 | diff -urNp linux-3.0.3/fs/exec.c linux-3.0.3/fs/exec.c | |
35567 | --- linux-3.0.3/fs/exec.c 2011-07-21 22:17:23.000000000 -0400 | |
35568 | +++ linux-3.0.3/fs/exec.c 2011-08-25 17:26:58.000000000 -0400 | |
35569 | @@ -55,12 +55,24 @@ | |
35570 | #include <linux/pipe_fs_i.h> | |
35571 | #include <linux/oom.h> | |
35572 | #include <linux/compat.h> | |
35573 | +#include <linux/random.h> | |
35574 | +#include <linux/seq_file.h> | |
35575 | + | |
35576 | +#ifdef CONFIG_PAX_REFCOUNT | |
35577 | +#include <linux/kallsyms.h> | |
35578 | +#include <linux/kdebug.h> | |
35579 | +#endif | |
35580 | ||
35581 | #include <asm/uaccess.h> | |
35582 | #include <asm/mmu_context.h> | |
35583 | #include <asm/tlb.h> | |
35584 | #include "internal.h" | |
35585 | ||
35586 | +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS | |
35587 | +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm); | |
35588 | +EXPORT_SYMBOL(pax_set_initial_flags_func); | |
35589 | +#endif | |
35590 | + | |
35591 | int core_uses_pid; | |
35592 | char core_pattern[CORENAME_MAX_SIZE] = "core"; | |
35593 | unsigned int core_pipe_limit; | |
35594 | @@ -70,7 +82,7 @@ struct core_name { | |
35595 | char *corename; | |
35596 | int used, size; | |
35597 | }; | |
35598 | -static atomic_t call_count = ATOMIC_INIT(1); | |
35599 | +static atomic_unchecked_t call_count = ATOMIC_INIT(1); | |
35600 | ||
35601 | /* The maximal length of core_pattern is also specified in sysctl.c */ | |
35602 | ||
35603 | @@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use | |
35604 | char *tmp = getname(library); | |
35605 | int error = PTR_ERR(tmp); | |
35606 | static const struct open_flags uselib_flags = { | |
35607 | - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC, | |
35608 | + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC, | |
35609 | .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN, | |
35610 | .intent = LOOKUP_OPEN | |
35611 | }; | |
35612 | @@ -195,18 +207,10 @@ static struct page *get_arg_page(struct | |
35613 | int write) | |
35614 | { | |
35615 | struct page *page; | |
35616 | - int ret; | |
35617 | ||
35618 | -#ifdef CONFIG_STACK_GROWSUP | |
35619 | - if (write) { | |
35620 | - ret = expand_downwards(bprm->vma, pos); | |
35621 | - if (ret < 0) | |
35622 | - return NULL; | |
35623 | - } | |
35624 | -#endif | |
35625 | - ret = get_user_pages(current, bprm->mm, pos, | |
35626 | - 1, write, 1, &page, NULL); | |
35627 | - if (ret <= 0) | |
35628 | + if (0 > expand_downwards(bprm->vma, pos)) | |
35629 | + return NULL; | |
35630 | + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL)) | |
35631 | return NULL; | |
35632 | ||
35633 | if (write) { | |
35634 | @@ -281,6 +285,11 @@ static int __bprm_mm_init(struct linux_b | |
35635 | vma->vm_end = STACK_TOP_MAX; | |
35636 | vma->vm_start = vma->vm_end - PAGE_SIZE; | |
35637 | vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP; | |
35638 | + | |
35639 | +#ifdef CONFIG_PAX_SEGMEXEC | |
35640 | + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC); | |
35641 | +#endif | |
35642 | + | |
35643 | vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
35644 | INIT_LIST_HEAD(&vma->anon_vma_chain); | |
35645 | ||
35646 | @@ -295,6 +304,12 @@ static int __bprm_mm_init(struct linux_b | |
35647 | mm->stack_vm = mm->total_vm = 1; | |
35648 | up_write(&mm->mmap_sem); | |
35649 | bprm->p = vma->vm_end - sizeof(void *); | |
35650 | + | |
35651 | +#ifdef CONFIG_PAX_RANDUSTACK | |
35652 | + if (randomize_va_space) | |
35653 | + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK; | |
35654 | +#endif | |
35655 | + | |
35656 | return 0; | |
35657 | err: | |
35658 | up_write(&mm->mmap_sem); | |
35659 | @@ -403,19 +418,7 @@ err: | |
35660 | return err; | |
35661 | } | |
35662 | ||
35663 | -struct user_arg_ptr { | |
35664 | -#ifdef CONFIG_COMPAT | |
35665 | - bool is_compat; | |
35666 | -#endif | |
35667 | - union { | |
35668 | - const char __user *const __user *native; | |
35669 | -#ifdef CONFIG_COMPAT | |
35670 | - compat_uptr_t __user *compat; | |
35671 | -#endif | |
35672 | - } ptr; | |
35673 | -}; | |
35674 | - | |
35675 | -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr) | |
35676 | +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr) | |
35677 | { | |
35678 | const char __user *native; | |
35679 | ||
35680 | @@ -566,7 +569,7 @@ int copy_strings_kernel(int argc, const | |
35681 | int r; | |
35682 | mm_segment_t oldfs = get_fs(); | |
35683 | struct user_arg_ptr argv = { | |
35684 | - .ptr.native = (const char __user *const __user *)__argv, | |
35685 | + .ptr.native = (__force const char __user *const __user *)__argv, | |
35686 | }; | |
35687 | ||
35688 | set_fs(KERNEL_DS); | |
35689 | @@ -601,7 +604,8 @@ static int shift_arg_pages(struct vm_are | |
35690 | unsigned long new_end = old_end - shift; | |
35691 | struct mmu_gather tlb; | |
35692 | ||
35693 | - BUG_ON(new_start > new_end); | |
35694 | + if (new_start >= new_end || new_start < mmap_min_addr) | |
35695 | + return -ENOMEM; | |
35696 | ||
35697 | /* | |
35698 | * ensure there are no vmas between where we want to go | |
35699 | @@ -610,6 +614,10 @@ static int shift_arg_pages(struct vm_are | |
35700 | if (vma != find_vma(mm, new_start)) | |
35701 | return -EFAULT; | |
35702 | ||
35703 | +#ifdef CONFIG_PAX_SEGMEXEC | |
35704 | + BUG_ON(pax_find_mirror_vma(vma)); | |
35705 | +#endif | |
35706 | + | |
35707 | /* | |
35708 | * cover the whole range: [new_start, old_end) | |
35709 | */ | |
35710 | @@ -690,10 +698,6 @@ int setup_arg_pages(struct linux_binprm | |
35711 | stack_top = arch_align_stack(stack_top); | |
35712 | stack_top = PAGE_ALIGN(stack_top); | |
35713 | ||
35714 | - if (unlikely(stack_top < mmap_min_addr) || | |
35715 | - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr)) | |
35716 | - return -ENOMEM; | |
35717 | - | |
35718 | stack_shift = vma->vm_end - stack_top; | |
35719 | ||
35720 | bprm->p -= stack_shift; | |
35721 | @@ -705,8 +709,28 @@ int setup_arg_pages(struct linux_binprm | |
35722 | bprm->exec -= stack_shift; | |
35723 | ||
35724 | down_write(&mm->mmap_sem); | |
35725 | + | |
35726 | + /* Move stack pages down in memory. */ | |
35727 | + if (stack_shift) { | |
35728 | + ret = shift_arg_pages(vma, stack_shift); | |
35729 | + if (ret) | |
35730 | + goto out_unlock; | |
35731 | + } | |
35732 | + | |
35733 | vm_flags = VM_STACK_FLAGS; | |
35734 | ||
35735 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
35736 | + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
35737 | + vm_flags &= ~VM_EXEC; | |
35738 | + | |
35739 | +#ifdef CONFIG_PAX_MPROTECT | |
35740 | + if (mm->pax_flags & MF_PAX_MPROTECT) | |
35741 | + vm_flags &= ~VM_MAYEXEC; | |
35742 | +#endif | |
35743 | + | |
35744 | + } | |
35745 | +#endif | |
35746 | + | |
35747 | /* | |
35748 | * Adjust stack execute permissions; explicitly enable for | |
35749 | * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone | |
35750 | @@ -725,13 +749,6 @@ int setup_arg_pages(struct linux_binprm | |
35751 | goto out_unlock; | |
35752 | BUG_ON(prev != vma); | |
35753 | ||
35754 | - /* Move stack pages down in memory. */ | |
35755 | - if (stack_shift) { | |
35756 | - ret = shift_arg_pages(vma, stack_shift); | |
35757 | - if (ret) | |
35758 | - goto out_unlock; | |
35759 | - } | |
35760 | - | |
35761 | /* mprotect_fixup is overkill to remove the temporary stack flags */ | |
35762 | vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP; | |
35763 | ||
35764 | @@ -771,7 +788,7 @@ struct file *open_exec(const char *name) | |
35765 | struct file *file; | |
35766 | int err; | |
35767 | static const struct open_flags open_exec_flags = { | |
35768 | - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC, | |
35769 | + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC, | |
35770 | .acc_mode = MAY_EXEC | MAY_OPEN, | |
35771 | .intent = LOOKUP_OPEN | |
35772 | }; | |
35773 | @@ -812,7 +829,7 @@ int kernel_read(struct file *file, loff_ | |
35774 | old_fs = get_fs(); | |
35775 | set_fs(get_ds()); | |
35776 | /* The cast to a user pointer is valid due to the set_fs() */ | |
35777 | - result = vfs_read(file, (void __user *)addr, count, &pos); | |
35778 | + result = vfs_read(file, (__force void __user *)addr, count, &pos); | |
35779 | set_fs(old_fs); | |
35780 | return result; | |
35781 | } | |
35782 | @@ -1236,7 +1253,7 @@ int check_unsafe_exec(struct linux_binpr | |
35783 | } | |
35784 | rcu_read_unlock(); | |
35785 | ||
35786 | - if (p->fs->users > n_fs) { | |
35787 | + if (atomic_read(&p->fs->users) > n_fs) { | |
35788 | bprm->unsafe |= LSM_UNSAFE_SHARE; | |
35789 | } else { | |
35790 | res = -EAGAIN; | |
35791 | @@ -1428,11 +1445,35 @@ static int do_execve_common(const char * | |
35792 | struct user_arg_ptr envp, | |
35793 | struct pt_regs *regs) | |
35794 | { | |
35795 | +#ifdef CONFIG_GRKERNSEC | |
35796 | + struct file *old_exec_file; | |
35797 | + struct acl_subject_label *old_acl; | |
35798 | + struct rlimit old_rlim[RLIM_NLIMITS]; | |
35799 | +#endif | |
35800 | struct linux_binprm *bprm; | |
35801 | struct file *file; | |
35802 | struct files_struct *displaced; | |
35803 | bool clear_in_exec; | |
35804 | int retval; | |
35805 | + const struct cred *cred = current_cred(); | |
35806 | + | |
35807 | + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1); | |
35808 | + | |
35809 | + /* | |
35810 | + * We move the actual failure in case of RLIMIT_NPROC excess from | |
35811 | + * set*uid() to execve() because too many poorly written programs | |
35812 | + * don't check setuid() return code. Here we additionally recheck | |
35813 | + * whether NPROC limit is still exceeded. | |
35814 | + */ | |
35815 | + if ((current->flags & PF_NPROC_EXCEEDED) && | |
35816 | + atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) { | |
35817 | + retval = -EAGAIN; | |
35818 | + goto out_ret; | |
35819 | + } | |
35820 | + | |
35821 | + /* We're below the limit (still or again), so we don't want to make | |
35822 | + * further execve() calls fail. */ | |
35823 | + current->flags &= ~PF_NPROC_EXCEEDED; | |
35824 | ||
35825 | retval = unshare_files(&displaced); | |
35826 | if (retval) | |
35827 | @@ -1464,6 +1505,16 @@ static int do_execve_common(const char * | |
35828 | bprm->filename = filename; | |
35829 | bprm->interp = filename; | |
35830 | ||
35831 | + if (gr_process_user_ban()) { | |
35832 | + retval = -EPERM; | |
35833 | + goto out_file; | |
35834 | + } | |
35835 | + | |
35836 | + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) { | |
35837 | + retval = -EACCES; | |
35838 | + goto out_file; | |
35839 | + } | |
35840 | + | |
35841 | retval = bprm_mm_init(bprm); | |
35842 | if (retval) | |
35843 | goto out_file; | |
35844 | @@ -1493,9 +1544,40 @@ static int do_execve_common(const char * | |
35845 | if (retval < 0) | |
35846 | goto out; | |
35847 | ||
35848 | + if (!gr_tpe_allow(file)) { | |
35849 | + retval = -EACCES; | |
35850 | + goto out; | |
35851 | + } | |
35852 | + | |
35853 | + if (gr_check_crash_exec(file)) { | |
35854 | + retval = -EACCES; | |
35855 | + goto out; | |
35856 | + } | |
35857 | + | |
35858 | + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt); | |
35859 | + | |
35860 | + gr_handle_exec_args(bprm, argv); | |
35861 | + | |
35862 | +#ifdef CONFIG_GRKERNSEC | |
35863 | + old_acl = current->acl; | |
35864 | + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim)); | |
35865 | + old_exec_file = current->exec_file; | |
35866 | + get_file(file); | |
35867 | + current->exec_file = file; | |
35868 | +#endif | |
35869 | + | |
35870 | + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt, | |
35871 | + bprm->unsafe & LSM_UNSAFE_SHARE); | |
35872 | + if (retval < 0) | |
35873 | + goto out_fail; | |
35874 | + | |
35875 | retval = search_binary_handler(bprm,regs); | |
35876 | if (retval < 0) | |
35877 | - goto out; | |
35878 | + goto out_fail; | |
35879 | +#ifdef CONFIG_GRKERNSEC | |
35880 | + if (old_exec_file) | |
35881 | + fput(old_exec_file); | |
35882 | +#endif | |
35883 | ||
35884 | /* execve succeeded */ | |
35885 | current->fs->in_exec = 0; | |
35886 | @@ -1506,6 +1588,14 @@ static int do_execve_common(const char * | |
35887 | put_files_struct(displaced); | |
35888 | return retval; | |
35889 | ||
35890 | +out_fail: | |
35891 | +#ifdef CONFIG_GRKERNSEC | |
35892 | + current->acl = old_acl; | |
35893 | + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim)); | |
35894 | + fput(current->exec_file); | |
35895 | + current->exec_file = old_exec_file; | |
35896 | +#endif | |
35897 | + | |
35898 | out: | |
35899 | if (bprm->mm) { | |
35900 | acct_arg_size(bprm, 0); | |
35901 | @@ -1579,7 +1669,7 @@ static int expand_corename(struct core_n | |
35902 | { | |
35903 | char *old_corename = cn->corename; | |
35904 | ||
35905 | - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count); | |
35906 | + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count); | |
35907 | cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL); | |
35908 | ||
35909 | if (!cn->corename) { | |
35910 | @@ -1667,7 +1757,7 @@ static int format_corename(struct core_n | |
35911 | int pid_in_pattern = 0; | |
35912 | int err = 0; | |
35913 | ||
35914 | - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count); | |
35915 | + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count); | |
35916 | cn->corename = kmalloc(cn->size, GFP_KERNEL); | |
35917 | cn->used = 0; | |
35918 | ||
35919 | @@ -1758,6 +1848,219 @@ out: | |
35920 | return ispipe; | |
35921 | } | |
35922 | ||
35923 | +int pax_check_flags(unsigned long *flags) | |
35924 | +{ | |
35925 | + int retval = 0; | |
35926 | + | |
35927 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC) | |
35928 | + if (*flags & MF_PAX_SEGMEXEC) | |
35929 | + { | |
35930 | + *flags &= ~MF_PAX_SEGMEXEC; | |
35931 | + retval = -EINVAL; | |
35932 | + } | |
35933 | +#endif | |
35934 | + | |
35935 | + if ((*flags & MF_PAX_PAGEEXEC) | |
35936 | + | |
35937 | +#ifdef CONFIG_PAX_PAGEEXEC | |
35938 | + && (*flags & MF_PAX_SEGMEXEC) | |
35939 | +#endif | |
35940 | + | |
35941 | + ) | |
35942 | + { | |
35943 | + *flags &= ~MF_PAX_PAGEEXEC; | |
35944 | + retval = -EINVAL; | |
35945 | + } | |
35946 | + | |
35947 | + if ((*flags & MF_PAX_MPROTECT) | |
35948 | + | |
35949 | +#ifdef CONFIG_PAX_MPROTECT | |
35950 | + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) | |
35951 | +#endif | |
35952 | + | |
35953 | + ) | |
35954 | + { | |
35955 | + *flags &= ~MF_PAX_MPROTECT; | |
35956 | + retval = -EINVAL; | |
35957 | + } | |
35958 | + | |
35959 | + if ((*flags & MF_PAX_EMUTRAMP) | |
35960 | + | |
35961 | +#ifdef CONFIG_PAX_EMUTRAMP | |
35962 | + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) | |
35963 | +#endif | |
35964 | + | |
35965 | + ) | |
35966 | + { | |
35967 | + *flags &= ~MF_PAX_EMUTRAMP; | |
35968 | + retval = -EINVAL; | |
35969 | + } | |
35970 | + | |
35971 | + return retval; | |
35972 | +} | |
35973 | + | |
35974 | +EXPORT_SYMBOL(pax_check_flags); | |
35975 | + | |
35976 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
35977 | +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp) | |
35978 | +{ | |
35979 | + struct task_struct *tsk = current; | |
35980 | + struct mm_struct *mm = current->mm; | |
35981 | + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL); | |
35982 | + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL); | |
35983 | + char *path_exec = NULL; | |
35984 | + char *path_fault = NULL; | |
35985 | + unsigned long start = 0UL, end = 0UL, offset = 0UL; | |
35986 | + | |
35987 | + if (buffer_exec && buffer_fault) { | |
35988 | + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL; | |
35989 | + | |
35990 | + down_read(&mm->mmap_sem); | |
35991 | + vma = mm->mmap; | |
35992 | + while (vma && (!vma_exec || !vma_fault)) { | |
35993 | + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file) | |
35994 | + vma_exec = vma; | |
35995 | + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end) | |
35996 | + vma_fault = vma; | |
35997 | + vma = vma->vm_next; | |
35998 | + } | |
35999 | + if (vma_exec) { | |
36000 | + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE); | |
36001 | + if (IS_ERR(path_exec)) | |
36002 | + path_exec = "<path too long>"; | |
36003 | + else { | |
36004 | + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\"); | |
36005 | + if (path_exec) { | |
36006 | + *path_exec = 0; | |
36007 | + path_exec = buffer_exec; | |
36008 | + } else | |
36009 | + path_exec = "<path too long>"; | |
36010 | + } | |
36011 | + } | |
36012 | + if (vma_fault) { | |
36013 | + start = vma_fault->vm_start; | |
36014 | + end = vma_fault->vm_end; | |
36015 | + offset = vma_fault->vm_pgoff << PAGE_SHIFT; | |
36016 | + if (vma_fault->vm_file) { | |
36017 | + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE); | |
36018 | + if (IS_ERR(path_fault)) | |
36019 | + path_fault = "<path too long>"; | |
36020 | + else { | |
36021 | + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\"); | |
36022 | + if (path_fault) { | |
36023 | + *path_fault = 0; | |
36024 | + path_fault = buffer_fault; | |
36025 | + } else | |
36026 | + path_fault = "<path too long>"; | |
36027 | + } | |
36028 | + } else | |
36029 | + path_fault = "<anonymous mapping>"; | |
36030 | + } | |
36031 | + up_read(&mm->mmap_sem); | |
36032 | + } | |
36033 | + if (tsk->signal->curr_ip) | |
36034 | + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset); | |
36035 | + else | |
36036 | + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset); | |
36037 | + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, " | |
36038 | + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk), | |
36039 | + task_uid(tsk), task_euid(tsk), pc, sp); | |
36040 | + free_page((unsigned long)buffer_exec); | |
36041 | + free_page((unsigned long)buffer_fault); | |
36042 | + pax_report_insns(pc, sp); | |
36043 | + do_coredump(SIGKILL, SIGKILL, regs); | |
36044 | +} | |
36045 | +#endif | |
36046 | + | |
36047 | +#ifdef CONFIG_PAX_REFCOUNT | |
36048 | +void pax_report_refcount_overflow(struct pt_regs *regs) | |
36049 | +{ | |
36050 | + if (current->signal->curr_ip) | |
36051 | + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n", | |
36052 | + ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid()); | |
36053 | + else | |
36054 | + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n", | |
36055 | + current->comm, task_pid_nr(current), current_uid(), current_euid()); | |
36056 | + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs)); | |
36057 | + show_regs(regs); | |
36058 | + force_sig_info(SIGKILL, SEND_SIG_FORCED, current); | |
36059 | +} | |
36060 | +#endif | |
36061 | + | |
36062 | +#ifdef CONFIG_PAX_USERCOPY | |
36063 | +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */ | |
36064 | +int object_is_on_stack(const void *obj, unsigned long len) | |
36065 | +{ | |
36066 | + const void * const stack = task_stack_page(current); | |
36067 | + const void * const stackend = stack + THREAD_SIZE; | |
36068 | + | |
36069 | +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86) | |
36070 | + const void *frame = NULL; | |
36071 | + const void *oldframe; | |
36072 | +#endif | |
36073 | + | |
36074 | + if (obj + len < obj) | |
36075 | + return -1; | |
36076 | + | |
36077 | + if (obj + len <= stack || stackend <= obj) | |
36078 | + return 0; | |
36079 | + | |
36080 | + if (obj < stack || stackend < obj + len) | |
36081 | + return -1; | |
36082 | + | |
36083 | +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86) | |
36084 | + oldframe = __builtin_frame_address(1); | |
36085 | + if (oldframe) | |
36086 | + frame = __builtin_frame_address(2); | |
36087 | + /* | |
36088 | + low ----------------------------------------------> high | |
36089 | + [saved bp][saved ip][args][local vars][saved bp][saved ip] | |
36090 | + ^----------------^ | |
36091 | + allow copies only within here | |
36092 | + */ | |
36093 | + while (stack <= frame && frame < stackend) { | |
36094 | + /* if obj + len extends past the last frame, this | |
36095 | + check won't pass and the next frame will be 0, | |
36096 | + causing us to bail out and correctly report | |
36097 | + the copy as invalid | |
36098 | + */ | |
36099 | + if (obj + len <= frame) | |
36100 | + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1; | |
36101 | + oldframe = frame; | |
36102 | + frame = *(const void * const *)frame; | |
36103 | + } | |
36104 | + return -1; | |
36105 | +#else | |
36106 | + return 1; | |
36107 | +#endif | |
36108 | +} | |
36109 | + | |
36110 | + | |
36111 | +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) | |
36112 | +{ | |
36113 | + if (current->signal->curr_ip) | |
36114 | + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n", | |
36115 | + ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len); | |
36116 | + else | |
36117 | + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n", | |
36118 | + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len); | |
36119 | + dump_stack(); | |
36120 | + gr_handle_kernel_exploit(); | |
36121 | + do_group_exit(SIGKILL); | |
36122 | +} | |
36123 | +#endif | |
36124 | + | |
36125 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
36126 | +void pax_track_stack(void) | |
36127 | +{ | |
36128 | + unsigned long sp = (unsigned long)&sp; | |
36129 | + if (sp < current_thread_info()->lowest_stack && | |
36130 | + sp > (unsigned long)task_stack_page(current)) | |
36131 | + current_thread_info()->lowest_stack = sp; | |
36132 | +} | |
36133 | +EXPORT_SYMBOL(pax_track_stack); | |
36134 | +#endif | |
36135 | + | |
36136 | static int zap_process(struct task_struct *start, int exit_code) | |
36137 | { | |
36138 | struct task_struct *t; | |
36139 | @@ -1969,17 +2272,17 @@ static void wait_for_dump_helpers(struct | |
36140 | pipe = file->f_path.dentry->d_inode->i_pipe; | |
36141 | ||
36142 | pipe_lock(pipe); | |
36143 | - pipe->readers++; | |
36144 | - pipe->writers--; | |
36145 | + atomic_inc(&pipe->readers); | |
36146 | + atomic_dec(&pipe->writers); | |
36147 | ||
36148 | - while ((pipe->readers > 1) && (!signal_pending(current))) { | |
36149 | + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) { | |
36150 | wake_up_interruptible_sync(&pipe->wait); | |
36151 | kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); | |
36152 | pipe_wait(pipe); | |
36153 | } | |
36154 | ||
36155 | - pipe->readers--; | |
36156 | - pipe->writers++; | |
36157 | + atomic_dec(&pipe->readers); | |
36158 | + atomic_inc(&pipe->writers); | |
36159 | pipe_unlock(pipe); | |
36160 | ||
36161 | } | |
36162 | @@ -2040,7 +2343,7 @@ void do_coredump(long signr, int exit_co | |
36163 | int retval = 0; | |
36164 | int flag = 0; | |
36165 | int ispipe; | |
36166 | - static atomic_t core_dump_count = ATOMIC_INIT(0); | |
36167 | + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0); | |
36168 | struct coredump_params cprm = { | |
36169 | .signr = signr, | |
36170 | .regs = regs, | |
36171 | @@ -2055,6 +2358,9 @@ void do_coredump(long signr, int exit_co | |
36172 | ||
36173 | audit_core_dumps(signr); | |
36174 | ||
36175 | + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL) | |
36176 | + gr_handle_brute_attach(current, cprm.mm_flags); | |
36177 | + | |
36178 | binfmt = mm->binfmt; | |
36179 | if (!binfmt || !binfmt->core_dump) | |
36180 | goto fail; | |
36181 | @@ -2095,6 +2401,8 @@ void do_coredump(long signr, int exit_co | |
36182 | goto fail_corename; | |
36183 | } | |
36184 | ||
36185 | + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1); | |
36186 | + | |
36187 | if (ispipe) { | |
36188 | int dump_count; | |
36189 | char **helper_argv; | |
36190 | @@ -2122,7 +2430,7 @@ void do_coredump(long signr, int exit_co | |
36191 | } | |
36192 | cprm.limit = RLIM_INFINITY; | |
36193 | ||
36194 | - dump_count = atomic_inc_return(&core_dump_count); | |
36195 | + dump_count = atomic_inc_return_unchecked(&core_dump_count); | |
36196 | if (core_pipe_limit && (core_pipe_limit < dump_count)) { | |
36197 | printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", | |
36198 | task_tgid_vnr(current), current->comm); | |
36199 | @@ -2192,7 +2500,7 @@ close_fail: | |
36200 | filp_close(cprm.file, NULL); | |
36201 | fail_dropcount: | |
36202 | if (ispipe) | |
36203 | - atomic_dec(&core_dump_count); | |
36204 | + atomic_dec_unchecked(&core_dump_count); | |
36205 | fail_unlock: | |
36206 | kfree(cn.corename); | |
36207 | fail_corename: | |
36208 | diff -urNp linux-3.0.3/fs/ext2/balloc.c linux-3.0.3/fs/ext2/balloc.c | |
36209 | --- linux-3.0.3/fs/ext2/balloc.c 2011-07-21 22:17:23.000000000 -0400 | |
36210 | +++ linux-3.0.3/fs/ext2/balloc.c 2011-08-23 21:48:14.000000000 -0400 | |
36211 | @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e | |
36212 | ||
36213 | free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); | |
36214 | root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); | |
36215 | - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && | |
36216 | + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) && | |
36217 | sbi->s_resuid != current_fsuid() && | |
36218 | (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { | |
36219 | return 0; | |
36220 | diff -urNp linux-3.0.3/fs/ext3/balloc.c linux-3.0.3/fs/ext3/balloc.c | |
36221 | --- linux-3.0.3/fs/ext3/balloc.c 2011-07-21 22:17:23.000000000 -0400 | |
36222 | +++ linux-3.0.3/fs/ext3/balloc.c 2011-08-23 21:48:14.000000000 -0400 | |
36223 | @@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e | |
36224 | ||
36225 | free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); | |
36226 | root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); | |
36227 | - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && | |
36228 | + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) && | |
36229 | sbi->s_resuid != current_fsuid() && | |
36230 | (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { | |
36231 | return 0; | |
36232 | diff -urNp linux-3.0.3/fs/ext4/balloc.c linux-3.0.3/fs/ext4/balloc.c | |
36233 | --- linux-3.0.3/fs/ext4/balloc.c 2011-07-21 22:17:23.000000000 -0400 | |
36234 | +++ linux-3.0.3/fs/ext4/balloc.c 2011-08-23 21:48:14.000000000 -0400 | |
36235 | @@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct e | |
36236 | /* Hm, nope. Are (enough) root reserved blocks available? */ | |
36237 | if (sbi->s_resuid == current_fsuid() || | |
36238 | ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) || | |
36239 | - capable(CAP_SYS_RESOURCE) || | |
36240 | - (flags & EXT4_MB_USE_ROOT_BLOCKS)) { | |
36241 | + (flags & EXT4_MB_USE_ROOT_BLOCKS) || | |
36242 | + capable_nolog(CAP_SYS_RESOURCE)) { | |
36243 | ||
36244 | if (free_blocks >= (nblocks + dirty_blocks)) | |
36245 | return 1; | |
36246 | diff -urNp linux-3.0.3/fs/ext4/ext4.h linux-3.0.3/fs/ext4/ext4.h | |
36247 | --- linux-3.0.3/fs/ext4/ext4.h 2011-08-23 21:44:40.000000000 -0400 | |
36248 | +++ linux-3.0.3/fs/ext4/ext4.h 2011-08-23 21:47:56.000000000 -0400 | |
36249 | @@ -1177,19 +1177,19 @@ struct ext4_sb_info { | |
36250 | unsigned long s_mb_last_start; | |
36251 | ||
36252 | /* stats for buddy allocator */ | |
36253 | - atomic_t s_bal_reqs; /* number of reqs with len > 1 */ | |
36254 | - atomic_t s_bal_success; /* we found long enough chunks */ | |
36255 | - atomic_t s_bal_allocated; /* in blocks */ | |
36256 | - atomic_t s_bal_ex_scanned; /* total extents scanned */ | |
36257 | - atomic_t s_bal_goals; /* goal hits */ | |
36258 | - atomic_t s_bal_breaks; /* too long searches */ | |
36259 | - atomic_t s_bal_2orders; /* 2^order hits */ | |
36260 | + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */ | |
36261 | + atomic_unchecked_t s_bal_success; /* we found long enough chunks */ | |
36262 | + atomic_unchecked_t s_bal_allocated; /* in blocks */ | |
36263 | + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */ | |
36264 | + atomic_unchecked_t s_bal_goals; /* goal hits */ | |
36265 | + atomic_unchecked_t s_bal_breaks; /* too long searches */ | |
36266 | + atomic_unchecked_t s_bal_2orders; /* 2^order hits */ | |
36267 | spinlock_t s_bal_lock; | |
36268 | unsigned long s_mb_buddies_generated; | |
36269 | unsigned long long s_mb_generation_time; | |
36270 | - atomic_t s_mb_lost_chunks; | |
36271 | - atomic_t s_mb_preallocated; | |
36272 | - atomic_t s_mb_discarded; | |
36273 | + atomic_unchecked_t s_mb_lost_chunks; | |
36274 | + atomic_unchecked_t s_mb_preallocated; | |
36275 | + atomic_unchecked_t s_mb_discarded; | |
36276 | atomic_t s_lock_busy; | |
36277 | ||
36278 | /* locality groups */ | |
36279 | diff -urNp linux-3.0.3/fs/ext4/mballoc.c linux-3.0.3/fs/ext4/mballoc.c | |
36280 | --- linux-3.0.3/fs/ext4/mballoc.c 2011-08-23 21:44:40.000000000 -0400 | |
36281 | +++ linux-3.0.3/fs/ext4/mballoc.c 2011-08-23 21:48:14.000000000 -0400 | |
36282 | @@ -1793,7 +1793,7 @@ void ext4_mb_simple_scan_group(struct ex | |
36283 | BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len); | |
36284 | ||
36285 | if (EXT4_SB(sb)->s_mb_stats) | |
36286 | - atomic_inc(&EXT4_SB(sb)->s_bal_2orders); | |
36287 | + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders); | |
36288 | ||
36289 | break; | |
36290 | } | |
36291 | @@ -2087,7 +2087,7 @@ repeat: | |
36292 | ac->ac_status = AC_STATUS_CONTINUE; | |
36293 | ac->ac_flags |= EXT4_MB_HINT_FIRST; | |
36294 | cr = 3; | |
36295 | - atomic_inc(&sbi->s_mb_lost_chunks); | |
36296 | + atomic_inc_unchecked(&sbi->s_mb_lost_chunks); | |
36297 | goto repeat; | |
36298 | } | |
36299 | } | |
36300 | @@ -2130,6 +2130,8 @@ static int ext4_mb_seq_groups_show(struc | |
36301 | ext4_grpblk_t counters[16]; | |
36302 | } sg; | |
36303 | ||
36304 | + pax_track_stack(); | |
36305 | + | |
36306 | group--; | |
36307 | if (group == 0) | |
36308 | seq_printf(seq, "#%-5s: %-5s %-5s %-5s " | |
36309 | @@ -2553,25 +2555,25 @@ int ext4_mb_release(struct super_block * | |
36310 | if (sbi->s_mb_stats) { | |
36311 | printk(KERN_INFO | |
36312 | "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n", | |
36313 | - atomic_read(&sbi->s_bal_allocated), | |
36314 | - atomic_read(&sbi->s_bal_reqs), | |
36315 | - atomic_read(&sbi->s_bal_success)); | |
36316 | + atomic_read_unchecked(&sbi->s_bal_allocated), | |
36317 | + atomic_read_unchecked(&sbi->s_bal_reqs), | |
36318 | + atomic_read_unchecked(&sbi->s_bal_success)); | |
36319 | printk(KERN_INFO | |
36320 | "EXT4-fs: mballoc: %u extents scanned, %u goal hits, " | |
36321 | "%u 2^N hits, %u breaks, %u lost\n", | |
36322 | - atomic_read(&sbi->s_bal_ex_scanned), | |
36323 | - atomic_read(&sbi->s_bal_goals), | |
36324 | - atomic_read(&sbi->s_bal_2orders), | |
36325 | - atomic_read(&sbi->s_bal_breaks), | |
36326 | - atomic_read(&sbi->s_mb_lost_chunks)); | |
36327 | + atomic_read_unchecked(&sbi->s_bal_ex_scanned), | |
36328 | + atomic_read_unchecked(&sbi->s_bal_goals), | |
36329 | + atomic_read_unchecked(&sbi->s_bal_2orders), | |
36330 | + atomic_read_unchecked(&sbi->s_bal_breaks), | |
36331 | + atomic_read_unchecked(&sbi->s_mb_lost_chunks)); | |
36332 | printk(KERN_INFO | |
36333 | "EXT4-fs: mballoc: %lu generated and it took %Lu\n", | |
36334 | sbi->s_mb_buddies_generated++, | |
36335 | sbi->s_mb_generation_time); | |
36336 | printk(KERN_INFO | |
36337 | "EXT4-fs: mballoc: %u preallocated, %u discarded\n", | |
36338 | - atomic_read(&sbi->s_mb_preallocated), | |
36339 | - atomic_read(&sbi->s_mb_discarded)); | |
36340 | + atomic_read_unchecked(&sbi->s_mb_preallocated), | |
36341 | + atomic_read_unchecked(&sbi->s_mb_discarded)); | |
36342 | } | |
36343 | ||
36344 | free_percpu(sbi->s_locality_groups); | |
36345 | @@ -3041,16 +3043,16 @@ static void ext4_mb_collect_stats(struct | |
36346 | struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb); | |
36347 | ||
36348 | if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) { | |
36349 | - atomic_inc(&sbi->s_bal_reqs); | |
36350 | - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated); | |
36351 | + atomic_inc_unchecked(&sbi->s_bal_reqs); | |
36352 | + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated); | |
36353 | if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len) | |
36354 | - atomic_inc(&sbi->s_bal_success); | |
36355 | - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned); | |
36356 | + atomic_inc_unchecked(&sbi->s_bal_success); | |
36357 | + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned); | |
36358 | if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start && | |
36359 | ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group) | |
36360 | - atomic_inc(&sbi->s_bal_goals); | |
36361 | + atomic_inc_unchecked(&sbi->s_bal_goals); | |
36362 | if (ac->ac_found > sbi->s_mb_max_to_scan) | |
36363 | - atomic_inc(&sbi->s_bal_breaks); | |
36364 | + atomic_inc_unchecked(&sbi->s_bal_breaks); | |
36365 | } | |
36366 | ||
36367 | if (ac->ac_op == EXT4_MB_HISTORY_ALLOC) | |
36368 | @@ -3448,7 +3450,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat | |
36369 | trace_ext4_mb_new_inode_pa(ac, pa); | |
36370 | ||
36371 | ext4_mb_use_inode_pa(ac, pa); | |
36372 | - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated); | |
36373 | + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated); | |
36374 | ||
36375 | ei = EXT4_I(ac->ac_inode); | |
36376 | grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group); | |
36377 | @@ -3508,7 +3510,7 @@ ext4_mb_new_group_pa(struct ext4_allocat | |
36378 | trace_ext4_mb_new_group_pa(ac, pa); | |
36379 | ||
36380 | ext4_mb_use_group_pa(ac, pa); | |
36381 | - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated); | |
36382 | + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated); | |
36383 | ||
36384 | grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group); | |
36385 | lg = ac->ac_lg; | |
36386 | @@ -3595,7 +3597,7 @@ ext4_mb_release_inode_pa(struct ext4_bud | |
36387 | * from the bitmap and continue. | |
36388 | */ | |
36389 | } | |
36390 | - atomic_add(free, &sbi->s_mb_discarded); | |
36391 | + atomic_add_unchecked(free, &sbi->s_mb_discarded); | |
36392 | ||
36393 | return err; | |
36394 | } | |
36395 | @@ -3613,7 +3615,7 @@ ext4_mb_release_group_pa(struct ext4_bud | |
36396 | ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit); | |
36397 | BUG_ON(group != e4b->bd_group && pa->pa_len != 0); | |
36398 | mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len); | |
36399 | - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded); | |
36400 | + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded); | |
36401 | trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len); | |
36402 | ||
36403 | return 0; | |
36404 | diff -urNp linux-3.0.3/fs/fcntl.c linux-3.0.3/fs/fcntl.c | |
36405 | --- linux-3.0.3/fs/fcntl.c 2011-07-21 22:17:23.000000000 -0400 | |
36406 | +++ linux-3.0.3/fs/fcntl.c 2011-08-23 21:48:14.000000000 -0400 | |
36407 | @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct | |
36408 | if (err) | |
36409 | return err; | |
36410 | ||
36411 | + if (gr_handle_chroot_fowner(pid, type)) | |
36412 | + return -ENOENT; | |
36413 | + if (gr_check_protected_task_fowner(pid, type)) | |
36414 | + return -EACCES; | |
36415 | + | |
36416 | f_modown(filp, pid, type, force); | |
36417 | return 0; | |
36418 | } | |
36419 | @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in | |
36420 | switch (cmd) { | |
36421 | case F_DUPFD: | |
36422 | case F_DUPFD_CLOEXEC: | |
36423 | + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0); | |
36424 | if (arg >= rlimit(RLIMIT_NOFILE)) | |
36425 | break; | |
36426 | err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0); | |
36427 | @@ -835,14 +841,14 @@ static int __init fcntl_init(void) | |
36428 | * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY | |
36429 | * is defined as O_NONBLOCK on some platforms and not on others. | |
36430 | */ | |
36431 | - BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32( | |
36432 | + BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32( | |
36433 | O_RDONLY | O_WRONLY | O_RDWR | | |
36434 | O_CREAT | O_EXCL | O_NOCTTY | | |
36435 | O_TRUNC | O_APPEND | /* O_NONBLOCK | */ | |
36436 | __O_SYNC | O_DSYNC | FASYNC | | |
36437 | O_DIRECT | O_LARGEFILE | O_DIRECTORY | | |
36438 | O_NOFOLLOW | O_NOATIME | O_CLOEXEC | | |
36439 | - __FMODE_EXEC | O_PATH | |
36440 | + __FMODE_EXEC | O_PATH | FMODE_GREXEC | |
36441 | )); | |
36442 | ||
36443 | fasync_cache = kmem_cache_create("fasync_cache", | |
36444 | diff -urNp linux-3.0.3/fs/fifo.c linux-3.0.3/fs/fifo.c | |
36445 | --- linux-3.0.3/fs/fifo.c 2011-07-21 22:17:23.000000000 -0400 | |
36446 | +++ linux-3.0.3/fs/fifo.c 2011-08-23 21:47:56.000000000 -0400 | |
36447 | @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode | |
36448 | */ | |
36449 | filp->f_op = &read_pipefifo_fops; | |
36450 | pipe->r_counter++; | |
36451 | - if (pipe->readers++ == 0) | |
36452 | + if (atomic_inc_return(&pipe->readers) == 1) | |
36453 | wake_up_partner(inode); | |
36454 | ||
36455 | - if (!pipe->writers) { | |
36456 | + if (!atomic_read(&pipe->writers)) { | |
36457 | if ((filp->f_flags & O_NONBLOCK)) { | |
36458 | /* suppress POLLHUP until we have | |
36459 | * seen a writer */ | |
36460 | @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode | |
36461 | * errno=ENXIO when there is no process reading the FIFO. | |
36462 | */ | |
36463 | ret = -ENXIO; | |
36464 | - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers) | |
36465 | + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers)) | |
36466 | goto err; | |
36467 | ||
36468 | filp->f_op = &write_pipefifo_fops; | |
36469 | pipe->w_counter++; | |
36470 | - if (!pipe->writers++) | |
36471 | + if (atomic_inc_return(&pipe->writers) == 1) | |
36472 | wake_up_partner(inode); | |
36473 | ||
36474 | - if (!pipe->readers) { | |
36475 | + if (!atomic_read(&pipe->readers)) { | |
36476 | wait_for_partner(inode, &pipe->r_counter); | |
36477 | if (signal_pending(current)) | |
36478 | goto err_wr; | |
36479 | @@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode | |
36480 | */ | |
36481 | filp->f_op = &rdwr_pipefifo_fops; | |
36482 | ||
36483 | - pipe->readers++; | |
36484 | - pipe->writers++; | |
36485 | + atomic_inc(&pipe->readers); | |
36486 | + atomic_inc(&pipe->writers); | |
36487 | pipe->r_counter++; | |
36488 | pipe->w_counter++; | |
36489 | - if (pipe->readers == 1 || pipe->writers == 1) | |
36490 | + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1) | |
36491 | wake_up_partner(inode); | |
36492 | break; | |
36493 | ||
36494 | @@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode | |
36495 | return 0; | |
36496 | ||
36497 | err_rd: | |
36498 | - if (!--pipe->readers) | |
36499 | + if (atomic_dec_and_test(&pipe->readers)) | |
36500 | wake_up_interruptible(&pipe->wait); | |
36501 | ret = -ERESTARTSYS; | |
36502 | goto err; | |
36503 | ||
36504 | err_wr: | |
36505 | - if (!--pipe->writers) | |
36506 | + if (atomic_dec_and_test(&pipe->writers)) | |
36507 | wake_up_interruptible(&pipe->wait); | |
36508 | ret = -ERESTARTSYS; | |
36509 | goto err; | |
36510 | ||
36511 | err: | |
36512 | - if (!pipe->readers && !pipe->writers) | |
36513 | + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) | |
36514 | free_pipe_info(inode); | |
36515 | ||
36516 | err_nocleanup: | |
36517 | diff -urNp linux-3.0.3/fs/file.c linux-3.0.3/fs/file.c | |
36518 | --- linux-3.0.3/fs/file.c 2011-07-21 22:17:23.000000000 -0400 | |
36519 | +++ linux-3.0.3/fs/file.c 2011-08-23 21:48:14.000000000 -0400 | |
36520 | @@ -15,6 +15,7 @@ | |
36521 | #include <linux/slab.h> | |
36522 | #include <linux/vmalloc.h> | |
36523 | #include <linux/file.h> | |
36524 | +#include <linux/security.h> | |
36525 | #include <linux/fdtable.h> | |
36526 | #include <linux/bitops.h> | |
36527 | #include <linux/interrupt.h> | |
36528 | @@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi | |
36529 | * N.B. For clone tasks sharing a files structure, this test | |
36530 | * will limit the total number of files that can be opened. | |
36531 | */ | |
36532 | + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0); | |
36533 | if (nr >= rlimit(RLIMIT_NOFILE)) | |
36534 | return -EMFILE; | |
36535 | ||
36536 | diff -urNp linux-3.0.3/fs/filesystems.c linux-3.0.3/fs/filesystems.c | |
36537 | --- linux-3.0.3/fs/filesystems.c 2011-07-21 22:17:23.000000000 -0400 | |
36538 | +++ linux-3.0.3/fs/filesystems.c 2011-08-23 21:48:14.000000000 -0400 | |
36539 | @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con | |
36540 | int len = dot ? dot - name : strlen(name); | |
36541 | ||
36542 | fs = __get_fs_type(name, len); | |
36543 | + | |
36544 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
36545 | + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0)) | |
36546 | +#else | |
36547 | if (!fs && (request_module("%.*s", len, name) == 0)) | |
36548 | +#endif | |
36549 | fs = __get_fs_type(name, len); | |
36550 | ||
36551 | if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) { | |
36552 | diff -urNp linux-3.0.3/fs/fscache/cookie.c linux-3.0.3/fs/fscache/cookie.c | |
36553 | --- linux-3.0.3/fs/fscache/cookie.c 2011-07-21 22:17:23.000000000 -0400 | |
36554 | +++ linux-3.0.3/fs/fscache/cookie.c 2011-08-23 21:47:56.000000000 -0400 | |
36555 | @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire | |
36556 | parent ? (char *) parent->def->name : "<no-parent>", | |
36557 | def->name, netfs_data); | |
36558 | ||
36559 | - fscache_stat(&fscache_n_acquires); | |
36560 | + fscache_stat_unchecked(&fscache_n_acquires); | |
36561 | ||
36562 | /* if there's no parent cookie, then we don't create one here either */ | |
36563 | if (!parent) { | |
36564 | - fscache_stat(&fscache_n_acquires_null); | |
36565 | + fscache_stat_unchecked(&fscache_n_acquires_null); | |
36566 | _leave(" [no parent]"); | |
36567 | return NULL; | |
36568 | } | |
36569 | @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire | |
36570 | /* allocate and initialise a cookie */ | |
36571 | cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL); | |
36572 | if (!cookie) { | |
36573 | - fscache_stat(&fscache_n_acquires_oom); | |
36574 | + fscache_stat_unchecked(&fscache_n_acquires_oom); | |
36575 | _leave(" [ENOMEM]"); | |
36576 | return NULL; | |
36577 | } | |
36578 | @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire | |
36579 | ||
36580 | switch (cookie->def->type) { | |
36581 | case FSCACHE_COOKIE_TYPE_INDEX: | |
36582 | - fscache_stat(&fscache_n_cookie_index); | |
36583 | + fscache_stat_unchecked(&fscache_n_cookie_index); | |
36584 | break; | |
36585 | case FSCACHE_COOKIE_TYPE_DATAFILE: | |
36586 | - fscache_stat(&fscache_n_cookie_data); | |
36587 | + fscache_stat_unchecked(&fscache_n_cookie_data); | |
36588 | break; | |
36589 | default: | |
36590 | - fscache_stat(&fscache_n_cookie_special); | |
36591 | + fscache_stat_unchecked(&fscache_n_cookie_special); | |
36592 | break; | |
36593 | } | |
36594 | ||
36595 | @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire | |
36596 | if (fscache_acquire_non_index_cookie(cookie) < 0) { | |
36597 | atomic_dec(&parent->n_children); | |
36598 | __fscache_cookie_put(cookie); | |
36599 | - fscache_stat(&fscache_n_acquires_nobufs); | |
36600 | + fscache_stat_unchecked(&fscache_n_acquires_nobufs); | |
36601 | _leave(" = NULL"); | |
36602 | return NULL; | |
36603 | } | |
36604 | } | |
36605 | ||
36606 | - fscache_stat(&fscache_n_acquires_ok); | |
36607 | + fscache_stat_unchecked(&fscache_n_acquires_ok); | |
36608 | _leave(" = %p", cookie); | |
36609 | return cookie; | |
36610 | } | |
36611 | @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo | |
36612 | cache = fscache_select_cache_for_object(cookie->parent); | |
36613 | if (!cache) { | |
36614 | up_read(&fscache_addremove_sem); | |
36615 | - fscache_stat(&fscache_n_acquires_no_cache); | |
36616 | + fscache_stat_unchecked(&fscache_n_acquires_no_cache); | |
36617 | _leave(" = -ENOMEDIUM [no cache]"); | |
36618 | return -ENOMEDIUM; | |
36619 | } | |
36620 | @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f | |
36621 | object = cache->ops->alloc_object(cache, cookie); | |
36622 | fscache_stat_d(&fscache_n_cop_alloc_object); | |
36623 | if (IS_ERR(object)) { | |
36624 | - fscache_stat(&fscache_n_object_no_alloc); | |
36625 | + fscache_stat_unchecked(&fscache_n_object_no_alloc); | |
36626 | ret = PTR_ERR(object); | |
36627 | goto error; | |
36628 | } | |
36629 | ||
36630 | - fscache_stat(&fscache_n_object_alloc); | |
36631 | + fscache_stat_unchecked(&fscache_n_object_alloc); | |
36632 | ||
36633 | object->debug_id = atomic_inc_return(&fscache_object_debug_id); | |
36634 | ||
36635 | @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca | |
36636 | struct fscache_object *object; | |
36637 | struct hlist_node *_p; | |
36638 | ||
36639 | - fscache_stat(&fscache_n_updates); | |
36640 | + fscache_stat_unchecked(&fscache_n_updates); | |
36641 | ||
36642 | if (!cookie) { | |
36643 | - fscache_stat(&fscache_n_updates_null); | |
36644 | + fscache_stat_unchecked(&fscache_n_updates_null); | |
36645 | _leave(" [no cookie]"); | |
36646 | return; | |
36647 | } | |
36648 | @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct | |
36649 | struct fscache_object *object; | |
36650 | unsigned long event; | |
36651 | ||
36652 | - fscache_stat(&fscache_n_relinquishes); | |
36653 | + fscache_stat_unchecked(&fscache_n_relinquishes); | |
36654 | if (retire) | |
36655 | - fscache_stat(&fscache_n_relinquishes_retire); | |
36656 | + fscache_stat_unchecked(&fscache_n_relinquishes_retire); | |
36657 | ||
36658 | if (!cookie) { | |
36659 | - fscache_stat(&fscache_n_relinquishes_null); | |
36660 | + fscache_stat_unchecked(&fscache_n_relinquishes_null); | |
36661 | _leave(" [no cookie]"); | |
36662 | return; | |
36663 | } | |
36664 | @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct | |
36665 | ||
36666 | /* wait for the cookie to finish being instantiated (or to fail) */ | |
36667 | if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) { | |
36668 | - fscache_stat(&fscache_n_relinquishes_waitcrt); | |
36669 | + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt); | |
36670 | wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING, | |
36671 | fscache_wait_bit, TASK_UNINTERRUPTIBLE); | |
36672 | } | |
36673 | diff -urNp linux-3.0.3/fs/fscache/internal.h linux-3.0.3/fs/fscache/internal.h | |
36674 | --- linux-3.0.3/fs/fscache/internal.h 2011-07-21 22:17:23.000000000 -0400 | |
36675 | +++ linux-3.0.3/fs/fscache/internal.h 2011-08-23 21:47:56.000000000 -0400 | |
36676 | @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void); | |
36677 | extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS]; | |
36678 | extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS]; | |
36679 | ||
36680 | -extern atomic_t fscache_n_op_pend; | |
36681 | -extern atomic_t fscache_n_op_run; | |
36682 | -extern atomic_t fscache_n_op_enqueue; | |
36683 | -extern atomic_t fscache_n_op_deferred_release; | |
36684 | -extern atomic_t fscache_n_op_release; | |
36685 | -extern atomic_t fscache_n_op_gc; | |
36686 | -extern atomic_t fscache_n_op_cancelled; | |
36687 | -extern atomic_t fscache_n_op_rejected; | |
36688 | - | |
36689 | -extern atomic_t fscache_n_attr_changed; | |
36690 | -extern atomic_t fscache_n_attr_changed_ok; | |
36691 | -extern atomic_t fscache_n_attr_changed_nobufs; | |
36692 | -extern atomic_t fscache_n_attr_changed_nomem; | |
36693 | -extern atomic_t fscache_n_attr_changed_calls; | |
36694 | - | |
36695 | -extern atomic_t fscache_n_allocs; | |
36696 | -extern atomic_t fscache_n_allocs_ok; | |
36697 | -extern atomic_t fscache_n_allocs_wait; | |
36698 | -extern atomic_t fscache_n_allocs_nobufs; | |
36699 | -extern atomic_t fscache_n_allocs_intr; | |
36700 | -extern atomic_t fscache_n_allocs_object_dead; | |
36701 | -extern atomic_t fscache_n_alloc_ops; | |
36702 | -extern atomic_t fscache_n_alloc_op_waits; | |
36703 | - | |
36704 | -extern atomic_t fscache_n_retrievals; | |
36705 | -extern atomic_t fscache_n_retrievals_ok; | |
36706 | -extern atomic_t fscache_n_retrievals_wait; | |
36707 | -extern atomic_t fscache_n_retrievals_nodata; | |
36708 | -extern atomic_t fscache_n_retrievals_nobufs; | |
36709 | -extern atomic_t fscache_n_retrievals_intr; | |
36710 | -extern atomic_t fscache_n_retrievals_nomem; | |
36711 | -extern atomic_t fscache_n_retrievals_object_dead; | |
36712 | -extern atomic_t fscache_n_retrieval_ops; | |
36713 | -extern atomic_t fscache_n_retrieval_op_waits; | |
36714 | - | |
36715 | -extern atomic_t fscache_n_stores; | |
36716 | -extern atomic_t fscache_n_stores_ok; | |
36717 | -extern atomic_t fscache_n_stores_again; | |
36718 | -extern atomic_t fscache_n_stores_nobufs; | |
36719 | -extern atomic_t fscache_n_stores_oom; | |
36720 | -extern atomic_t fscache_n_store_ops; | |
36721 | -extern atomic_t fscache_n_store_calls; | |
36722 | -extern atomic_t fscache_n_store_pages; | |
36723 | -extern atomic_t fscache_n_store_radix_deletes; | |
36724 | -extern atomic_t fscache_n_store_pages_over_limit; | |
36725 | - | |
36726 | -extern atomic_t fscache_n_store_vmscan_not_storing; | |
36727 | -extern atomic_t fscache_n_store_vmscan_gone; | |
36728 | -extern atomic_t fscache_n_store_vmscan_busy; | |
36729 | -extern atomic_t fscache_n_store_vmscan_cancelled; | |
36730 | - | |
36731 | -extern atomic_t fscache_n_marks; | |
36732 | -extern atomic_t fscache_n_uncaches; | |
36733 | - | |
36734 | -extern atomic_t fscache_n_acquires; | |
36735 | -extern atomic_t fscache_n_acquires_null; | |
36736 | -extern atomic_t fscache_n_acquires_no_cache; | |
36737 | -extern atomic_t fscache_n_acquires_ok; | |
36738 | -extern atomic_t fscache_n_acquires_nobufs; | |
36739 | -extern atomic_t fscache_n_acquires_oom; | |
36740 | - | |
36741 | -extern atomic_t fscache_n_updates; | |
36742 | -extern atomic_t fscache_n_updates_null; | |
36743 | -extern atomic_t fscache_n_updates_run; | |
36744 | - | |
36745 | -extern atomic_t fscache_n_relinquishes; | |
36746 | -extern atomic_t fscache_n_relinquishes_null; | |
36747 | -extern atomic_t fscache_n_relinquishes_waitcrt; | |
36748 | -extern atomic_t fscache_n_relinquishes_retire; | |
36749 | - | |
36750 | -extern atomic_t fscache_n_cookie_index; | |
36751 | -extern atomic_t fscache_n_cookie_data; | |
36752 | -extern atomic_t fscache_n_cookie_special; | |
36753 | - | |
36754 | -extern atomic_t fscache_n_object_alloc; | |
36755 | -extern atomic_t fscache_n_object_no_alloc; | |
36756 | -extern atomic_t fscache_n_object_lookups; | |
36757 | -extern atomic_t fscache_n_object_lookups_negative; | |
36758 | -extern atomic_t fscache_n_object_lookups_positive; | |
36759 | -extern atomic_t fscache_n_object_lookups_timed_out; | |
36760 | -extern atomic_t fscache_n_object_created; | |
36761 | -extern atomic_t fscache_n_object_avail; | |
36762 | -extern atomic_t fscache_n_object_dead; | |
36763 | - | |
36764 | -extern atomic_t fscache_n_checkaux_none; | |
36765 | -extern atomic_t fscache_n_checkaux_okay; | |
36766 | -extern atomic_t fscache_n_checkaux_update; | |
36767 | -extern atomic_t fscache_n_checkaux_obsolete; | |
36768 | +extern atomic_unchecked_t fscache_n_op_pend; | |
36769 | +extern atomic_unchecked_t fscache_n_op_run; | |
36770 | +extern atomic_unchecked_t fscache_n_op_enqueue; | |
36771 | +extern atomic_unchecked_t fscache_n_op_deferred_release; | |
36772 | +extern atomic_unchecked_t fscache_n_op_release; | |
36773 | +extern atomic_unchecked_t fscache_n_op_gc; | |
36774 | +extern atomic_unchecked_t fscache_n_op_cancelled; | |
36775 | +extern atomic_unchecked_t fscache_n_op_rejected; | |
36776 | + | |
36777 | +extern atomic_unchecked_t fscache_n_attr_changed; | |
36778 | +extern atomic_unchecked_t fscache_n_attr_changed_ok; | |
36779 | +extern atomic_unchecked_t fscache_n_attr_changed_nobufs; | |
36780 | +extern atomic_unchecked_t fscache_n_attr_changed_nomem; | |
36781 | +extern atomic_unchecked_t fscache_n_attr_changed_calls; | |
36782 | + | |
36783 | +extern atomic_unchecked_t fscache_n_allocs; | |
36784 | +extern atomic_unchecked_t fscache_n_allocs_ok; | |
36785 | +extern atomic_unchecked_t fscache_n_allocs_wait; | |
36786 | +extern atomic_unchecked_t fscache_n_allocs_nobufs; | |
36787 | +extern atomic_unchecked_t fscache_n_allocs_intr; | |
36788 | +extern atomic_unchecked_t fscache_n_allocs_object_dead; | |
36789 | +extern atomic_unchecked_t fscache_n_alloc_ops; | |
36790 | +extern atomic_unchecked_t fscache_n_alloc_op_waits; | |
36791 | + | |
36792 | +extern atomic_unchecked_t fscache_n_retrievals; | |
36793 | +extern atomic_unchecked_t fscache_n_retrievals_ok; | |
36794 | +extern atomic_unchecked_t fscache_n_retrievals_wait; | |
36795 | +extern atomic_unchecked_t fscache_n_retrievals_nodata; | |
36796 | +extern atomic_unchecked_t fscache_n_retrievals_nobufs; | |
36797 | +extern atomic_unchecked_t fscache_n_retrievals_intr; | |
36798 | +extern atomic_unchecked_t fscache_n_retrievals_nomem; | |
36799 | +extern atomic_unchecked_t fscache_n_retrievals_object_dead; | |
36800 | +extern atomic_unchecked_t fscache_n_retrieval_ops; | |
36801 | +extern atomic_unchecked_t fscache_n_retrieval_op_waits; | |
36802 | + | |
36803 | +extern atomic_unchecked_t fscache_n_stores; | |
36804 | +extern atomic_unchecked_t fscache_n_stores_ok; | |
36805 | +extern atomic_unchecked_t fscache_n_stores_again; | |
36806 | +extern atomic_unchecked_t fscache_n_stores_nobufs; | |
36807 | +extern atomic_unchecked_t fscache_n_stores_oom; | |
36808 | +extern atomic_unchecked_t fscache_n_store_ops; | |
36809 | +extern atomic_unchecked_t fscache_n_store_calls; | |
36810 | +extern atomic_unchecked_t fscache_n_store_pages; | |
36811 | +extern atomic_unchecked_t fscache_n_store_radix_deletes; | |
36812 | +extern atomic_unchecked_t fscache_n_store_pages_over_limit; | |
36813 | + | |
36814 | +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing; | |
36815 | +extern atomic_unchecked_t fscache_n_store_vmscan_gone; | |
36816 | +extern atomic_unchecked_t fscache_n_store_vmscan_busy; | |
36817 | +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled; | |
36818 | + | |
36819 | +extern atomic_unchecked_t fscache_n_marks; | |
36820 | +extern atomic_unchecked_t fscache_n_uncaches; | |
36821 | + | |
36822 | +extern atomic_unchecked_t fscache_n_acquires; | |
36823 | +extern atomic_unchecked_t fscache_n_acquires_null; | |
36824 | +extern atomic_unchecked_t fscache_n_acquires_no_cache; | |
36825 | +extern atomic_unchecked_t fscache_n_acquires_ok; | |
36826 | +extern atomic_unchecked_t fscache_n_acquires_nobufs; | |
36827 | +extern atomic_unchecked_t fscache_n_acquires_oom; | |
36828 | + | |
36829 | +extern atomic_unchecked_t fscache_n_updates; | |
36830 | +extern atomic_unchecked_t fscache_n_updates_null; | |
36831 | +extern atomic_unchecked_t fscache_n_updates_run; | |
36832 | + | |
36833 | +extern atomic_unchecked_t fscache_n_relinquishes; | |
36834 | +extern atomic_unchecked_t fscache_n_relinquishes_null; | |
36835 | +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt; | |
36836 | +extern atomic_unchecked_t fscache_n_relinquishes_retire; | |
36837 | + | |
36838 | +extern atomic_unchecked_t fscache_n_cookie_index; | |
36839 | +extern atomic_unchecked_t fscache_n_cookie_data; | |
36840 | +extern atomic_unchecked_t fscache_n_cookie_special; | |
36841 | + | |
36842 | +extern atomic_unchecked_t fscache_n_object_alloc; | |
36843 | +extern atomic_unchecked_t fscache_n_object_no_alloc; | |
36844 | +extern atomic_unchecked_t fscache_n_object_lookups; | |
36845 | +extern atomic_unchecked_t fscache_n_object_lookups_negative; | |
36846 | +extern atomic_unchecked_t fscache_n_object_lookups_positive; | |
36847 | +extern atomic_unchecked_t fscache_n_object_lookups_timed_out; | |
36848 | +extern atomic_unchecked_t fscache_n_object_created; | |
36849 | +extern atomic_unchecked_t fscache_n_object_avail; | |
36850 | +extern atomic_unchecked_t fscache_n_object_dead; | |
36851 | + | |
36852 | +extern atomic_unchecked_t fscache_n_checkaux_none; | |
36853 | +extern atomic_unchecked_t fscache_n_checkaux_okay; | |
36854 | +extern atomic_unchecked_t fscache_n_checkaux_update; | |
36855 | +extern atomic_unchecked_t fscache_n_checkaux_obsolete; | |
36856 | ||
36857 | extern atomic_t fscache_n_cop_alloc_object; | |
36858 | extern atomic_t fscache_n_cop_lookup_object; | |
36859 | @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t | |
36860 | atomic_inc(stat); | |
36861 | } | |
36862 | ||
36863 | +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat) | |
36864 | +{ | |
36865 | + atomic_inc_unchecked(stat); | |
36866 | +} | |
36867 | + | |
36868 | static inline void fscache_stat_d(atomic_t *stat) | |
36869 | { | |
36870 | atomic_dec(stat); | |
36871 | @@ -267,6 +272,7 @@ extern const struct file_operations fsca | |
36872 | ||
36873 | #define __fscache_stat(stat) (NULL) | |
36874 | #define fscache_stat(stat) do {} while (0) | |
36875 | +#define fscache_stat_unchecked(stat) do {} while (0) | |
36876 | #define fscache_stat_d(stat) do {} while (0) | |
36877 | #endif | |
36878 | ||
36879 | diff -urNp linux-3.0.3/fs/fscache/object.c linux-3.0.3/fs/fscache/object.c | |
36880 | --- linux-3.0.3/fs/fscache/object.c 2011-07-21 22:17:23.000000000 -0400 | |
36881 | +++ linux-3.0.3/fs/fscache/object.c 2011-08-23 21:47:56.000000000 -0400 | |
36882 | @@ -128,7 +128,7 @@ static void fscache_object_state_machine | |
36883 | /* update the object metadata on disk */ | |
36884 | case FSCACHE_OBJECT_UPDATING: | |
36885 | clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events); | |
36886 | - fscache_stat(&fscache_n_updates_run); | |
36887 | + fscache_stat_unchecked(&fscache_n_updates_run); | |
36888 | fscache_stat(&fscache_n_cop_update_object); | |
36889 | object->cache->ops->update_object(object); | |
36890 | fscache_stat_d(&fscache_n_cop_update_object); | |
36891 | @@ -217,7 +217,7 @@ static void fscache_object_state_machine | |
36892 | spin_lock(&object->lock); | |
36893 | object->state = FSCACHE_OBJECT_DEAD; | |
36894 | spin_unlock(&object->lock); | |
36895 | - fscache_stat(&fscache_n_object_dead); | |
36896 | + fscache_stat_unchecked(&fscache_n_object_dead); | |
36897 | goto terminal_transit; | |
36898 | ||
36899 | /* handle the parent cache of this object being withdrawn from | |
36900 | @@ -232,7 +232,7 @@ static void fscache_object_state_machine | |
36901 | spin_lock(&object->lock); | |
36902 | object->state = FSCACHE_OBJECT_DEAD; | |
36903 | spin_unlock(&object->lock); | |
36904 | - fscache_stat(&fscache_n_object_dead); | |
36905 | + fscache_stat_unchecked(&fscache_n_object_dead); | |
36906 | goto terminal_transit; | |
36907 | ||
36908 | /* complain about the object being woken up once it is | |
36909 | @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct | |
36910 | parent->cookie->def->name, cookie->def->name, | |
36911 | object->cache->tag->name); | |
36912 | ||
36913 | - fscache_stat(&fscache_n_object_lookups); | |
36914 | + fscache_stat_unchecked(&fscache_n_object_lookups); | |
36915 | fscache_stat(&fscache_n_cop_lookup_object); | |
36916 | ret = object->cache->ops->lookup_object(object); | |
36917 | fscache_stat_d(&fscache_n_cop_lookup_object); | |
36918 | @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct | |
36919 | if (ret == -ETIMEDOUT) { | |
36920 | /* probably stuck behind another object, so move this one to | |
36921 | * the back of the queue */ | |
36922 | - fscache_stat(&fscache_n_object_lookups_timed_out); | |
36923 | + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out); | |
36924 | set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events); | |
36925 | } | |
36926 | ||
36927 | @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru | |
36928 | ||
36929 | spin_lock(&object->lock); | |
36930 | if (object->state == FSCACHE_OBJECT_LOOKING_UP) { | |
36931 | - fscache_stat(&fscache_n_object_lookups_negative); | |
36932 | + fscache_stat_unchecked(&fscache_n_object_lookups_negative); | |
36933 | ||
36934 | /* transit here to allow write requests to begin stacking up | |
36935 | * and read requests to begin returning ENODATA */ | |
36936 | @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca | |
36937 | * result, in which case there may be data available */ | |
36938 | spin_lock(&object->lock); | |
36939 | if (object->state == FSCACHE_OBJECT_LOOKING_UP) { | |
36940 | - fscache_stat(&fscache_n_object_lookups_positive); | |
36941 | + fscache_stat_unchecked(&fscache_n_object_lookups_positive); | |
36942 | ||
36943 | clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags); | |
36944 | ||
36945 | @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca | |
36946 | set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events); | |
36947 | } else { | |
36948 | ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING); | |
36949 | - fscache_stat(&fscache_n_object_created); | |
36950 | + fscache_stat_unchecked(&fscache_n_object_created); | |
36951 | ||
36952 | object->state = FSCACHE_OBJECT_AVAILABLE; | |
36953 | spin_unlock(&object->lock); | |
36954 | @@ -602,7 +602,7 @@ static void fscache_object_available(str | |
36955 | fscache_enqueue_dependents(object); | |
36956 | ||
36957 | fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif); | |
36958 | - fscache_stat(&fscache_n_object_avail); | |
36959 | + fscache_stat_unchecked(&fscache_n_object_avail); | |
36960 | ||
36961 | _leave(""); | |
36962 | } | |
36963 | @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux( | |
36964 | enum fscache_checkaux result; | |
36965 | ||
36966 | if (!object->cookie->def->check_aux) { | |
36967 | - fscache_stat(&fscache_n_checkaux_none); | |
36968 | + fscache_stat_unchecked(&fscache_n_checkaux_none); | |
36969 | return FSCACHE_CHECKAUX_OKAY; | |
36970 | } | |
36971 | ||
36972 | @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux( | |
36973 | switch (result) { | |
36974 | /* entry okay as is */ | |
36975 | case FSCACHE_CHECKAUX_OKAY: | |
36976 | - fscache_stat(&fscache_n_checkaux_okay); | |
36977 | + fscache_stat_unchecked(&fscache_n_checkaux_okay); | |
36978 | break; | |
36979 | ||
36980 | /* entry requires update */ | |
36981 | case FSCACHE_CHECKAUX_NEEDS_UPDATE: | |
36982 | - fscache_stat(&fscache_n_checkaux_update); | |
36983 | + fscache_stat_unchecked(&fscache_n_checkaux_update); | |
36984 | break; | |
36985 | ||
36986 | /* entry requires deletion */ | |
36987 | case FSCACHE_CHECKAUX_OBSOLETE: | |
36988 | - fscache_stat(&fscache_n_checkaux_obsolete); | |
36989 | + fscache_stat_unchecked(&fscache_n_checkaux_obsolete); | |
36990 | break; | |
36991 | ||
36992 | default: | |
36993 | diff -urNp linux-3.0.3/fs/fscache/operation.c linux-3.0.3/fs/fscache/operation.c | |
36994 | --- linux-3.0.3/fs/fscache/operation.c 2011-07-21 22:17:23.000000000 -0400 | |
36995 | +++ linux-3.0.3/fs/fscache/operation.c 2011-08-23 21:47:56.000000000 -0400 | |
36996 | @@ -17,7 +17,7 @@ | |
36997 | #include <linux/slab.h> | |
36998 | #include "internal.h" | |
36999 | ||
37000 | -atomic_t fscache_op_debug_id; | |
37001 | +atomic_unchecked_t fscache_op_debug_id; | |
37002 | EXPORT_SYMBOL(fscache_op_debug_id); | |
37003 | ||
37004 | /** | |
37005 | @@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fs | |
37006 | ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE); | |
37007 | ASSERTCMP(atomic_read(&op->usage), >, 0); | |
37008 | ||
37009 | - fscache_stat(&fscache_n_op_enqueue); | |
37010 | + fscache_stat_unchecked(&fscache_n_op_enqueue); | |
37011 | switch (op->flags & FSCACHE_OP_TYPE) { | |
37012 | case FSCACHE_OP_ASYNC: | |
37013 | _debug("queue async"); | |
37014 | @@ -69,7 +69,7 @@ static void fscache_run_op(struct fscach | |
37015 | wake_up_bit(&op->flags, FSCACHE_OP_WAITING); | |
37016 | if (op->processor) | |
37017 | fscache_enqueue_operation(op); | |
37018 | - fscache_stat(&fscache_n_op_run); | |
37019 | + fscache_stat_unchecked(&fscache_n_op_run); | |
37020 | } | |
37021 | ||
37022 | /* | |
37023 | @@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct f | |
37024 | if (object->n_ops > 1) { | |
37025 | atomic_inc(&op->usage); | |
37026 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37027 | - fscache_stat(&fscache_n_op_pend); | |
37028 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37029 | } else if (!list_empty(&object->pending_ops)) { | |
37030 | atomic_inc(&op->usage); | |
37031 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37032 | - fscache_stat(&fscache_n_op_pend); | |
37033 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37034 | fscache_start_operations(object); | |
37035 | } else { | |
37036 | ASSERTCMP(object->n_in_progress, ==, 0); | |
37037 | @@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct f | |
37038 | object->n_exclusive++; /* reads and writes must wait */ | |
37039 | atomic_inc(&op->usage); | |
37040 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37041 | - fscache_stat(&fscache_n_op_pend); | |
37042 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37043 | ret = 0; | |
37044 | } else { | |
37045 | /* not allowed to submit ops in any other state */ | |
37046 | @@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_obj | |
37047 | if (object->n_exclusive > 0) { | |
37048 | atomic_inc(&op->usage); | |
37049 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37050 | - fscache_stat(&fscache_n_op_pend); | |
37051 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37052 | } else if (!list_empty(&object->pending_ops)) { | |
37053 | atomic_inc(&op->usage); | |
37054 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37055 | - fscache_stat(&fscache_n_op_pend); | |
37056 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37057 | fscache_start_operations(object); | |
37058 | } else { | |
37059 | ASSERTCMP(object->n_exclusive, ==, 0); | |
37060 | @@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_obj | |
37061 | object->n_ops++; | |
37062 | atomic_inc(&op->usage); | |
37063 | list_add_tail(&op->pend_link, &object->pending_ops); | |
37064 | - fscache_stat(&fscache_n_op_pend); | |
37065 | + fscache_stat_unchecked(&fscache_n_op_pend); | |
37066 | ret = 0; | |
37067 | } else if (object->state == FSCACHE_OBJECT_DYING || | |
37068 | object->state == FSCACHE_OBJECT_LC_DYING || | |
37069 | object->state == FSCACHE_OBJECT_WITHDRAWING) { | |
37070 | - fscache_stat(&fscache_n_op_rejected); | |
37071 | + fscache_stat_unchecked(&fscache_n_op_rejected); | |
37072 | ret = -ENOBUFS; | |
37073 | } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) { | |
37074 | fscache_report_unexpected_submission(object, op, ostate); | |
37075 | @@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_ope | |
37076 | ||
37077 | ret = -EBUSY; | |
37078 | if (!list_empty(&op->pend_link)) { | |
37079 | - fscache_stat(&fscache_n_op_cancelled); | |
37080 | + fscache_stat_unchecked(&fscache_n_op_cancelled); | |
37081 | list_del_init(&op->pend_link); | |
37082 | object->n_ops--; | |
37083 | if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags)) | |
37084 | @@ -331,7 +331,7 @@ void fscache_put_operation(struct fscach | |
37085 | if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags)) | |
37086 | BUG(); | |
37087 | ||
37088 | - fscache_stat(&fscache_n_op_release); | |
37089 | + fscache_stat_unchecked(&fscache_n_op_release); | |
37090 | ||
37091 | if (op->release) { | |
37092 | op->release(op); | |
37093 | @@ -348,7 +348,7 @@ void fscache_put_operation(struct fscach | |
37094 | * lock, and defer it otherwise */ | |
37095 | if (!spin_trylock(&object->lock)) { | |
37096 | _debug("defer put"); | |
37097 | - fscache_stat(&fscache_n_op_deferred_release); | |
37098 | + fscache_stat_unchecked(&fscache_n_op_deferred_release); | |
37099 | ||
37100 | cache = object->cache; | |
37101 | spin_lock(&cache->op_gc_list_lock); | |
37102 | @@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_st | |
37103 | ||
37104 | _debug("GC DEFERRED REL OBJ%x OP%x", | |
37105 | object->debug_id, op->debug_id); | |
37106 | - fscache_stat(&fscache_n_op_gc); | |
37107 | + fscache_stat_unchecked(&fscache_n_op_gc); | |
37108 | ||
37109 | ASSERTCMP(atomic_read(&op->usage), ==, 0); | |
37110 | ||
37111 | diff -urNp linux-3.0.3/fs/fscache/page.c linux-3.0.3/fs/fscache/page.c | |
37112 | --- linux-3.0.3/fs/fscache/page.c 2011-07-21 22:17:23.000000000 -0400 | |
37113 | +++ linux-3.0.3/fs/fscache/page.c 2011-08-23 21:47:56.000000000 -0400 | |
37114 | @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct | |
37115 | val = radix_tree_lookup(&cookie->stores, page->index); | |
37116 | if (!val) { | |
37117 | rcu_read_unlock(); | |
37118 | - fscache_stat(&fscache_n_store_vmscan_not_storing); | |
37119 | + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing); | |
37120 | __fscache_uncache_page(cookie, page); | |
37121 | return true; | |
37122 | } | |
37123 | @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct | |
37124 | spin_unlock(&cookie->stores_lock); | |
37125 | ||
37126 | if (xpage) { | |
37127 | - fscache_stat(&fscache_n_store_vmscan_cancelled); | |
37128 | - fscache_stat(&fscache_n_store_radix_deletes); | |
37129 | + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled); | |
37130 | + fscache_stat_unchecked(&fscache_n_store_radix_deletes); | |
37131 | ASSERTCMP(xpage, ==, page); | |
37132 | } else { | |
37133 | - fscache_stat(&fscache_n_store_vmscan_gone); | |
37134 | + fscache_stat_unchecked(&fscache_n_store_vmscan_gone); | |
37135 | } | |
37136 | ||
37137 | wake_up_bit(&cookie->flags, 0); | |
37138 | @@ -107,7 +107,7 @@ page_busy: | |
37139 | /* we might want to wait here, but that could deadlock the allocator as | |
37140 | * the work threads writing to the cache may all end up sleeping | |
37141 | * on memory allocation */ | |
37142 | - fscache_stat(&fscache_n_store_vmscan_busy); | |
37143 | + fscache_stat_unchecked(&fscache_n_store_vmscan_busy); | |
37144 | return false; | |
37145 | } | |
37146 | EXPORT_SYMBOL(__fscache_maybe_release_page); | |
37147 | @@ -131,7 +131,7 @@ static void fscache_end_page_write(struc | |
37148 | FSCACHE_COOKIE_STORING_TAG); | |
37149 | if (!radix_tree_tag_get(&cookie->stores, page->index, | |
37150 | FSCACHE_COOKIE_PENDING_TAG)) { | |
37151 | - fscache_stat(&fscache_n_store_radix_deletes); | |
37152 | + fscache_stat_unchecked(&fscache_n_store_radix_deletes); | |
37153 | xpage = radix_tree_delete(&cookie->stores, page->index); | |
37154 | } | |
37155 | spin_unlock(&cookie->stores_lock); | |
37156 | @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru | |
37157 | ||
37158 | _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id); | |
37159 | ||
37160 | - fscache_stat(&fscache_n_attr_changed_calls); | |
37161 | + fscache_stat_unchecked(&fscache_n_attr_changed_calls); | |
37162 | ||
37163 | if (fscache_object_is_active(object)) { | |
37164 | fscache_stat(&fscache_n_cop_attr_changed); | |
37165 | @@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscach | |
37166 | ||
37167 | ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX); | |
37168 | ||
37169 | - fscache_stat(&fscache_n_attr_changed); | |
37170 | + fscache_stat_unchecked(&fscache_n_attr_changed); | |
37171 | ||
37172 | op = kzalloc(sizeof(*op), GFP_KERNEL); | |
37173 | if (!op) { | |
37174 | - fscache_stat(&fscache_n_attr_changed_nomem); | |
37175 | + fscache_stat_unchecked(&fscache_n_attr_changed_nomem); | |
37176 | _leave(" = -ENOMEM"); | |
37177 | return -ENOMEM; | |
37178 | } | |
37179 | @@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscach | |
37180 | if (fscache_submit_exclusive_op(object, op) < 0) | |
37181 | goto nobufs; | |
37182 | spin_unlock(&cookie->lock); | |
37183 | - fscache_stat(&fscache_n_attr_changed_ok); | |
37184 | + fscache_stat_unchecked(&fscache_n_attr_changed_ok); | |
37185 | fscache_put_operation(op); | |
37186 | _leave(" = 0"); | |
37187 | return 0; | |
37188 | @@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscach | |
37189 | nobufs: | |
37190 | spin_unlock(&cookie->lock); | |
37191 | kfree(op); | |
37192 | - fscache_stat(&fscache_n_attr_changed_nobufs); | |
37193 | + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs); | |
37194 | _leave(" = %d", -ENOBUFS); | |
37195 | return -ENOBUFS; | |
37196 | } | |
37197 | @@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache | |
37198 | /* allocate a retrieval operation and attempt to submit it */ | |
37199 | op = kzalloc(sizeof(*op), GFP_NOIO); | |
37200 | if (!op) { | |
37201 | - fscache_stat(&fscache_n_retrievals_nomem); | |
37202 | + fscache_stat_unchecked(&fscache_n_retrievals_nomem); | |
37203 | return NULL; | |
37204 | } | |
37205 | ||
37206 | @@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_loo | |
37207 | return 0; | |
37208 | } | |
37209 | ||
37210 | - fscache_stat(&fscache_n_retrievals_wait); | |
37211 | + fscache_stat_unchecked(&fscache_n_retrievals_wait); | |
37212 | ||
37213 | jif = jiffies; | |
37214 | if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP, | |
37215 | fscache_wait_bit_interruptible, | |
37216 | TASK_INTERRUPTIBLE) != 0) { | |
37217 | - fscache_stat(&fscache_n_retrievals_intr); | |
37218 | + fscache_stat_unchecked(&fscache_n_retrievals_intr); | |
37219 | _leave(" = -ERESTARTSYS"); | |
37220 | return -ERESTARTSYS; | |
37221 | } | |
37222 | @@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_loo | |
37223 | */ | |
37224 | static int fscache_wait_for_retrieval_activation(struct fscache_object *object, | |
37225 | struct fscache_retrieval *op, | |
37226 | - atomic_t *stat_op_waits, | |
37227 | - atomic_t *stat_object_dead) | |
37228 | + atomic_unchecked_t *stat_op_waits, | |
37229 | + atomic_unchecked_t *stat_object_dead) | |
37230 | { | |
37231 | int ret; | |
37232 | ||
37233 | @@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_ac | |
37234 | goto check_if_dead; | |
37235 | ||
37236 | _debug(">>> WT"); | |
37237 | - fscache_stat(stat_op_waits); | |
37238 | + fscache_stat_unchecked(stat_op_waits); | |
37239 | if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING, | |
37240 | fscache_wait_bit_interruptible, | |
37241 | TASK_INTERRUPTIBLE) < 0) { | |
37242 | @@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_ac | |
37243 | ||
37244 | check_if_dead: | |
37245 | if (unlikely(fscache_object_is_dead(object))) { | |
37246 | - fscache_stat(stat_object_dead); | |
37247 | + fscache_stat_unchecked(stat_object_dead); | |
37248 | return -ENOBUFS; | |
37249 | } | |
37250 | return 0; | |
37251 | @@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct | |
37252 | ||
37253 | _enter("%p,%p,,,", cookie, page); | |
37254 | ||
37255 | - fscache_stat(&fscache_n_retrievals); | |
37256 | + fscache_stat_unchecked(&fscache_n_retrievals); | |
37257 | ||
37258 | if (hlist_empty(&cookie->backing_objects)) | |
37259 | goto nobufs; | |
37260 | @@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct | |
37261 | goto nobufs_unlock; | |
37262 | spin_unlock(&cookie->lock); | |
37263 | ||
37264 | - fscache_stat(&fscache_n_retrieval_ops); | |
37265 | + fscache_stat_unchecked(&fscache_n_retrieval_ops); | |
37266 | ||
37267 | /* pin the netfs read context in case we need to do the actual netfs | |
37268 | * read because we've encountered a cache read failure */ | |
37269 | @@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct | |
37270 | ||
37271 | error: | |
37272 | if (ret == -ENOMEM) | |
37273 | - fscache_stat(&fscache_n_retrievals_nomem); | |
37274 | + fscache_stat_unchecked(&fscache_n_retrievals_nomem); | |
37275 | else if (ret == -ERESTARTSYS) | |
37276 | - fscache_stat(&fscache_n_retrievals_intr); | |
37277 | + fscache_stat_unchecked(&fscache_n_retrievals_intr); | |
37278 | else if (ret == -ENODATA) | |
37279 | - fscache_stat(&fscache_n_retrievals_nodata); | |
37280 | + fscache_stat_unchecked(&fscache_n_retrievals_nodata); | |
37281 | else if (ret < 0) | |
37282 | - fscache_stat(&fscache_n_retrievals_nobufs); | |
37283 | + fscache_stat_unchecked(&fscache_n_retrievals_nobufs); | |
37284 | else | |
37285 | - fscache_stat(&fscache_n_retrievals_ok); | |
37286 | + fscache_stat_unchecked(&fscache_n_retrievals_ok); | |
37287 | ||
37288 | fscache_put_retrieval(op); | |
37289 | _leave(" = %d", ret); | |
37290 | @@ -429,7 +429,7 @@ nobufs_unlock: | |
37291 | spin_unlock(&cookie->lock); | |
37292 | kfree(op); | |
37293 | nobufs: | |
37294 | - fscache_stat(&fscache_n_retrievals_nobufs); | |
37295 | + fscache_stat_unchecked(&fscache_n_retrievals_nobufs); | |
37296 | _leave(" = -ENOBUFS"); | |
37297 | return -ENOBUFS; | |
37298 | } | |
37299 | @@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct | |
37300 | ||
37301 | _enter("%p,,%d,,,", cookie, *nr_pages); | |
37302 | ||
37303 | - fscache_stat(&fscache_n_retrievals); | |
37304 | + fscache_stat_unchecked(&fscache_n_retrievals); | |
37305 | ||
37306 | if (hlist_empty(&cookie->backing_objects)) | |
37307 | goto nobufs; | |
37308 | @@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct | |
37309 | goto nobufs_unlock; | |
37310 | spin_unlock(&cookie->lock); | |
37311 | ||
37312 | - fscache_stat(&fscache_n_retrieval_ops); | |
37313 | + fscache_stat_unchecked(&fscache_n_retrieval_ops); | |
37314 | ||
37315 | /* pin the netfs read context in case we need to do the actual netfs | |
37316 | * read because we've encountered a cache read failure */ | |
37317 | @@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct | |
37318 | ||
37319 | error: | |
37320 | if (ret == -ENOMEM) | |
37321 | - fscache_stat(&fscache_n_retrievals_nomem); | |
37322 | + fscache_stat_unchecked(&fscache_n_retrievals_nomem); | |
37323 | else if (ret == -ERESTARTSYS) | |
37324 | - fscache_stat(&fscache_n_retrievals_intr); | |
37325 | + fscache_stat_unchecked(&fscache_n_retrievals_intr); | |
37326 | else if (ret == -ENODATA) | |
37327 | - fscache_stat(&fscache_n_retrievals_nodata); | |
37328 | + fscache_stat_unchecked(&fscache_n_retrievals_nodata); | |
37329 | else if (ret < 0) | |
37330 | - fscache_stat(&fscache_n_retrievals_nobufs); | |
37331 | + fscache_stat_unchecked(&fscache_n_retrievals_nobufs); | |
37332 | else | |
37333 | - fscache_stat(&fscache_n_retrievals_ok); | |
37334 | + fscache_stat_unchecked(&fscache_n_retrievals_ok); | |
37335 | ||
37336 | fscache_put_retrieval(op); | |
37337 | _leave(" = %d", ret); | |
37338 | @@ -545,7 +545,7 @@ nobufs_unlock: | |
37339 | spin_unlock(&cookie->lock); | |
37340 | kfree(op); | |
37341 | nobufs: | |
37342 | - fscache_stat(&fscache_n_retrievals_nobufs); | |
37343 | + fscache_stat_unchecked(&fscache_n_retrievals_nobufs); | |
37344 | _leave(" = -ENOBUFS"); | |
37345 | return -ENOBUFS; | |
37346 | } | |
37347 | @@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_ | |
37348 | ||
37349 | _enter("%p,%p,,,", cookie, page); | |
37350 | ||
37351 | - fscache_stat(&fscache_n_allocs); | |
37352 | + fscache_stat_unchecked(&fscache_n_allocs); | |
37353 | ||
37354 | if (hlist_empty(&cookie->backing_objects)) | |
37355 | goto nobufs; | |
37356 | @@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_ | |
37357 | goto nobufs_unlock; | |
37358 | spin_unlock(&cookie->lock); | |
37359 | ||
37360 | - fscache_stat(&fscache_n_alloc_ops); | |
37361 | + fscache_stat_unchecked(&fscache_n_alloc_ops); | |
37362 | ||
37363 | ret = fscache_wait_for_retrieval_activation( | |
37364 | object, op, | |
37365 | @@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_ | |
37366 | ||
37367 | error: | |
37368 | if (ret == -ERESTARTSYS) | |
37369 | - fscache_stat(&fscache_n_allocs_intr); | |
37370 | + fscache_stat_unchecked(&fscache_n_allocs_intr); | |
37371 | else if (ret < 0) | |
37372 | - fscache_stat(&fscache_n_allocs_nobufs); | |
37373 | + fscache_stat_unchecked(&fscache_n_allocs_nobufs); | |
37374 | else | |
37375 | - fscache_stat(&fscache_n_allocs_ok); | |
37376 | + fscache_stat_unchecked(&fscache_n_allocs_ok); | |
37377 | ||
37378 | fscache_put_retrieval(op); | |
37379 | _leave(" = %d", ret); | |
37380 | @@ -625,7 +625,7 @@ nobufs_unlock: | |
37381 | spin_unlock(&cookie->lock); | |
37382 | kfree(op); | |
37383 | nobufs: | |
37384 | - fscache_stat(&fscache_n_allocs_nobufs); | |
37385 | + fscache_stat_unchecked(&fscache_n_allocs_nobufs); | |
37386 | _leave(" = -ENOBUFS"); | |
37387 | return -ENOBUFS; | |
37388 | } | |
37389 | @@ -666,7 +666,7 @@ static void fscache_write_op(struct fsca | |
37390 | ||
37391 | spin_lock(&cookie->stores_lock); | |
37392 | ||
37393 | - fscache_stat(&fscache_n_store_calls); | |
37394 | + fscache_stat_unchecked(&fscache_n_store_calls); | |
37395 | ||
37396 | /* find a page to store */ | |
37397 | page = NULL; | |
37398 | @@ -677,7 +677,7 @@ static void fscache_write_op(struct fsca | |
37399 | page = results[0]; | |
37400 | _debug("gang %d [%lx]", n, page->index); | |
37401 | if (page->index > op->store_limit) { | |
37402 | - fscache_stat(&fscache_n_store_pages_over_limit); | |
37403 | + fscache_stat_unchecked(&fscache_n_store_pages_over_limit); | |
37404 | goto superseded; | |
37405 | } | |
37406 | ||
37407 | @@ -689,7 +689,7 @@ static void fscache_write_op(struct fsca | |
37408 | spin_unlock(&cookie->stores_lock); | |
37409 | spin_unlock(&object->lock); | |
37410 | ||
37411 | - fscache_stat(&fscache_n_store_pages); | |
37412 | + fscache_stat_unchecked(&fscache_n_store_pages); | |
37413 | fscache_stat(&fscache_n_cop_write_page); | |
37414 | ret = object->cache->ops->write_page(op, page); | |
37415 | fscache_stat_d(&fscache_n_cop_write_page); | |
37416 | @@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_ | |
37417 | ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX); | |
37418 | ASSERT(PageFsCache(page)); | |
37419 | ||
37420 | - fscache_stat(&fscache_n_stores); | |
37421 | + fscache_stat_unchecked(&fscache_n_stores); | |
37422 | ||
37423 | op = kzalloc(sizeof(*op), GFP_NOIO); | |
37424 | if (!op) | |
37425 | @@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_ | |
37426 | spin_unlock(&cookie->stores_lock); | |
37427 | spin_unlock(&object->lock); | |
37428 | ||
37429 | - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id); | |
37430 | + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id); | |
37431 | op->store_limit = object->store_limit; | |
37432 | ||
37433 | if (fscache_submit_op(object, &op->op) < 0) | |
37434 | @@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_ | |
37435 | ||
37436 | spin_unlock(&cookie->lock); | |
37437 | radix_tree_preload_end(); | |
37438 | - fscache_stat(&fscache_n_store_ops); | |
37439 | - fscache_stat(&fscache_n_stores_ok); | |
37440 | + fscache_stat_unchecked(&fscache_n_store_ops); | |
37441 | + fscache_stat_unchecked(&fscache_n_stores_ok); | |
37442 | ||
37443 | /* the work queue now carries its own ref on the object */ | |
37444 | fscache_put_operation(&op->op); | |
37445 | @@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_ | |
37446 | return 0; | |
37447 | ||
37448 | already_queued: | |
37449 | - fscache_stat(&fscache_n_stores_again); | |
37450 | + fscache_stat_unchecked(&fscache_n_stores_again); | |
37451 | already_pending: | |
37452 | spin_unlock(&cookie->stores_lock); | |
37453 | spin_unlock(&object->lock); | |
37454 | spin_unlock(&cookie->lock); | |
37455 | radix_tree_preload_end(); | |
37456 | kfree(op); | |
37457 | - fscache_stat(&fscache_n_stores_ok); | |
37458 | + fscache_stat_unchecked(&fscache_n_stores_ok); | |
37459 | _leave(" = 0"); | |
37460 | return 0; | |
37461 | ||
37462 | @@ -851,14 +851,14 @@ nobufs: | |
37463 | spin_unlock(&cookie->lock); | |
37464 | radix_tree_preload_end(); | |
37465 | kfree(op); | |
37466 | - fscache_stat(&fscache_n_stores_nobufs); | |
37467 | + fscache_stat_unchecked(&fscache_n_stores_nobufs); | |
37468 | _leave(" = -ENOBUFS"); | |
37469 | return -ENOBUFS; | |
37470 | ||
37471 | nomem_free: | |
37472 | kfree(op); | |
37473 | nomem: | |
37474 | - fscache_stat(&fscache_n_stores_oom); | |
37475 | + fscache_stat_unchecked(&fscache_n_stores_oom); | |
37476 | _leave(" = -ENOMEM"); | |
37477 | return -ENOMEM; | |
37478 | } | |
37479 | @@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscac | |
37480 | ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX); | |
37481 | ASSERTCMP(page, !=, NULL); | |
37482 | ||
37483 | - fscache_stat(&fscache_n_uncaches); | |
37484 | + fscache_stat_unchecked(&fscache_n_uncaches); | |
37485 | ||
37486 | /* cache withdrawal may beat us to it */ | |
37487 | if (!PageFsCache(page)) | |
37488 | @@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fs | |
37489 | unsigned long loop; | |
37490 | ||
37491 | #ifdef CONFIG_FSCACHE_STATS | |
37492 | - atomic_add(pagevec->nr, &fscache_n_marks); | |
37493 | + atomic_add_unchecked(pagevec->nr, &fscache_n_marks); | |
37494 | #endif | |
37495 | ||
37496 | for (loop = 0; loop < pagevec->nr; loop++) { | |
37497 | diff -urNp linux-3.0.3/fs/fscache/stats.c linux-3.0.3/fs/fscache/stats.c | |
37498 | --- linux-3.0.3/fs/fscache/stats.c 2011-07-21 22:17:23.000000000 -0400 | |
37499 | +++ linux-3.0.3/fs/fscache/stats.c 2011-08-23 21:47:56.000000000 -0400 | |
37500 | @@ -18,95 +18,95 @@ | |
37501 | /* | |
37502 | * operation counters | |
37503 | */ | |
37504 | -atomic_t fscache_n_op_pend; | |
37505 | -atomic_t fscache_n_op_run; | |
37506 | -atomic_t fscache_n_op_enqueue; | |
37507 | -atomic_t fscache_n_op_requeue; | |
37508 | -atomic_t fscache_n_op_deferred_release; | |
37509 | -atomic_t fscache_n_op_release; | |
37510 | -atomic_t fscache_n_op_gc; | |
37511 | -atomic_t fscache_n_op_cancelled; | |
37512 | -atomic_t fscache_n_op_rejected; | |
37513 | - | |
37514 | -atomic_t fscache_n_attr_changed; | |
37515 | -atomic_t fscache_n_attr_changed_ok; | |
37516 | -atomic_t fscache_n_attr_changed_nobufs; | |
37517 | -atomic_t fscache_n_attr_changed_nomem; | |
37518 | -atomic_t fscache_n_attr_changed_calls; | |
37519 | - | |
37520 | -atomic_t fscache_n_allocs; | |
37521 | -atomic_t fscache_n_allocs_ok; | |
37522 | -atomic_t fscache_n_allocs_wait; | |
37523 | -atomic_t fscache_n_allocs_nobufs; | |
37524 | -atomic_t fscache_n_allocs_intr; | |
37525 | -atomic_t fscache_n_allocs_object_dead; | |
37526 | -atomic_t fscache_n_alloc_ops; | |
37527 | -atomic_t fscache_n_alloc_op_waits; | |
37528 | - | |
37529 | -atomic_t fscache_n_retrievals; | |
37530 | -atomic_t fscache_n_retrievals_ok; | |
37531 | -atomic_t fscache_n_retrievals_wait; | |
37532 | -atomic_t fscache_n_retrievals_nodata; | |
37533 | -atomic_t fscache_n_retrievals_nobufs; | |
37534 | -atomic_t fscache_n_retrievals_intr; | |
37535 | -atomic_t fscache_n_retrievals_nomem; | |
37536 | -atomic_t fscache_n_retrievals_object_dead; | |
37537 | -atomic_t fscache_n_retrieval_ops; | |
37538 | -atomic_t fscache_n_retrieval_op_waits; | |
37539 | - | |
37540 | -atomic_t fscache_n_stores; | |
37541 | -atomic_t fscache_n_stores_ok; | |
37542 | -atomic_t fscache_n_stores_again; | |
37543 | -atomic_t fscache_n_stores_nobufs; | |
37544 | -atomic_t fscache_n_stores_oom; | |
37545 | -atomic_t fscache_n_store_ops; | |
37546 | -atomic_t fscache_n_store_calls; | |
37547 | -atomic_t fscache_n_store_pages; | |
37548 | -atomic_t fscache_n_store_radix_deletes; | |
37549 | -atomic_t fscache_n_store_pages_over_limit; | |
37550 | - | |
37551 | -atomic_t fscache_n_store_vmscan_not_storing; | |
37552 | -atomic_t fscache_n_store_vmscan_gone; | |
37553 | -atomic_t fscache_n_store_vmscan_busy; | |
37554 | -atomic_t fscache_n_store_vmscan_cancelled; | |
37555 | - | |
37556 | -atomic_t fscache_n_marks; | |
37557 | -atomic_t fscache_n_uncaches; | |
37558 | - | |
37559 | -atomic_t fscache_n_acquires; | |
37560 | -atomic_t fscache_n_acquires_null; | |
37561 | -atomic_t fscache_n_acquires_no_cache; | |
37562 | -atomic_t fscache_n_acquires_ok; | |
37563 | -atomic_t fscache_n_acquires_nobufs; | |
37564 | -atomic_t fscache_n_acquires_oom; | |
37565 | - | |
37566 | -atomic_t fscache_n_updates; | |
37567 | -atomic_t fscache_n_updates_null; | |
37568 | -atomic_t fscache_n_updates_run; | |
37569 | - | |
37570 | -atomic_t fscache_n_relinquishes; | |
37571 | -atomic_t fscache_n_relinquishes_null; | |
37572 | -atomic_t fscache_n_relinquishes_waitcrt; | |
37573 | -atomic_t fscache_n_relinquishes_retire; | |
37574 | - | |
37575 | -atomic_t fscache_n_cookie_index; | |
37576 | -atomic_t fscache_n_cookie_data; | |
37577 | -atomic_t fscache_n_cookie_special; | |
37578 | - | |
37579 | -atomic_t fscache_n_object_alloc; | |
37580 | -atomic_t fscache_n_object_no_alloc; | |
37581 | -atomic_t fscache_n_object_lookups; | |
37582 | -atomic_t fscache_n_object_lookups_negative; | |
37583 | -atomic_t fscache_n_object_lookups_positive; | |
37584 | -atomic_t fscache_n_object_lookups_timed_out; | |
37585 | -atomic_t fscache_n_object_created; | |
37586 | -atomic_t fscache_n_object_avail; | |
37587 | -atomic_t fscache_n_object_dead; | |
37588 | - | |
37589 | -atomic_t fscache_n_checkaux_none; | |
37590 | -atomic_t fscache_n_checkaux_okay; | |
37591 | -atomic_t fscache_n_checkaux_update; | |
37592 | -atomic_t fscache_n_checkaux_obsolete; | |
37593 | +atomic_unchecked_t fscache_n_op_pend; | |
37594 | +atomic_unchecked_t fscache_n_op_run; | |
37595 | +atomic_unchecked_t fscache_n_op_enqueue; | |
37596 | +atomic_unchecked_t fscache_n_op_requeue; | |
37597 | +atomic_unchecked_t fscache_n_op_deferred_release; | |
37598 | +atomic_unchecked_t fscache_n_op_release; | |
37599 | +atomic_unchecked_t fscache_n_op_gc; | |
37600 | +atomic_unchecked_t fscache_n_op_cancelled; | |
37601 | +atomic_unchecked_t fscache_n_op_rejected; | |
37602 | + | |
37603 | +atomic_unchecked_t fscache_n_attr_changed; | |
37604 | +atomic_unchecked_t fscache_n_attr_changed_ok; | |
37605 | +atomic_unchecked_t fscache_n_attr_changed_nobufs; | |
37606 | +atomic_unchecked_t fscache_n_attr_changed_nomem; | |
37607 | +atomic_unchecked_t fscache_n_attr_changed_calls; | |
37608 | + | |
37609 | +atomic_unchecked_t fscache_n_allocs; | |
37610 | +atomic_unchecked_t fscache_n_allocs_ok; | |
37611 | +atomic_unchecked_t fscache_n_allocs_wait; | |
37612 | +atomic_unchecked_t fscache_n_allocs_nobufs; | |
37613 | +atomic_unchecked_t fscache_n_allocs_intr; | |
37614 | +atomic_unchecked_t fscache_n_allocs_object_dead; | |
37615 | +atomic_unchecked_t fscache_n_alloc_ops; | |
37616 | +atomic_unchecked_t fscache_n_alloc_op_waits; | |
37617 | + | |
37618 | +atomic_unchecked_t fscache_n_retrievals; | |
37619 | +atomic_unchecked_t fscache_n_retrievals_ok; | |
37620 | +atomic_unchecked_t fscache_n_retrievals_wait; | |
37621 | +atomic_unchecked_t fscache_n_retrievals_nodata; | |
37622 | +atomic_unchecked_t fscache_n_retrievals_nobufs; | |
37623 | +atomic_unchecked_t fscache_n_retrievals_intr; | |
37624 | +atomic_unchecked_t fscache_n_retrievals_nomem; | |
37625 | +atomic_unchecked_t fscache_n_retrievals_object_dead; | |
37626 | +atomic_unchecked_t fscache_n_retrieval_ops; | |
37627 | +atomic_unchecked_t fscache_n_retrieval_op_waits; | |
37628 | + | |
37629 | +atomic_unchecked_t fscache_n_stores; | |
37630 | +atomic_unchecked_t fscache_n_stores_ok; | |
37631 | +atomic_unchecked_t fscache_n_stores_again; | |
37632 | +atomic_unchecked_t fscache_n_stores_nobufs; | |
37633 | +atomic_unchecked_t fscache_n_stores_oom; | |
37634 | +atomic_unchecked_t fscache_n_store_ops; | |
37635 | +atomic_unchecked_t fscache_n_store_calls; | |
37636 | +atomic_unchecked_t fscache_n_store_pages; | |
37637 | +atomic_unchecked_t fscache_n_store_radix_deletes; | |
37638 | +atomic_unchecked_t fscache_n_store_pages_over_limit; | |
37639 | + | |
37640 | +atomic_unchecked_t fscache_n_store_vmscan_not_storing; | |
37641 | +atomic_unchecked_t fscache_n_store_vmscan_gone; | |
37642 | +atomic_unchecked_t fscache_n_store_vmscan_busy; | |
37643 | +atomic_unchecked_t fscache_n_store_vmscan_cancelled; | |
37644 | + | |
37645 | +atomic_unchecked_t fscache_n_marks; | |
37646 | +atomic_unchecked_t fscache_n_uncaches; | |
37647 | + | |
37648 | +atomic_unchecked_t fscache_n_acquires; | |
37649 | +atomic_unchecked_t fscache_n_acquires_null; | |
37650 | +atomic_unchecked_t fscache_n_acquires_no_cache; | |
37651 | +atomic_unchecked_t fscache_n_acquires_ok; | |
37652 | +atomic_unchecked_t fscache_n_acquires_nobufs; | |
37653 | +atomic_unchecked_t fscache_n_acquires_oom; | |
37654 | + | |
37655 | +atomic_unchecked_t fscache_n_updates; | |
37656 | +atomic_unchecked_t fscache_n_updates_null; | |
37657 | +atomic_unchecked_t fscache_n_updates_run; | |
37658 | + | |
37659 | +atomic_unchecked_t fscache_n_relinquishes; | |
37660 | +atomic_unchecked_t fscache_n_relinquishes_null; | |
37661 | +atomic_unchecked_t fscache_n_relinquishes_waitcrt; | |
37662 | +atomic_unchecked_t fscache_n_relinquishes_retire; | |
37663 | + | |
37664 | +atomic_unchecked_t fscache_n_cookie_index; | |
37665 | +atomic_unchecked_t fscache_n_cookie_data; | |
37666 | +atomic_unchecked_t fscache_n_cookie_special; | |
37667 | + | |
37668 | +atomic_unchecked_t fscache_n_object_alloc; | |
37669 | +atomic_unchecked_t fscache_n_object_no_alloc; | |
37670 | +atomic_unchecked_t fscache_n_object_lookups; | |
37671 | +atomic_unchecked_t fscache_n_object_lookups_negative; | |
37672 | +atomic_unchecked_t fscache_n_object_lookups_positive; | |
37673 | +atomic_unchecked_t fscache_n_object_lookups_timed_out; | |
37674 | +atomic_unchecked_t fscache_n_object_created; | |
37675 | +atomic_unchecked_t fscache_n_object_avail; | |
37676 | +atomic_unchecked_t fscache_n_object_dead; | |
37677 | + | |
37678 | +atomic_unchecked_t fscache_n_checkaux_none; | |
37679 | +atomic_unchecked_t fscache_n_checkaux_okay; | |
37680 | +atomic_unchecked_t fscache_n_checkaux_update; | |
37681 | +atomic_unchecked_t fscache_n_checkaux_obsolete; | |
37682 | ||
37683 | atomic_t fscache_n_cop_alloc_object; | |
37684 | atomic_t fscache_n_cop_lookup_object; | |
37685 | @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq | |
37686 | seq_puts(m, "FS-Cache statistics\n"); | |
37687 | ||
37688 | seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n", | |
37689 | - atomic_read(&fscache_n_cookie_index), | |
37690 | - atomic_read(&fscache_n_cookie_data), | |
37691 | - atomic_read(&fscache_n_cookie_special)); | |
37692 | + atomic_read_unchecked(&fscache_n_cookie_index), | |
37693 | + atomic_read_unchecked(&fscache_n_cookie_data), | |
37694 | + atomic_read_unchecked(&fscache_n_cookie_special)); | |
37695 | ||
37696 | seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n", | |
37697 | - atomic_read(&fscache_n_object_alloc), | |
37698 | - atomic_read(&fscache_n_object_no_alloc), | |
37699 | - atomic_read(&fscache_n_object_avail), | |
37700 | - atomic_read(&fscache_n_object_dead)); | |
37701 | + atomic_read_unchecked(&fscache_n_object_alloc), | |
37702 | + atomic_read_unchecked(&fscache_n_object_no_alloc), | |
37703 | + atomic_read_unchecked(&fscache_n_object_avail), | |
37704 | + atomic_read_unchecked(&fscache_n_object_dead)); | |
37705 | seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n", | |
37706 | - atomic_read(&fscache_n_checkaux_none), | |
37707 | - atomic_read(&fscache_n_checkaux_okay), | |
37708 | - atomic_read(&fscache_n_checkaux_update), | |
37709 | - atomic_read(&fscache_n_checkaux_obsolete)); | |
37710 | + atomic_read_unchecked(&fscache_n_checkaux_none), | |
37711 | + atomic_read_unchecked(&fscache_n_checkaux_okay), | |
37712 | + atomic_read_unchecked(&fscache_n_checkaux_update), | |
37713 | + atomic_read_unchecked(&fscache_n_checkaux_obsolete)); | |
37714 | ||
37715 | seq_printf(m, "Pages : mrk=%u unc=%u\n", | |
37716 | - atomic_read(&fscache_n_marks), | |
37717 | - atomic_read(&fscache_n_uncaches)); | |
37718 | + atomic_read_unchecked(&fscache_n_marks), | |
37719 | + atomic_read_unchecked(&fscache_n_uncaches)); | |
37720 | ||
37721 | seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u" | |
37722 | " oom=%u\n", | |
37723 | - atomic_read(&fscache_n_acquires), | |
37724 | - atomic_read(&fscache_n_acquires_null), | |
37725 | - atomic_read(&fscache_n_acquires_no_cache), | |
37726 | - atomic_read(&fscache_n_acquires_ok), | |
37727 | - atomic_read(&fscache_n_acquires_nobufs), | |
37728 | - atomic_read(&fscache_n_acquires_oom)); | |
37729 | + atomic_read_unchecked(&fscache_n_acquires), | |
37730 | + atomic_read_unchecked(&fscache_n_acquires_null), | |
37731 | + atomic_read_unchecked(&fscache_n_acquires_no_cache), | |
37732 | + atomic_read_unchecked(&fscache_n_acquires_ok), | |
37733 | + atomic_read_unchecked(&fscache_n_acquires_nobufs), | |
37734 | + atomic_read_unchecked(&fscache_n_acquires_oom)); | |
37735 | ||
37736 | seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n", | |
37737 | - atomic_read(&fscache_n_object_lookups), | |
37738 | - atomic_read(&fscache_n_object_lookups_negative), | |
37739 | - atomic_read(&fscache_n_object_lookups_positive), | |
37740 | - atomic_read(&fscache_n_object_created), | |
37741 | - atomic_read(&fscache_n_object_lookups_timed_out)); | |
37742 | + atomic_read_unchecked(&fscache_n_object_lookups), | |
37743 | + atomic_read_unchecked(&fscache_n_object_lookups_negative), | |
37744 | + atomic_read_unchecked(&fscache_n_object_lookups_positive), | |
37745 | + atomic_read_unchecked(&fscache_n_object_created), | |
37746 | + atomic_read_unchecked(&fscache_n_object_lookups_timed_out)); | |
37747 | ||
37748 | seq_printf(m, "Updates: n=%u nul=%u run=%u\n", | |
37749 | - atomic_read(&fscache_n_updates), | |
37750 | - atomic_read(&fscache_n_updates_null), | |
37751 | - atomic_read(&fscache_n_updates_run)); | |
37752 | + atomic_read_unchecked(&fscache_n_updates), | |
37753 | + atomic_read_unchecked(&fscache_n_updates_null), | |
37754 | + atomic_read_unchecked(&fscache_n_updates_run)); | |
37755 | ||
37756 | seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n", | |
37757 | - atomic_read(&fscache_n_relinquishes), | |
37758 | - atomic_read(&fscache_n_relinquishes_null), | |
37759 | - atomic_read(&fscache_n_relinquishes_waitcrt), | |
37760 | - atomic_read(&fscache_n_relinquishes_retire)); | |
37761 | + atomic_read_unchecked(&fscache_n_relinquishes), | |
37762 | + atomic_read_unchecked(&fscache_n_relinquishes_null), | |
37763 | + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt), | |
37764 | + atomic_read_unchecked(&fscache_n_relinquishes_retire)); | |
37765 | ||
37766 | seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n", | |
37767 | - atomic_read(&fscache_n_attr_changed), | |
37768 | - atomic_read(&fscache_n_attr_changed_ok), | |
37769 | - atomic_read(&fscache_n_attr_changed_nobufs), | |
37770 | - atomic_read(&fscache_n_attr_changed_nomem), | |
37771 | - atomic_read(&fscache_n_attr_changed_calls)); | |
37772 | + atomic_read_unchecked(&fscache_n_attr_changed), | |
37773 | + atomic_read_unchecked(&fscache_n_attr_changed_ok), | |
37774 | + atomic_read_unchecked(&fscache_n_attr_changed_nobufs), | |
37775 | + atomic_read_unchecked(&fscache_n_attr_changed_nomem), | |
37776 | + atomic_read_unchecked(&fscache_n_attr_changed_calls)); | |
37777 | ||
37778 | seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n", | |
37779 | - atomic_read(&fscache_n_allocs), | |
37780 | - atomic_read(&fscache_n_allocs_ok), | |
37781 | - atomic_read(&fscache_n_allocs_wait), | |
37782 | - atomic_read(&fscache_n_allocs_nobufs), | |
37783 | - atomic_read(&fscache_n_allocs_intr)); | |
37784 | + atomic_read_unchecked(&fscache_n_allocs), | |
37785 | + atomic_read_unchecked(&fscache_n_allocs_ok), | |
37786 | + atomic_read_unchecked(&fscache_n_allocs_wait), | |
37787 | + atomic_read_unchecked(&fscache_n_allocs_nobufs), | |
37788 | + atomic_read_unchecked(&fscache_n_allocs_intr)); | |
37789 | seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n", | |
37790 | - atomic_read(&fscache_n_alloc_ops), | |
37791 | - atomic_read(&fscache_n_alloc_op_waits), | |
37792 | - atomic_read(&fscache_n_allocs_object_dead)); | |
37793 | + atomic_read_unchecked(&fscache_n_alloc_ops), | |
37794 | + atomic_read_unchecked(&fscache_n_alloc_op_waits), | |
37795 | + atomic_read_unchecked(&fscache_n_allocs_object_dead)); | |
37796 | ||
37797 | seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u" | |
37798 | " int=%u oom=%u\n", | |
37799 | - atomic_read(&fscache_n_retrievals), | |
37800 | - atomic_read(&fscache_n_retrievals_ok), | |
37801 | - atomic_read(&fscache_n_retrievals_wait), | |
37802 | - atomic_read(&fscache_n_retrievals_nodata), | |
37803 | - atomic_read(&fscache_n_retrievals_nobufs), | |
37804 | - atomic_read(&fscache_n_retrievals_intr), | |
37805 | - atomic_read(&fscache_n_retrievals_nomem)); | |
37806 | + atomic_read_unchecked(&fscache_n_retrievals), | |
37807 | + atomic_read_unchecked(&fscache_n_retrievals_ok), | |
37808 | + atomic_read_unchecked(&fscache_n_retrievals_wait), | |
37809 | + atomic_read_unchecked(&fscache_n_retrievals_nodata), | |
37810 | + atomic_read_unchecked(&fscache_n_retrievals_nobufs), | |
37811 | + atomic_read_unchecked(&fscache_n_retrievals_intr), | |
37812 | + atomic_read_unchecked(&fscache_n_retrievals_nomem)); | |
37813 | seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n", | |
37814 | - atomic_read(&fscache_n_retrieval_ops), | |
37815 | - atomic_read(&fscache_n_retrieval_op_waits), | |
37816 | - atomic_read(&fscache_n_retrievals_object_dead)); | |
37817 | + atomic_read_unchecked(&fscache_n_retrieval_ops), | |
37818 | + atomic_read_unchecked(&fscache_n_retrieval_op_waits), | |
37819 | + atomic_read_unchecked(&fscache_n_retrievals_object_dead)); | |
37820 | ||
37821 | seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n", | |
37822 | - atomic_read(&fscache_n_stores), | |
37823 | - atomic_read(&fscache_n_stores_ok), | |
37824 | - atomic_read(&fscache_n_stores_again), | |
37825 | - atomic_read(&fscache_n_stores_nobufs), | |
37826 | - atomic_read(&fscache_n_stores_oom)); | |
37827 | + atomic_read_unchecked(&fscache_n_stores), | |
37828 | + atomic_read_unchecked(&fscache_n_stores_ok), | |
37829 | + atomic_read_unchecked(&fscache_n_stores_again), | |
37830 | + atomic_read_unchecked(&fscache_n_stores_nobufs), | |
37831 | + atomic_read_unchecked(&fscache_n_stores_oom)); | |
37832 | seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n", | |
37833 | - atomic_read(&fscache_n_store_ops), | |
37834 | - atomic_read(&fscache_n_store_calls), | |
37835 | - atomic_read(&fscache_n_store_pages), | |
37836 | - atomic_read(&fscache_n_store_radix_deletes), | |
37837 | - atomic_read(&fscache_n_store_pages_over_limit)); | |
37838 | + atomic_read_unchecked(&fscache_n_store_ops), | |
37839 | + atomic_read_unchecked(&fscache_n_store_calls), | |
37840 | + atomic_read_unchecked(&fscache_n_store_pages), | |
37841 | + atomic_read_unchecked(&fscache_n_store_radix_deletes), | |
37842 | + atomic_read_unchecked(&fscache_n_store_pages_over_limit)); | |
37843 | ||
37844 | seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n", | |
37845 | - atomic_read(&fscache_n_store_vmscan_not_storing), | |
37846 | - atomic_read(&fscache_n_store_vmscan_gone), | |
37847 | - atomic_read(&fscache_n_store_vmscan_busy), | |
37848 | - atomic_read(&fscache_n_store_vmscan_cancelled)); | |
37849 | + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing), | |
37850 | + atomic_read_unchecked(&fscache_n_store_vmscan_gone), | |
37851 | + atomic_read_unchecked(&fscache_n_store_vmscan_busy), | |
37852 | + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled)); | |
37853 | ||
37854 | seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n", | |
37855 | - atomic_read(&fscache_n_op_pend), | |
37856 | - atomic_read(&fscache_n_op_run), | |
37857 | - atomic_read(&fscache_n_op_enqueue), | |
37858 | - atomic_read(&fscache_n_op_cancelled), | |
37859 | - atomic_read(&fscache_n_op_rejected)); | |
37860 | + atomic_read_unchecked(&fscache_n_op_pend), | |
37861 | + atomic_read_unchecked(&fscache_n_op_run), | |
37862 | + atomic_read_unchecked(&fscache_n_op_enqueue), | |
37863 | + atomic_read_unchecked(&fscache_n_op_cancelled), | |
37864 | + atomic_read_unchecked(&fscache_n_op_rejected)); | |
37865 | seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n", | |
37866 | - atomic_read(&fscache_n_op_deferred_release), | |
37867 | - atomic_read(&fscache_n_op_release), | |
37868 | - atomic_read(&fscache_n_op_gc)); | |
37869 | + atomic_read_unchecked(&fscache_n_op_deferred_release), | |
37870 | + atomic_read_unchecked(&fscache_n_op_release), | |
37871 | + atomic_read_unchecked(&fscache_n_op_gc)); | |
37872 | ||
37873 | seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n", | |
37874 | atomic_read(&fscache_n_cop_alloc_object), | |
37875 | diff -urNp linux-3.0.3/fs/fs_struct.c linux-3.0.3/fs/fs_struct.c | |
37876 | --- linux-3.0.3/fs/fs_struct.c 2011-07-21 22:17:23.000000000 -0400 | |
37877 | +++ linux-3.0.3/fs/fs_struct.c 2011-08-23 21:48:14.000000000 -0400 | |
37878 | @@ -4,6 +4,7 @@ | |
37879 | #include <linux/path.h> | |
37880 | #include <linux/slab.h> | |
37881 | #include <linux/fs_struct.h> | |
37882 | +#include <linux/grsecurity.h> | |
37883 | #include "internal.h" | |
37884 | ||
37885 | static inline void path_get_longterm(struct path *path) | |
37886 | @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s | |
37887 | old_root = fs->root; | |
37888 | fs->root = *path; | |
37889 | path_get_longterm(path); | |
37890 | + gr_set_chroot_entries(current, path); | |
37891 | write_seqcount_end(&fs->seq); | |
37892 | spin_unlock(&fs->lock); | |
37893 | if (old_root.dentry) | |
37894 | @@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo | |
37895 | && fs->root.mnt == old_root->mnt) { | |
37896 | path_get_longterm(new_root); | |
37897 | fs->root = *new_root; | |
37898 | + gr_set_chroot_entries(p, new_root); | |
37899 | count++; | |
37900 | } | |
37901 | if (fs->pwd.dentry == old_root->dentry | |
37902 | @@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk) | |
37903 | spin_lock(&fs->lock); | |
37904 | write_seqcount_begin(&fs->seq); | |
37905 | tsk->fs = NULL; | |
37906 | - kill = !--fs->users; | |
37907 | + gr_clear_chroot_entries(tsk); | |
37908 | + kill = !atomic_dec_return(&fs->users); | |
37909 | write_seqcount_end(&fs->seq); | |
37910 | spin_unlock(&fs->lock); | |
37911 | task_unlock(tsk); | |
37912 | @@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct | |
37913 | struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL); | |
37914 | /* We don't need to lock fs - think why ;-) */ | |
37915 | if (fs) { | |
37916 | - fs->users = 1; | |
37917 | + atomic_set(&fs->users, 1); | |
37918 | fs->in_exec = 0; | |
37919 | spin_lock_init(&fs->lock); | |
37920 | seqcount_init(&fs->seq); | |
37921 | @@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct | |
37922 | spin_lock(&old->lock); | |
37923 | fs->root = old->root; | |
37924 | path_get_longterm(&fs->root); | |
37925 | + /* instead of calling gr_set_chroot_entries here, | |
37926 | + we call it from every caller of this function | |
37927 | + */ | |
37928 | fs->pwd = old->pwd; | |
37929 | path_get_longterm(&fs->pwd); | |
37930 | spin_unlock(&old->lock); | |
37931 | @@ -150,8 +157,9 @@ int unshare_fs_struct(void) | |
37932 | ||
37933 | task_lock(current); | |
37934 | spin_lock(&fs->lock); | |
37935 | - kill = !--fs->users; | |
37936 | + kill = !atomic_dec_return(&fs->users); | |
37937 | current->fs = new_fs; | |
37938 | + gr_set_chroot_entries(current, &new_fs->root); | |
37939 | spin_unlock(&fs->lock); | |
37940 | task_unlock(current); | |
37941 | ||
37942 | @@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask); | |
37943 | ||
37944 | /* to be mentioned only in INIT_TASK */ | |
37945 | struct fs_struct init_fs = { | |
37946 | - .users = 1, | |
37947 | + .users = ATOMIC_INIT(1), | |
37948 | .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock), | |
37949 | .seq = SEQCNT_ZERO, | |
37950 | .umask = 0022, | |
37951 | @@ -186,12 +194,13 @@ void daemonize_fs_struct(void) | |
37952 | task_lock(current); | |
37953 | ||
37954 | spin_lock(&init_fs.lock); | |
37955 | - init_fs.users++; | |
37956 | + atomic_inc(&init_fs.users); | |
37957 | spin_unlock(&init_fs.lock); | |
37958 | ||
37959 | spin_lock(&fs->lock); | |
37960 | current->fs = &init_fs; | |
37961 | - kill = !--fs->users; | |
37962 | + gr_set_chroot_entries(current, ¤t->fs->root); | |
37963 | + kill = !atomic_dec_return(&fs->users); | |
37964 | spin_unlock(&fs->lock); | |
37965 | ||
37966 | task_unlock(current); | |
37967 | diff -urNp linux-3.0.3/fs/fuse/cuse.c linux-3.0.3/fs/fuse/cuse.c | |
37968 | --- linux-3.0.3/fs/fuse/cuse.c 2011-07-21 22:17:23.000000000 -0400 | |
37969 | +++ linux-3.0.3/fs/fuse/cuse.c 2011-08-23 21:47:56.000000000 -0400 | |
37970 | @@ -586,10 +586,12 @@ static int __init cuse_init(void) | |
37971 | INIT_LIST_HEAD(&cuse_conntbl[i]); | |
37972 | ||
37973 | /* inherit and extend fuse_dev_operations */ | |
37974 | - cuse_channel_fops = fuse_dev_operations; | |
37975 | - cuse_channel_fops.owner = THIS_MODULE; | |
37976 | - cuse_channel_fops.open = cuse_channel_open; | |
37977 | - cuse_channel_fops.release = cuse_channel_release; | |
37978 | + pax_open_kernel(); | |
37979 | + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations)); | |
37980 | + *(void **)&cuse_channel_fops.owner = THIS_MODULE; | |
37981 | + *(void **)&cuse_channel_fops.open = cuse_channel_open; | |
37982 | + *(void **)&cuse_channel_fops.release = cuse_channel_release; | |
37983 | + pax_close_kernel(); | |
37984 | ||
37985 | cuse_class = class_create(THIS_MODULE, "cuse"); | |
37986 | if (IS_ERR(cuse_class)) | |
37987 | diff -urNp linux-3.0.3/fs/fuse/dev.c linux-3.0.3/fs/fuse/dev.c | |
37988 | --- linux-3.0.3/fs/fuse/dev.c 2011-07-21 22:17:23.000000000 -0400 | |
37989 | +++ linux-3.0.3/fs/fuse/dev.c 2011-08-23 21:47:56.000000000 -0400 | |
37990 | @@ -1238,7 +1238,7 @@ static ssize_t fuse_dev_splice_read(stru | |
37991 | ret = 0; | |
37992 | pipe_lock(pipe); | |
37993 | ||
37994 | - if (!pipe->readers) { | |
37995 | + if (!atomic_read(&pipe->readers)) { | |
37996 | send_sig(SIGPIPE, current, 0); | |
37997 | if (!ret) | |
37998 | ret = -EPIPE; | |
37999 | diff -urNp linux-3.0.3/fs/fuse/dir.c linux-3.0.3/fs/fuse/dir.c | |
38000 | --- linux-3.0.3/fs/fuse/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
38001 | +++ linux-3.0.3/fs/fuse/dir.c 2011-08-23 21:47:56.000000000 -0400 | |
38002 | @@ -1148,7 +1148,7 @@ static char *read_link(struct dentry *de | |
38003 | return link; | |
38004 | } | |
38005 | ||
38006 | -static void free_link(char *link) | |
38007 | +static void free_link(const char *link) | |
38008 | { | |
38009 | if (!IS_ERR(link)) | |
38010 | free_page((unsigned long) link); | |
38011 | diff -urNp linux-3.0.3/fs/gfs2/inode.c linux-3.0.3/fs/gfs2/inode.c | |
38012 | --- linux-3.0.3/fs/gfs2/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38013 | +++ linux-3.0.3/fs/gfs2/inode.c 2011-08-23 21:47:56.000000000 -0400 | |
38014 | @@ -1525,7 +1525,7 @@ out: | |
38015 | ||
38016 | static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p) | |
38017 | { | |
38018 | - char *s = nd_get_link(nd); | |
38019 | + const char *s = nd_get_link(nd); | |
38020 | if (!IS_ERR(s)) | |
38021 | kfree(s); | |
38022 | } | |
38023 | diff -urNp linux-3.0.3/fs/hfsplus/catalog.c linux-3.0.3/fs/hfsplus/catalog.c | |
38024 | --- linux-3.0.3/fs/hfsplus/catalog.c 2011-07-21 22:17:23.000000000 -0400 | |
38025 | +++ linux-3.0.3/fs/hfsplus/catalog.c 2011-08-23 21:48:14.000000000 -0400 | |
38026 | @@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block | |
38027 | int err; | |
38028 | u16 type; | |
38029 | ||
38030 | + pax_track_stack(); | |
38031 | + | |
38032 | hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL); | |
38033 | err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry)); | |
38034 | if (err) | |
38035 | @@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct | |
38036 | int entry_size; | |
38037 | int err; | |
38038 | ||
38039 | + pax_track_stack(); | |
38040 | + | |
38041 | dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", | |
38042 | str->name, cnid, inode->i_nlink); | |
38043 | hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd); | |
38044 | @@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid, | |
38045 | int entry_size, type; | |
38046 | int err = 0; | |
38047 | ||
38048 | + pax_track_stack(); | |
38049 | + | |
38050 | dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", | |
38051 | cnid, src_dir->i_ino, src_name->name, | |
38052 | dst_dir->i_ino, dst_name->name); | |
38053 | diff -urNp linux-3.0.3/fs/hfsplus/dir.c linux-3.0.3/fs/hfsplus/dir.c | |
38054 | --- linux-3.0.3/fs/hfsplus/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
38055 | +++ linux-3.0.3/fs/hfsplus/dir.c 2011-08-23 21:48:14.000000000 -0400 | |
38056 | @@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file * | |
38057 | struct hfsplus_readdir_data *rd; | |
38058 | u16 type; | |
38059 | ||
38060 | + pax_track_stack(); | |
38061 | + | |
38062 | if (filp->f_pos >= inode->i_size) | |
38063 | return 0; | |
38064 | ||
38065 | diff -urNp linux-3.0.3/fs/hfsplus/inode.c linux-3.0.3/fs/hfsplus/inode.c | |
38066 | --- linux-3.0.3/fs/hfsplus/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38067 | +++ linux-3.0.3/fs/hfsplus/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
38068 | @@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode | |
38069 | int res = 0; | |
38070 | u16 type; | |
38071 | ||
38072 | + pax_track_stack(); | |
38073 | + | |
38074 | type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset); | |
38075 | ||
38076 | HFSPLUS_I(inode)->linkid = 0; | |
38077 | @@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode | |
38078 | struct hfs_find_data fd; | |
38079 | hfsplus_cat_entry entry; | |
38080 | ||
38081 | + pax_track_stack(); | |
38082 | + | |
38083 | if (HFSPLUS_IS_RSRC(inode)) | |
38084 | main_inode = HFSPLUS_I(inode)->rsrc_inode; | |
38085 | ||
38086 | diff -urNp linux-3.0.3/fs/hfsplus/ioctl.c linux-3.0.3/fs/hfsplus/ioctl.c | |
38087 | --- linux-3.0.3/fs/hfsplus/ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
38088 | +++ linux-3.0.3/fs/hfsplus/ioctl.c 2011-08-23 21:48:14.000000000 -0400 | |
38089 | @@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent | |
38090 | struct hfsplus_cat_file *file; | |
38091 | int res; | |
38092 | ||
38093 | + pax_track_stack(); | |
38094 | + | |
38095 | if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode)) | |
38096 | return -EOPNOTSUPP; | |
38097 | ||
38098 | @@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry * | |
38099 | struct hfsplus_cat_file *file; | |
38100 | ssize_t res = 0; | |
38101 | ||
38102 | + pax_track_stack(); | |
38103 | + | |
38104 | if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode)) | |
38105 | return -EOPNOTSUPP; | |
38106 | ||
38107 | diff -urNp linux-3.0.3/fs/hfsplus/super.c linux-3.0.3/fs/hfsplus/super.c | |
38108 | --- linux-3.0.3/fs/hfsplus/super.c 2011-07-21 22:17:23.000000000 -0400 | |
38109 | +++ linux-3.0.3/fs/hfsplus/super.c 2011-08-23 21:48:14.000000000 -0400 | |
38110 | @@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup | |
38111 | struct nls_table *nls = NULL; | |
38112 | int err; | |
38113 | ||
38114 | + pax_track_stack(); | |
38115 | + | |
38116 | err = -EINVAL; | |
38117 | sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); | |
38118 | if (!sbi) | |
38119 | diff -urNp linux-3.0.3/fs/hugetlbfs/inode.c linux-3.0.3/fs/hugetlbfs/inode.c | |
38120 | --- linux-3.0.3/fs/hugetlbfs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38121 | +++ linux-3.0.3/fs/hugetlbfs/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
38122 | @@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs | |
38123 | .kill_sb = kill_litter_super, | |
38124 | }; | |
38125 | ||
38126 | -static struct vfsmount *hugetlbfs_vfsmount; | |
38127 | +struct vfsmount *hugetlbfs_vfsmount; | |
38128 | ||
38129 | static int can_do_hugetlb_shm(void) | |
38130 | { | |
38131 | diff -urNp linux-3.0.3/fs/inode.c linux-3.0.3/fs/inode.c | |
38132 | --- linux-3.0.3/fs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38133 | +++ linux-3.0.3/fs/inode.c 2011-08-23 21:47:56.000000000 -0400 | |
38134 | @@ -829,8 +829,8 @@ unsigned int get_next_ino(void) | |
38135 | ||
38136 | #ifdef CONFIG_SMP | |
38137 | if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) { | |
38138 | - static atomic_t shared_last_ino; | |
38139 | - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino); | |
38140 | + static atomic_unchecked_t shared_last_ino; | |
38141 | + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino); | |
38142 | ||
38143 | res = next - LAST_INO_BATCH; | |
38144 | } | |
38145 | diff -urNp linux-3.0.3/fs/jbd/checkpoint.c linux-3.0.3/fs/jbd/checkpoint.c | |
38146 | --- linux-3.0.3/fs/jbd/checkpoint.c 2011-07-21 22:17:23.000000000 -0400 | |
38147 | +++ linux-3.0.3/fs/jbd/checkpoint.c 2011-08-23 21:48:14.000000000 -0400 | |
38148 | @@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal | |
38149 | tid_t this_tid; | |
38150 | int result; | |
38151 | ||
38152 | + pax_track_stack(); | |
38153 | + | |
38154 | jbd_debug(1, "Start checkpoint\n"); | |
38155 | ||
38156 | /* | |
38157 | diff -urNp linux-3.0.3/fs/jffs2/compr_rtime.c linux-3.0.3/fs/jffs2/compr_rtime.c | |
38158 | --- linux-3.0.3/fs/jffs2/compr_rtime.c 2011-07-21 22:17:23.000000000 -0400 | |
38159 | +++ linux-3.0.3/fs/jffs2/compr_rtime.c 2011-08-23 21:48:14.000000000 -0400 | |
38160 | @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned | |
38161 | int outpos = 0; | |
38162 | int pos=0; | |
38163 | ||
38164 | + pax_track_stack(); | |
38165 | + | |
38166 | memset(positions,0,sizeof(positions)); | |
38167 | ||
38168 | while (pos < (*sourcelen) && outpos <= (*dstlen)-2) { | |
38169 | @@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign | |
38170 | int outpos = 0; | |
38171 | int pos=0; | |
38172 | ||
38173 | + pax_track_stack(); | |
38174 | + | |
38175 | memset(positions,0,sizeof(positions)); | |
38176 | ||
38177 | while (outpos<destlen) { | |
38178 | diff -urNp linux-3.0.3/fs/jffs2/compr_rubin.c linux-3.0.3/fs/jffs2/compr_rubin.c | |
38179 | --- linux-3.0.3/fs/jffs2/compr_rubin.c 2011-07-21 22:17:23.000000000 -0400 | |
38180 | +++ linux-3.0.3/fs/jffs2/compr_rubin.c 2011-08-23 21:48:14.000000000 -0400 | |
38181 | @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig | |
38182 | int ret; | |
38183 | uint32_t mysrclen, mydstlen; | |
38184 | ||
38185 | + pax_track_stack(); | |
38186 | + | |
38187 | mysrclen = *sourcelen; | |
38188 | mydstlen = *dstlen - 8; | |
38189 | ||
38190 | diff -urNp linux-3.0.3/fs/jffs2/erase.c linux-3.0.3/fs/jffs2/erase.c | |
38191 | --- linux-3.0.3/fs/jffs2/erase.c 2011-07-21 22:17:23.000000000 -0400 | |
38192 | +++ linux-3.0.3/fs/jffs2/erase.c 2011-08-23 21:47:56.000000000 -0400 | |
38193 | @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru | |
38194 | struct jffs2_unknown_node marker = { | |
38195 | .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK), | |
38196 | .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER), | |
38197 | - .totlen = cpu_to_je32(c->cleanmarker_size) | |
38198 | + .totlen = cpu_to_je32(c->cleanmarker_size), | |
38199 | + .hdr_crc = cpu_to_je32(0) | |
38200 | }; | |
38201 | ||
38202 | jffs2_prealloc_raw_node_refs(c, jeb, 1); | |
38203 | diff -urNp linux-3.0.3/fs/jffs2/wbuf.c linux-3.0.3/fs/jffs2/wbuf.c | |
38204 | --- linux-3.0.3/fs/jffs2/wbuf.c 2011-07-21 22:17:23.000000000 -0400 | |
38205 | +++ linux-3.0.3/fs/jffs2/wbuf.c 2011-08-23 21:47:56.000000000 -0400 | |
38206 | @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o | |
38207 | { | |
38208 | .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK), | |
38209 | .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER), | |
38210 | - .totlen = constant_cpu_to_je32(8) | |
38211 | + .totlen = constant_cpu_to_je32(8), | |
38212 | + .hdr_crc = constant_cpu_to_je32(0) | |
38213 | }; | |
38214 | ||
38215 | /* | |
38216 | diff -urNp linux-3.0.3/fs/jffs2/xattr.c linux-3.0.3/fs/jffs2/xattr.c | |
38217 | --- linux-3.0.3/fs/jffs2/xattr.c 2011-07-21 22:17:23.000000000 -0400 | |
38218 | +++ linux-3.0.3/fs/jffs2/xattr.c 2011-08-23 21:48:14.000000000 -0400 | |
38219 | @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct | |
38220 | ||
38221 | BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING)); | |
38222 | ||
38223 | + pax_track_stack(); | |
38224 | + | |
38225 | /* Phase.1 : Merge same xref */ | |
38226 | for (i=0; i < XREF_TMPHASH_SIZE; i++) | |
38227 | xref_tmphash[i] = NULL; | |
38228 | diff -urNp linux-3.0.3/fs/jfs/super.c linux-3.0.3/fs/jfs/super.c | |
38229 | --- linux-3.0.3/fs/jfs/super.c 2011-07-21 22:17:23.000000000 -0400 | |
38230 | +++ linux-3.0.3/fs/jfs/super.c 2011-08-23 21:47:56.000000000 -0400 | |
38231 | @@ -803,7 +803,7 @@ static int __init init_jfs_fs(void) | |
38232 | ||
38233 | jfs_inode_cachep = | |
38234 | kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0, | |
38235 | - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, | |
38236 | + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY, | |
38237 | init_once); | |
38238 | if (jfs_inode_cachep == NULL) | |
38239 | return -ENOMEM; | |
38240 | diff -urNp linux-3.0.3/fs/Kconfig.binfmt linux-3.0.3/fs/Kconfig.binfmt | |
38241 | --- linux-3.0.3/fs/Kconfig.binfmt 2011-07-21 22:17:23.000000000 -0400 | |
38242 | +++ linux-3.0.3/fs/Kconfig.binfmt 2011-08-23 21:47:56.000000000 -0400 | |
38243 | @@ -86,7 +86,7 @@ config HAVE_AOUT | |
38244 | ||
38245 | config BINFMT_AOUT | |
38246 | tristate "Kernel support for a.out and ECOFF binaries" | |
38247 | - depends on HAVE_AOUT | |
38248 | + depends on HAVE_AOUT && BROKEN | |
38249 | ---help--- | |
38250 | A.out (Assembler.OUTput) is a set of formats for libraries and | |
38251 | executables used in the earliest versions of UNIX. Linux used | |
38252 | diff -urNp linux-3.0.3/fs/libfs.c linux-3.0.3/fs/libfs.c | |
38253 | --- linux-3.0.3/fs/libfs.c 2011-07-21 22:17:23.000000000 -0400 | |
38254 | +++ linux-3.0.3/fs/libfs.c 2011-08-23 21:47:56.000000000 -0400 | |
38255 | @@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v | |
38256 | ||
38257 | for (p=q->next; p != &dentry->d_subdirs; p=p->next) { | |
38258 | struct dentry *next; | |
38259 | + char d_name[sizeof(next->d_iname)]; | |
38260 | + const unsigned char *name; | |
38261 | + | |
38262 | next = list_entry(p, struct dentry, d_u.d_child); | |
38263 | spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); | |
38264 | if (!simple_positive(next)) { | |
38265 | @@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v | |
38266 | ||
38267 | spin_unlock(&next->d_lock); | |
38268 | spin_unlock(&dentry->d_lock); | |
38269 | - if (filldir(dirent, next->d_name.name, | |
38270 | + name = next->d_name.name; | |
38271 | + if (name == next->d_iname) { | |
38272 | + memcpy(d_name, name, next->d_name.len); | |
38273 | + name = d_name; | |
38274 | + } | |
38275 | + if (filldir(dirent, name, | |
38276 | next->d_name.len, filp->f_pos, | |
38277 | next->d_inode->i_ino, | |
38278 | dt_type(next->d_inode)) < 0) | |
38279 | diff -urNp linux-3.0.3/fs/lockd/clntproc.c linux-3.0.3/fs/lockd/clntproc.c | |
38280 | --- linux-3.0.3/fs/lockd/clntproc.c 2011-07-21 22:17:23.000000000 -0400 | |
38281 | +++ linux-3.0.3/fs/lockd/clntproc.c 2011-08-23 21:48:14.000000000 -0400 | |
38282 | @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt | |
38283 | /* | |
38284 | * Cookie counter for NLM requests | |
38285 | */ | |
38286 | -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234); | |
38287 | +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234); | |
38288 | ||
38289 | void nlmclnt_next_cookie(struct nlm_cookie *c) | |
38290 | { | |
38291 | - u32 cookie = atomic_inc_return(&nlm_cookie); | |
38292 | + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie); | |
38293 | ||
38294 | memcpy(c->data, &cookie, 4); | |
38295 | c->len=4; | |
38296 | @@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s | |
38297 | struct nlm_rqst reqst, *req; | |
38298 | int status; | |
38299 | ||
38300 | + pax_track_stack(); | |
38301 | + | |
38302 | req = &reqst; | |
38303 | memset(req, 0, sizeof(*req)); | |
38304 | locks_init_lock(&req->a_args.lock.fl); | |
38305 | diff -urNp linux-3.0.3/fs/locks.c linux-3.0.3/fs/locks.c | |
38306 | --- linux-3.0.3/fs/locks.c 2011-07-21 22:17:23.000000000 -0400 | |
38307 | +++ linux-3.0.3/fs/locks.c 2011-08-23 21:47:56.000000000 -0400 | |
38308 | @@ -2043,16 +2043,16 @@ void locks_remove_flock(struct file *fil | |
38309 | return; | |
38310 | ||
38311 | if (filp->f_op && filp->f_op->flock) { | |
38312 | - struct file_lock fl = { | |
38313 | + struct file_lock flock = { | |
38314 | .fl_pid = current->tgid, | |
38315 | .fl_file = filp, | |
38316 | .fl_flags = FL_FLOCK, | |
38317 | .fl_type = F_UNLCK, | |
38318 | .fl_end = OFFSET_MAX, | |
38319 | }; | |
38320 | - filp->f_op->flock(filp, F_SETLKW, &fl); | |
38321 | - if (fl.fl_ops && fl.fl_ops->fl_release_private) | |
38322 | - fl.fl_ops->fl_release_private(&fl); | |
38323 | + filp->f_op->flock(filp, F_SETLKW, &flock); | |
38324 | + if (flock.fl_ops && flock.fl_ops->fl_release_private) | |
38325 | + flock.fl_ops->fl_release_private(&flock); | |
38326 | } | |
38327 | ||
38328 | lock_flocks(); | |
38329 | diff -urNp linux-3.0.3/fs/logfs/super.c linux-3.0.3/fs/logfs/super.c | |
38330 | --- linux-3.0.3/fs/logfs/super.c 2011-07-21 22:17:23.000000000 -0400 | |
38331 | +++ linux-3.0.3/fs/logfs/super.c 2011-08-23 21:48:14.000000000 -0400 | |
38332 | @@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super | |
38333 | struct logfs_disk_super _ds1, *ds1 = &_ds1; | |
38334 | int err, valid0, valid1; | |
38335 | ||
38336 | + pax_track_stack(); | |
38337 | + | |
38338 | /* read first superblock */ | |
38339 | err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0); | |
38340 | if (err) | |
38341 | diff -urNp linux-3.0.3/fs/namei.c linux-3.0.3/fs/namei.c | |
38342 | --- linux-3.0.3/fs/namei.c 2011-07-21 22:17:23.000000000 -0400 | |
38343 | +++ linux-3.0.3/fs/namei.c 2011-08-23 21:48:14.000000000 -0400 | |
38344 | @@ -237,21 +237,31 @@ int generic_permission(struct inode *ino | |
38345 | return ret; | |
38346 | ||
38347 | /* | |
38348 | - * Read/write DACs are always overridable. | |
38349 | - * Executable DACs are overridable for all directories and | |
38350 | - * for non-directories that have least one exec bit set. | |
38351 | + * Searching includes executable on directories, else just read. | |
38352 | */ | |
38353 | - if (!(mask & MAY_EXEC) || execute_ok(inode)) | |
38354 | - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) | |
38355 | + mask &= MAY_READ | MAY_WRITE | MAY_EXEC; | |
38356 | + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) { | |
38357 | +#ifdef CONFIG_GRKERNSEC | |
38358 | + if (flags & IPERM_FLAG_RCU) | |
38359 | + return -ECHILD; | |
38360 | +#endif | |
38361 | + if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) | |
38362 | return 0; | |
38363 | + } | |
38364 | ||
38365 | /* | |
38366 | - * Searching includes executable on directories, else just read. | |
38367 | + * Read/write DACs are always overridable. | |
38368 | + * Executable DACs are overridable for all directories and | |
38369 | + * for non-directories that have least one exec bit set. | |
38370 | */ | |
38371 | - mask &= MAY_READ | MAY_WRITE | MAY_EXEC; | |
38372 | - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) | |
38373 | - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) | |
38374 | + if (!(mask & MAY_EXEC) || execute_ok(inode)) { | |
38375 | +#ifdef CONFIG_GRKERNSEC | |
38376 | + if (flags & IPERM_FLAG_RCU) | |
38377 | + return -ECHILD; | |
38378 | +#endif | |
38379 | + if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) | |
38380 | return 0; | |
38381 | + } | |
38382 | ||
38383 | return -EACCES; | |
38384 | } | |
38385 | @@ -547,6 +557,9 @@ static int complete_walk(struct nameidat | |
38386 | br_read_unlock(vfsmount_lock); | |
38387 | } | |
38388 | ||
38389 | + if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) | |
38390 | + return -ENOENT; | |
38391 | + | |
38392 | if (likely(!(nd->flags & LOOKUP_JUMPED))) | |
38393 | return 0; | |
38394 | ||
38395 | @@ -593,9 +606,16 @@ static inline int exec_permission(struct | |
38396 | if (ret == -ECHILD) | |
38397 | return ret; | |
38398 | ||
38399 | - if (ns_capable(ns, CAP_DAC_OVERRIDE) || | |
38400 | - ns_capable(ns, CAP_DAC_READ_SEARCH)) | |
38401 | + if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE)) | |
38402 | goto ok; | |
38403 | + else { | |
38404 | +#ifdef CONFIG_GRKERNSEC | |
38405 | + if (flags & IPERM_FLAG_RCU) | |
38406 | + return -ECHILD; | |
38407 | +#endif | |
38408 | + if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE)) | |
38409 | + goto ok; | |
38410 | + } | |
38411 | ||
38412 | return ret; | |
38413 | ok: | |
38414 | @@ -703,11 +723,19 @@ follow_link(struct path *link, struct na | |
38415 | return error; | |
38416 | } | |
38417 | ||
38418 | + if (gr_handle_follow_link(dentry->d_parent->d_inode, | |
38419 | + dentry->d_inode, dentry, nd->path.mnt)) { | |
38420 | + error = -EACCES; | |
38421 | + *p = ERR_PTR(error); /* no ->put_link(), please */ | |
38422 | + path_put(&nd->path); | |
38423 | + return error; | |
38424 | + } | |
38425 | + | |
38426 | nd->last_type = LAST_BIND; | |
38427 | *p = dentry->d_inode->i_op->follow_link(dentry, nd); | |
38428 | error = PTR_ERR(*p); | |
38429 | if (!IS_ERR(*p)) { | |
38430 | - char *s = nd_get_link(nd); | |
38431 | + const char *s = nd_get_link(nd); | |
38432 | error = 0; | |
38433 | if (s) | |
38434 | error = __vfs_follow_link(nd, s); | |
38435 | @@ -1625,6 +1653,9 @@ static int do_path_lookup(int dfd, const | |
38436 | retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd); | |
38437 | ||
38438 | if (likely(!retval)) { | |
38439 | + if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt)) | |
38440 | + return -ENOENT; | |
38441 | + | |
38442 | if (unlikely(!audit_dummy_context())) { | |
38443 | if (nd->path.dentry && nd->inode) | |
38444 | audit_inode(name, nd->path.dentry); | |
38445 | @@ -1935,6 +1966,30 @@ int vfs_create(struct inode *dir, struct | |
38446 | return error; | |
38447 | } | |
38448 | ||
38449 | +/* | |
38450 | + * Note that while the flag value (low two bits) for sys_open means: | |
38451 | + * 00 - read-only | |
38452 | + * 01 - write-only | |
38453 | + * 10 - read-write | |
38454 | + * 11 - special | |
38455 | + * it is changed into | |
38456 | + * 00 - no permissions needed | |
38457 | + * 01 - read-permission | |
38458 | + * 10 - write-permission | |
38459 | + * 11 - read-write | |
38460 | + * for the internal routines (ie open_namei()/follow_link() etc) | |
38461 | + * This is more logical, and also allows the 00 "no perm needed" | |
38462 | + * to be used for symlinks (where the permissions are checked | |
38463 | + * later). | |
38464 | + * | |
38465 | +*/ | |
38466 | +static inline int open_to_namei_flags(int flag) | |
38467 | +{ | |
38468 | + if ((flag+1) & O_ACCMODE) | |
38469 | + flag++; | |
38470 | + return flag; | |
38471 | +} | |
38472 | + | |
38473 | static int may_open(struct path *path, int acc_mode, int flag) | |
38474 | { | |
38475 | struct dentry *dentry = path->dentry; | |
38476 | @@ -1987,7 +2042,27 @@ static int may_open(struct path *path, i | |
38477 | /* | |
38478 | * Ensure there are no outstanding leases on the file. | |
38479 | */ | |
38480 | - return break_lease(inode, flag); | |
38481 | + error = break_lease(inode, flag); | |
38482 | + | |
38483 | + if (error) | |
38484 | + return error; | |
38485 | + | |
38486 | + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) { | |
38487 | + error = -EPERM; | |
38488 | + goto exit; | |
38489 | + } | |
38490 | + | |
38491 | + if (gr_handle_rawio(inode)) { | |
38492 | + error = -EPERM; | |
38493 | + goto exit; | |
38494 | + } | |
38495 | + | |
38496 | + if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) { | |
38497 | + error = -EACCES; | |
38498 | + goto exit; | |
38499 | + } | |
38500 | +exit: | |
38501 | + return error; | |
38502 | } | |
38503 | ||
38504 | static int handle_truncate(struct file *filp) | |
38505 | @@ -2013,30 +2088,6 @@ static int handle_truncate(struct file * | |
38506 | } | |
38507 | ||
38508 | /* | |
38509 | - * Note that while the flag value (low two bits) for sys_open means: | |
38510 | - * 00 - read-only | |
38511 | - * 01 - write-only | |
38512 | - * 10 - read-write | |
38513 | - * 11 - special | |
38514 | - * it is changed into | |
38515 | - * 00 - no permissions needed | |
38516 | - * 01 - read-permission | |
38517 | - * 10 - write-permission | |
38518 | - * 11 - read-write | |
38519 | - * for the internal routines (ie open_namei()/follow_link() etc) | |
38520 | - * This is more logical, and also allows the 00 "no perm needed" | |
38521 | - * to be used for symlinks (where the permissions are checked | |
38522 | - * later). | |
38523 | - * | |
38524 | -*/ | |
38525 | -static inline int open_to_namei_flags(int flag) | |
38526 | -{ | |
38527 | - if ((flag+1) & O_ACCMODE) | |
38528 | - flag++; | |
38529 | - return flag; | |
38530 | -} | |
38531 | - | |
38532 | -/* | |
38533 | * Handle the last step of open() | |
38534 | */ | |
38535 | static struct file *do_last(struct nameidata *nd, struct path *path, | |
38536 | @@ -2045,6 +2096,7 @@ static struct file *do_last(struct namei | |
38537 | struct dentry *dir = nd->path.dentry; | |
38538 | struct dentry *dentry; | |
38539 | int open_flag = op->open_flag; | |
38540 | + int flag = open_to_namei_flags(open_flag); | |
38541 | int will_truncate = open_flag & O_TRUNC; | |
38542 | int want_write = 0; | |
38543 | int acc_mode = op->acc_mode; | |
38544 | @@ -2132,6 +2184,12 @@ static struct file *do_last(struct namei | |
38545 | /* Negative dentry, just create the file */ | |
38546 | if (!dentry->d_inode) { | |
38547 | int mode = op->mode; | |
38548 | + | |
38549 | + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) { | |
38550 | + error = -EACCES; | |
38551 | + goto exit_mutex_unlock; | |
38552 | + } | |
38553 | + | |
38554 | if (!IS_POSIXACL(dir->d_inode)) | |
38555 | mode &= ~current_umask(); | |
38556 | /* | |
38557 | @@ -2155,6 +2213,8 @@ static struct file *do_last(struct namei | |
38558 | error = vfs_create(dir->d_inode, dentry, mode, nd); | |
38559 | if (error) | |
38560 | goto exit_mutex_unlock; | |
38561 | + else | |
38562 | + gr_handle_create(path->dentry, path->mnt); | |
38563 | mutex_unlock(&dir->d_inode->i_mutex); | |
38564 | dput(nd->path.dentry); | |
38565 | nd->path.dentry = dentry; | |
38566 | @@ -2164,6 +2224,14 @@ static struct file *do_last(struct namei | |
38567 | /* | |
38568 | * It already exists. | |
38569 | */ | |
38570 | + | |
38571 | + /* only check if O_CREAT is specified, all other checks need to go | |
38572 | + into may_open */ | |
38573 | + if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) { | |
38574 | + error = -EACCES; | |
38575 | + goto exit_mutex_unlock; | |
38576 | + } | |
38577 | + | |
38578 | mutex_unlock(&dir->d_inode->i_mutex); | |
38579 | audit_inode(pathname, path->dentry); | |
38580 | ||
38581 | @@ -2450,6 +2518,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const | |
38582 | error = may_mknod(mode); | |
38583 | if (error) | |
38584 | goto out_dput; | |
38585 | + | |
38586 | + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) { | |
38587 | + error = -EPERM; | |
38588 | + goto out_dput; | |
38589 | + } | |
38590 | + | |
38591 | + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) { | |
38592 | + error = -EACCES; | |
38593 | + goto out_dput; | |
38594 | + } | |
38595 | + | |
38596 | error = mnt_want_write(nd.path.mnt); | |
38597 | if (error) | |
38598 | goto out_dput; | |
38599 | @@ -2470,6 +2549,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const | |
38600 | } | |
38601 | out_drop_write: | |
38602 | mnt_drop_write(nd.path.mnt); | |
38603 | + | |
38604 | + if (!error) | |
38605 | + gr_handle_create(dentry, nd.path.mnt); | |
38606 | out_dput: | |
38607 | dput(dentry); | |
38608 | out_unlock: | |
38609 | @@ -2522,6 +2604,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const | |
38610 | if (IS_ERR(dentry)) | |
38611 | goto out_unlock; | |
38612 | ||
38613 | + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) { | |
38614 | + error = -EACCES; | |
38615 | + goto out_dput; | |
38616 | + } | |
38617 | + | |
38618 | if (!IS_POSIXACL(nd.path.dentry->d_inode)) | |
38619 | mode &= ~current_umask(); | |
38620 | error = mnt_want_write(nd.path.mnt); | |
38621 | @@ -2533,6 +2620,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const | |
38622 | error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode); | |
38623 | out_drop_write: | |
38624 | mnt_drop_write(nd.path.mnt); | |
38625 | + | |
38626 | + if (!error) | |
38627 | + gr_handle_create(dentry, nd.path.mnt); | |
38628 | + | |
38629 | out_dput: | |
38630 | dput(dentry); | |
38631 | out_unlock: | |
38632 | @@ -2613,6 +2704,8 @@ static long do_rmdir(int dfd, const char | |
38633 | char * name; | |
38634 | struct dentry *dentry; | |
38635 | struct nameidata nd; | |
38636 | + ino_t saved_ino = 0; | |
38637 | + dev_t saved_dev = 0; | |
38638 | ||
38639 | error = user_path_parent(dfd, pathname, &nd, &name); | |
38640 | if (error) | |
38641 | @@ -2641,6 +2734,17 @@ static long do_rmdir(int dfd, const char | |
38642 | error = -ENOENT; | |
38643 | goto exit3; | |
38644 | } | |
38645 | + | |
38646 | + if (dentry->d_inode->i_nlink <= 1) { | |
38647 | + saved_ino = dentry->d_inode->i_ino; | |
38648 | + saved_dev = gr_get_dev_from_dentry(dentry); | |
38649 | + } | |
38650 | + | |
38651 | + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) { | |
38652 | + error = -EACCES; | |
38653 | + goto exit3; | |
38654 | + } | |
38655 | + | |
38656 | error = mnt_want_write(nd.path.mnt); | |
38657 | if (error) | |
38658 | goto exit3; | |
38659 | @@ -2648,6 +2752,8 @@ static long do_rmdir(int dfd, const char | |
38660 | if (error) | |
38661 | goto exit4; | |
38662 | error = vfs_rmdir(nd.path.dentry->d_inode, dentry); | |
38663 | + if (!error && (saved_dev || saved_ino)) | |
38664 | + gr_handle_delete(saved_ino, saved_dev); | |
38665 | exit4: | |
38666 | mnt_drop_write(nd.path.mnt); | |
38667 | exit3: | |
38668 | @@ -2710,6 +2816,8 @@ static long do_unlinkat(int dfd, const c | |
38669 | struct dentry *dentry; | |
38670 | struct nameidata nd; | |
38671 | struct inode *inode = NULL; | |
38672 | + ino_t saved_ino = 0; | |
38673 | + dev_t saved_dev = 0; | |
38674 | ||
38675 | error = user_path_parent(dfd, pathname, &nd, &name); | |
38676 | if (error) | |
38677 | @@ -2732,6 +2840,16 @@ static long do_unlinkat(int dfd, const c | |
38678 | if (!inode) | |
38679 | goto slashes; | |
38680 | ihold(inode); | |
38681 | + | |
38682 | + if (inode->i_nlink <= 1) { | |
38683 | + saved_ino = inode->i_ino; | |
38684 | + saved_dev = gr_get_dev_from_dentry(dentry); | |
38685 | + } | |
38686 | + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) { | |
38687 | + error = -EACCES; | |
38688 | + goto exit2; | |
38689 | + } | |
38690 | + | |
38691 | error = mnt_want_write(nd.path.mnt); | |
38692 | if (error) | |
38693 | goto exit2; | |
38694 | @@ -2739,6 +2857,8 @@ static long do_unlinkat(int dfd, const c | |
38695 | if (error) | |
38696 | goto exit3; | |
38697 | error = vfs_unlink(nd.path.dentry->d_inode, dentry); | |
38698 | + if (!error && (saved_ino || saved_dev)) | |
38699 | + gr_handle_delete(saved_ino, saved_dev); | |
38700 | exit3: | |
38701 | mnt_drop_write(nd.path.mnt); | |
38702 | exit2: | |
38703 | @@ -2816,6 +2936,11 @@ SYSCALL_DEFINE3(symlinkat, const char __ | |
38704 | if (IS_ERR(dentry)) | |
38705 | goto out_unlock; | |
38706 | ||
38707 | + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) { | |
38708 | + error = -EACCES; | |
38709 | + goto out_dput; | |
38710 | + } | |
38711 | + | |
38712 | error = mnt_want_write(nd.path.mnt); | |
38713 | if (error) | |
38714 | goto out_dput; | |
38715 | @@ -2823,6 +2948,8 @@ SYSCALL_DEFINE3(symlinkat, const char __ | |
38716 | if (error) | |
38717 | goto out_drop_write; | |
38718 | error = vfs_symlink(nd.path.dentry->d_inode, dentry, from); | |
38719 | + if (!error) | |
38720 | + gr_handle_create(dentry, nd.path.mnt); | |
38721 | out_drop_write: | |
38722 | mnt_drop_write(nd.path.mnt); | |
38723 | out_dput: | |
38724 | @@ -2931,6 +3058,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con | |
38725 | error = PTR_ERR(new_dentry); | |
38726 | if (IS_ERR(new_dentry)) | |
38727 | goto out_unlock; | |
38728 | + | |
38729 | + if (gr_handle_hardlink(old_path.dentry, old_path.mnt, | |
38730 | + old_path.dentry->d_inode, | |
38731 | + old_path.dentry->d_inode->i_mode, to)) { | |
38732 | + error = -EACCES; | |
38733 | + goto out_dput; | |
38734 | + } | |
38735 | + | |
38736 | + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt, | |
38737 | + old_path.dentry, old_path.mnt, to)) { | |
38738 | + error = -EACCES; | |
38739 | + goto out_dput; | |
38740 | + } | |
38741 | + | |
38742 | error = mnt_want_write(nd.path.mnt); | |
38743 | if (error) | |
38744 | goto out_dput; | |
38745 | @@ -2938,6 +3079,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con | |
38746 | if (error) | |
38747 | goto out_drop_write; | |
38748 | error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry); | |
38749 | + if (!error) | |
38750 | + gr_handle_create(new_dentry, nd.path.mnt); | |
38751 | out_drop_write: | |
38752 | mnt_drop_write(nd.path.mnt); | |
38753 | out_dput: | |
38754 | @@ -3113,6 +3256,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c | |
38755 | char *to; | |
38756 | int error; | |
38757 | ||
38758 | + pax_track_stack(); | |
38759 | + | |
38760 | error = user_path_parent(olddfd, oldname, &oldnd, &from); | |
38761 | if (error) | |
38762 | goto exit; | |
38763 | @@ -3169,6 +3314,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c | |
38764 | if (new_dentry == trap) | |
38765 | goto exit5; | |
38766 | ||
38767 | + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt, | |
38768 | + old_dentry, old_dir->d_inode, oldnd.path.mnt, | |
38769 | + to); | |
38770 | + if (error) | |
38771 | + goto exit5; | |
38772 | + | |
38773 | error = mnt_want_write(oldnd.path.mnt); | |
38774 | if (error) | |
38775 | goto exit5; | |
38776 | @@ -3178,6 +3329,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c | |
38777 | goto exit6; | |
38778 | error = vfs_rename(old_dir->d_inode, old_dentry, | |
38779 | new_dir->d_inode, new_dentry); | |
38780 | + if (!error) | |
38781 | + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry, | |
38782 | + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0); | |
38783 | exit6: | |
38784 | mnt_drop_write(oldnd.path.mnt); | |
38785 | exit5: | |
38786 | @@ -3203,6 +3357,8 @@ SYSCALL_DEFINE2(rename, const char __use | |
38787 | ||
38788 | int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) | |
38789 | { | |
38790 | + char tmpbuf[64]; | |
38791 | + const char *newlink; | |
38792 | int len; | |
38793 | ||
38794 | len = PTR_ERR(link); | |
38795 | @@ -3212,7 +3368,14 @@ int vfs_readlink(struct dentry *dentry, | |
38796 | len = strlen(link); | |
38797 | if (len > (unsigned) buflen) | |
38798 | len = buflen; | |
38799 | - if (copy_to_user(buffer, link, len)) | |
38800 | + | |
38801 | + if (len < sizeof(tmpbuf)) { | |
38802 | + memcpy(tmpbuf, link, len); | |
38803 | + newlink = tmpbuf; | |
38804 | + } else | |
38805 | + newlink = link; | |
38806 | + | |
38807 | + if (copy_to_user(buffer, newlink, len)) | |
38808 | len = -EFAULT; | |
38809 | out: | |
38810 | return len; | |
38811 | diff -urNp linux-3.0.3/fs/namespace.c linux-3.0.3/fs/namespace.c | |
38812 | --- linux-3.0.3/fs/namespace.c 2011-07-21 22:17:23.000000000 -0400 | |
38813 | +++ linux-3.0.3/fs/namespace.c 2011-08-23 21:48:14.000000000 -0400 | |
38814 | @@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn | |
38815 | if (!(sb->s_flags & MS_RDONLY)) | |
38816 | retval = do_remount_sb(sb, MS_RDONLY, NULL, 0); | |
38817 | up_write(&sb->s_umount); | |
38818 | + | |
38819 | + gr_log_remount(mnt->mnt_devname, retval); | |
38820 | + | |
38821 | return retval; | |
38822 | } | |
38823 | ||
38824 | @@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn | |
38825 | br_write_unlock(vfsmount_lock); | |
38826 | up_write(&namespace_sem); | |
38827 | release_mounts(&umount_list); | |
38828 | + | |
38829 | + gr_log_unmount(mnt->mnt_devname, retval); | |
38830 | + | |
38831 | return retval; | |
38832 | } | |
38833 | ||
38834 | @@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_ | |
38835 | MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | | |
38836 | MS_STRICTATIME); | |
38837 | ||
38838 | + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) { | |
38839 | + retval = -EPERM; | |
38840 | + goto dput_out; | |
38841 | + } | |
38842 | + | |
38843 | + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) { | |
38844 | + retval = -EPERM; | |
38845 | + goto dput_out; | |
38846 | + } | |
38847 | + | |
38848 | if (flags & MS_REMOUNT) | |
38849 | retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, | |
38850 | data_page); | |
38851 | @@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_ | |
38852 | dev_name, data_page); | |
38853 | dput_out: | |
38854 | path_put(&path); | |
38855 | + | |
38856 | + gr_log_mount(dev_name, dir_name, retval); | |
38857 | + | |
38858 | return retval; | |
38859 | } | |
38860 | ||
38861 | @@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _ | |
38862 | if (error) | |
38863 | goto out2; | |
38864 | ||
38865 | + if (gr_handle_chroot_pivot()) { | |
38866 | + error = -EPERM; | |
38867 | + goto out2; | |
38868 | + } | |
38869 | + | |
38870 | get_fs_root(current->fs, &root); | |
38871 | error = lock_mount(&old); | |
38872 | if (error) | |
38873 | diff -urNp linux-3.0.3/fs/ncpfs/dir.c linux-3.0.3/fs/ncpfs/dir.c | |
38874 | --- linux-3.0.3/fs/ncpfs/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
38875 | +++ linux-3.0.3/fs/ncpfs/dir.c 2011-08-23 21:48:14.000000000 -0400 | |
38876 | @@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr | |
38877 | int res, val = 0, len; | |
38878 | __u8 __name[NCP_MAXPATHLEN + 1]; | |
38879 | ||
38880 | + pax_track_stack(); | |
38881 | + | |
38882 | if (dentry == dentry->d_sb->s_root) | |
38883 | return 1; | |
38884 | ||
38885 | @@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct | |
38886 | int error, res, len; | |
38887 | __u8 __name[NCP_MAXPATHLEN + 1]; | |
38888 | ||
38889 | + pax_track_stack(); | |
38890 | + | |
38891 | error = -EIO; | |
38892 | if (!ncp_conn_valid(server)) | |
38893 | goto finished; | |
38894 | @@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st | |
38895 | PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n", | |
38896 | dentry->d_parent->d_name.name, dentry->d_name.name, mode); | |
38897 | ||
38898 | + pax_track_stack(); | |
38899 | + | |
38900 | ncp_age_dentry(server, dentry); | |
38901 | len = sizeof(__name); | |
38902 | error = ncp_io2vol(server, __name, &len, dentry->d_name.name, | |
38903 | @@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, | |
38904 | int error, len; | |
38905 | __u8 __name[NCP_MAXPATHLEN + 1]; | |
38906 | ||
38907 | + pax_track_stack(); | |
38908 | + | |
38909 | DPRINTK("ncp_mkdir: making %s/%s\n", | |
38910 | dentry->d_parent->d_name.name, dentry->d_name.name); | |
38911 | ||
38912 | @@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_ | |
38913 | int old_len, new_len; | |
38914 | __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1]; | |
38915 | ||
38916 | + pax_track_stack(); | |
38917 | + | |
38918 | DPRINTK("ncp_rename: %s/%s to %s/%s\n", | |
38919 | old_dentry->d_parent->d_name.name, old_dentry->d_name.name, | |
38920 | new_dentry->d_parent->d_name.name, new_dentry->d_name.name); | |
38921 | diff -urNp linux-3.0.3/fs/ncpfs/inode.c linux-3.0.3/fs/ncpfs/inode.c | |
38922 | --- linux-3.0.3/fs/ncpfs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38923 | +++ linux-3.0.3/fs/ncpfs/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
38924 | @@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b | |
38925 | #endif | |
38926 | struct ncp_entry_info finfo; | |
38927 | ||
38928 | + pax_track_stack(); | |
38929 | + | |
38930 | memset(&data, 0, sizeof(data)); | |
38931 | server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL); | |
38932 | if (!server) | |
38933 | diff -urNp linux-3.0.3/fs/nfs/inode.c linux-3.0.3/fs/nfs/inode.c | |
38934 | --- linux-3.0.3/fs/nfs/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
38935 | +++ linux-3.0.3/fs/nfs/inode.c 2011-08-23 21:47:56.000000000 -0400 | |
38936 | @@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct | |
38937 | nfsi->attrtimeo = NFS_MINATTRTIMEO(inode); | |
38938 | nfsi->attrtimeo_timestamp = jiffies; | |
38939 | ||
38940 | - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode))); | |
38941 | + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf)); | |
38942 | if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) | |
38943 | nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE; | |
38944 | else | |
38945 | @@ -1000,16 +1000,16 @@ static int nfs_size_need_update(const st | |
38946 | return nfs_size_to_loff_t(fattr->size) > i_size_read(inode); | |
38947 | } | |
38948 | ||
38949 | -static atomic_long_t nfs_attr_generation_counter; | |
38950 | +static atomic_long_unchecked_t nfs_attr_generation_counter; | |
38951 | ||
38952 | static unsigned long nfs_read_attr_generation_counter(void) | |
38953 | { | |
38954 | - return atomic_long_read(&nfs_attr_generation_counter); | |
38955 | + return atomic_long_read_unchecked(&nfs_attr_generation_counter); | |
38956 | } | |
38957 | ||
38958 | unsigned long nfs_inc_attr_generation_counter(void) | |
38959 | { | |
38960 | - return atomic_long_inc_return(&nfs_attr_generation_counter); | |
38961 | + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter); | |
38962 | } | |
38963 | ||
38964 | void nfs_fattr_init(struct nfs_fattr *fattr) | |
38965 | diff -urNp linux-3.0.3/fs/nfsd/nfs4state.c linux-3.0.3/fs/nfsd/nfs4state.c | |
38966 | --- linux-3.0.3/fs/nfsd/nfs4state.c 2011-08-23 21:44:40.000000000 -0400 | |
38967 | +++ linux-3.0.3/fs/nfsd/nfs4state.c 2011-08-23 21:48:14.000000000 -0400 | |
38968 | @@ -3794,6 +3794,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc | |
38969 | unsigned int strhashval; | |
38970 | int err; | |
38971 | ||
38972 | + pax_track_stack(); | |
38973 | + | |
38974 | dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n", | |
38975 | (long long) lock->lk_offset, | |
38976 | (long long) lock->lk_length); | |
38977 | diff -urNp linux-3.0.3/fs/nfsd/nfs4xdr.c linux-3.0.3/fs/nfsd/nfs4xdr.c | |
38978 | --- linux-3.0.3/fs/nfsd/nfs4xdr.c 2011-07-21 22:17:23.000000000 -0400 | |
38979 | +++ linux-3.0.3/fs/nfsd/nfs4xdr.c 2011-08-23 21:48:14.000000000 -0400 | |
38980 | @@ -1788,6 +1788,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s | |
38981 | .dentry = dentry, | |
38982 | }; | |
38983 | ||
38984 | + pax_track_stack(); | |
38985 | + | |
38986 | BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1); | |
38987 | BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion)); | |
38988 | BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion)); | |
38989 | diff -urNp linux-3.0.3/fs/nfsd/vfs.c linux-3.0.3/fs/nfsd/vfs.c | |
38990 | --- linux-3.0.3/fs/nfsd/vfs.c 2011-07-21 22:17:23.000000000 -0400 | |
38991 | +++ linux-3.0.3/fs/nfsd/vfs.c 2011-08-23 21:47:56.000000000 -0400 | |
38992 | @@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st | |
38993 | } else { | |
38994 | oldfs = get_fs(); | |
38995 | set_fs(KERNEL_DS); | |
38996 | - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset); | |
38997 | + host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset); | |
38998 | set_fs(oldfs); | |
38999 | } | |
39000 | ||
39001 | @@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s | |
39002 | ||
39003 | /* Write the data. */ | |
39004 | oldfs = get_fs(); set_fs(KERNEL_DS); | |
39005 | - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset); | |
39006 | + host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset); | |
39007 | set_fs(oldfs); | |
39008 | if (host_err < 0) | |
39009 | goto out_nfserr; | |
39010 | @@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st | |
39011 | */ | |
39012 | ||
39013 | oldfs = get_fs(); set_fs(KERNEL_DS); | |
39014 | - host_err = inode->i_op->readlink(dentry, buf, *lenp); | |
39015 | + host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp); | |
39016 | set_fs(oldfs); | |
39017 | ||
39018 | if (host_err < 0) | |
39019 | diff -urNp linux-3.0.3/fs/notify/fanotify/fanotify_user.c linux-3.0.3/fs/notify/fanotify/fanotify_user.c | |
39020 | --- linux-3.0.3/fs/notify/fanotify/fanotify_user.c 2011-07-21 22:17:23.000000000 -0400 | |
39021 | +++ linux-3.0.3/fs/notify/fanotify/fanotify_user.c 2011-08-23 21:48:14.000000000 -0400 | |
39022 | @@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct | |
39023 | goto out_close_fd; | |
39024 | ||
39025 | ret = -EFAULT; | |
39026 | - if (copy_to_user(buf, &fanotify_event_metadata, | |
39027 | + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata || | |
39028 | + copy_to_user(buf, &fanotify_event_metadata, | |
39029 | fanotify_event_metadata.event_len)) | |
39030 | goto out_kill_access_response; | |
39031 | ||
39032 | diff -urNp linux-3.0.3/fs/notify/notification.c linux-3.0.3/fs/notify/notification.c | |
39033 | --- linux-3.0.3/fs/notify/notification.c 2011-07-21 22:17:23.000000000 -0400 | |
39034 | +++ linux-3.0.3/fs/notify/notification.c 2011-08-23 21:47:56.000000000 -0400 | |
39035 | @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event | |
39036 | * get set to 0 so it will never get 'freed' | |
39037 | */ | |
39038 | static struct fsnotify_event *q_overflow_event; | |
39039 | -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0); | |
39040 | +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0); | |
39041 | ||
39042 | /** | |
39043 | * fsnotify_get_cookie - return a unique cookie for use in synchronizing events. | |
39044 | @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A | |
39045 | */ | |
39046 | u32 fsnotify_get_cookie(void) | |
39047 | { | |
39048 | - return atomic_inc_return(&fsnotify_sync_cookie); | |
39049 | + return atomic_inc_return_unchecked(&fsnotify_sync_cookie); | |
39050 | } | |
39051 | EXPORT_SYMBOL_GPL(fsnotify_get_cookie); | |
39052 | ||
39053 | diff -urNp linux-3.0.3/fs/ntfs/dir.c linux-3.0.3/fs/ntfs/dir.c | |
39054 | --- linux-3.0.3/fs/ntfs/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
39055 | +++ linux-3.0.3/fs/ntfs/dir.c 2011-08-23 21:47:56.000000000 -0400 | |
39056 | @@ -1329,7 +1329,7 @@ find_next_index_buffer: | |
39057 | ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK & | |
39058 | ~(s64)(ndir->itype.index.block_size - 1))); | |
39059 | /* Bounds checks. */ | |
39060 | - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) { | |
39061 | + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) { | |
39062 | ntfs_error(sb, "Out of bounds check failed. Corrupt directory " | |
39063 | "inode 0x%lx or driver bug.", vdir->i_ino); | |
39064 | goto err_out; | |
39065 | diff -urNp linux-3.0.3/fs/ntfs/file.c linux-3.0.3/fs/ntfs/file.c | |
39066 | --- linux-3.0.3/fs/ntfs/file.c 2011-07-21 22:17:23.000000000 -0400 | |
39067 | +++ linux-3.0.3/fs/ntfs/file.c 2011-08-23 21:47:56.000000000 -0400 | |
39068 | @@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_ | |
39069 | #endif /* NTFS_RW */ | |
39070 | }; | |
39071 | ||
39072 | -const struct file_operations ntfs_empty_file_ops = {}; | |
39073 | +const struct file_operations ntfs_empty_file_ops __read_only; | |
39074 | ||
39075 | -const struct inode_operations ntfs_empty_inode_ops = {}; | |
39076 | +const struct inode_operations ntfs_empty_inode_ops __read_only; | |
39077 | diff -urNp linux-3.0.3/fs/ocfs2/localalloc.c linux-3.0.3/fs/ocfs2/localalloc.c | |
39078 | --- linux-3.0.3/fs/ocfs2/localalloc.c 2011-07-21 22:17:23.000000000 -0400 | |
39079 | +++ linux-3.0.3/fs/ocfs2/localalloc.c 2011-08-23 21:47:56.000000000 -0400 | |
39080 | @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo | |
39081 | goto bail; | |
39082 | } | |
39083 | ||
39084 | - atomic_inc(&osb->alloc_stats.moves); | |
39085 | + atomic_inc_unchecked(&osb->alloc_stats.moves); | |
39086 | ||
39087 | bail: | |
39088 | if (handle) | |
39089 | diff -urNp linux-3.0.3/fs/ocfs2/namei.c linux-3.0.3/fs/ocfs2/namei.c | |
39090 | --- linux-3.0.3/fs/ocfs2/namei.c 2011-07-21 22:17:23.000000000 -0400 | |
39091 | +++ linux-3.0.3/fs/ocfs2/namei.c 2011-08-23 21:48:14.000000000 -0400 | |
39092 | @@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol | |
39093 | struct ocfs2_dir_lookup_result orphan_insert = { NULL, }; | |
39094 | struct ocfs2_dir_lookup_result target_insert = { NULL, }; | |
39095 | ||
39096 | + pax_track_stack(); | |
39097 | + | |
39098 | /* At some point it might be nice to break this function up a | |
39099 | * bit. */ | |
39100 | ||
39101 | diff -urNp linux-3.0.3/fs/ocfs2/ocfs2.h linux-3.0.3/fs/ocfs2/ocfs2.h | |
39102 | --- linux-3.0.3/fs/ocfs2/ocfs2.h 2011-07-21 22:17:23.000000000 -0400 | |
39103 | +++ linux-3.0.3/fs/ocfs2/ocfs2.h 2011-08-23 21:47:56.000000000 -0400 | |
39104 | @@ -235,11 +235,11 @@ enum ocfs2_vol_state | |
39105 | ||
39106 | struct ocfs2_alloc_stats | |
39107 | { | |
39108 | - atomic_t moves; | |
39109 | - atomic_t local_data; | |
39110 | - atomic_t bitmap_data; | |
39111 | - atomic_t bg_allocs; | |
39112 | - atomic_t bg_extends; | |
39113 | + atomic_unchecked_t moves; | |
39114 | + atomic_unchecked_t local_data; | |
39115 | + atomic_unchecked_t bitmap_data; | |
39116 | + atomic_unchecked_t bg_allocs; | |
39117 | + atomic_unchecked_t bg_extends; | |
39118 | }; | |
39119 | ||
39120 | enum ocfs2_local_alloc_state | |
39121 | diff -urNp linux-3.0.3/fs/ocfs2/suballoc.c linux-3.0.3/fs/ocfs2/suballoc.c | |
39122 | --- linux-3.0.3/fs/ocfs2/suballoc.c 2011-07-21 22:17:23.000000000 -0400 | |
39123 | +++ linux-3.0.3/fs/ocfs2/suballoc.c 2011-08-23 21:47:56.000000000 -0400 | |
39124 | @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s | |
39125 | mlog_errno(status); | |
39126 | goto bail; | |
39127 | } | |
39128 | - atomic_inc(&osb->alloc_stats.bg_extends); | |
39129 | + atomic_inc_unchecked(&osb->alloc_stats.bg_extends); | |
39130 | ||
39131 | /* You should never ask for this much metadata */ | |
39132 | BUG_ON(bits_wanted > | |
39133 | @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl | |
39134 | mlog_errno(status); | |
39135 | goto bail; | |
39136 | } | |
39137 | - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39138 | + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39139 | ||
39140 | *suballoc_loc = res.sr_bg_blkno; | |
39141 | *suballoc_bit_start = res.sr_bit_offset; | |
39142 | @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_ | |
39143 | trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno, | |
39144 | res->sr_bits); | |
39145 | ||
39146 | - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39147 | + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39148 | ||
39149 | BUG_ON(res->sr_bits != 1); | |
39150 | ||
39151 | @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand | |
39152 | mlog_errno(status); | |
39153 | goto bail; | |
39154 | } | |
39155 | - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39156 | + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs); | |
39157 | ||
39158 | BUG_ON(res.sr_bits != 1); | |
39159 | ||
39160 | @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han | |
39161 | cluster_start, | |
39162 | num_clusters); | |
39163 | if (!status) | |
39164 | - atomic_inc(&osb->alloc_stats.local_data); | |
39165 | + atomic_inc_unchecked(&osb->alloc_stats.local_data); | |
39166 | } else { | |
39167 | if (min_clusters > (osb->bitmap_cpg - 1)) { | |
39168 | /* The only paths asking for contiguousness | |
39169 | @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han | |
39170 | ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode, | |
39171 | res.sr_bg_blkno, | |
39172 | res.sr_bit_offset); | |
39173 | - atomic_inc(&osb->alloc_stats.bitmap_data); | |
39174 | + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data); | |
39175 | *num_clusters = res.sr_bits; | |
39176 | } | |
39177 | } | |
39178 | diff -urNp linux-3.0.3/fs/ocfs2/super.c linux-3.0.3/fs/ocfs2/super.c | |
39179 | --- linux-3.0.3/fs/ocfs2/super.c 2011-07-21 22:17:23.000000000 -0400 | |
39180 | +++ linux-3.0.3/fs/ocfs2/super.c 2011-08-23 21:47:56.000000000 -0400 | |
39181 | @@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_s | |
39182 | "%10s => GlobalAllocs: %d LocalAllocs: %d " | |
39183 | "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n", | |
39184 | "Stats", | |
39185 | - atomic_read(&osb->alloc_stats.bitmap_data), | |
39186 | - atomic_read(&osb->alloc_stats.local_data), | |
39187 | - atomic_read(&osb->alloc_stats.bg_allocs), | |
39188 | - atomic_read(&osb->alloc_stats.moves), | |
39189 | - atomic_read(&osb->alloc_stats.bg_extends)); | |
39190 | + atomic_read_unchecked(&osb->alloc_stats.bitmap_data), | |
39191 | + atomic_read_unchecked(&osb->alloc_stats.local_data), | |
39192 | + atomic_read_unchecked(&osb->alloc_stats.bg_allocs), | |
39193 | + atomic_read_unchecked(&osb->alloc_stats.moves), | |
39194 | + atomic_read_unchecked(&osb->alloc_stats.bg_extends)); | |
39195 | ||
39196 | out += snprintf(buf + out, len - out, | |
39197 | "%10s => State: %u Descriptor: %llu Size: %u bits " | |
39198 | @@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct | |
39199 | spin_lock_init(&osb->osb_xattr_lock); | |
39200 | ocfs2_init_steal_slots(osb); | |
39201 | ||
39202 | - atomic_set(&osb->alloc_stats.moves, 0); | |
39203 | - atomic_set(&osb->alloc_stats.local_data, 0); | |
39204 | - atomic_set(&osb->alloc_stats.bitmap_data, 0); | |
39205 | - atomic_set(&osb->alloc_stats.bg_allocs, 0); | |
39206 | - atomic_set(&osb->alloc_stats.bg_extends, 0); | |
39207 | + atomic_set_unchecked(&osb->alloc_stats.moves, 0); | |
39208 | + atomic_set_unchecked(&osb->alloc_stats.local_data, 0); | |
39209 | + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0); | |
39210 | + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0); | |
39211 | + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0); | |
39212 | ||
39213 | /* Copy the blockcheck stats from the superblock probe */ | |
39214 | osb->osb_ecc_stats = *stats; | |
39215 | diff -urNp linux-3.0.3/fs/ocfs2/symlink.c linux-3.0.3/fs/ocfs2/symlink.c | |
39216 | --- linux-3.0.3/fs/ocfs2/symlink.c 2011-07-21 22:17:23.000000000 -0400 | |
39217 | +++ linux-3.0.3/fs/ocfs2/symlink.c 2011-08-23 21:47:56.000000000 -0400 | |
39218 | @@ -142,7 +142,7 @@ bail: | |
39219 | ||
39220 | static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) | |
39221 | { | |
39222 | - char *link = nd_get_link(nd); | |
39223 | + const char *link = nd_get_link(nd); | |
39224 | if (!IS_ERR(link)) | |
39225 | kfree(link); | |
39226 | } | |
39227 | diff -urNp linux-3.0.3/fs/open.c linux-3.0.3/fs/open.c | |
39228 | --- linux-3.0.3/fs/open.c 2011-07-21 22:17:23.000000000 -0400 | |
39229 | +++ linux-3.0.3/fs/open.c 2011-08-23 21:48:14.000000000 -0400 | |
39230 | @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _ | |
39231 | error = locks_verify_truncate(inode, NULL, length); | |
39232 | if (!error) | |
39233 | error = security_path_truncate(&path); | |
39234 | + | |
39235 | + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt)) | |
39236 | + error = -EACCES; | |
39237 | + | |
39238 | if (!error) | |
39239 | error = do_truncate(path.dentry, length, 0, NULL); | |
39240 | ||
39241 | @@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con | |
39242 | if (__mnt_is_readonly(path.mnt)) | |
39243 | res = -EROFS; | |
39244 | ||
39245 | + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode)) | |
39246 | + res = -EACCES; | |
39247 | + | |
39248 | out_path_release: | |
39249 | path_put(&path); | |
39250 | out: | |
39251 | @@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user | |
39252 | if (error) | |
39253 | goto dput_and_out; | |
39254 | ||
39255 | + gr_log_chdir(path.dentry, path.mnt); | |
39256 | + | |
39257 | set_fs_pwd(current->fs, &path); | |
39258 | ||
39259 | dput_and_out: | |
39260 | @@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd | |
39261 | goto out_putf; | |
39262 | ||
39263 | error = inode_permission(inode, MAY_EXEC | MAY_CHDIR); | |
39264 | + | |
39265 | + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt)) | |
39266 | + error = -EPERM; | |
39267 | + | |
39268 | + if (!error) | |
39269 | + gr_log_chdir(file->f_path.dentry, file->f_path.mnt); | |
39270 | + | |
39271 | if (!error) | |
39272 | set_fs_pwd(current->fs, &file->f_path); | |
39273 | out_putf: | |
39274 | @@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use | |
39275 | if (error) | |
39276 | goto dput_and_out; | |
39277 | ||
39278 | + if (gr_handle_chroot_chroot(path.dentry, path.mnt)) | |
39279 | + goto dput_and_out; | |
39280 | + | |
39281 | + if (gr_handle_chroot_caps(&path)) { | |
39282 | + error = -ENOMEM; | |
39283 | + goto dput_and_out; | |
39284 | + } | |
39285 | + | |
39286 | set_fs_root(current->fs, &path); | |
39287 | + | |
39288 | + gr_handle_chroot_chdir(&path); | |
39289 | + | |
39290 | error = 0; | |
39291 | dput_and_out: | |
39292 | path_put(&path); | |
39293 | @@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd | |
39294 | err = mnt_want_write_file(file); | |
39295 | if (err) | |
39296 | goto out_putf; | |
39297 | + | |
39298 | mutex_lock(&inode->i_mutex); | |
39299 | + | |
39300 | + if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) { | |
39301 | + err = -EACCES; | |
39302 | + goto out_unlock; | |
39303 | + } | |
39304 | + | |
39305 | err = security_path_chmod(dentry, file->f_vfsmnt, mode); | |
39306 | if (err) | |
39307 | goto out_unlock; | |
39308 | if (mode == (mode_t) -1) | |
39309 | mode = inode->i_mode; | |
39310 | + | |
39311 | + if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) { | |
39312 | + err = -EACCES; | |
39313 | + goto out_unlock; | |
39314 | + } | |
39315 | + | |
39316 | newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); | |
39317 | newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; | |
39318 | err = notify_change(dentry, &newattrs); | |
39319 | @@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons | |
39320 | error = mnt_want_write(path.mnt); | |
39321 | if (error) | |
39322 | goto dput_and_out; | |
39323 | + | |
39324 | mutex_lock(&inode->i_mutex); | |
39325 | + | |
39326 | + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) { | |
39327 | + error = -EACCES; | |
39328 | + goto out_unlock; | |
39329 | + } | |
39330 | + | |
39331 | error = security_path_chmod(path.dentry, path.mnt, mode); | |
39332 | if (error) | |
39333 | goto out_unlock; | |
39334 | if (mode == (mode_t) -1) | |
39335 | mode = inode->i_mode; | |
39336 | + | |
39337 | + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) { | |
39338 | + error = -EACCES; | |
39339 | + goto out_unlock; | |
39340 | + } | |
39341 | + | |
39342 | newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); | |
39343 | newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; | |
39344 | error = notify_change(path.dentry, &newattrs); | |
39345 | @@ -528,6 +581,9 @@ static int chown_common(struct path *pat | |
39346 | int error; | |
39347 | struct iattr newattrs; | |
39348 | ||
39349 | + if (!gr_acl_handle_chown(path->dentry, path->mnt)) | |
39350 | + return -EACCES; | |
39351 | + | |
39352 | newattrs.ia_valid = ATTR_CTIME; | |
39353 | if (user != (uid_t) -1) { | |
39354 | newattrs.ia_valid |= ATTR_UID; | |
39355 | @@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u | |
39356 | if (!IS_ERR(tmp)) { | |
39357 | fd = get_unused_fd_flags(flags); | |
39358 | if (fd >= 0) { | |
39359 | - struct file *f = do_filp_open(dfd, tmp, &op, lookup); | |
39360 | + struct file *f; | |
39361 | + /* don't allow to be set by userland */ | |
39362 | + flags &= ~FMODE_GREXEC; | |
39363 | + f = do_filp_open(dfd, tmp, &op, lookup); | |
39364 | if (IS_ERR(f)) { | |
39365 | put_unused_fd(fd); | |
39366 | fd = PTR_ERR(f); | |
39367 | diff -urNp linux-3.0.3/fs/partitions/ldm.c linux-3.0.3/fs/partitions/ldm.c | |
39368 | --- linux-3.0.3/fs/partitions/ldm.c 2011-07-21 22:17:23.000000000 -0400 | |
39369 | +++ linux-3.0.3/fs/partitions/ldm.c 2011-08-23 21:48:14.000000000 -0400 | |
39370 | @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data | |
39371 | ldm_error ("A VBLK claims to have %d parts.", num); | |
39372 | return false; | |
39373 | } | |
39374 | + | |
39375 | if (rec >= num) { | |
39376 | ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num); | |
39377 | return false; | |
39378 | @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data | |
39379 | goto found; | |
39380 | } | |
39381 | ||
39382 | - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL); | |
39383 | + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL); | |
39384 | if (!f) { | |
39385 | ldm_crit ("Out of memory."); | |
39386 | return false; | |
39387 | diff -urNp linux-3.0.3/fs/pipe.c linux-3.0.3/fs/pipe.c | |
39388 | --- linux-3.0.3/fs/pipe.c 2011-07-21 22:17:23.000000000 -0400 | |
39389 | +++ linux-3.0.3/fs/pipe.c 2011-08-23 21:48:14.000000000 -0400 | |
39390 | @@ -420,9 +420,9 @@ redo: | |
39391 | } | |
39392 | if (bufs) /* More to do? */ | |
39393 | continue; | |
39394 | - if (!pipe->writers) | |
39395 | + if (!atomic_read(&pipe->writers)) | |
39396 | break; | |
39397 | - if (!pipe->waiting_writers) { | |
39398 | + if (!atomic_read(&pipe->waiting_writers)) { | |
39399 | /* syscall merging: Usually we must not sleep | |
39400 | * if O_NONBLOCK is set, or if we got some data. | |
39401 | * But if a writer sleeps in kernel space, then | |
39402 | @@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str | |
39403 | mutex_lock(&inode->i_mutex); | |
39404 | pipe = inode->i_pipe; | |
39405 | ||
39406 | - if (!pipe->readers) { | |
39407 | + if (!atomic_read(&pipe->readers)) { | |
39408 | send_sig(SIGPIPE, current, 0); | |
39409 | ret = -EPIPE; | |
39410 | goto out; | |
39411 | @@ -530,7 +530,7 @@ redo1: | |
39412 | for (;;) { | |
39413 | int bufs; | |
39414 | ||
39415 | - if (!pipe->readers) { | |
39416 | + if (!atomic_read(&pipe->readers)) { | |
39417 | send_sig(SIGPIPE, current, 0); | |
39418 | if (!ret) | |
39419 | ret = -EPIPE; | |
39420 | @@ -616,9 +616,9 @@ redo2: | |
39421 | kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); | |
39422 | do_wakeup = 0; | |
39423 | } | |
39424 | - pipe->waiting_writers++; | |
39425 | + atomic_inc(&pipe->waiting_writers); | |
39426 | pipe_wait(pipe); | |
39427 | - pipe->waiting_writers--; | |
39428 | + atomic_dec(&pipe->waiting_writers); | |
39429 | } | |
39430 | out: | |
39431 | mutex_unlock(&inode->i_mutex); | |
39432 | @@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table | |
39433 | mask = 0; | |
39434 | if (filp->f_mode & FMODE_READ) { | |
39435 | mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0; | |
39436 | - if (!pipe->writers && filp->f_version != pipe->w_counter) | |
39437 | + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter) | |
39438 | mask |= POLLHUP; | |
39439 | } | |
39440 | ||
39441 | @@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table | |
39442 | * Most Unices do not set POLLERR for FIFOs but on Linux they | |
39443 | * behave exactly like pipes for poll(). | |
39444 | */ | |
39445 | - if (!pipe->readers) | |
39446 | + if (!atomic_read(&pipe->readers)) | |
39447 | mask |= POLLERR; | |
39448 | } | |
39449 | ||
39450 | @@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de | |
39451 | ||
39452 | mutex_lock(&inode->i_mutex); | |
39453 | pipe = inode->i_pipe; | |
39454 | - pipe->readers -= decr; | |
39455 | - pipe->writers -= decw; | |
39456 | + atomic_sub(decr, &pipe->readers); | |
39457 | + atomic_sub(decw, &pipe->writers); | |
39458 | ||
39459 | - if (!pipe->readers && !pipe->writers) { | |
39460 | + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) { | |
39461 | free_pipe_info(inode); | |
39462 | } else { | |
39463 | wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP); | |
39464 | @@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru | |
39465 | ||
39466 | if (inode->i_pipe) { | |
39467 | ret = 0; | |
39468 | - inode->i_pipe->readers++; | |
39469 | + atomic_inc(&inode->i_pipe->readers); | |
39470 | } | |
39471 | ||
39472 | mutex_unlock(&inode->i_mutex); | |
39473 | @@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str | |
39474 | ||
39475 | if (inode->i_pipe) { | |
39476 | ret = 0; | |
39477 | - inode->i_pipe->writers++; | |
39478 | + atomic_inc(&inode->i_pipe->writers); | |
39479 | } | |
39480 | ||
39481 | mutex_unlock(&inode->i_mutex); | |
39482 | @@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru | |
39483 | if (inode->i_pipe) { | |
39484 | ret = 0; | |
39485 | if (filp->f_mode & FMODE_READ) | |
39486 | - inode->i_pipe->readers++; | |
39487 | + atomic_inc(&inode->i_pipe->readers); | |
39488 | if (filp->f_mode & FMODE_WRITE) | |
39489 | - inode->i_pipe->writers++; | |
39490 | + atomic_inc(&inode->i_pipe->writers); | |
39491 | } | |
39492 | ||
39493 | mutex_unlock(&inode->i_mutex); | |
39494 | @@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode) | |
39495 | inode->i_pipe = NULL; | |
39496 | } | |
39497 | ||
39498 | -static struct vfsmount *pipe_mnt __read_mostly; | |
39499 | +struct vfsmount *pipe_mnt __read_mostly; | |
39500 | ||
39501 | /* | |
39502 | * pipefs_dname() is called from d_path(). | |
39503 | @@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi | |
39504 | goto fail_iput; | |
39505 | inode->i_pipe = pipe; | |
39506 | ||
39507 | - pipe->readers = pipe->writers = 1; | |
39508 | + atomic_set(&pipe->readers, 1); | |
39509 | + atomic_set(&pipe->writers, 1); | |
39510 | inode->i_fop = &rdwr_pipefifo_fops; | |
39511 | ||
39512 | /* | |
39513 | diff -urNp linux-3.0.3/fs/proc/array.c linux-3.0.3/fs/proc/array.c | |
39514 | --- linux-3.0.3/fs/proc/array.c 2011-07-21 22:17:23.000000000 -0400 | |
39515 | +++ linux-3.0.3/fs/proc/array.c 2011-08-23 21:48:14.000000000 -0400 | |
39516 | @@ -60,6 +60,7 @@ | |
39517 | #include <linux/tty.h> | |
39518 | #include <linux/string.h> | |
39519 | #include <linux/mman.h> | |
39520 | +#include <linux/grsecurity.h> | |
39521 | #include <linux/proc_fs.h> | |
39522 | #include <linux/ioport.h> | |
39523 | #include <linux/uaccess.h> | |
39524 | @@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq | |
39525 | seq_putc(m, '\n'); | |
39526 | } | |
39527 | ||
39528 | +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
39529 | +static inline void task_pax(struct seq_file *m, struct task_struct *p) | |
39530 | +{ | |
39531 | + if (p->mm) | |
39532 | + seq_printf(m, "PaX:\t%c%c%c%c%c\n", | |
39533 | + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p', | |
39534 | + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e', | |
39535 | + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm', | |
39536 | + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r', | |
39537 | + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's'); | |
39538 | + else | |
39539 | + seq_printf(m, "PaX:\t-----\n"); | |
39540 | +} | |
39541 | +#endif | |
39542 | + | |
39543 | int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, | |
39544 | struct pid *pid, struct task_struct *task) | |
39545 | { | |
39546 | @@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, | |
39547 | task_cpus_allowed(m, task); | |
39548 | cpuset_task_status_allowed(m, task); | |
39549 | task_context_switch_counts(m, task); | |
39550 | + | |
39551 | +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
39552 | + task_pax(m, task); | |
39553 | +#endif | |
39554 | + | |
39555 | +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC) | |
39556 | + task_grsec_rbac(m, task); | |
39557 | +#endif | |
39558 | + | |
39559 | return 0; | |
39560 | } | |
39561 | ||
39562 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
39563 | +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \ | |
39564 | + (_mm->pax_flags & MF_PAX_RANDMMAP || \ | |
39565 | + _mm->pax_flags & MF_PAX_SEGMEXEC)) | |
39566 | +#endif | |
39567 | + | |
39568 | static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, | |
39569 | struct pid *pid, struct task_struct *task, int whole) | |
39570 | { | |
39571 | @@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file | |
39572 | cputime_t cutime, cstime, utime, stime; | |
39573 | cputime_t cgtime, gtime; | |
39574 | unsigned long rsslim = 0; | |
39575 | - char tcomm[sizeof(task->comm)]; | |
39576 | + char tcomm[sizeof(task->comm)] = { 0 }; | |
39577 | unsigned long flags; | |
39578 | ||
39579 | + pax_track_stack(); | |
39580 | + | |
39581 | state = *get_task_state(task); | |
39582 | vsize = eip = esp = 0; | |
39583 | permitted = ptrace_may_access(task, PTRACE_MODE_READ); | |
39584 | @@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file | |
39585 | gtime = task->gtime; | |
39586 | } | |
39587 | ||
39588 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
39589 | + if (PAX_RAND_FLAGS(mm)) { | |
39590 | + eip = 0; | |
39591 | + esp = 0; | |
39592 | + wchan = 0; | |
39593 | + } | |
39594 | +#endif | |
39595 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
39596 | + wchan = 0; | |
39597 | + eip =0; | |
39598 | + esp =0; | |
39599 | +#endif | |
39600 | + | |
39601 | /* scale priority and nice values from timeslices to -20..20 */ | |
39602 | /* to make it look like a "normal" Unix priority/nice value */ | |
39603 | priority = task_prio(task); | |
39604 | @@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file | |
39605 | vsize, | |
39606 | mm ? get_mm_rss(mm) : 0, | |
39607 | rsslim, | |
39608 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
39609 | + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0), | |
39610 | + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0), | |
39611 | + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0), | |
39612 | +#else | |
39613 | mm ? (permitted ? mm->start_code : 1) : 0, | |
39614 | mm ? (permitted ? mm->end_code : 1) : 0, | |
39615 | (permitted && mm) ? mm->start_stack : 0, | |
39616 | +#endif | |
39617 | esp, | |
39618 | eip, | |
39619 | /* The signal information here is obsolete. | |
39620 | @@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s | |
39621 | ||
39622 | return 0; | |
39623 | } | |
39624 | + | |
39625 | +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR | |
39626 | +int proc_pid_ipaddr(struct task_struct *task, char *buffer) | |
39627 | +{ | |
39628 | + u32 curr_ip = 0; | |
39629 | + unsigned long flags; | |
39630 | + | |
39631 | + if (lock_task_sighand(task, &flags)) { | |
39632 | + curr_ip = task->signal->curr_ip; | |
39633 | + unlock_task_sighand(task, &flags); | |
39634 | + } | |
39635 | + | |
39636 | + return sprintf(buffer, "%pI4\n", &curr_ip); | |
39637 | +} | |
39638 | +#endif | |
39639 | diff -urNp linux-3.0.3/fs/proc/base.c linux-3.0.3/fs/proc/base.c | |
39640 | --- linux-3.0.3/fs/proc/base.c 2011-08-23 21:44:40.000000000 -0400 | |
39641 | +++ linux-3.0.3/fs/proc/base.c 2011-08-23 21:48:14.000000000 -0400 | |
39642 | @@ -107,6 +107,22 @@ struct pid_entry { | |
39643 | union proc_op op; | |
39644 | }; | |
39645 | ||
39646 | +struct getdents_callback { | |
39647 | + struct linux_dirent __user * current_dir; | |
39648 | + struct linux_dirent __user * previous; | |
39649 | + struct file * file; | |
39650 | + int count; | |
39651 | + int error; | |
39652 | +}; | |
39653 | + | |
39654 | +static int gr_fake_filldir(void * __buf, const char *name, int namlen, | |
39655 | + loff_t offset, u64 ino, unsigned int d_type) | |
39656 | +{ | |
39657 | + struct getdents_callback * buf = (struct getdents_callback *) __buf; | |
39658 | + buf->error = -EINVAL; | |
39659 | + return 0; | |
39660 | +} | |
39661 | + | |
39662 | #define NOD(NAME, MODE, IOP, FOP, OP) { \ | |
39663 | .name = (NAME), \ | |
39664 | .len = sizeof(NAME) - 1, \ | |
39665 | @@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_per | |
39666 | if (task == current) | |
39667 | return mm; | |
39668 | ||
39669 | + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task)) | |
39670 | + return ERR_PTR(-EPERM); | |
39671 | + | |
39672 | /* | |
39673 | * If current is actively ptrace'ing, and would also be | |
39674 | * permitted to freshly attach with ptrace now, permit it. | |
39675 | @@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_ | |
39676 | if (!mm->arg_end) | |
39677 | goto out_mm; /* Shh! No looking before we're done */ | |
39678 | ||
39679 | + if (gr_acl_handle_procpidmem(task)) | |
39680 | + goto out_mm; | |
39681 | + | |
39682 | len = mm->arg_end - mm->arg_start; | |
39683 | ||
39684 | if (len > PAGE_SIZE) | |
39685 | @@ -309,12 +331,28 @@ out: | |
39686 | return res; | |
39687 | } | |
39688 | ||
39689 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
39690 | +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \ | |
39691 | + (_mm->pax_flags & MF_PAX_RANDMMAP || \ | |
39692 | + _mm->pax_flags & MF_PAX_SEGMEXEC)) | |
39693 | +#endif | |
39694 | + | |
39695 | static int proc_pid_auxv(struct task_struct *task, char *buffer) | |
39696 | { | |
39697 | struct mm_struct *mm = mm_for_maps(task); | |
39698 | int res = PTR_ERR(mm); | |
39699 | if (mm && !IS_ERR(mm)) { | |
39700 | unsigned int nwords = 0; | |
39701 | + | |
39702 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
39703 | + /* allow if we're currently ptracing this task */ | |
39704 | + if (PAX_RAND_FLAGS(mm) && | |
39705 | + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) { | |
39706 | + mmput(mm); | |
39707 | + return res; | |
39708 | + } | |
39709 | +#endif | |
39710 | + | |
39711 | do { | |
39712 | nwords += 2; | |
39713 | } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ | |
39714 | @@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_str | |
39715 | } | |
39716 | ||
39717 | ||
39718 | -#ifdef CONFIG_KALLSYMS | |
39719 | +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
39720 | /* | |
39721 | * Provides a wchan file via kallsyms in a proper one-value-per-file format. | |
39722 | * Returns the resolved symbol. If that fails, simply return the address. | |
39723 | @@ -367,7 +405,7 @@ static void unlock_trace(struct task_str | |
39724 | mutex_unlock(&task->signal->cred_guard_mutex); | |
39725 | } | |
39726 | ||
39727 | -#ifdef CONFIG_STACKTRACE | |
39728 | +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
39729 | ||
39730 | #define MAX_STACK_TRACE_DEPTH 64 | |
39731 | ||
39732 | @@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_s | |
39733 | return count; | |
39734 | } | |
39735 | ||
39736 | -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK | |
39737 | +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP) | |
39738 | static int proc_pid_syscall(struct task_struct *task, char *buffer) | |
39739 | { | |
39740 | long nr; | |
39741 | @@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_ | |
39742 | /************************************************************************/ | |
39743 | ||
39744 | /* permission checks */ | |
39745 | -static int proc_fd_access_allowed(struct inode *inode) | |
39746 | +static int proc_fd_access_allowed(struct inode *inode, unsigned int log) | |
39747 | { | |
39748 | struct task_struct *task; | |
39749 | int allowed = 0; | |
39750 | @@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct | |
39751 | */ | |
39752 | task = get_proc_task(inode); | |
39753 | if (task) { | |
39754 | - allowed = ptrace_may_access(task, PTRACE_MODE_READ); | |
39755 | + if (log) | |
39756 | + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ); | |
39757 | + else | |
39758 | + allowed = ptrace_may_access(task, PTRACE_MODE_READ); | |
39759 | put_task_struct(task); | |
39760 | } | |
39761 | return allowed; | |
39762 | @@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file | |
39763 | if (!task) | |
39764 | goto out_no_task; | |
39765 | ||
39766 | + if (gr_acl_handle_procpidmem(task)) | |
39767 | + goto out; | |
39768 | + | |
39769 | ret = -ENOMEM; | |
39770 | page = (char *)__get_free_page(GFP_TEMPORARY); | |
39771 | if (!page) | |
39772 | @@ -1614,7 +1658,7 @@ static void *proc_pid_follow_link(struct | |
39773 | path_put(&nd->path); | |
39774 | ||
39775 | /* Are we allowed to snoop on the tasks file descriptors? */ | |
39776 | - if (!proc_fd_access_allowed(inode)) | |
39777 | + if (!proc_fd_access_allowed(inode,0)) | |
39778 | goto out; | |
39779 | ||
39780 | error = PROC_I(inode)->op.proc_get_link(inode, &nd->path); | |
39781 | @@ -1653,8 +1697,18 @@ static int proc_pid_readlink(struct dent | |
39782 | struct path path; | |
39783 | ||
39784 | /* Are we allowed to snoop on the tasks file descriptors? */ | |
39785 | - if (!proc_fd_access_allowed(inode)) | |
39786 | - goto out; | |
39787 | + /* logging this is needed for learning on chromium to work properly, | |
39788 | + but we don't want to flood the logs from 'ps' which does a readlink | |
39789 | + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn | |
39790 | + CAP_SYS_PTRACE as it's not necessary for its basic functionality | |
39791 | + */ | |
39792 | + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') { | |
39793 | + if (!proc_fd_access_allowed(inode,0)) | |
39794 | + goto out; | |
39795 | + } else { | |
39796 | + if (!proc_fd_access_allowed(inode,1)) | |
39797 | + goto out; | |
39798 | + } | |
39799 | ||
39800 | error = PROC_I(inode)->op.proc_get_link(inode, &path); | |
39801 | if (error) | |
39802 | @@ -1719,7 +1773,11 @@ struct inode *proc_pid_make_inode(struct | |
39803 | rcu_read_lock(); | |
39804 | cred = __task_cred(task); | |
39805 | inode->i_uid = cred->euid; | |
39806 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
39807 | + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID; | |
39808 | +#else | |
39809 | inode->i_gid = cred->egid; | |
39810 | +#endif | |
39811 | rcu_read_unlock(); | |
39812 | } | |
39813 | security_task_to_inode(task, inode); | |
39814 | @@ -1737,6 +1795,9 @@ int pid_getattr(struct vfsmount *mnt, st | |
39815 | struct inode *inode = dentry->d_inode; | |
39816 | struct task_struct *task; | |
39817 | const struct cred *cred; | |
39818 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39819 | + const struct cred *tmpcred = current_cred(); | |
39820 | +#endif | |
39821 | ||
39822 | generic_fillattr(inode, stat); | |
39823 | ||
39824 | @@ -1744,13 +1805,41 @@ int pid_getattr(struct vfsmount *mnt, st | |
39825 | stat->uid = 0; | |
39826 | stat->gid = 0; | |
39827 | task = pid_task(proc_pid(inode), PIDTYPE_PID); | |
39828 | + | |
39829 | + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) { | |
39830 | + rcu_read_unlock(); | |
39831 | + return -ENOENT; | |
39832 | + } | |
39833 | + | |
39834 | if (task) { | |
39835 | + cred = __task_cred(task); | |
39836 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39837 | + if (!tmpcred->uid || (tmpcred->uid == cred->uid) | |
39838 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
39839 | + || in_group_p(CONFIG_GRKERNSEC_PROC_GID) | |
39840 | +#endif | |
39841 | + ) { | |
39842 | +#endif | |
39843 | if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || | |
39844 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
39845 | + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) || | |
39846 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39847 | + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) || | |
39848 | +#endif | |
39849 | task_dumpable(task)) { | |
39850 | - cred = __task_cred(task); | |
39851 | stat->uid = cred->euid; | |
39852 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
39853 | + stat->gid = CONFIG_GRKERNSEC_PROC_GID; | |
39854 | +#else | |
39855 | stat->gid = cred->egid; | |
39856 | +#endif | |
39857 | } | |
39858 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39859 | + } else { | |
39860 | + rcu_read_unlock(); | |
39861 | + return -ENOENT; | |
39862 | + } | |
39863 | +#endif | |
39864 | } | |
39865 | rcu_read_unlock(); | |
39866 | return 0; | |
39867 | @@ -1787,11 +1876,20 @@ int pid_revalidate(struct dentry *dentry | |
39868 | ||
39869 | if (task) { | |
39870 | if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || | |
39871 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
39872 | + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) || | |
39873 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39874 | + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) || | |
39875 | +#endif | |
39876 | task_dumpable(task)) { | |
39877 | rcu_read_lock(); | |
39878 | cred = __task_cred(task); | |
39879 | inode->i_uid = cred->euid; | |
39880 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
39881 | + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID; | |
39882 | +#else | |
39883 | inode->i_gid = cred->egid; | |
39884 | +#endif | |
39885 | rcu_read_unlock(); | |
39886 | } else { | |
39887 | inode->i_uid = 0; | |
39888 | @@ -1909,7 +2007,8 @@ static int proc_fd_info(struct inode *in | |
39889 | int fd = proc_fd(inode); | |
39890 | ||
39891 | if (task) { | |
39892 | - files = get_files_struct(task); | |
39893 | + if (!gr_acl_handle_procpidmem(task)) | |
39894 | + files = get_files_struct(task); | |
39895 | put_task_struct(task); | |
39896 | } | |
39897 | if (files) { | |
39898 | @@ -2169,11 +2268,21 @@ static const struct file_operations proc | |
39899 | */ | |
39900 | static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags) | |
39901 | { | |
39902 | + struct task_struct *task; | |
39903 | int rv = generic_permission(inode, mask, flags, NULL); | |
39904 | - if (rv == 0) | |
39905 | - return 0; | |
39906 | + | |
39907 | if (task_pid(current) == proc_pid(inode)) | |
39908 | rv = 0; | |
39909 | + | |
39910 | + task = get_proc_task(inode); | |
39911 | + if (task == NULL) | |
39912 | + return rv; | |
39913 | + | |
39914 | + if (gr_acl_handle_procpidmem(task)) | |
39915 | + rv = -EACCES; | |
39916 | + | |
39917 | + put_task_struct(task); | |
39918 | + | |
39919 | return rv; | |
39920 | } | |
39921 | ||
39922 | @@ -2283,6 +2392,9 @@ static struct dentry *proc_pident_lookup | |
39923 | if (!task) | |
39924 | goto out_no_task; | |
39925 | ||
39926 | + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task)) | |
39927 | + goto out; | |
39928 | + | |
39929 | /* | |
39930 | * Yes, it does not scale. And it should not. Don't add | |
39931 | * new entries into /proc/<tgid>/ without very good reasons. | |
39932 | @@ -2327,6 +2439,9 @@ static int proc_pident_readdir(struct fi | |
39933 | if (!task) | |
39934 | goto out_no_task; | |
39935 | ||
39936 | + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task)) | |
39937 | + goto out; | |
39938 | + | |
39939 | ret = 0; | |
39940 | i = filp->f_pos; | |
39941 | switch (i) { | |
39942 | @@ -2597,7 +2712,7 @@ static void *proc_self_follow_link(struc | |
39943 | static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd, | |
39944 | void *cookie) | |
39945 | { | |
39946 | - char *s = nd_get_link(nd); | |
39947 | + const char *s = nd_get_link(nd); | |
39948 | if (!IS_ERR(s)) | |
39949 | __putname(s); | |
39950 | } | |
39951 | @@ -2795,7 +2910,7 @@ static const struct pid_entry tgid_base_ | |
39952 | REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations), | |
39953 | #endif | |
39954 | REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), | |
39955 | -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK | |
39956 | +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP) | |
39957 | INF("syscall", S_IRUGO, proc_pid_syscall), | |
39958 | #endif | |
39959 | INF("cmdline", S_IRUGO, proc_pid_cmdline), | |
39960 | @@ -2820,10 +2935,10 @@ static const struct pid_entry tgid_base_ | |
39961 | #ifdef CONFIG_SECURITY | |
39962 | DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), | |
39963 | #endif | |
39964 | -#ifdef CONFIG_KALLSYMS | |
39965 | +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
39966 | INF("wchan", S_IRUGO, proc_pid_wchan), | |
39967 | #endif | |
39968 | -#ifdef CONFIG_STACKTRACE | |
39969 | +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
39970 | ONE("stack", S_IRUGO, proc_pid_stack), | |
39971 | #endif | |
39972 | #ifdef CONFIG_SCHEDSTATS | |
39973 | @@ -2857,6 +2972,9 @@ static const struct pid_entry tgid_base_ | |
39974 | #ifdef CONFIG_HARDWALL | |
39975 | INF("hardwall", S_IRUGO, proc_pid_hardwall), | |
39976 | #endif | |
39977 | +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR | |
39978 | + INF("ipaddr", S_IRUSR, proc_pid_ipaddr), | |
39979 | +#endif | |
39980 | }; | |
39981 | ||
39982 | static int proc_tgid_base_readdir(struct file * filp, | |
39983 | @@ -2982,7 +3100,14 @@ static struct dentry *proc_pid_instantia | |
39984 | if (!inode) | |
39985 | goto out; | |
39986 | ||
39987 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
39988 | + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR; | |
39989 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
39990 | + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID; | |
39991 | + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP; | |
39992 | +#else | |
39993 | inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO; | |
39994 | +#endif | |
39995 | inode->i_op = &proc_tgid_base_inode_operations; | |
39996 | inode->i_fop = &proc_tgid_base_operations; | |
39997 | inode->i_flags|=S_IMMUTABLE; | |
39998 | @@ -3024,7 +3149,11 @@ struct dentry *proc_pid_lookup(struct in | |
39999 | if (!task) | |
40000 | goto out; | |
40001 | ||
40002 | + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task)) | |
40003 | + goto out_put_task; | |
40004 | + | |
40005 | result = proc_pid_instantiate(dir, dentry, task, NULL); | |
40006 | +out_put_task: | |
40007 | put_task_struct(task); | |
40008 | out: | |
40009 | return result; | |
40010 | @@ -3089,6 +3218,11 @@ int proc_pid_readdir(struct file * filp, | |
40011 | { | |
40012 | unsigned int nr; | |
40013 | struct task_struct *reaper; | |
40014 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40015 | + const struct cred *tmpcred = current_cred(); | |
40016 | + const struct cred *itercred; | |
40017 | +#endif | |
40018 | + filldir_t __filldir = filldir; | |
40019 | struct tgid_iter iter; | |
40020 | struct pid_namespace *ns; | |
40021 | ||
40022 | @@ -3112,8 +3246,27 @@ int proc_pid_readdir(struct file * filp, | |
40023 | for (iter = next_tgid(ns, iter); | |
40024 | iter.task; | |
40025 | iter.tgid += 1, iter = next_tgid(ns, iter)) { | |
40026 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40027 | + rcu_read_lock(); | |
40028 | + itercred = __task_cred(iter.task); | |
40029 | +#endif | |
40030 | + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task) | |
40031 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40032 | + || (tmpcred->uid && (itercred->uid != tmpcred->uid) | |
40033 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
40034 | + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID) | |
40035 | +#endif | |
40036 | + ) | |
40037 | +#endif | |
40038 | + ) | |
40039 | + __filldir = &gr_fake_filldir; | |
40040 | + else | |
40041 | + __filldir = filldir; | |
40042 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40043 | + rcu_read_unlock(); | |
40044 | +#endif | |
40045 | filp->f_pos = iter.tgid + TGID_OFFSET; | |
40046 | - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) { | |
40047 | + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) { | |
40048 | put_task_struct(iter.task); | |
40049 | goto out; | |
40050 | } | |
40051 | @@ -3141,7 +3294,7 @@ static const struct pid_entry tid_base_s | |
40052 | REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations), | |
40053 | #endif | |
40054 | REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), | |
40055 | -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK | |
40056 | +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP) | |
40057 | INF("syscall", S_IRUGO, proc_pid_syscall), | |
40058 | #endif | |
40059 | INF("cmdline", S_IRUGO, proc_pid_cmdline), | |
40060 | @@ -3165,10 +3318,10 @@ static const struct pid_entry tid_base_s | |
40061 | #ifdef CONFIG_SECURITY | |
40062 | DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), | |
40063 | #endif | |
40064 | -#ifdef CONFIG_KALLSYMS | |
40065 | +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
40066 | INF("wchan", S_IRUGO, proc_pid_wchan), | |
40067 | #endif | |
40068 | -#ifdef CONFIG_STACKTRACE | |
40069 | +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
40070 | ONE("stack", S_IRUGO, proc_pid_stack), | |
40071 | #endif | |
40072 | #ifdef CONFIG_SCHEDSTATS | |
40073 | diff -urNp linux-3.0.3/fs/proc/cmdline.c linux-3.0.3/fs/proc/cmdline.c | |
40074 | --- linux-3.0.3/fs/proc/cmdline.c 2011-07-21 22:17:23.000000000 -0400 | |
40075 | +++ linux-3.0.3/fs/proc/cmdline.c 2011-08-23 21:48:14.000000000 -0400 | |
40076 | @@ -23,7 +23,11 @@ static const struct file_operations cmdl | |
40077 | ||
40078 | static int __init proc_cmdline_init(void) | |
40079 | { | |
40080 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
40081 | + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops); | |
40082 | +#else | |
40083 | proc_create("cmdline", 0, NULL, &cmdline_proc_fops); | |
40084 | +#endif | |
40085 | return 0; | |
40086 | } | |
40087 | module_init(proc_cmdline_init); | |
40088 | diff -urNp linux-3.0.3/fs/proc/devices.c linux-3.0.3/fs/proc/devices.c | |
40089 | --- linux-3.0.3/fs/proc/devices.c 2011-07-21 22:17:23.000000000 -0400 | |
40090 | +++ linux-3.0.3/fs/proc/devices.c 2011-08-23 21:48:14.000000000 -0400 | |
40091 | @@ -64,7 +64,11 @@ static const struct file_operations proc | |
40092 | ||
40093 | static int __init proc_devices_init(void) | |
40094 | { | |
40095 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
40096 | + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations); | |
40097 | +#else | |
40098 | proc_create("devices", 0, NULL, &proc_devinfo_operations); | |
40099 | +#endif | |
40100 | return 0; | |
40101 | } | |
40102 | module_init(proc_devices_init); | |
40103 | diff -urNp linux-3.0.3/fs/proc/inode.c linux-3.0.3/fs/proc/inode.c | |
40104 | --- linux-3.0.3/fs/proc/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
40105 | +++ linux-3.0.3/fs/proc/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
40106 | @@ -440,7 +440,11 @@ struct inode *proc_get_inode(struct supe | |
40107 | if (de->mode) { | |
40108 | inode->i_mode = de->mode; | |
40109 | inode->i_uid = de->uid; | |
40110 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
40111 | + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID; | |
40112 | +#else | |
40113 | inode->i_gid = de->gid; | |
40114 | +#endif | |
40115 | } | |
40116 | if (de->size) | |
40117 | inode->i_size = de->size; | |
40118 | diff -urNp linux-3.0.3/fs/proc/internal.h linux-3.0.3/fs/proc/internal.h | |
40119 | --- linux-3.0.3/fs/proc/internal.h 2011-07-21 22:17:23.000000000 -0400 | |
40120 | +++ linux-3.0.3/fs/proc/internal.h 2011-08-23 21:48:14.000000000 -0400 | |
40121 | @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi | |
40122 | struct pid *pid, struct task_struct *task); | |
40123 | extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, | |
40124 | struct pid *pid, struct task_struct *task); | |
40125 | +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR | |
40126 | +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer); | |
40127 | +#endif | |
40128 | extern loff_t mem_lseek(struct file *file, loff_t offset, int orig); | |
40129 | ||
40130 | extern const struct file_operations proc_maps_operations; | |
40131 | diff -urNp linux-3.0.3/fs/proc/Kconfig linux-3.0.3/fs/proc/Kconfig | |
40132 | --- linux-3.0.3/fs/proc/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
40133 | +++ linux-3.0.3/fs/proc/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
40134 | @@ -30,12 +30,12 @@ config PROC_FS | |
40135 | ||
40136 | config PROC_KCORE | |
40137 | bool "/proc/kcore support" if !ARM | |
40138 | - depends on PROC_FS && MMU | |
40139 | + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD | |
40140 | ||
40141 | config PROC_VMCORE | |
40142 | bool "/proc/vmcore support" | |
40143 | - depends on PROC_FS && CRASH_DUMP | |
40144 | - default y | |
40145 | + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC | |
40146 | + default n | |
40147 | help | |
40148 | Exports the dump image of crashed kernel in ELF format. | |
40149 | ||
40150 | @@ -59,8 +59,8 @@ config PROC_SYSCTL | |
40151 | limited in memory. | |
40152 | ||
40153 | config PROC_PAGE_MONITOR | |
40154 | - default y | |
40155 | - depends on PROC_FS && MMU | |
40156 | + default n | |
40157 | + depends on PROC_FS && MMU && !GRKERNSEC | |
40158 | bool "Enable /proc page monitoring" if EXPERT | |
40159 | help | |
40160 | Various /proc files exist to monitor process memory utilization: | |
40161 | diff -urNp linux-3.0.3/fs/proc/kcore.c linux-3.0.3/fs/proc/kcore.c | |
40162 | --- linux-3.0.3/fs/proc/kcore.c 2011-07-21 22:17:23.000000000 -0400 | |
40163 | +++ linux-3.0.3/fs/proc/kcore.c 2011-08-23 21:48:14.000000000 -0400 | |
40164 | @@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu | |
40165 | off_t offset = 0; | |
40166 | struct kcore_list *m; | |
40167 | ||
40168 | + pax_track_stack(); | |
40169 | + | |
40170 | /* setup ELF header */ | |
40171 | elf = (struct elfhdr *) bufp; | |
40172 | bufp += sizeof(struct elfhdr); | |
40173 | @@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use | |
40174 | * the addresses in the elf_phdr on our list. | |
40175 | */ | |
40176 | start = kc_offset_to_vaddr(*fpos - elf_buflen); | |
40177 | - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen) | |
40178 | + tsz = PAGE_SIZE - (start & ~PAGE_MASK); | |
40179 | + if (tsz > buflen) | |
40180 | tsz = buflen; | |
40181 | - | |
40182 | + | |
40183 | while (buflen) { | |
40184 | struct kcore_list *m; | |
40185 | ||
40186 | @@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use | |
40187 | kfree(elf_buf); | |
40188 | } else { | |
40189 | if (kern_addr_valid(start)) { | |
40190 | - unsigned long n; | |
40191 | + char *elf_buf; | |
40192 | + mm_segment_t oldfs; | |
40193 | ||
40194 | - n = copy_to_user(buffer, (char *)start, tsz); | |
40195 | - /* | |
40196 | - * We cannot distingush between fault on source | |
40197 | - * and fault on destination. When this happens | |
40198 | - * we clear too and hope it will trigger the | |
40199 | - * EFAULT again. | |
40200 | - */ | |
40201 | - if (n) { | |
40202 | - if (clear_user(buffer + tsz - n, | |
40203 | - n)) | |
40204 | + elf_buf = kmalloc(tsz, GFP_KERNEL); | |
40205 | + if (!elf_buf) | |
40206 | + return -ENOMEM; | |
40207 | + oldfs = get_fs(); | |
40208 | + set_fs(KERNEL_DS); | |
40209 | + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) { | |
40210 | + set_fs(oldfs); | |
40211 | + if (copy_to_user(buffer, elf_buf, tsz)) { | |
40212 | + kfree(elf_buf); | |
40213 | return -EFAULT; | |
40214 | + } | |
40215 | } | |
40216 | + set_fs(oldfs); | |
40217 | + kfree(elf_buf); | |
40218 | } else { | |
40219 | if (clear_user(buffer, tsz)) | |
40220 | return -EFAULT; | |
40221 | @@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use | |
40222 | ||
40223 | static int open_kcore(struct inode *inode, struct file *filp) | |
40224 | { | |
40225 | +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM) | |
40226 | + return -EPERM; | |
40227 | +#endif | |
40228 | if (!capable(CAP_SYS_RAWIO)) | |
40229 | return -EPERM; | |
40230 | if (kcore_need_update) | |
40231 | diff -urNp linux-3.0.3/fs/proc/meminfo.c linux-3.0.3/fs/proc/meminfo.c | |
40232 | --- linux-3.0.3/fs/proc/meminfo.c 2011-07-21 22:17:23.000000000 -0400 | |
40233 | +++ linux-3.0.3/fs/proc/meminfo.c 2011-08-23 21:48:14.000000000 -0400 | |
40234 | @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_ | |
40235 | unsigned long pages[NR_LRU_LISTS]; | |
40236 | int lru; | |
40237 | ||
40238 | + pax_track_stack(); | |
40239 | + | |
40240 | /* | |
40241 | * display in kilobytes. | |
40242 | */ | |
40243 | @@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_ | |
40244 | vmi.used >> 10, | |
40245 | vmi.largest_chunk >> 10 | |
40246 | #ifdef CONFIG_MEMORY_FAILURE | |
40247 | - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10) | |
40248 | + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10) | |
40249 | #endif | |
40250 | #ifdef CONFIG_TRANSPARENT_HUGEPAGE | |
40251 | ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) * | |
40252 | diff -urNp linux-3.0.3/fs/proc/nommu.c linux-3.0.3/fs/proc/nommu.c | |
40253 | --- linux-3.0.3/fs/proc/nommu.c 2011-07-21 22:17:23.000000000 -0400 | |
40254 | +++ linux-3.0.3/fs/proc/nommu.c 2011-08-23 21:47:56.000000000 -0400 | |
40255 | @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_ | |
40256 | if (len < 1) | |
40257 | len = 1; | |
40258 | seq_printf(m, "%*c", len, ' '); | |
40259 | - seq_path(m, &file->f_path, ""); | |
40260 | + seq_path(m, &file->f_path, "\n\\"); | |
40261 | } | |
40262 | ||
40263 | seq_putc(m, '\n'); | |
40264 | diff -urNp linux-3.0.3/fs/proc/proc_net.c linux-3.0.3/fs/proc/proc_net.c | |
40265 | --- linux-3.0.3/fs/proc/proc_net.c 2011-07-21 22:17:23.000000000 -0400 | |
40266 | +++ linux-3.0.3/fs/proc/proc_net.c 2011-08-23 21:48:14.000000000 -0400 | |
40267 | @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str | |
40268 | struct task_struct *task; | |
40269 | struct nsproxy *ns; | |
40270 | struct net *net = NULL; | |
40271 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40272 | + const struct cred *cred = current_cred(); | |
40273 | +#endif | |
40274 | + | |
40275 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
40276 | + if (cred->fsuid) | |
40277 | + return net; | |
40278 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40279 | + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)) | |
40280 | + return net; | |
40281 | +#endif | |
40282 | ||
40283 | rcu_read_lock(); | |
40284 | task = pid_task(proc_pid(dir), PIDTYPE_PID); | |
40285 | diff -urNp linux-3.0.3/fs/proc/proc_sysctl.c linux-3.0.3/fs/proc/proc_sysctl.c | |
40286 | --- linux-3.0.3/fs/proc/proc_sysctl.c 2011-07-21 22:17:23.000000000 -0400 | |
40287 | +++ linux-3.0.3/fs/proc/proc_sysctl.c 2011-08-23 21:48:14.000000000 -0400 | |
40288 | @@ -8,6 +8,8 @@ | |
40289 | #include <linux/namei.h> | |
40290 | #include "internal.h" | |
40291 | ||
40292 | +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op); | |
40293 | + | |
40294 | static const struct dentry_operations proc_sys_dentry_operations; | |
40295 | static const struct file_operations proc_sys_file_operations; | |
40296 | static const struct inode_operations proc_sys_inode_operations; | |
40297 | @@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st | |
40298 | if (!p) | |
40299 | goto out; | |
40300 | ||
40301 | + if (gr_handle_sysctl(p, MAY_EXEC)) | |
40302 | + goto out; | |
40303 | + | |
40304 | err = ERR_PTR(-ENOMEM); | |
40305 | inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p); | |
40306 | if (h) | |
40307 | @@ -230,6 +235,9 @@ static int scan(struct ctl_table_header | |
40308 | if (*pos < file->f_pos) | |
40309 | continue; | |
40310 | ||
40311 | + if (gr_handle_sysctl(table, 0)) | |
40312 | + continue; | |
40313 | + | |
40314 | res = proc_sys_fill_cache(file, dirent, filldir, head, table); | |
40315 | if (res) | |
40316 | return res; | |
40317 | @@ -355,6 +363,9 @@ static int proc_sys_getattr(struct vfsmo | |
40318 | if (IS_ERR(head)) | |
40319 | return PTR_ERR(head); | |
40320 | ||
40321 | + if (table && gr_handle_sysctl(table, MAY_EXEC)) | |
40322 | + return -ENOENT; | |
40323 | + | |
40324 | generic_fillattr(inode, stat); | |
40325 | if (table) | |
40326 | stat->mode = (stat->mode & S_IFMT) | table->mode; | |
40327 | diff -urNp linux-3.0.3/fs/proc/root.c linux-3.0.3/fs/proc/root.c | |
40328 | --- linux-3.0.3/fs/proc/root.c 2011-07-21 22:17:23.000000000 -0400 | |
40329 | +++ linux-3.0.3/fs/proc/root.c 2011-08-23 21:48:14.000000000 -0400 | |
40330 | @@ -123,7 +123,15 @@ void __init proc_root_init(void) | |
40331 | #ifdef CONFIG_PROC_DEVICETREE | |
40332 | proc_device_tree_init(); | |
40333 | #endif | |
40334 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
40335 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
40336 | + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL); | |
40337 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
40338 | + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL); | |
40339 | +#endif | |
40340 | +#else | |
40341 | proc_mkdir("bus", NULL); | |
40342 | +#endif | |
40343 | proc_sys_init(); | |
40344 | } | |
40345 | ||
40346 | diff -urNp linux-3.0.3/fs/proc/task_mmu.c linux-3.0.3/fs/proc/task_mmu.c | |
40347 | --- linux-3.0.3/fs/proc/task_mmu.c 2011-07-21 22:17:23.000000000 -0400 | |
40348 | +++ linux-3.0.3/fs/proc/task_mmu.c 2011-08-23 21:48:14.000000000 -0400 | |
40349 | @@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct | |
40350 | "VmExe:\t%8lu kB\n" | |
40351 | "VmLib:\t%8lu kB\n" | |
40352 | "VmPTE:\t%8lu kB\n" | |
40353 | - "VmSwap:\t%8lu kB\n", | |
40354 | - hiwater_vm << (PAGE_SHIFT-10), | |
40355 | + "VmSwap:\t%8lu kB\n" | |
40356 | + | |
40357 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
40358 | + "CsBase:\t%8lx\nCsLim:\t%8lx\n" | |
40359 | +#endif | |
40360 | + | |
40361 | + ,hiwater_vm << (PAGE_SHIFT-10), | |
40362 | (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10), | |
40363 | mm->locked_vm << (PAGE_SHIFT-10), | |
40364 | hiwater_rss << (PAGE_SHIFT-10), | |
40365 | @@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct | |
40366 | data << (PAGE_SHIFT-10), | |
40367 | mm->stack_vm << (PAGE_SHIFT-10), text, lib, | |
40368 | (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10, | |
40369 | - swap << (PAGE_SHIFT-10)); | |
40370 | + swap << (PAGE_SHIFT-10) | |
40371 | + | |
40372 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
40373 | + , mm->context.user_cs_base, mm->context.user_cs_limit | |
40374 | +#endif | |
40375 | + | |
40376 | + ); | |
40377 | } | |
40378 | ||
40379 | unsigned long task_vsize(struct mm_struct *mm) | |
40380 | @@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in | |
40381 | return ret; | |
40382 | } | |
40383 | ||
40384 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40385 | +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \ | |
40386 | + (_mm->pax_flags & MF_PAX_RANDMMAP || \ | |
40387 | + _mm->pax_flags & MF_PAX_SEGMEXEC)) | |
40388 | +#endif | |
40389 | + | |
40390 | static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma) | |
40391 | { | |
40392 | struct mm_struct *mm = vma->vm_mm; | |
40393 | @@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file | |
40394 | pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT; | |
40395 | } | |
40396 | ||
40397 | - /* We don't show the stack guard page in /proc/maps */ | |
40398 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40399 | + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start; | |
40400 | + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end; | |
40401 | +#else | |
40402 | start = vma->vm_start; | |
40403 | - if (stack_guard_page_start(vma, start)) | |
40404 | - start += PAGE_SIZE; | |
40405 | end = vma->vm_end; | |
40406 | - if (stack_guard_page_end(vma, end)) | |
40407 | - end -= PAGE_SIZE; | |
40408 | +#endif | |
40409 | ||
40410 | seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n", | |
40411 | start, | |
40412 | @@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file | |
40413 | flags & VM_WRITE ? 'w' : '-', | |
40414 | flags & VM_EXEC ? 'x' : '-', | |
40415 | flags & VM_MAYSHARE ? 's' : 'p', | |
40416 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40417 | + PAX_RAND_FLAGS(mm) ? 0UL : pgoff, | |
40418 | +#else | |
40419 | pgoff, | |
40420 | +#endif | |
40421 | MAJOR(dev), MINOR(dev), ino, &len); | |
40422 | ||
40423 | /* | |
40424 | @@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file | |
40425 | */ | |
40426 | if (file) { | |
40427 | pad_len_spaces(m, len); | |
40428 | - seq_path(m, &file->f_path, "\n"); | |
40429 | + seq_path(m, &file->f_path, "\n\\"); | |
40430 | } else { | |
40431 | const char *name = arch_vma_name(vma); | |
40432 | if (!name) { | |
40433 | @@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file | |
40434 | if (vma->vm_start <= mm->brk && | |
40435 | vma->vm_end >= mm->start_brk) { | |
40436 | name = "[heap]"; | |
40437 | - } else if (vma->vm_start <= mm->start_stack && | |
40438 | - vma->vm_end >= mm->start_stack) { | |
40439 | + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) || | |
40440 | + (vma->vm_start <= mm->start_stack && | |
40441 | + vma->vm_end >= mm->start_stack)) { | |
40442 | name = "[stack]"; | |
40443 | } | |
40444 | } else { | |
40445 | @@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m, | |
40446 | }; | |
40447 | ||
40448 | memset(&mss, 0, sizeof mss); | |
40449 | - mss.vma = vma; | |
40450 | - /* mmap_sem is held in m_start */ | |
40451 | - if (vma->vm_mm && !is_vm_hugetlb_page(vma)) | |
40452 | - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk); | |
40453 | - | |
40454 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40455 | + if (!PAX_RAND_FLAGS(vma->vm_mm)) { | |
40456 | +#endif | |
40457 | + mss.vma = vma; | |
40458 | + /* mmap_sem is held in m_start */ | |
40459 | + if (vma->vm_mm && !is_vm_hugetlb_page(vma)) | |
40460 | + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk); | |
40461 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40462 | + } | |
40463 | +#endif | |
40464 | show_map_vma(m, vma); | |
40465 | ||
40466 | seq_printf(m, | |
40467 | @@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m, | |
40468 | "KernelPageSize: %8lu kB\n" | |
40469 | "MMUPageSize: %8lu kB\n" | |
40470 | "Locked: %8lu kB\n", | |
40471 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
40472 | + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10, | |
40473 | +#else | |
40474 | (vma->vm_end - vma->vm_start) >> 10, | |
40475 | +#endif | |
40476 | mss.resident >> 10, | |
40477 | (unsigned long)(mss.pss >> (10 + PSS_SHIFT)), | |
40478 | mss.shared_clean >> 10, | |
40479 | @@ -1001,7 +1032,7 @@ static int show_numa_map(struct seq_file | |
40480 | ||
40481 | if (file) { | |
40482 | seq_printf(m, " file="); | |
40483 | - seq_path(m, &file->f_path, "\n\t= "); | |
40484 | + seq_path(m, &file->f_path, "\n\t\\= "); | |
40485 | } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) { | |
40486 | seq_printf(m, " heap"); | |
40487 | } else if (vma->vm_start <= mm->start_stack && | |
40488 | diff -urNp linux-3.0.3/fs/proc/task_nommu.c linux-3.0.3/fs/proc/task_nommu.c | |
40489 | --- linux-3.0.3/fs/proc/task_nommu.c 2011-07-21 22:17:23.000000000 -0400 | |
40490 | +++ linux-3.0.3/fs/proc/task_nommu.c 2011-08-23 21:47:56.000000000 -0400 | |
40491 | @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct | |
40492 | else | |
40493 | bytes += kobjsize(mm); | |
40494 | ||
40495 | - if (current->fs && current->fs->users > 1) | |
40496 | + if (current->fs && atomic_read(¤t->fs->users) > 1) | |
40497 | sbytes += kobjsize(current->fs); | |
40498 | else | |
40499 | bytes += kobjsize(current->fs); | |
40500 | @@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil | |
40501 | ||
40502 | if (file) { | |
40503 | pad_len_spaces(m, len); | |
40504 | - seq_path(m, &file->f_path, ""); | |
40505 | + seq_path(m, &file->f_path, "\n\\"); | |
40506 | } else if (mm) { | |
40507 | if (vma->vm_start <= mm->start_stack && | |
40508 | vma->vm_end >= mm->start_stack) { | |
40509 | diff -urNp linux-3.0.3/fs/quota/netlink.c linux-3.0.3/fs/quota/netlink.c | |
40510 | --- linux-3.0.3/fs/quota/netlink.c 2011-07-21 22:17:23.000000000 -0400 | |
40511 | +++ linux-3.0.3/fs/quota/netlink.c 2011-08-23 21:47:56.000000000 -0400 | |
40512 | @@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam | |
40513 | void quota_send_warning(short type, unsigned int id, dev_t dev, | |
40514 | const char warntype) | |
40515 | { | |
40516 | - static atomic_t seq; | |
40517 | + static atomic_unchecked_t seq; | |
40518 | struct sk_buff *skb; | |
40519 | void *msg_head; | |
40520 | int ret; | |
40521 | @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi | |
40522 | "VFS: Not enough memory to send quota warning.\n"); | |
40523 | return; | |
40524 | } | |
40525 | - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq), | |
40526 | + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq), | |
40527 | "a_genl_family, 0, QUOTA_NL_C_WARNING); | |
40528 | if (!msg_head) { | |
40529 | printk(KERN_ERR | |
40530 | diff -urNp linux-3.0.3/fs/readdir.c linux-3.0.3/fs/readdir.c | |
40531 | --- linux-3.0.3/fs/readdir.c 2011-07-21 22:17:23.000000000 -0400 | |
40532 | +++ linux-3.0.3/fs/readdir.c 2011-08-23 21:48:14.000000000 -0400 | |
40533 | @@ -17,6 +17,7 @@ | |
40534 | #include <linux/security.h> | |
40535 | #include <linux/syscalls.h> | |
40536 | #include <linux/unistd.h> | |
40537 | +#include <linux/namei.h> | |
40538 | ||
40539 | #include <asm/uaccess.h> | |
40540 | ||
40541 | @@ -67,6 +68,7 @@ struct old_linux_dirent { | |
40542 | ||
40543 | struct readdir_callback { | |
40544 | struct old_linux_dirent __user * dirent; | |
40545 | + struct file * file; | |
40546 | int result; | |
40547 | }; | |
40548 | ||
40549 | @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons | |
40550 | buf->result = -EOVERFLOW; | |
40551 | return -EOVERFLOW; | |
40552 | } | |
40553 | + | |
40554 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
40555 | + return 0; | |
40556 | + | |
40557 | buf->result++; | |
40558 | dirent = buf->dirent; | |
40559 | if (!access_ok(VERIFY_WRITE, dirent, | |
40560 | @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in | |
40561 | ||
40562 | buf.result = 0; | |
40563 | buf.dirent = dirent; | |
40564 | + buf.file = file; | |
40565 | ||
40566 | error = vfs_readdir(file, fillonedir, &buf); | |
40567 | if (buf.result) | |
40568 | @@ -142,6 +149,7 @@ struct linux_dirent { | |
40569 | struct getdents_callback { | |
40570 | struct linux_dirent __user * current_dir; | |
40571 | struct linux_dirent __user * previous; | |
40572 | + struct file * file; | |
40573 | int count; | |
40574 | int error; | |
40575 | }; | |
40576 | @@ -163,6 +171,10 @@ static int filldir(void * __buf, const c | |
40577 | buf->error = -EOVERFLOW; | |
40578 | return -EOVERFLOW; | |
40579 | } | |
40580 | + | |
40581 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
40582 | + return 0; | |
40583 | + | |
40584 | dirent = buf->previous; | |
40585 | if (dirent) { | |
40586 | if (__put_user(offset, &dirent->d_off)) | |
40587 | @@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, | |
40588 | buf.previous = NULL; | |
40589 | buf.count = count; | |
40590 | buf.error = 0; | |
40591 | + buf.file = file; | |
40592 | ||
40593 | error = vfs_readdir(file, filldir, &buf); | |
40594 | if (error >= 0) | |
40595 | @@ -229,6 +242,7 @@ out: | |
40596 | struct getdents_callback64 { | |
40597 | struct linux_dirent64 __user * current_dir; | |
40598 | struct linux_dirent64 __user * previous; | |
40599 | + struct file *file; | |
40600 | int count; | |
40601 | int error; | |
40602 | }; | |
40603 | @@ -244,6 +258,10 @@ static int filldir64(void * __buf, const | |
40604 | buf->error = -EINVAL; /* only used if we fail.. */ | |
40605 | if (reclen > buf->count) | |
40606 | return -EINVAL; | |
40607 | + | |
40608 | + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino)) | |
40609 | + return 0; | |
40610 | + | |
40611 | dirent = buf->previous; | |
40612 | if (dirent) { | |
40613 | if (__put_user(offset, &dirent->d_off)) | |
40614 | @@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int | |
40615 | ||
40616 | buf.current_dir = dirent; | |
40617 | buf.previous = NULL; | |
40618 | + buf.file = file; | |
40619 | buf.count = count; | |
40620 | buf.error = 0; | |
40621 | ||
40622 | diff -urNp linux-3.0.3/fs/reiserfs/dir.c linux-3.0.3/fs/reiserfs/dir.c | |
40623 | --- linux-3.0.3/fs/reiserfs/dir.c 2011-07-21 22:17:23.000000000 -0400 | |
40624 | +++ linux-3.0.3/fs/reiserfs/dir.c 2011-08-23 21:48:14.000000000 -0400 | |
40625 | @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr | |
40626 | struct reiserfs_dir_entry de; | |
40627 | int ret = 0; | |
40628 | ||
40629 | + pax_track_stack(); | |
40630 | + | |
40631 | reiserfs_write_lock(inode->i_sb); | |
40632 | ||
40633 | reiserfs_check_lock_depth(inode->i_sb, "readdir"); | |
40634 | diff -urNp linux-3.0.3/fs/reiserfs/do_balan.c linux-3.0.3/fs/reiserfs/do_balan.c | |
40635 | --- linux-3.0.3/fs/reiserfs/do_balan.c 2011-07-21 22:17:23.000000000 -0400 | |
40636 | +++ linux-3.0.3/fs/reiserfs/do_balan.c 2011-08-23 21:47:56.000000000 -0400 | |
40637 | @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, | |
40638 | return; | |
40639 | } | |
40640 | ||
40641 | - atomic_inc(&(fs_generation(tb->tb_sb))); | |
40642 | + atomic_inc_unchecked(&(fs_generation(tb->tb_sb))); | |
40643 | do_balance_starts(tb); | |
40644 | ||
40645 | /* balance leaf returns 0 except if combining L R and S into | |
40646 | diff -urNp linux-3.0.3/fs/reiserfs/journal.c linux-3.0.3/fs/reiserfs/journal.c | |
40647 | --- linux-3.0.3/fs/reiserfs/journal.c 2011-07-21 22:17:23.000000000 -0400 | |
40648 | +++ linux-3.0.3/fs/reiserfs/journal.c 2011-08-23 21:48:14.000000000 -0400 | |
40649 | @@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea | |
40650 | struct buffer_head *bh; | |
40651 | int i, j; | |
40652 | ||
40653 | + pax_track_stack(); | |
40654 | + | |
40655 | bh = __getblk(dev, block, bufsize); | |
40656 | if (buffer_uptodate(bh)) | |
40657 | return (bh); | |
40658 | diff -urNp linux-3.0.3/fs/reiserfs/namei.c linux-3.0.3/fs/reiserfs/namei.c | |
40659 | --- linux-3.0.3/fs/reiserfs/namei.c 2011-07-21 22:17:23.000000000 -0400 | |
40660 | +++ linux-3.0.3/fs/reiserfs/namei.c 2011-08-23 21:48:14.000000000 -0400 | |
40661 | @@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode | |
40662 | unsigned long savelink = 1; | |
40663 | struct timespec ctime; | |
40664 | ||
40665 | + pax_track_stack(); | |
40666 | + | |
40667 | /* three balancings: (1) old name removal, (2) new name insertion | |
40668 | and (3) maybe "save" link insertion | |
40669 | stat data updates: (1) old directory, | |
40670 | diff -urNp linux-3.0.3/fs/reiserfs/procfs.c linux-3.0.3/fs/reiserfs/procfs.c | |
40671 | --- linux-3.0.3/fs/reiserfs/procfs.c 2011-07-21 22:17:23.000000000 -0400 | |
40672 | +++ linux-3.0.3/fs/reiserfs/procfs.c 2011-08-23 21:48:14.000000000 -0400 | |
40673 | @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m | |
40674 | "SMALL_TAILS " : "NO_TAILS ", | |
40675 | replay_only(sb) ? "REPLAY_ONLY " : "", | |
40676 | convert_reiserfs(sb) ? "CONV " : "", | |
40677 | - atomic_read(&r->s_generation_counter), | |
40678 | + atomic_read_unchecked(&r->s_generation_counter), | |
40679 | SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes), | |
40680 | SF(s_do_balance), SF(s_unneeded_left_neighbor), | |
40681 | SF(s_good_search_by_key_reada), SF(s_bmaps), | |
40682 | @@ -299,6 +299,8 @@ static int show_journal(struct seq_file | |
40683 | struct journal_params *jp = &rs->s_v1.s_journal; | |
40684 | char b[BDEVNAME_SIZE]; | |
40685 | ||
40686 | + pax_track_stack(); | |
40687 | + | |
40688 | seq_printf(m, /* on-disk fields */ | |
40689 | "jp_journal_1st_block: \t%i\n" | |
40690 | "jp_journal_dev: \t%s[%x]\n" | |
40691 | diff -urNp linux-3.0.3/fs/reiserfs/stree.c linux-3.0.3/fs/reiserfs/stree.c | |
40692 | --- linux-3.0.3/fs/reiserfs/stree.c 2011-07-21 22:17:23.000000000 -0400 | |
40693 | +++ linux-3.0.3/fs/reiserfs/stree.c 2011-08-23 21:48:14.000000000 -0400 | |
40694 | @@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs | |
40695 | int iter = 0; | |
40696 | #endif | |
40697 | ||
40698 | + pax_track_stack(); | |
40699 | + | |
40700 | BUG_ON(!th->t_trans_id); | |
40701 | ||
40702 | init_tb_struct(th, &s_del_balance, sb, path, | |
40703 | @@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r | |
40704 | int retval; | |
40705 | int quota_cut_bytes = 0; | |
40706 | ||
40707 | + pax_track_stack(); | |
40708 | + | |
40709 | BUG_ON(!th->t_trans_id); | |
40710 | ||
40711 | le_key2cpu_key(&cpu_key, key); | |
40712 | @@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser | |
40713 | int quota_cut_bytes; | |
40714 | loff_t tail_pos = 0; | |
40715 | ||
40716 | + pax_track_stack(); | |
40717 | + | |
40718 | BUG_ON(!th->t_trans_id); | |
40719 | ||
40720 | init_tb_struct(th, &s_cut_balance, inode->i_sb, path, | |
40721 | @@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis | |
40722 | int retval; | |
40723 | int fs_gen; | |
40724 | ||
40725 | + pax_track_stack(); | |
40726 | + | |
40727 | BUG_ON(!th->t_trans_id); | |
40728 | ||
40729 | fs_gen = get_generation(inode->i_sb); | |
40730 | @@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs | |
40731 | int fs_gen = 0; | |
40732 | int quota_bytes = 0; | |
40733 | ||
40734 | + pax_track_stack(); | |
40735 | + | |
40736 | BUG_ON(!th->t_trans_id); | |
40737 | ||
40738 | if (inode) { /* Do we count quotas for item? */ | |
40739 | diff -urNp linux-3.0.3/fs/reiserfs/super.c linux-3.0.3/fs/reiserfs/super.c | |
40740 | --- linux-3.0.3/fs/reiserfs/super.c 2011-07-21 22:17:23.000000000 -0400 | |
40741 | +++ linux-3.0.3/fs/reiserfs/super.c 2011-08-23 21:48:14.000000000 -0400 | |
40742 | @@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct | |
40743 | {.option_name = NULL} | |
40744 | }; | |
40745 | ||
40746 | + pax_track_stack(); | |
40747 | + | |
40748 | *blocks = 0; | |
40749 | if (!options || !*options) | |
40750 | /* use default configuration: create tails, journaling on, no | |
40751 | diff -urNp linux-3.0.3/fs/select.c linux-3.0.3/fs/select.c | |
40752 | --- linux-3.0.3/fs/select.c 2011-07-21 22:17:23.000000000 -0400 | |
40753 | +++ linux-3.0.3/fs/select.c 2011-08-23 21:48:14.000000000 -0400 | |
40754 | @@ -20,6 +20,7 @@ | |
40755 | #include <linux/module.h> | |
40756 | #include <linux/slab.h> | |
40757 | #include <linux/poll.h> | |
40758 | +#include <linux/security.h> | |
40759 | #include <linux/personality.h> /* for STICKY_TIMEOUTS */ | |
40760 | #include <linux/file.h> | |
40761 | #include <linux/fdtable.h> | |
40762 | @@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s | |
40763 | int retval, i, timed_out = 0; | |
40764 | unsigned long slack = 0; | |
40765 | ||
40766 | + pax_track_stack(); | |
40767 | + | |
40768 | rcu_read_lock(); | |
40769 | retval = max_select_fd(n, fds); | |
40770 | rcu_read_unlock(); | |
40771 | @@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user | |
40772 | /* Allocate small arguments on the stack to save memory and be faster */ | |
40773 | long stack_fds[SELECT_STACK_ALLOC/sizeof(long)]; | |
40774 | ||
40775 | + pax_track_stack(); | |
40776 | + | |
40777 | ret = -EINVAL; | |
40778 | if (n < 0) | |
40779 | goto out_nofds; | |
40780 | @@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf | |
40781 | struct poll_list *walk = head; | |
40782 | unsigned long todo = nfds; | |
40783 | ||
40784 | + pax_track_stack(); | |
40785 | + | |
40786 | + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1); | |
40787 | if (nfds > rlimit(RLIMIT_NOFILE)) | |
40788 | return -EINVAL; | |
40789 | ||
40790 | diff -urNp linux-3.0.3/fs/seq_file.c linux-3.0.3/fs/seq_file.c | |
40791 | --- linux-3.0.3/fs/seq_file.c 2011-07-21 22:17:23.000000000 -0400 | |
40792 | +++ linux-3.0.3/fs/seq_file.c 2011-08-23 21:47:56.000000000 -0400 | |
40793 | @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, | |
40794 | return 0; | |
40795 | } | |
40796 | if (!m->buf) { | |
40797 | - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL); | |
40798 | + m->size = PAGE_SIZE; | |
40799 | + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL); | |
40800 | if (!m->buf) | |
40801 | return -ENOMEM; | |
40802 | } | |
40803 | @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, | |
40804 | Eoverflow: | |
40805 | m->op->stop(m, p); | |
40806 | kfree(m->buf); | |
40807 | - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL); | |
40808 | + m->size <<= 1; | |
40809 | + m->buf = kmalloc(m->size, GFP_KERNEL); | |
40810 | return !m->buf ? -ENOMEM : -EAGAIN; | |
40811 | } | |
40812 | ||
40813 | @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char | |
40814 | m->version = file->f_version; | |
40815 | /* grab buffer if we didn't have one */ | |
40816 | if (!m->buf) { | |
40817 | - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL); | |
40818 | + m->size = PAGE_SIZE; | |
40819 | + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL); | |
40820 | if (!m->buf) | |
40821 | goto Enomem; | |
40822 | } | |
40823 | @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char | |
40824 | goto Fill; | |
40825 | m->op->stop(m, p); | |
40826 | kfree(m->buf); | |
40827 | - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL); | |
40828 | + m->size <<= 1; | |
40829 | + m->buf = kmalloc(m->size, GFP_KERNEL); | |
40830 | if (!m->buf) | |
40831 | goto Enomem; | |
40832 | m->count = 0; | |
40833 | @@ -549,7 +553,7 @@ static void single_stop(struct seq_file | |
40834 | int single_open(struct file *file, int (*show)(struct seq_file *, void *), | |
40835 | void *data) | |
40836 | { | |
40837 | - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL); | |
40838 | + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL); | |
40839 | int res = -ENOMEM; | |
40840 | ||
40841 | if (op) { | |
40842 | diff -urNp linux-3.0.3/fs/splice.c linux-3.0.3/fs/splice.c | |
40843 | --- linux-3.0.3/fs/splice.c 2011-07-21 22:17:23.000000000 -0400 | |
40844 | +++ linux-3.0.3/fs/splice.c 2011-08-23 21:48:14.000000000 -0400 | |
40845 | @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode | |
40846 | pipe_lock(pipe); | |
40847 | ||
40848 | for (;;) { | |
40849 | - if (!pipe->readers) { | |
40850 | + if (!atomic_read(&pipe->readers)) { | |
40851 | send_sig(SIGPIPE, current, 0); | |
40852 | if (!ret) | |
40853 | ret = -EPIPE; | |
40854 | @@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode | |
40855 | do_wakeup = 0; | |
40856 | } | |
40857 | ||
40858 | - pipe->waiting_writers++; | |
40859 | + atomic_inc(&pipe->waiting_writers); | |
40860 | pipe_wait(pipe); | |
40861 | - pipe->waiting_writers--; | |
40862 | + atomic_dec(&pipe->waiting_writers); | |
40863 | } | |
40864 | ||
40865 | pipe_unlock(pipe); | |
40866 | @@ -320,6 +320,8 @@ __generic_file_splice_read(struct file * | |
40867 | .spd_release = spd_release_page, | |
40868 | }; | |
40869 | ||
40870 | + pax_track_stack(); | |
40871 | + | |
40872 | if (splice_grow_spd(pipe, &spd)) | |
40873 | return -ENOMEM; | |
40874 | ||
40875 | @@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file | |
40876 | old_fs = get_fs(); | |
40877 | set_fs(get_ds()); | |
40878 | /* The cast to a user pointer is valid due to the set_fs() */ | |
40879 | - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos); | |
40880 | + res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos); | |
40881 | set_fs(old_fs); | |
40882 | ||
40883 | return res; | |
40884 | @@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file | |
40885 | old_fs = get_fs(); | |
40886 | set_fs(get_ds()); | |
40887 | /* The cast to a user pointer is valid due to the set_fs() */ | |
40888 | - res = vfs_write(file, (const char __user *)buf, count, &pos); | |
40889 | + res = vfs_write(file, (__force const char __user *)buf, count, &pos); | |
40890 | set_fs(old_fs); | |
40891 | ||
40892 | return res; | |
40893 | @@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct | |
40894 | .spd_release = spd_release_page, | |
40895 | }; | |
40896 | ||
40897 | + pax_track_stack(); | |
40898 | + | |
40899 | if (splice_grow_spd(pipe, &spd)) | |
40900 | return -ENOMEM; | |
40901 | ||
40902 | @@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct | |
40903 | goto err; | |
40904 | ||
40905 | this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset); | |
40906 | - vec[i].iov_base = (void __user *) page_address(page); | |
40907 | + vec[i].iov_base = (__force void __user *) page_address(page); | |
40908 | vec[i].iov_len = this_len; | |
40909 | spd.pages[i] = page; | |
40910 | spd.nr_pages++; | |
40911 | @@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed); | |
40912 | int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd) | |
40913 | { | |
40914 | while (!pipe->nrbufs) { | |
40915 | - if (!pipe->writers) | |
40916 | + if (!atomic_read(&pipe->writers)) | |
40917 | return 0; | |
40918 | ||
40919 | - if (!pipe->waiting_writers && sd->num_spliced) | |
40920 | + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced) | |
40921 | return 0; | |
40922 | ||
40923 | if (sd->flags & SPLICE_F_NONBLOCK) | |
40924 | @@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct fi | |
40925 | * out of the pipe right after the splice_to_pipe(). So set | |
40926 | * PIPE_READERS appropriately. | |
40927 | */ | |
40928 | - pipe->readers = 1; | |
40929 | + atomic_set(&pipe->readers, 1); | |
40930 | ||
40931 | current->splice_pipe = pipe; | |
40932 | } | |
40933 | @@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file | |
40934 | }; | |
40935 | long ret; | |
40936 | ||
40937 | + pax_track_stack(); | |
40938 | + | |
40939 | pipe = get_pipe_info(file); | |
40940 | if (!pipe) | |
40941 | return -EBADF; | |
40942 | @@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_ | |
40943 | ret = -ERESTARTSYS; | |
40944 | break; | |
40945 | } | |
40946 | - if (!pipe->writers) | |
40947 | + if (!atomic_read(&pipe->writers)) | |
40948 | break; | |
40949 | - if (!pipe->waiting_writers) { | |
40950 | + if (!atomic_read(&pipe->waiting_writers)) { | |
40951 | if (flags & SPLICE_F_NONBLOCK) { | |
40952 | ret = -EAGAIN; | |
40953 | break; | |
40954 | @@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_ | |
40955 | pipe_lock(pipe); | |
40956 | ||
40957 | while (pipe->nrbufs >= pipe->buffers) { | |
40958 | - if (!pipe->readers) { | |
40959 | + if (!atomic_read(&pipe->readers)) { | |
40960 | send_sig(SIGPIPE, current, 0); | |
40961 | ret = -EPIPE; | |
40962 | break; | |
40963 | @@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_ | |
40964 | ret = -ERESTARTSYS; | |
40965 | break; | |
40966 | } | |
40967 | - pipe->waiting_writers++; | |
40968 | + atomic_inc(&pipe->waiting_writers); | |
40969 | pipe_wait(pipe); | |
40970 | - pipe->waiting_writers--; | |
40971 | + atomic_dec(&pipe->waiting_writers); | |
40972 | } | |
40973 | ||
40974 | pipe_unlock(pipe); | |
40975 | @@ -1819,14 +1825,14 @@ retry: | |
40976 | pipe_double_lock(ipipe, opipe); | |
40977 | ||
40978 | do { | |
40979 | - if (!opipe->readers) { | |
40980 | + if (!atomic_read(&opipe->readers)) { | |
40981 | send_sig(SIGPIPE, current, 0); | |
40982 | if (!ret) | |
40983 | ret = -EPIPE; | |
40984 | break; | |
40985 | } | |
40986 | ||
40987 | - if (!ipipe->nrbufs && !ipipe->writers) | |
40988 | + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers)) | |
40989 | break; | |
40990 | ||
40991 | /* | |
40992 | @@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_i | |
40993 | pipe_double_lock(ipipe, opipe); | |
40994 | ||
40995 | do { | |
40996 | - if (!opipe->readers) { | |
40997 | + if (!atomic_read(&opipe->readers)) { | |
40998 | send_sig(SIGPIPE, current, 0); | |
40999 | if (!ret) | |
41000 | ret = -EPIPE; | |
41001 | @@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_i | |
41002 | * return EAGAIN if we have the potential of some data in the | |
41003 | * future, otherwise just return 0 | |
41004 | */ | |
41005 | - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK)) | |
41006 | + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK)) | |
41007 | ret = -EAGAIN; | |
41008 | ||
41009 | pipe_unlock(ipipe); | |
41010 | diff -urNp linux-3.0.3/fs/sysfs/file.c linux-3.0.3/fs/sysfs/file.c | |
41011 | --- linux-3.0.3/fs/sysfs/file.c 2011-07-21 22:17:23.000000000 -0400 | |
41012 | +++ linux-3.0.3/fs/sysfs/file.c 2011-08-23 21:47:56.000000000 -0400 | |
41013 | @@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent | |
41014 | ||
41015 | struct sysfs_open_dirent { | |
41016 | atomic_t refcnt; | |
41017 | - atomic_t event; | |
41018 | + atomic_unchecked_t event; | |
41019 | wait_queue_head_t poll; | |
41020 | struct list_head buffers; /* goes through sysfs_buffer.list */ | |
41021 | }; | |
41022 | @@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentr | |
41023 | if (!sysfs_get_active(attr_sd)) | |
41024 | return -ENODEV; | |
41025 | ||
41026 | - buffer->event = atomic_read(&attr_sd->s_attr.open->event); | |
41027 | + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event); | |
41028 | count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page); | |
41029 | ||
41030 | sysfs_put_active(attr_sd); | |
41031 | @@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct | |
41032 | return -ENOMEM; | |
41033 | ||
41034 | atomic_set(&new_od->refcnt, 0); | |
41035 | - atomic_set(&new_od->event, 1); | |
41036 | + atomic_set_unchecked(&new_od->event, 1); | |
41037 | init_waitqueue_head(&new_od->poll); | |
41038 | INIT_LIST_HEAD(&new_od->buffers); | |
41039 | goto retry; | |
41040 | @@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct fi | |
41041 | ||
41042 | sysfs_put_active(attr_sd); | |
41043 | ||
41044 | - if (buffer->event != atomic_read(&od->event)) | |
41045 | + if (buffer->event != atomic_read_unchecked(&od->event)) | |
41046 | goto trigger; | |
41047 | ||
41048 | return DEFAULT_POLLMASK; | |
41049 | @@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_di | |
41050 | ||
41051 | od = sd->s_attr.open; | |
41052 | if (od) { | |
41053 | - atomic_inc(&od->event); | |
41054 | + atomic_inc_unchecked(&od->event); | |
41055 | wake_up_interruptible(&od->poll); | |
41056 | } | |
41057 | ||
41058 | diff -urNp linux-3.0.3/fs/sysfs/mount.c linux-3.0.3/fs/sysfs/mount.c | |
41059 | --- linux-3.0.3/fs/sysfs/mount.c 2011-07-21 22:17:23.000000000 -0400 | |
41060 | +++ linux-3.0.3/fs/sysfs/mount.c 2011-08-23 21:48:14.000000000 -0400 | |
41061 | @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = { | |
41062 | .s_name = "", | |
41063 | .s_count = ATOMIC_INIT(1), | |
41064 | .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT), | |
41065 | +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT | |
41066 | + .s_mode = S_IFDIR | S_IRWXU, | |
41067 | +#else | |
41068 | .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO, | |
41069 | +#endif | |
41070 | .s_ino = 1, | |
41071 | }; | |
41072 | ||
41073 | diff -urNp linux-3.0.3/fs/sysfs/symlink.c linux-3.0.3/fs/sysfs/symlink.c | |
41074 | --- linux-3.0.3/fs/sysfs/symlink.c 2011-07-21 22:17:23.000000000 -0400 | |
41075 | +++ linux-3.0.3/fs/sysfs/symlink.c 2011-08-23 21:47:56.000000000 -0400 | |
41076 | @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de | |
41077 | ||
41078 | static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) | |
41079 | { | |
41080 | - char *page = nd_get_link(nd); | |
41081 | + const char *page = nd_get_link(nd); | |
41082 | if (!IS_ERR(page)) | |
41083 | free_page((unsigned long)page); | |
41084 | } | |
41085 | diff -urNp linux-3.0.3/fs/udf/inode.c linux-3.0.3/fs/udf/inode.c | |
41086 | --- linux-3.0.3/fs/udf/inode.c 2011-07-21 22:17:23.000000000 -0400 | |
41087 | +++ linux-3.0.3/fs/udf/inode.c 2011-08-23 21:48:14.000000000 -0400 | |
41088 | @@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk( | |
41089 | int goal = 0, pgoal = iinfo->i_location.logicalBlockNum; | |
41090 | int lastblock = 0; | |
41091 | ||
41092 | + pax_track_stack(); | |
41093 | + | |
41094 | prev_epos.offset = udf_file_entry_alloc_offset(inode); | |
41095 | prev_epos.block = iinfo->i_location; | |
41096 | prev_epos.bh = NULL; | |
41097 | diff -urNp linux-3.0.3/fs/udf/misc.c linux-3.0.3/fs/udf/misc.c | |
41098 | --- linux-3.0.3/fs/udf/misc.c 2011-07-21 22:17:23.000000000 -0400 | |
41099 | +++ linux-3.0.3/fs/udf/misc.c 2011-08-23 21:47:56.000000000 -0400 | |
41100 | @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id | |
41101 | ||
41102 | u8 udf_tag_checksum(const struct tag *t) | |
41103 | { | |
41104 | - u8 *data = (u8 *)t; | |
41105 | + const u8 *data = (const u8 *)t; | |
41106 | u8 checksum = 0; | |
41107 | int i; | |
41108 | for (i = 0; i < sizeof(struct tag); ++i) | |
41109 | diff -urNp linux-3.0.3/fs/utimes.c linux-3.0.3/fs/utimes.c | |
41110 | --- linux-3.0.3/fs/utimes.c 2011-07-21 22:17:23.000000000 -0400 | |
41111 | +++ linux-3.0.3/fs/utimes.c 2011-08-23 21:48:14.000000000 -0400 | |
41112 | @@ -1,6 +1,7 @@ | |
41113 | #include <linux/compiler.h> | |
41114 | #include <linux/file.h> | |
41115 | #include <linux/fs.h> | |
41116 | +#include <linux/security.h> | |
41117 | #include <linux/linkage.h> | |
41118 | #include <linux/mount.h> | |
41119 | #include <linux/namei.h> | |
41120 | @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa | |
41121 | goto mnt_drop_write_and_out; | |
41122 | } | |
41123 | } | |
41124 | + | |
41125 | + if (!gr_acl_handle_utime(path->dentry, path->mnt)) { | |
41126 | + error = -EACCES; | |
41127 | + goto mnt_drop_write_and_out; | |
41128 | + } | |
41129 | + | |
41130 | mutex_lock(&inode->i_mutex); | |
41131 | error = notify_change(path->dentry, &newattrs); | |
41132 | mutex_unlock(&inode->i_mutex); | |
41133 | diff -urNp linux-3.0.3/fs/xattr_acl.c linux-3.0.3/fs/xattr_acl.c | |
41134 | --- linux-3.0.3/fs/xattr_acl.c 2011-07-21 22:17:23.000000000 -0400 | |
41135 | +++ linux-3.0.3/fs/xattr_acl.c 2011-08-23 21:47:56.000000000 -0400 | |
41136 | @@ -17,8 +17,8 @@ | |
41137 | struct posix_acl * | |
41138 | posix_acl_from_xattr(const void *value, size_t size) | |
41139 | { | |
41140 | - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value; | |
41141 | - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end; | |
41142 | + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value; | |
41143 | + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end; | |
41144 | int count; | |
41145 | struct posix_acl *acl; | |
41146 | struct posix_acl_entry *acl_e; | |
41147 | diff -urNp linux-3.0.3/fs/xattr.c linux-3.0.3/fs/xattr.c | |
41148 | --- linux-3.0.3/fs/xattr.c 2011-07-21 22:17:23.000000000 -0400 | |
41149 | +++ linux-3.0.3/fs/xattr.c 2011-08-23 21:48:14.000000000 -0400 | |
41150 | @@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr); | |
41151 | * Extended attribute SET operations | |
41152 | */ | |
41153 | static long | |
41154 | -setxattr(struct dentry *d, const char __user *name, const void __user *value, | |
41155 | +setxattr(struct path *path, const char __user *name, const void __user *value, | |
41156 | size_t size, int flags) | |
41157 | { | |
41158 | int error; | |
41159 | @@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __ | |
41160 | return PTR_ERR(kvalue); | |
41161 | } | |
41162 | ||
41163 | - error = vfs_setxattr(d, kname, kvalue, size, flags); | |
41164 | + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) { | |
41165 | + error = -EACCES; | |
41166 | + goto out; | |
41167 | + } | |
41168 | + | |
41169 | + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags); | |
41170 | +out: | |
41171 | kfree(kvalue); | |
41172 | return error; | |
41173 | } | |
41174 | @@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __u | |
41175 | return error; | |
41176 | error = mnt_want_write(path.mnt); | |
41177 | if (!error) { | |
41178 | - error = setxattr(path.dentry, name, value, size, flags); | |
41179 | + error = setxattr(&path, name, value, size, flags); | |
41180 | mnt_drop_write(path.mnt); | |
41181 | } | |
41182 | path_put(&path); | |
41183 | @@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __ | |
41184 | return error; | |
41185 | error = mnt_want_write(path.mnt); | |
41186 | if (!error) { | |
41187 | - error = setxattr(path.dentry, name, value, size, flags); | |
41188 | + error = setxattr(&path, name, value, size, flags); | |
41189 | mnt_drop_write(path.mnt); | |
41190 | } | |
41191 | path_put(&path); | |
41192 | @@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons | |
41193 | const void __user *,value, size_t, size, int, flags) | |
41194 | { | |
41195 | struct file *f; | |
41196 | - struct dentry *dentry; | |
41197 | int error = -EBADF; | |
41198 | ||
41199 | f = fget(fd); | |
41200 | if (!f) | |
41201 | return error; | |
41202 | - dentry = f->f_path.dentry; | |
41203 | - audit_inode(NULL, dentry); | |
41204 | + audit_inode(NULL, f->f_path.dentry); | |
41205 | error = mnt_want_write_file(f); | |
41206 | if (!error) { | |
41207 | - error = setxattr(dentry, name, value, size, flags); | |
41208 | + error = setxattr(&f->f_path, name, value, size, flags); | |
41209 | mnt_drop_write(f->f_path.mnt); | |
41210 | } | |
41211 | fput(f); | |
41212 | diff -urNp linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl32.c linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl32.c | |
41213 | --- linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-07-21 22:17:23.000000000 -0400 | |
41214 | +++ linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-08-23 21:48:14.000000000 -0400 | |
41215 | @@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1( | |
41216 | xfs_fsop_geom_t fsgeo; | |
41217 | int error; | |
41218 | ||
41219 | + memset(&fsgeo, 0, sizeof(fsgeo)); | |
41220 | error = xfs_fs_geometry(mp, &fsgeo, 3); | |
41221 | if (error) | |
41222 | return -error; | |
41223 | diff -urNp linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl.c linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl.c | |
41224 | --- linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl.c 2011-07-21 22:17:23.000000000 -0400 | |
41225 | +++ linux-3.0.3/fs/xfs/linux-2.6/xfs_ioctl.c 2011-08-23 21:47:56.000000000 -0400 | |
41226 | @@ -128,7 +128,7 @@ xfs_find_handle( | |
41227 | } | |
41228 | ||
41229 | error = -EFAULT; | |
41230 | - if (copy_to_user(hreq->ohandle, &handle, hsize) || | |
41231 | + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) || | |
41232 | copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32))) | |
41233 | goto out_put; | |
41234 | ||
41235 | diff -urNp linux-3.0.3/fs/xfs/linux-2.6/xfs_iops.c linux-3.0.3/fs/xfs/linux-2.6/xfs_iops.c | |
41236 | --- linux-3.0.3/fs/xfs/linux-2.6/xfs_iops.c 2011-07-21 22:17:23.000000000 -0400 | |
41237 | +++ linux-3.0.3/fs/xfs/linux-2.6/xfs_iops.c 2011-08-23 21:47:56.000000000 -0400 | |
41238 | @@ -437,7 +437,7 @@ xfs_vn_put_link( | |
41239 | struct nameidata *nd, | |
41240 | void *p) | |
41241 | { | |
41242 | - char *s = nd_get_link(nd); | |
41243 | + const char *s = nd_get_link(nd); | |
41244 | ||
41245 | if (!IS_ERR(s)) | |
41246 | kfree(s); | |
41247 | diff -urNp linux-3.0.3/fs/xfs/xfs_bmap.c linux-3.0.3/fs/xfs/xfs_bmap.c | |
41248 | --- linux-3.0.3/fs/xfs/xfs_bmap.c 2011-07-21 22:17:23.000000000 -0400 | |
41249 | +++ linux-3.0.3/fs/xfs/xfs_bmap.c 2011-08-23 21:47:56.000000000 -0400 | |
41250 | @@ -253,7 +253,7 @@ xfs_bmap_validate_ret( | |
41251 | int nmap, | |
41252 | int ret_nmap); | |
41253 | #else | |
41254 | -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) | |
41255 | +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0) | |
41256 | #endif /* DEBUG */ | |
41257 | ||
41258 | STATIC int | |
41259 | diff -urNp linux-3.0.3/fs/xfs/xfs_dir2_sf.c linux-3.0.3/fs/xfs/xfs_dir2_sf.c | |
41260 | --- linux-3.0.3/fs/xfs/xfs_dir2_sf.c 2011-07-21 22:17:23.000000000 -0400 | |
41261 | +++ linux-3.0.3/fs/xfs/xfs_dir2_sf.c 2011-08-23 21:47:56.000000000 -0400 | |
41262 | @@ -780,7 +780,15 @@ xfs_dir2_sf_getdents( | |
41263 | } | |
41264 | ||
41265 | ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep)); | |
41266 | - if (filldir(dirent, (char *)sfep->name, sfep->namelen, | |
41267 | + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) { | |
41268 | + char name[sfep->namelen]; | |
41269 | + memcpy(name, sfep->name, sfep->namelen); | |
41270 | + if (filldir(dirent, name, sfep->namelen, | |
41271 | + off & 0x7fffffff, ino, DT_UNKNOWN)) { | |
41272 | + *offset = off & 0x7fffffff; | |
41273 | + return 0; | |
41274 | + } | |
41275 | + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen, | |
41276 | off & 0x7fffffff, ino, DT_UNKNOWN)) { | |
41277 | *offset = off & 0x7fffffff; | |
41278 | return 0; | |
41279 | diff -urNp linux-3.0.3/grsecurity/gracl_alloc.c linux-3.0.3/grsecurity/gracl_alloc.c | |
41280 | --- linux-3.0.3/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500 | |
41281 | +++ linux-3.0.3/grsecurity/gracl_alloc.c 2011-08-23 21:48:14.000000000 -0400 | |
41282 | @@ -0,0 +1,105 @@ | |
41283 | +#include <linux/kernel.h> | |
41284 | +#include <linux/mm.h> | |
41285 | +#include <linux/slab.h> | |
41286 | +#include <linux/vmalloc.h> | |
41287 | +#include <linux/gracl.h> | |
41288 | +#include <linux/grsecurity.h> | |
41289 | + | |
41290 | +static unsigned long alloc_stack_next = 1; | |
41291 | +static unsigned long alloc_stack_size = 1; | |
41292 | +static void **alloc_stack; | |
41293 | + | |
41294 | +static __inline__ int | |
41295 | +alloc_pop(void) | |
41296 | +{ | |
41297 | + if (alloc_stack_next == 1) | |
41298 | + return 0; | |
41299 | + | |
41300 | + kfree(alloc_stack[alloc_stack_next - 2]); | |
41301 | + | |
41302 | + alloc_stack_next--; | |
41303 | + | |
41304 | + return 1; | |
41305 | +} | |
41306 | + | |
41307 | +static __inline__ int | |
41308 | +alloc_push(void *buf) | |
41309 | +{ | |
41310 | + if (alloc_stack_next >= alloc_stack_size) | |
41311 | + return 1; | |
41312 | + | |
41313 | + alloc_stack[alloc_stack_next - 1] = buf; | |
41314 | + | |
41315 | + alloc_stack_next++; | |
41316 | + | |
41317 | + return 0; | |
41318 | +} | |
41319 | + | |
41320 | +void * | |
41321 | +acl_alloc(unsigned long len) | |
41322 | +{ | |
41323 | + void *ret = NULL; | |
41324 | + | |
41325 | + if (!len || len > PAGE_SIZE) | |
41326 | + goto out; | |
41327 | + | |
41328 | + ret = kmalloc(len, GFP_KERNEL); | |
41329 | + | |
41330 | + if (ret) { | |
41331 | + if (alloc_push(ret)) { | |
41332 | + kfree(ret); | |
41333 | + ret = NULL; | |
41334 | + } | |
41335 | + } | |
41336 | + | |
41337 | +out: | |
41338 | + return ret; | |
41339 | +} | |
41340 | + | |
41341 | +void * | |
41342 | +acl_alloc_num(unsigned long num, unsigned long len) | |
41343 | +{ | |
41344 | + if (!len || (num > (PAGE_SIZE / len))) | |
41345 | + return NULL; | |
41346 | + | |
41347 | + return acl_alloc(num * len); | |
41348 | +} | |
41349 | + | |
41350 | +void | |
41351 | +acl_free_all(void) | |
41352 | +{ | |
41353 | + if (gr_acl_is_enabled() || !alloc_stack) | |
41354 | + return; | |
41355 | + | |
41356 | + while (alloc_pop()) ; | |
41357 | + | |
41358 | + if (alloc_stack) { | |
41359 | + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE) | |
41360 | + kfree(alloc_stack); | |
41361 | + else | |
41362 | + vfree(alloc_stack); | |
41363 | + } | |
41364 | + | |
41365 | + alloc_stack = NULL; | |
41366 | + alloc_stack_size = 1; | |
41367 | + alloc_stack_next = 1; | |
41368 | + | |
41369 | + return; | |
41370 | +} | |
41371 | + | |
41372 | +int | |
41373 | +acl_alloc_stack_init(unsigned long size) | |
41374 | +{ | |
41375 | + if ((size * sizeof (void *)) <= PAGE_SIZE) | |
41376 | + alloc_stack = | |
41377 | + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL); | |
41378 | + else | |
41379 | + alloc_stack = (void **) vmalloc(size * sizeof (void *)); | |
41380 | + | |
41381 | + alloc_stack_size = size; | |
41382 | + | |
41383 | + if (!alloc_stack) | |
41384 | + return 0; | |
41385 | + else | |
41386 | + return 1; | |
41387 | +} | |
41388 | diff -urNp linux-3.0.3/grsecurity/gracl.c linux-3.0.3/grsecurity/gracl.c | |
41389 | --- linux-3.0.3/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500 | |
41390 | +++ linux-3.0.3/grsecurity/gracl.c 2011-08-23 21:48:14.000000000 -0400 | |
41391 | @@ -0,0 +1,4106 @@ | |
41392 | +#include <linux/kernel.h> | |
41393 | +#include <linux/module.h> | |
41394 | +#include <linux/sched.h> | |
41395 | +#include <linux/mm.h> | |
41396 | +#include <linux/file.h> | |
41397 | +#include <linux/fs.h> | |
41398 | +#include <linux/namei.h> | |
41399 | +#include <linux/mount.h> | |
41400 | +#include <linux/tty.h> | |
41401 | +#include <linux/proc_fs.h> | |
41402 | +#include <linux/lglock.h> | |
41403 | +#include <linux/slab.h> | |
41404 | +#include <linux/vmalloc.h> | |
41405 | +#include <linux/types.h> | |
41406 | +#include <linux/sysctl.h> | |
41407 | +#include <linux/netdevice.h> | |
41408 | +#include <linux/ptrace.h> | |
41409 | +#include <linux/gracl.h> | |
41410 | +#include <linux/gralloc.h> | |
41411 | +#include <linux/grsecurity.h> | |
41412 | +#include <linux/grinternal.h> | |
41413 | +#include <linux/pid_namespace.h> | |
41414 | +#include <linux/fdtable.h> | |
41415 | +#include <linux/percpu.h> | |
41416 | + | |
41417 | +#include <asm/uaccess.h> | |
41418 | +#include <asm/errno.h> | |
41419 | +#include <asm/mman.h> | |
41420 | + | |
41421 | +static struct acl_role_db acl_role_set; | |
41422 | +static struct name_db name_set; | |
41423 | +static struct inodev_db inodev_set; | |
41424 | + | |
41425 | +/* for keeping track of userspace pointers used for subjects, so we | |
41426 | + can share references in the kernel as well | |
41427 | +*/ | |
41428 | + | |
41429 | +static struct path real_root; | |
41430 | + | |
41431 | +static struct acl_subj_map_db subj_map_set; | |
41432 | + | |
41433 | +static struct acl_role_label *default_role; | |
41434 | + | |
41435 | +static struct acl_role_label *role_list; | |
41436 | + | |
41437 | +static u16 acl_sp_role_value; | |
41438 | + | |
41439 | +extern char *gr_shared_page[4]; | |
41440 | +static DEFINE_MUTEX(gr_dev_mutex); | |
41441 | +DEFINE_RWLOCK(gr_inode_lock); | |
41442 | + | |
41443 | +struct gr_arg *gr_usermode; | |
41444 | + | |
41445 | +static unsigned int gr_status __read_only = GR_STATUS_INIT; | |
41446 | + | |
41447 | +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum); | |
41448 | +extern void gr_clear_learn_entries(void); | |
41449 | + | |
41450 | +#ifdef CONFIG_GRKERNSEC_RESLOG | |
41451 | +extern void gr_log_resource(const struct task_struct *task, | |
41452 | + const int res, const unsigned long wanted, const int gt); | |
41453 | +#endif | |
41454 | + | |
41455 | +unsigned char *gr_system_salt; | |
41456 | +unsigned char *gr_system_sum; | |
41457 | + | |
41458 | +static struct sprole_pw **acl_special_roles = NULL; | |
41459 | +static __u16 num_sprole_pws = 0; | |
41460 | + | |
41461 | +static struct acl_role_label *kernel_role = NULL; | |
41462 | + | |
41463 | +static unsigned int gr_auth_attempts = 0; | |
41464 | +static unsigned long gr_auth_expires = 0UL; | |
41465 | + | |
41466 | +#ifdef CONFIG_NET | |
41467 | +extern struct vfsmount *sock_mnt; | |
41468 | +#endif | |
41469 | + | |
41470 | +extern struct vfsmount *pipe_mnt; | |
41471 | +extern struct vfsmount *shm_mnt; | |
41472 | +#ifdef CONFIG_HUGETLBFS | |
41473 | +extern struct vfsmount *hugetlbfs_vfsmount; | |
41474 | +#endif | |
41475 | + | |
41476 | +static struct acl_object_label *fakefs_obj_rw; | |
41477 | +static struct acl_object_label *fakefs_obj_rwx; | |
41478 | + | |
41479 | +extern int gr_init_uidset(void); | |
41480 | +extern void gr_free_uidset(void); | |
41481 | +extern void gr_remove_uid(uid_t uid); | |
41482 | +extern int gr_find_uid(uid_t uid); | |
41483 | + | |
41484 | +DECLARE_BRLOCK(vfsmount_lock); | |
41485 | + | |
41486 | +__inline__ int | |
41487 | +gr_acl_is_enabled(void) | |
41488 | +{ | |
41489 | + return (gr_status & GR_READY); | |
41490 | +} | |
41491 | + | |
41492 | +#ifdef CONFIG_BTRFS_FS | |
41493 | +extern dev_t get_btrfs_dev_from_inode(struct inode *inode); | |
41494 | +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat); | |
41495 | +#endif | |
41496 | + | |
41497 | +static inline dev_t __get_dev(const struct dentry *dentry) | |
41498 | +{ | |
41499 | +#ifdef CONFIG_BTRFS_FS | |
41500 | + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr) | |
41501 | + return get_btrfs_dev_from_inode(dentry->d_inode); | |
41502 | + else | |
41503 | +#endif | |
41504 | + return dentry->d_inode->i_sb->s_dev; | |
41505 | +} | |
41506 | + | |
41507 | +dev_t gr_get_dev_from_dentry(struct dentry *dentry) | |
41508 | +{ | |
41509 | + return __get_dev(dentry); | |
41510 | +} | |
41511 | + | |
41512 | +static char gr_task_roletype_to_char(struct task_struct *task) | |
41513 | +{ | |
41514 | + switch (task->role->roletype & | |
41515 | + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP | | |
41516 | + GR_ROLE_SPECIAL)) { | |
41517 | + case GR_ROLE_DEFAULT: | |
41518 | + return 'D'; | |
41519 | + case GR_ROLE_USER: | |
41520 | + return 'U'; | |
41521 | + case GR_ROLE_GROUP: | |
41522 | + return 'G'; | |
41523 | + case GR_ROLE_SPECIAL: | |
41524 | + return 'S'; | |
41525 | + } | |
41526 | + | |
41527 | + return 'X'; | |
41528 | +} | |
41529 | + | |
41530 | +char gr_roletype_to_char(void) | |
41531 | +{ | |
41532 | + return gr_task_roletype_to_char(current); | |
41533 | +} | |
41534 | + | |
41535 | +__inline__ int | |
41536 | +gr_acl_tpe_check(void) | |
41537 | +{ | |
41538 | + if (unlikely(!(gr_status & GR_READY))) | |
41539 | + return 0; | |
41540 | + if (current->role->roletype & GR_ROLE_TPE) | |
41541 | + return 1; | |
41542 | + else | |
41543 | + return 0; | |
41544 | +} | |
41545 | + | |
41546 | +int | |
41547 | +gr_handle_rawio(const struct inode *inode) | |
41548 | +{ | |
41549 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS | |
41550 | + if (inode && S_ISBLK(inode->i_mode) && | |
41551 | + grsec_enable_chroot_caps && proc_is_chrooted(current) && | |
41552 | + !capable(CAP_SYS_RAWIO)) | |
41553 | + return 1; | |
41554 | +#endif | |
41555 | + return 0; | |
41556 | +} | |
41557 | + | |
41558 | +static int | |
41559 | +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb) | |
41560 | +{ | |
41561 | + if (likely(lena != lenb)) | |
41562 | + return 0; | |
41563 | + | |
41564 | + return !memcmp(a, b, lena); | |
41565 | +} | |
41566 | + | |
41567 | +static int prepend(char **buffer, int *buflen, const char *str, int namelen) | |
41568 | +{ | |
41569 | + *buflen -= namelen; | |
41570 | + if (*buflen < 0) | |
41571 | + return -ENAMETOOLONG; | |
41572 | + *buffer -= namelen; | |
41573 | + memcpy(*buffer, str, namelen); | |
41574 | + return 0; | |
41575 | +} | |
41576 | + | |
41577 | +static int prepend_name(char **buffer, int *buflen, struct qstr *name) | |
41578 | +{ | |
41579 | + return prepend(buffer, buflen, name->name, name->len); | |
41580 | +} | |
41581 | + | |
41582 | +static int prepend_path(const struct path *path, struct path *root, | |
41583 | + char **buffer, int *buflen) | |
41584 | +{ | |
41585 | + struct dentry *dentry = path->dentry; | |
41586 | + struct vfsmount *vfsmnt = path->mnt; | |
41587 | + bool slash = false; | |
41588 | + int error = 0; | |
41589 | + | |
41590 | + while (dentry != root->dentry || vfsmnt != root->mnt) { | |
41591 | + struct dentry * parent; | |
41592 | + | |
41593 | + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { | |
41594 | + /* Global root? */ | |
41595 | + if (vfsmnt->mnt_parent == vfsmnt) { | |
41596 | + goto out; | |
41597 | + } | |
41598 | + dentry = vfsmnt->mnt_mountpoint; | |
41599 | + vfsmnt = vfsmnt->mnt_parent; | |
41600 | + continue; | |
41601 | + } | |
41602 | + parent = dentry->d_parent; | |
41603 | + prefetch(parent); | |
41604 | + spin_lock(&dentry->d_lock); | |
41605 | + error = prepend_name(buffer, buflen, &dentry->d_name); | |
41606 | + spin_unlock(&dentry->d_lock); | |
41607 | + if (!error) | |
41608 | + error = prepend(buffer, buflen, "/", 1); | |
41609 | + if (error) | |
41610 | + break; | |
41611 | + | |
41612 | + slash = true; | |
41613 | + dentry = parent; | |
41614 | + } | |
41615 | + | |
41616 | +out: | |
41617 | + if (!error && !slash) | |
41618 | + error = prepend(buffer, buflen, "/", 1); | |
41619 | + | |
41620 | + return error; | |
41621 | +} | |
41622 | + | |
41623 | +/* this must be called with vfsmount_lock and rename_lock held */ | |
41624 | + | |
41625 | +static char *__our_d_path(const struct path *path, struct path *root, | |
41626 | + char *buf, int buflen) | |
41627 | +{ | |
41628 | + char *res = buf + buflen; | |
41629 | + int error; | |
41630 | + | |
41631 | + prepend(&res, &buflen, "\0", 1); | |
41632 | + error = prepend_path(path, root, &res, &buflen); | |
41633 | + if (error) | |
41634 | + return ERR_PTR(error); | |
41635 | + | |
41636 | + return res; | |
41637 | +} | |
41638 | + | |
41639 | +static char * | |
41640 | +gen_full_path(struct path *path, struct path *root, char *buf, int buflen) | |
41641 | +{ | |
41642 | + char *retval; | |
41643 | + | |
41644 | + retval = __our_d_path(path, root, buf, buflen); | |
41645 | + if (unlikely(IS_ERR(retval))) | |
41646 | + retval = strcpy(buf, "<path too long>"); | |
41647 | + else if (unlikely(retval[1] == '/' && retval[2] == '\0')) | |
41648 | + retval[1] = '\0'; | |
41649 | + | |
41650 | + return retval; | |
41651 | +} | |
41652 | + | |
41653 | +static char * | |
41654 | +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt, | |
41655 | + char *buf, int buflen) | |
41656 | +{ | |
41657 | + struct path path; | |
41658 | + char *res; | |
41659 | + | |
41660 | + path.dentry = (struct dentry *)dentry; | |
41661 | + path.mnt = (struct vfsmount *)vfsmnt; | |
41662 | + | |
41663 | + /* we can use real_root.dentry, real_root.mnt, because this is only called | |
41664 | + by the RBAC system */ | |
41665 | + res = gen_full_path(&path, &real_root, buf, buflen); | |
41666 | + | |
41667 | + return res; | |
41668 | +} | |
41669 | + | |
41670 | +static char * | |
41671 | +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt, | |
41672 | + char *buf, int buflen) | |
41673 | +{ | |
41674 | + char *res; | |
41675 | + struct path path; | |
41676 | + struct path root; | |
41677 | + struct task_struct *reaper = &init_task; | |
41678 | + | |
41679 | + path.dentry = (struct dentry *)dentry; | |
41680 | + path.mnt = (struct vfsmount *)vfsmnt; | |
41681 | + | |
41682 | + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */ | |
41683 | + get_fs_root(reaper->fs, &root); | |
41684 | + | |
41685 | + write_seqlock(&rename_lock); | |
41686 | + br_read_lock(vfsmount_lock); | |
41687 | + res = gen_full_path(&path, &root, buf, buflen); | |
41688 | + br_read_unlock(vfsmount_lock); | |
41689 | + write_sequnlock(&rename_lock); | |
41690 | + | |
41691 | + path_put(&root); | |
41692 | + return res; | |
41693 | +} | |
41694 | + | |
41695 | +static char * | |
41696 | +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt) | |
41697 | +{ | |
41698 | + char *ret; | |
41699 | + write_seqlock(&rename_lock); | |
41700 | + br_read_lock(vfsmount_lock); | |
41701 | + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()), | |
41702 | + PAGE_SIZE); | |
41703 | + br_read_unlock(vfsmount_lock); | |
41704 | + write_sequnlock(&rename_lock); | |
41705 | + return ret; | |
41706 | +} | |
41707 | + | |
41708 | +char * | |
41709 | +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt) | |
41710 | +{ | |
41711 | + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()), | |
41712 | + PAGE_SIZE); | |
41713 | +} | |
41714 | + | |
41715 | +char * | |
41716 | +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt) | |
41717 | +{ | |
41718 | + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()), | |
41719 | + PAGE_SIZE); | |
41720 | +} | |
41721 | + | |
41722 | +char * | |
41723 | +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt) | |
41724 | +{ | |
41725 | + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()), | |
41726 | + PAGE_SIZE); | |
41727 | +} | |
41728 | + | |
41729 | +char * | |
41730 | +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt) | |
41731 | +{ | |
41732 | + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()), | |
41733 | + PAGE_SIZE); | |
41734 | +} | |
41735 | + | |
41736 | +char * | |
41737 | +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt) | |
41738 | +{ | |
41739 | + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()), | |
41740 | + PAGE_SIZE); | |
41741 | +} | |
41742 | + | |
41743 | +__inline__ __u32 | |
41744 | +to_gr_audit(const __u32 reqmode) | |
41745 | +{ | |
41746 | + /* masks off auditable permission flags, then shifts them to create | |
41747 | + auditing flags, and adds the special case of append auditing if | |
41748 | + we're requesting write */ | |
41749 | + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0)); | |
41750 | +} | |
41751 | + | |
41752 | +struct acl_subject_label * | |
41753 | +lookup_subject_map(const struct acl_subject_label *userp) | |
41754 | +{ | |
41755 | + unsigned int index = shash(userp, subj_map_set.s_size); | |
41756 | + struct subject_map *match; | |
41757 | + | |
41758 | + match = subj_map_set.s_hash[index]; | |
41759 | + | |
41760 | + while (match && match->user != userp) | |
41761 | + match = match->next; | |
41762 | + | |
41763 | + if (match != NULL) | |
41764 | + return match->kernel; | |
41765 | + else | |
41766 | + return NULL; | |
41767 | +} | |
41768 | + | |
41769 | +static void | |
41770 | +insert_subj_map_entry(struct subject_map *subjmap) | |
41771 | +{ | |
41772 | + unsigned int index = shash(subjmap->user, subj_map_set.s_size); | |
41773 | + struct subject_map **curr; | |
41774 | + | |
41775 | + subjmap->prev = NULL; | |
41776 | + | |
41777 | + curr = &subj_map_set.s_hash[index]; | |
41778 | + if (*curr != NULL) | |
41779 | + (*curr)->prev = subjmap; | |
41780 | + | |
41781 | + subjmap->next = *curr; | |
41782 | + *curr = subjmap; | |
41783 | + | |
41784 | + return; | |
41785 | +} | |
41786 | + | |
41787 | +static struct acl_role_label * | |
41788 | +lookup_acl_role_label(const struct task_struct *task, const uid_t uid, | |
41789 | + const gid_t gid) | |
41790 | +{ | |
41791 | + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size); | |
41792 | + struct acl_role_label *match; | |
41793 | + struct role_allowed_ip *ipp; | |
41794 | + unsigned int x; | |
41795 | + u32 curr_ip = task->signal->curr_ip; | |
41796 | + | |
41797 | + task->signal->saved_ip = curr_ip; | |
41798 | + | |
41799 | + match = acl_role_set.r_hash[index]; | |
41800 | + | |
41801 | + while (match) { | |
41802 | + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) { | |
41803 | + for (x = 0; x < match->domain_child_num; x++) { | |
41804 | + if (match->domain_children[x] == uid) | |
41805 | + goto found; | |
41806 | + } | |
41807 | + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER) | |
41808 | + break; | |
41809 | + match = match->next; | |
41810 | + } | |
41811 | +found: | |
41812 | + if (match == NULL) { | |
41813 | + try_group: | |
41814 | + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size); | |
41815 | + match = acl_role_set.r_hash[index]; | |
41816 | + | |
41817 | + while (match) { | |
41818 | + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) { | |
41819 | + for (x = 0; x < match->domain_child_num; x++) { | |
41820 | + if (match->domain_children[x] == gid) | |
41821 | + goto found2; | |
41822 | + } | |
41823 | + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP) | |
41824 | + break; | |
41825 | + match = match->next; | |
41826 | + } | |
41827 | +found2: | |
41828 | + if (match == NULL) | |
41829 | + match = default_role; | |
41830 | + if (match->allowed_ips == NULL) | |
41831 | + return match; | |
41832 | + else { | |
41833 | + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) { | |
41834 | + if (likely | |
41835 | + ((ntohl(curr_ip) & ipp->netmask) == | |
41836 | + (ntohl(ipp->addr) & ipp->netmask))) | |
41837 | + return match; | |
41838 | + } | |
41839 | + match = default_role; | |
41840 | + } | |
41841 | + } else if (match->allowed_ips == NULL) { | |
41842 | + return match; | |
41843 | + } else { | |
41844 | + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) { | |
41845 | + if (likely | |
41846 | + ((ntohl(curr_ip) & ipp->netmask) == | |
41847 | + (ntohl(ipp->addr) & ipp->netmask))) | |
41848 | + return match; | |
41849 | + } | |
41850 | + goto try_group; | |
41851 | + } | |
41852 | + | |
41853 | + return match; | |
41854 | +} | |
41855 | + | |
41856 | +struct acl_subject_label * | |
41857 | +lookup_acl_subj_label(const ino_t ino, const dev_t dev, | |
41858 | + const struct acl_role_label *role) | |
41859 | +{ | |
41860 | + unsigned int index = fhash(ino, dev, role->subj_hash_size); | |
41861 | + struct acl_subject_label *match; | |
41862 | + | |
41863 | + match = role->subj_hash[index]; | |
41864 | + | |
41865 | + while (match && (match->inode != ino || match->device != dev || | |
41866 | + (match->mode & GR_DELETED))) { | |
41867 | + match = match->next; | |
41868 | + } | |
41869 | + | |
41870 | + if (match && !(match->mode & GR_DELETED)) | |
41871 | + return match; | |
41872 | + else | |
41873 | + return NULL; | |
41874 | +} | |
41875 | + | |
41876 | +struct acl_subject_label * | |
41877 | +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev, | |
41878 | + const struct acl_role_label *role) | |
41879 | +{ | |
41880 | + unsigned int index = fhash(ino, dev, role->subj_hash_size); | |
41881 | + struct acl_subject_label *match; | |
41882 | + | |
41883 | + match = role->subj_hash[index]; | |
41884 | + | |
41885 | + while (match && (match->inode != ino || match->device != dev || | |
41886 | + !(match->mode & GR_DELETED))) { | |
41887 | + match = match->next; | |
41888 | + } | |
41889 | + | |
41890 | + if (match && (match->mode & GR_DELETED)) | |
41891 | + return match; | |
41892 | + else | |
41893 | + return NULL; | |
41894 | +} | |
41895 | + | |
41896 | +static struct acl_object_label * | |
41897 | +lookup_acl_obj_label(const ino_t ino, const dev_t dev, | |
41898 | + const struct acl_subject_label *subj) | |
41899 | +{ | |
41900 | + unsigned int index = fhash(ino, dev, subj->obj_hash_size); | |
41901 | + struct acl_object_label *match; | |
41902 | + | |
41903 | + match = subj->obj_hash[index]; | |
41904 | + | |
41905 | + while (match && (match->inode != ino || match->device != dev || | |
41906 | + (match->mode & GR_DELETED))) { | |
41907 | + match = match->next; | |
41908 | + } | |
41909 | + | |
41910 | + if (match && !(match->mode & GR_DELETED)) | |
41911 | + return match; | |
41912 | + else | |
41913 | + return NULL; | |
41914 | +} | |
41915 | + | |
41916 | +static struct acl_object_label * | |
41917 | +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev, | |
41918 | + const struct acl_subject_label *subj) | |
41919 | +{ | |
41920 | + unsigned int index = fhash(ino, dev, subj->obj_hash_size); | |
41921 | + struct acl_object_label *match; | |
41922 | + | |
41923 | + match = subj->obj_hash[index]; | |
41924 | + | |
41925 | + while (match && (match->inode != ino || match->device != dev || | |
41926 | + !(match->mode & GR_DELETED))) { | |
41927 | + match = match->next; | |
41928 | + } | |
41929 | + | |
41930 | + if (match && (match->mode & GR_DELETED)) | |
41931 | + return match; | |
41932 | + | |
41933 | + match = subj->obj_hash[index]; | |
41934 | + | |
41935 | + while (match && (match->inode != ino || match->device != dev || | |
41936 | + (match->mode & GR_DELETED))) { | |
41937 | + match = match->next; | |
41938 | + } | |
41939 | + | |
41940 | + if (match && !(match->mode & GR_DELETED)) | |
41941 | + return match; | |
41942 | + else | |
41943 | + return NULL; | |
41944 | +} | |
41945 | + | |
41946 | +static struct name_entry * | |
41947 | +lookup_name_entry(const char *name) | |
41948 | +{ | |
41949 | + unsigned int len = strlen(name); | |
41950 | + unsigned int key = full_name_hash(name, len); | |
41951 | + unsigned int index = key % name_set.n_size; | |
41952 | + struct name_entry *match; | |
41953 | + | |
41954 | + match = name_set.n_hash[index]; | |
41955 | + | |
41956 | + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len))) | |
41957 | + match = match->next; | |
41958 | + | |
41959 | + return match; | |
41960 | +} | |
41961 | + | |
41962 | +static struct name_entry * | |
41963 | +lookup_name_entry_create(const char *name) | |
41964 | +{ | |
41965 | + unsigned int len = strlen(name); | |
41966 | + unsigned int key = full_name_hash(name, len); | |
41967 | + unsigned int index = key % name_set.n_size; | |
41968 | + struct name_entry *match; | |
41969 | + | |
41970 | + match = name_set.n_hash[index]; | |
41971 | + | |
41972 | + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) || | |
41973 | + !match->deleted)) | |
41974 | + match = match->next; | |
41975 | + | |
41976 | + if (match && match->deleted) | |
41977 | + return match; | |
41978 | + | |
41979 | + match = name_set.n_hash[index]; | |
41980 | + | |
41981 | + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) || | |
41982 | + match->deleted)) | |
41983 | + match = match->next; | |
41984 | + | |
41985 | + if (match && !match->deleted) | |
41986 | + return match; | |
41987 | + else | |
41988 | + return NULL; | |
41989 | +} | |
41990 | + | |
41991 | +static struct inodev_entry * | |
41992 | +lookup_inodev_entry(const ino_t ino, const dev_t dev) | |
41993 | +{ | |
41994 | + unsigned int index = fhash(ino, dev, inodev_set.i_size); | |
41995 | + struct inodev_entry *match; | |
41996 | + | |
41997 | + match = inodev_set.i_hash[index]; | |
41998 | + | |
41999 | + while (match && (match->nentry->inode != ino || match->nentry->device != dev)) | |
42000 | + match = match->next; | |
42001 | + | |
42002 | + return match; | |
42003 | +} | |
42004 | + | |
42005 | +static void | |
42006 | +insert_inodev_entry(struct inodev_entry *entry) | |
42007 | +{ | |
42008 | + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device, | |
42009 | + inodev_set.i_size); | |
42010 | + struct inodev_entry **curr; | |
42011 | + | |
42012 | + entry->prev = NULL; | |
42013 | + | |
42014 | + curr = &inodev_set.i_hash[index]; | |
42015 | + if (*curr != NULL) | |
42016 | + (*curr)->prev = entry; | |
42017 | + | |
42018 | + entry->next = *curr; | |
42019 | + *curr = entry; | |
42020 | + | |
42021 | + return; | |
42022 | +} | |
42023 | + | |
42024 | +static void | |
42025 | +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid) | |
42026 | +{ | |
42027 | + unsigned int index = | |
42028 | + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size); | |
42029 | + struct acl_role_label **curr; | |
42030 | + struct acl_role_label *tmp; | |
42031 | + | |
42032 | + curr = &acl_role_set.r_hash[index]; | |
42033 | + | |
42034 | + /* if role was already inserted due to domains and already has | |
42035 | + a role in the same bucket as it attached, then we need to | |
42036 | + combine these two buckets | |
42037 | + */ | |
42038 | + if (role->next) { | |
42039 | + tmp = role->next; | |
42040 | + while (tmp->next) | |
42041 | + tmp = tmp->next; | |
42042 | + tmp->next = *curr; | |
42043 | + } else | |
42044 | + role->next = *curr; | |
42045 | + *curr = role; | |
42046 | + | |
42047 | + return; | |
42048 | +} | |
42049 | + | |
42050 | +static void | |
42051 | +insert_acl_role_label(struct acl_role_label *role) | |
42052 | +{ | |
42053 | + int i; | |
42054 | + | |
42055 | + if (role_list == NULL) { | |
42056 | + role_list = role; | |
42057 | + role->prev = NULL; | |
42058 | + } else { | |
42059 | + role->prev = role_list; | |
42060 | + role_list = role; | |
42061 | + } | |
42062 | + | |
42063 | + /* used for hash chains */ | |
42064 | + role->next = NULL; | |
42065 | + | |
42066 | + if (role->roletype & GR_ROLE_DOMAIN) { | |
42067 | + for (i = 0; i < role->domain_child_num; i++) | |
42068 | + __insert_acl_role_label(role, role->domain_children[i]); | |
42069 | + } else | |
42070 | + __insert_acl_role_label(role, role->uidgid); | |
42071 | +} | |
42072 | + | |
42073 | +static int | |
42074 | +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted) | |
42075 | +{ | |
42076 | + struct name_entry **curr, *nentry; | |
42077 | + struct inodev_entry *ientry; | |
42078 | + unsigned int len = strlen(name); | |
42079 | + unsigned int key = full_name_hash(name, len); | |
42080 | + unsigned int index = key % name_set.n_size; | |
42081 | + | |
42082 | + curr = &name_set.n_hash[index]; | |
42083 | + | |
42084 | + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len))) | |
42085 | + curr = &((*curr)->next); | |
42086 | + | |
42087 | + if (*curr != NULL) | |
42088 | + return 1; | |
42089 | + | |
42090 | + nentry = acl_alloc(sizeof (struct name_entry)); | |
42091 | + if (nentry == NULL) | |
42092 | + return 0; | |
42093 | + ientry = acl_alloc(sizeof (struct inodev_entry)); | |
42094 | + if (ientry == NULL) | |
42095 | + return 0; | |
42096 | + ientry->nentry = nentry; | |
42097 | + | |
42098 | + nentry->key = key; | |
42099 | + nentry->name = name; | |
42100 | + nentry->inode = inode; | |
42101 | + nentry->device = device; | |
42102 | + nentry->len = len; | |
42103 | + nentry->deleted = deleted; | |
42104 | + | |
42105 | + nentry->prev = NULL; | |
42106 | + curr = &name_set.n_hash[index]; | |
42107 | + if (*curr != NULL) | |
42108 | + (*curr)->prev = nentry; | |
42109 | + nentry->next = *curr; | |
42110 | + *curr = nentry; | |
42111 | + | |
42112 | + /* insert us into the table searchable by inode/dev */ | |
42113 | + insert_inodev_entry(ientry); | |
42114 | + | |
42115 | + return 1; | |
42116 | +} | |
42117 | + | |
42118 | +static void | |
42119 | +insert_acl_obj_label(struct acl_object_label *obj, | |
42120 | + struct acl_subject_label *subj) | |
42121 | +{ | |
42122 | + unsigned int index = | |
42123 | + fhash(obj->inode, obj->device, subj->obj_hash_size); | |
42124 | + struct acl_object_label **curr; | |
42125 | + | |
42126 | + | |
42127 | + obj->prev = NULL; | |
42128 | + | |
42129 | + curr = &subj->obj_hash[index]; | |
42130 | + if (*curr != NULL) | |
42131 | + (*curr)->prev = obj; | |
42132 | + | |
42133 | + obj->next = *curr; | |
42134 | + *curr = obj; | |
42135 | + | |
42136 | + return; | |
42137 | +} | |
42138 | + | |
42139 | +static void | |
42140 | +insert_acl_subj_label(struct acl_subject_label *obj, | |
42141 | + struct acl_role_label *role) | |
42142 | +{ | |
42143 | + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size); | |
42144 | + struct acl_subject_label **curr; | |
42145 | + | |
42146 | + obj->prev = NULL; | |
42147 | + | |
42148 | + curr = &role->subj_hash[index]; | |
42149 | + if (*curr != NULL) | |
42150 | + (*curr)->prev = obj; | |
42151 | + | |
42152 | + obj->next = *curr; | |
42153 | + *curr = obj; | |
42154 | + | |
42155 | + return; | |
42156 | +} | |
42157 | + | |
42158 | +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */ | |
42159 | + | |
42160 | +static void * | |
42161 | +create_table(__u32 * len, int elementsize) | |
42162 | +{ | |
42163 | + unsigned int table_sizes[] = { | |
42164 | + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381, | |
42165 | + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143, | |
42166 | + 4194301, 8388593, 16777213, 33554393, 67108859 | |
42167 | + }; | |
42168 | + void *newtable = NULL; | |
42169 | + unsigned int pwr = 0; | |
42170 | + | |
42171 | + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) && | |
42172 | + table_sizes[pwr] <= *len) | |
42173 | + pwr++; | |
42174 | + | |
42175 | + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize)) | |
42176 | + return newtable; | |
42177 | + | |
42178 | + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE) | |
42179 | + newtable = | |
42180 | + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL); | |
42181 | + else | |
42182 | + newtable = vmalloc(table_sizes[pwr] * elementsize); | |
42183 | + | |
42184 | + *len = table_sizes[pwr]; | |
42185 | + | |
42186 | + return newtable; | |
42187 | +} | |
42188 | + | |
42189 | +static int | |
42190 | +init_variables(const struct gr_arg *arg) | |
42191 | +{ | |
42192 | + struct task_struct *reaper = &init_task; | |
42193 | + unsigned int stacksize; | |
42194 | + | |
42195 | + subj_map_set.s_size = arg->role_db.num_subjects; | |
42196 | + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children; | |
42197 | + name_set.n_size = arg->role_db.num_objects; | |
42198 | + inodev_set.i_size = arg->role_db.num_objects; | |
42199 | + | |
42200 | + if (!subj_map_set.s_size || !acl_role_set.r_size || | |
42201 | + !name_set.n_size || !inodev_set.i_size) | |
42202 | + return 1; | |
42203 | + | |
42204 | + if (!gr_init_uidset()) | |
42205 | + return 1; | |
42206 | + | |
42207 | + /* set up the stack that holds allocation info */ | |
42208 | + | |
42209 | + stacksize = arg->role_db.num_pointers + 5; | |
42210 | + | |
42211 | + if (!acl_alloc_stack_init(stacksize)) | |
42212 | + return 1; | |
42213 | + | |
42214 | + /* grab reference for the real root dentry and vfsmount */ | |
42215 | + get_fs_root(reaper->fs, &real_root); | |
42216 | + | |
42217 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
42218 | + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino); | |
42219 | +#endif | |
42220 | + | |
42221 | + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label)); | |
42222 | + if (fakefs_obj_rw == NULL) | |
42223 | + return 1; | |
42224 | + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE; | |
42225 | + | |
42226 | + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label)); | |
42227 | + if (fakefs_obj_rwx == NULL) | |
42228 | + return 1; | |
42229 | + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC; | |
42230 | + | |
42231 | + subj_map_set.s_hash = | |
42232 | + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *)); | |
42233 | + acl_role_set.r_hash = | |
42234 | + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *)); | |
42235 | + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *)); | |
42236 | + inodev_set.i_hash = | |
42237 | + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *)); | |
42238 | + | |
42239 | + if (!subj_map_set.s_hash || !acl_role_set.r_hash || | |
42240 | + !name_set.n_hash || !inodev_set.i_hash) | |
42241 | + return 1; | |
42242 | + | |
42243 | + memset(subj_map_set.s_hash, 0, | |
42244 | + sizeof(struct subject_map *) * subj_map_set.s_size); | |
42245 | + memset(acl_role_set.r_hash, 0, | |
42246 | + sizeof (struct acl_role_label *) * acl_role_set.r_size); | |
42247 | + memset(name_set.n_hash, 0, | |
42248 | + sizeof (struct name_entry *) * name_set.n_size); | |
42249 | + memset(inodev_set.i_hash, 0, | |
42250 | + sizeof (struct inodev_entry *) * inodev_set.i_size); | |
42251 | + | |
42252 | + return 0; | |
42253 | +} | |
42254 | + | |
42255 | +/* free information not needed after startup | |
42256 | + currently contains user->kernel pointer mappings for subjects | |
42257 | +*/ | |
42258 | + | |
42259 | +static void | |
42260 | +free_init_variables(void) | |
42261 | +{ | |
42262 | + __u32 i; | |
42263 | + | |
42264 | + if (subj_map_set.s_hash) { | |
42265 | + for (i = 0; i < subj_map_set.s_size; i++) { | |
42266 | + if (subj_map_set.s_hash[i]) { | |
42267 | + kfree(subj_map_set.s_hash[i]); | |
42268 | + subj_map_set.s_hash[i] = NULL; | |
42269 | + } | |
42270 | + } | |
42271 | + | |
42272 | + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <= | |
42273 | + PAGE_SIZE) | |
42274 | + kfree(subj_map_set.s_hash); | |
42275 | + else | |
42276 | + vfree(subj_map_set.s_hash); | |
42277 | + } | |
42278 | + | |
42279 | + return; | |
42280 | +} | |
42281 | + | |
42282 | +static void | |
42283 | +free_variables(void) | |
42284 | +{ | |
42285 | + struct acl_subject_label *s; | |
42286 | + struct acl_role_label *r; | |
42287 | + struct task_struct *task, *task2; | |
42288 | + unsigned int x; | |
42289 | + | |
42290 | + gr_clear_learn_entries(); | |
42291 | + | |
42292 | + read_lock(&tasklist_lock); | |
42293 | + do_each_thread(task2, task) { | |
42294 | + task->acl_sp_role = 0; | |
42295 | + task->acl_role_id = 0; | |
42296 | + task->acl = NULL; | |
42297 | + task->role = NULL; | |
42298 | + } while_each_thread(task2, task); | |
42299 | + read_unlock(&tasklist_lock); | |
42300 | + | |
42301 | + /* release the reference to the real root dentry and vfsmount */ | |
42302 | + path_put(&real_root); | |
42303 | + | |
42304 | + /* free all object hash tables */ | |
42305 | + | |
42306 | + FOR_EACH_ROLE_START(r) | |
42307 | + if (r->subj_hash == NULL) | |
42308 | + goto next_role; | |
42309 | + FOR_EACH_SUBJECT_START(r, s, x) | |
42310 | + if (s->obj_hash == NULL) | |
42311 | + break; | |
42312 | + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE) | |
42313 | + kfree(s->obj_hash); | |
42314 | + else | |
42315 | + vfree(s->obj_hash); | |
42316 | + FOR_EACH_SUBJECT_END(s, x) | |
42317 | + FOR_EACH_NESTED_SUBJECT_START(r, s) | |
42318 | + if (s->obj_hash == NULL) | |
42319 | + break; | |
42320 | + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE) | |
42321 | + kfree(s->obj_hash); | |
42322 | + else | |
42323 | + vfree(s->obj_hash); | |
42324 | + FOR_EACH_NESTED_SUBJECT_END(s) | |
42325 | + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE) | |
42326 | + kfree(r->subj_hash); | |
42327 | + else | |
42328 | + vfree(r->subj_hash); | |
42329 | + r->subj_hash = NULL; | |
42330 | +next_role: | |
42331 | + FOR_EACH_ROLE_END(r) | |
42332 | + | |
42333 | + acl_free_all(); | |
42334 | + | |
42335 | + if (acl_role_set.r_hash) { | |
42336 | + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <= | |
42337 | + PAGE_SIZE) | |
42338 | + kfree(acl_role_set.r_hash); | |
42339 | + else | |
42340 | + vfree(acl_role_set.r_hash); | |
42341 | + } | |
42342 | + if (name_set.n_hash) { | |
42343 | + if ((name_set.n_size * sizeof (struct name_entry *)) <= | |
42344 | + PAGE_SIZE) | |
42345 | + kfree(name_set.n_hash); | |
42346 | + else | |
42347 | + vfree(name_set.n_hash); | |
42348 | + } | |
42349 | + | |
42350 | + if (inodev_set.i_hash) { | |
42351 | + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <= | |
42352 | + PAGE_SIZE) | |
42353 | + kfree(inodev_set.i_hash); | |
42354 | + else | |
42355 | + vfree(inodev_set.i_hash); | |
42356 | + } | |
42357 | + | |
42358 | + gr_free_uidset(); | |
42359 | + | |
42360 | + memset(&name_set, 0, sizeof (struct name_db)); | |
42361 | + memset(&inodev_set, 0, sizeof (struct inodev_db)); | |
42362 | + memset(&acl_role_set, 0, sizeof (struct acl_role_db)); | |
42363 | + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db)); | |
42364 | + | |
42365 | + default_role = NULL; | |
42366 | + role_list = NULL; | |
42367 | + | |
42368 | + return; | |
42369 | +} | |
42370 | + | |
42371 | +static __u32 | |
42372 | +count_user_objs(struct acl_object_label *userp) | |
42373 | +{ | |
42374 | + struct acl_object_label o_tmp; | |
42375 | + __u32 num = 0; | |
42376 | + | |
42377 | + while (userp) { | |
42378 | + if (copy_from_user(&o_tmp, userp, | |
42379 | + sizeof (struct acl_object_label))) | |
42380 | + break; | |
42381 | + | |
42382 | + userp = o_tmp.prev; | |
42383 | + num++; | |
42384 | + } | |
42385 | + | |
42386 | + return num; | |
42387 | +} | |
42388 | + | |
42389 | +static struct acl_subject_label * | |
42390 | +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role); | |
42391 | + | |
42392 | +static int | |
42393 | +copy_user_glob(struct acl_object_label *obj) | |
42394 | +{ | |
42395 | + struct acl_object_label *g_tmp, **guser; | |
42396 | + unsigned int len; | |
42397 | + char *tmp; | |
42398 | + | |
42399 | + if (obj->globbed == NULL) | |
42400 | + return 0; | |
42401 | + | |
42402 | + guser = &obj->globbed; | |
42403 | + while (*guser) { | |
42404 | + g_tmp = (struct acl_object_label *) | |
42405 | + acl_alloc(sizeof (struct acl_object_label)); | |
42406 | + if (g_tmp == NULL) | |
42407 | + return -ENOMEM; | |
42408 | + | |
42409 | + if (copy_from_user(g_tmp, *guser, | |
42410 | + sizeof (struct acl_object_label))) | |
42411 | + return -EFAULT; | |
42412 | + | |
42413 | + len = strnlen_user(g_tmp->filename, PATH_MAX); | |
42414 | + | |
42415 | + if (!len || len >= PATH_MAX) | |
42416 | + return -EINVAL; | |
42417 | + | |
42418 | + if ((tmp = (char *) acl_alloc(len)) == NULL) | |
42419 | + return -ENOMEM; | |
42420 | + | |
42421 | + if (copy_from_user(tmp, g_tmp->filename, len)) | |
42422 | + return -EFAULT; | |
42423 | + tmp[len-1] = '\0'; | |
42424 | + g_tmp->filename = tmp; | |
42425 | + | |
42426 | + *guser = g_tmp; | |
42427 | + guser = &(g_tmp->next); | |
42428 | + } | |
42429 | + | |
42430 | + return 0; | |
42431 | +} | |
42432 | + | |
42433 | +static int | |
42434 | +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj, | |
42435 | + struct acl_role_label *role) | |
42436 | +{ | |
42437 | + struct acl_object_label *o_tmp; | |
42438 | + unsigned int len; | |
42439 | + int ret; | |
42440 | + char *tmp; | |
42441 | + | |
42442 | + while (userp) { | |
42443 | + if ((o_tmp = (struct acl_object_label *) | |
42444 | + acl_alloc(sizeof (struct acl_object_label))) == NULL) | |
42445 | + return -ENOMEM; | |
42446 | + | |
42447 | + if (copy_from_user(o_tmp, userp, | |
42448 | + sizeof (struct acl_object_label))) | |
42449 | + return -EFAULT; | |
42450 | + | |
42451 | + userp = o_tmp->prev; | |
42452 | + | |
42453 | + len = strnlen_user(o_tmp->filename, PATH_MAX); | |
42454 | + | |
42455 | + if (!len || len >= PATH_MAX) | |
42456 | + return -EINVAL; | |
42457 | + | |
42458 | + if ((tmp = (char *) acl_alloc(len)) == NULL) | |
42459 | + return -ENOMEM; | |
42460 | + | |
42461 | + if (copy_from_user(tmp, o_tmp->filename, len)) | |
42462 | + return -EFAULT; | |
42463 | + tmp[len-1] = '\0'; | |
42464 | + o_tmp->filename = tmp; | |
42465 | + | |
42466 | + insert_acl_obj_label(o_tmp, subj); | |
42467 | + if (!insert_name_entry(o_tmp->filename, o_tmp->inode, | |
42468 | + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0)) | |
42469 | + return -ENOMEM; | |
42470 | + | |
42471 | + ret = copy_user_glob(o_tmp); | |
42472 | + if (ret) | |
42473 | + return ret; | |
42474 | + | |
42475 | + if (o_tmp->nested) { | |
42476 | + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role); | |
42477 | + if (IS_ERR(o_tmp->nested)) | |
42478 | + return PTR_ERR(o_tmp->nested); | |
42479 | + | |
42480 | + /* insert into nested subject list */ | |
42481 | + o_tmp->nested->next = role->hash->first; | |
42482 | + role->hash->first = o_tmp->nested; | |
42483 | + } | |
42484 | + } | |
42485 | + | |
42486 | + return 0; | |
42487 | +} | |
42488 | + | |
42489 | +static __u32 | |
42490 | +count_user_subjs(struct acl_subject_label *userp) | |
42491 | +{ | |
42492 | + struct acl_subject_label s_tmp; | |
42493 | + __u32 num = 0; | |
42494 | + | |
42495 | + while (userp) { | |
42496 | + if (copy_from_user(&s_tmp, userp, | |
42497 | + sizeof (struct acl_subject_label))) | |
42498 | + break; | |
42499 | + | |
42500 | + userp = s_tmp.prev; | |
42501 | + /* do not count nested subjects against this count, since | |
42502 | + they are not included in the hash table, but are | |
42503 | + attached to objects. We have already counted | |
42504 | + the subjects in userspace for the allocation | |
42505 | + stack | |
42506 | + */ | |
42507 | + if (!(s_tmp.mode & GR_NESTED)) | |
42508 | + num++; | |
42509 | + } | |
42510 | + | |
42511 | + return num; | |
42512 | +} | |
42513 | + | |
42514 | +static int | |
42515 | +copy_user_allowedips(struct acl_role_label *rolep) | |
42516 | +{ | |
42517 | + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast; | |
42518 | + | |
42519 | + ruserip = rolep->allowed_ips; | |
42520 | + | |
42521 | + while (ruserip) { | |
42522 | + rlast = rtmp; | |
42523 | + | |
42524 | + if ((rtmp = (struct role_allowed_ip *) | |
42525 | + acl_alloc(sizeof (struct role_allowed_ip))) == NULL) | |
42526 | + return -ENOMEM; | |
42527 | + | |
42528 | + if (copy_from_user(rtmp, ruserip, | |
42529 | + sizeof (struct role_allowed_ip))) | |
42530 | + return -EFAULT; | |
42531 | + | |
42532 | + ruserip = rtmp->prev; | |
42533 | + | |
42534 | + if (!rlast) { | |
42535 | + rtmp->prev = NULL; | |
42536 | + rolep->allowed_ips = rtmp; | |
42537 | + } else { | |
42538 | + rlast->next = rtmp; | |
42539 | + rtmp->prev = rlast; | |
42540 | + } | |
42541 | + | |
42542 | + if (!ruserip) | |
42543 | + rtmp->next = NULL; | |
42544 | + } | |
42545 | + | |
42546 | + return 0; | |
42547 | +} | |
42548 | + | |
42549 | +static int | |
42550 | +copy_user_transitions(struct acl_role_label *rolep) | |
42551 | +{ | |
42552 | + struct role_transition *rusertp, *rtmp = NULL, *rlast; | |
42553 | + | |
42554 | + unsigned int len; | |
42555 | + char *tmp; | |
42556 | + | |
42557 | + rusertp = rolep->transitions; | |
42558 | + | |
42559 | + while (rusertp) { | |
42560 | + rlast = rtmp; | |
42561 | + | |
42562 | + if ((rtmp = (struct role_transition *) | |
42563 | + acl_alloc(sizeof (struct role_transition))) == NULL) | |
42564 | + return -ENOMEM; | |
42565 | + | |
42566 | + if (copy_from_user(rtmp, rusertp, | |
42567 | + sizeof (struct role_transition))) | |
42568 | + return -EFAULT; | |
42569 | + | |
42570 | + rusertp = rtmp->prev; | |
42571 | + | |
42572 | + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN); | |
42573 | + | |
42574 | + if (!len || len >= GR_SPROLE_LEN) | |
42575 | + return -EINVAL; | |
42576 | + | |
42577 | + if ((tmp = (char *) acl_alloc(len)) == NULL) | |
42578 | + return -ENOMEM; | |
42579 | + | |
42580 | + if (copy_from_user(tmp, rtmp->rolename, len)) | |
42581 | + return -EFAULT; | |
42582 | + tmp[len-1] = '\0'; | |
42583 | + rtmp->rolename = tmp; | |
42584 | + | |
42585 | + if (!rlast) { | |
42586 | + rtmp->prev = NULL; | |
42587 | + rolep->transitions = rtmp; | |
42588 | + } else { | |
42589 | + rlast->next = rtmp; | |
42590 | + rtmp->prev = rlast; | |
42591 | + } | |
42592 | + | |
42593 | + if (!rusertp) | |
42594 | + rtmp->next = NULL; | |
42595 | + } | |
42596 | + | |
42597 | + return 0; | |
42598 | +} | |
42599 | + | |
42600 | +static struct acl_subject_label * | |
42601 | +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role) | |
42602 | +{ | |
42603 | + struct acl_subject_label *s_tmp = NULL, *s_tmp2; | |
42604 | + unsigned int len; | |
42605 | + char *tmp; | |
42606 | + __u32 num_objs; | |
42607 | + struct acl_ip_label **i_tmp, *i_utmp2; | |
42608 | + struct gr_hash_struct ghash; | |
42609 | + struct subject_map *subjmap; | |
42610 | + unsigned int i_num; | |
42611 | + int err; | |
42612 | + | |
42613 | + s_tmp = lookup_subject_map(userp); | |
42614 | + | |
42615 | + /* we've already copied this subject into the kernel, just return | |
42616 | + the reference to it, and don't copy it over again | |
42617 | + */ | |
42618 | + if (s_tmp) | |
42619 | + return(s_tmp); | |
42620 | + | |
42621 | + if ((s_tmp = (struct acl_subject_label *) | |
42622 | + acl_alloc(sizeof (struct acl_subject_label))) == NULL) | |
42623 | + return ERR_PTR(-ENOMEM); | |
42624 | + | |
42625 | + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL); | |
42626 | + if (subjmap == NULL) | |
42627 | + return ERR_PTR(-ENOMEM); | |
42628 | + | |
42629 | + subjmap->user = userp; | |
42630 | + subjmap->kernel = s_tmp; | |
42631 | + insert_subj_map_entry(subjmap); | |
42632 | + | |
42633 | + if (copy_from_user(s_tmp, userp, | |
42634 | + sizeof (struct acl_subject_label))) | |
42635 | + return ERR_PTR(-EFAULT); | |
42636 | + | |
42637 | + len = strnlen_user(s_tmp->filename, PATH_MAX); | |
42638 | + | |
42639 | + if (!len || len >= PATH_MAX) | |
42640 | + return ERR_PTR(-EINVAL); | |
42641 | + | |
42642 | + if ((tmp = (char *) acl_alloc(len)) == NULL) | |
42643 | + return ERR_PTR(-ENOMEM); | |
42644 | + | |
42645 | + if (copy_from_user(tmp, s_tmp->filename, len)) | |
42646 | + return ERR_PTR(-EFAULT); | |
42647 | + tmp[len-1] = '\0'; | |
42648 | + s_tmp->filename = tmp; | |
42649 | + | |
42650 | + if (!strcmp(s_tmp->filename, "/")) | |
42651 | + role->root_label = s_tmp; | |
42652 | + | |
42653 | + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct))) | |
42654 | + return ERR_PTR(-EFAULT); | |
42655 | + | |
42656 | + /* copy user and group transition tables */ | |
42657 | + | |
42658 | + if (s_tmp->user_trans_num) { | |
42659 | + uid_t *uidlist; | |
42660 | + | |
42661 | + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t)); | |
42662 | + if (uidlist == NULL) | |
42663 | + return ERR_PTR(-ENOMEM); | |
42664 | + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t))) | |
42665 | + return ERR_PTR(-EFAULT); | |
42666 | + | |
42667 | + s_tmp->user_transitions = uidlist; | |
42668 | + } | |
42669 | + | |
42670 | + if (s_tmp->group_trans_num) { | |
42671 | + gid_t *gidlist; | |
42672 | + | |
42673 | + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t)); | |
42674 | + if (gidlist == NULL) | |
42675 | + return ERR_PTR(-ENOMEM); | |
42676 | + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t))) | |
42677 | + return ERR_PTR(-EFAULT); | |
42678 | + | |
42679 | + s_tmp->group_transitions = gidlist; | |
42680 | + } | |
42681 | + | |
42682 | + /* set up object hash table */ | |
42683 | + num_objs = count_user_objs(ghash.first); | |
42684 | + | |
42685 | + s_tmp->obj_hash_size = num_objs; | |
42686 | + s_tmp->obj_hash = | |
42687 | + (struct acl_object_label **) | |
42688 | + create_table(&(s_tmp->obj_hash_size), sizeof(void *)); | |
42689 | + | |
42690 | + if (!s_tmp->obj_hash) | |
42691 | + return ERR_PTR(-ENOMEM); | |
42692 | + | |
42693 | + memset(s_tmp->obj_hash, 0, | |
42694 | + s_tmp->obj_hash_size * | |
42695 | + sizeof (struct acl_object_label *)); | |
42696 | + | |
42697 | + /* add in objects */ | |
42698 | + err = copy_user_objs(ghash.first, s_tmp, role); | |
42699 | + | |
42700 | + if (err) | |
42701 | + return ERR_PTR(err); | |
42702 | + | |
42703 | + /* set pointer for parent subject */ | |
42704 | + if (s_tmp->parent_subject) { | |
42705 | + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role); | |
42706 | + | |
42707 | + if (IS_ERR(s_tmp2)) | |
42708 | + return s_tmp2; | |
42709 | + | |
42710 | + s_tmp->parent_subject = s_tmp2; | |
42711 | + } | |
42712 | + | |
42713 | + /* add in ip acls */ | |
42714 | + | |
42715 | + if (!s_tmp->ip_num) { | |
42716 | + s_tmp->ips = NULL; | |
42717 | + goto insert; | |
42718 | + } | |
42719 | + | |
42720 | + i_tmp = | |
42721 | + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num, | |
42722 | + sizeof (struct acl_ip_label *)); | |
42723 | + | |
42724 | + if (!i_tmp) | |
42725 | + return ERR_PTR(-ENOMEM); | |
42726 | + | |
42727 | + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) { | |
42728 | + *(i_tmp + i_num) = | |
42729 | + (struct acl_ip_label *) | |
42730 | + acl_alloc(sizeof (struct acl_ip_label)); | |
42731 | + if (!*(i_tmp + i_num)) | |
42732 | + return ERR_PTR(-ENOMEM); | |
42733 | + | |
42734 | + if (copy_from_user | |
42735 | + (&i_utmp2, s_tmp->ips + i_num, | |
42736 | + sizeof (struct acl_ip_label *))) | |
42737 | + return ERR_PTR(-EFAULT); | |
42738 | + | |
42739 | + if (copy_from_user | |
42740 | + (*(i_tmp + i_num), i_utmp2, | |
42741 | + sizeof (struct acl_ip_label))) | |
42742 | + return ERR_PTR(-EFAULT); | |
42743 | + | |
42744 | + if ((*(i_tmp + i_num))->iface == NULL) | |
42745 | + continue; | |
42746 | + | |
42747 | + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ); | |
42748 | + if (!len || len >= IFNAMSIZ) | |
42749 | + return ERR_PTR(-EINVAL); | |
42750 | + tmp = acl_alloc(len); | |
42751 | + if (tmp == NULL) | |
42752 | + return ERR_PTR(-ENOMEM); | |
42753 | + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len)) | |
42754 | + return ERR_PTR(-EFAULT); | |
42755 | + (*(i_tmp + i_num))->iface = tmp; | |
42756 | + } | |
42757 | + | |
42758 | + s_tmp->ips = i_tmp; | |
42759 | + | |
42760 | +insert: | |
42761 | + if (!insert_name_entry(s_tmp->filename, s_tmp->inode, | |
42762 | + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0)) | |
42763 | + return ERR_PTR(-ENOMEM); | |
42764 | + | |
42765 | + return s_tmp; | |
42766 | +} | |
42767 | + | |
42768 | +static int | |
42769 | +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role) | |
42770 | +{ | |
42771 | + struct acl_subject_label s_pre; | |
42772 | + struct acl_subject_label * ret; | |
42773 | + int err; | |
42774 | + | |
42775 | + while (userp) { | |
42776 | + if (copy_from_user(&s_pre, userp, | |
42777 | + sizeof (struct acl_subject_label))) | |
42778 | + return -EFAULT; | |
42779 | + | |
42780 | + /* do not add nested subjects here, add | |
42781 | + while parsing objects | |
42782 | + */ | |
42783 | + | |
42784 | + if (s_pre.mode & GR_NESTED) { | |
42785 | + userp = s_pre.prev; | |
42786 | + continue; | |
42787 | + } | |
42788 | + | |
42789 | + ret = do_copy_user_subj(userp, role); | |
42790 | + | |
42791 | + err = PTR_ERR(ret); | |
42792 | + if (IS_ERR(ret)) | |
42793 | + return err; | |
42794 | + | |
42795 | + insert_acl_subj_label(ret, role); | |
42796 | + | |
42797 | + userp = s_pre.prev; | |
42798 | + } | |
42799 | + | |
42800 | + return 0; | |
42801 | +} | |
42802 | + | |
42803 | +static int | |
42804 | +copy_user_acl(struct gr_arg *arg) | |
42805 | +{ | |
42806 | + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2; | |
42807 | + struct sprole_pw *sptmp; | |
42808 | + struct gr_hash_struct *ghash; | |
42809 | + uid_t *domainlist; | |
42810 | + unsigned int r_num; | |
42811 | + unsigned int len; | |
42812 | + char *tmp; | |
42813 | + int err = 0; | |
42814 | + __u16 i; | |
42815 | + __u32 num_subjs; | |
42816 | + | |
42817 | + /* we need a default and kernel role */ | |
42818 | + if (arg->role_db.num_roles < 2) | |
42819 | + return -EINVAL; | |
42820 | + | |
42821 | + /* copy special role authentication info from userspace */ | |
42822 | + | |
42823 | + num_sprole_pws = arg->num_sprole_pws; | |
42824 | + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *)); | |
42825 | + | |
42826 | + if (!acl_special_roles) { | |
42827 | + err = -ENOMEM; | |
42828 | + goto cleanup; | |
42829 | + } | |
42830 | + | |
42831 | + for (i = 0; i < num_sprole_pws; i++) { | |
42832 | + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw)); | |
42833 | + if (!sptmp) { | |
42834 | + err = -ENOMEM; | |
42835 | + goto cleanup; | |
42836 | + } | |
42837 | + if (copy_from_user(sptmp, arg->sprole_pws + i, | |
42838 | + sizeof (struct sprole_pw))) { | |
42839 | + err = -EFAULT; | |
42840 | + goto cleanup; | |
42841 | + } | |
42842 | + | |
42843 | + len = | |
42844 | + strnlen_user(sptmp->rolename, GR_SPROLE_LEN); | |
42845 | + | |
42846 | + if (!len || len >= GR_SPROLE_LEN) { | |
42847 | + err = -EINVAL; | |
42848 | + goto cleanup; | |
42849 | + } | |
42850 | + | |
42851 | + if ((tmp = (char *) acl_alloc(len)) == NULL) { | |
42852 | + err = -ENOMEM; | |
42853 | + goto cleanup; | |
42854 | + } | |
42855 | + | |
42856 | + if (copy_from_user(tmp, sptmp->rolename, len)) { | |
42857 | + err = -EFAULT; | |
42858 | + goto cleanup; | |
42859 | + } | |
42860 | + tmp[len-1] = '\0'; | |
42861 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
42862 | + printk(KERN_ALERT "Copying special role %s\n", tmp); | |
42863 | +#endif | |
42864 | + sptmp->rolename = tmp; | |
42865 | + acl_special_roles[i] = sptmp; | |
42866 | + } | |
42867 | + | |
42868 | + r_utmp = (struct acl_role_label **) arg->role_db.r_table; | |
42869 | + | |
42870 | + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) { | |
42871 | + r_tmp = acl_alloc(sizeof (struct acl_role_label)); | |
42872 | + | |
42873 | + if (!r_tmp) { | |
42874 | + err = -ENOMEM; | |
42875 | + goto cleanup; | |
42876 | + } | |
42877 | + | |
42878 | + if (copy_from_user(&r_utmp2, r_utmp + r_num, | |
42879 | + sizeof (struct acl_role_label *))) { | |
42880 | + err = -EFAULT; | |
42881 | + goto cleanup; | |
42882 | + } | |
42883 | + | |
42884 | + if (copy_from_user(r_tmp, r_utmp2, | |
42885 | + sizeof (struct acl_role_label))) { | |
42886 | + err = -EFAULT; | |
42887 | + goto cleanup; | |
42888 | + } | |
42889 | + | |
42890 | + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN); | |
42891 | + | |
42892 | + if (!len || len >= PATH_MAX) { | |
42893 | + err = -EINVAL; | |
42894 | + goto cleanup; | |
42895 | + } | |
42896 | + | |
42897 | + if ((tmp = (char *) acl_alloc(len)) == NULL) { | |
42898 | + err = -ENOMEM; | |
42899 | + goto cleanup; | |
42900 | + } | |
42901 | + if (copy_from_user(tmp, r_tmp->rolename, len)) { | |
42902 | + err = -EFAULT; | |
42903 | + goto cleanup; | |
42904 | + } | |
42905 | + tmp[len-1] = '\0'; | |
42906 | + r_tmp->rolename = tmp; | |
42907 | + | |
42908 | + if (!strcmp(r_tmp->rolename, "default") | |
42909 | + && (r_tmp->roletype & GR_ROLE_DEFAULT)) { | |
42910 | + default_role = r_tmp; | |
42911 | + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) { | |
42912 | + kernel_role = r_tmp; | |
42913 | + } | |
42914 | + | |
42915 | + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) { | |
42916 | + err = -ENOMEM; | |
42917 | + goto cleanup; | |
42918 | + } | |
42919 | + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) { | |
42920 | + err = -EFAULT; | |
42921 | + goto cleanup; | |
42922 | + } | |
42923 | + | |
42924 | + r_tmp->hash = ghash; | |
42925 | + | |
42926 | + num_subjs = count_user_subjs(r_tmp->hash->first); | |
42927 | + | |
42928 | + r_tmp->subj_hash_size = num_subjs; | |
42929 | + r_tmp->subj_hash = | |
42930 | + (struct acl_subject_label **) | |
42931 | + create_table(&(r_tmp->subj_hash_size), sizeof(void *)); | |
42932 | + | |
42933 | + if (!r_tmp->subj_hash) { | |
42934 | + err = -ENOMEM; | |
42935 | + goto cleanup; | |
42936 | + } | |
42937 | + | |
42938 | + err = copy_user_allowedips(r_tmp); | |
42939 | + if (err) | |
42940 | + goto cleanup; | |
42941 | + | |
42942 | + /* copy domain info */ | |
42943 | + if (r_tmp->domain_children != NULL) { | |
42944 | + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t)); | |
42945 | + if (domainlist == NULL) { | |
42946 | + err = -ENOMEM; | |
42947 | + goto cleanup; | |
42948 | + } | |
42949 | + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) { | |
42950 | + err = -EFAULT; | |
42951 | + goto cleanup; | |
42952 | + } | |
42953 | + r_tmp->domain_children = domainlist; | |
42954 | + } | |
42955 | + | |
42956 | + err = copy_user_transitions(r_tmp); | |
42957 | + if (err) | |
42958 | + goto cleanup; | |
42959 | + | |
42960 | + memset(r_tmp->subj_hash, 0, | |
42961 | + r_tmp->subj_hash_size * | |
42962 | + sizeof (struct acl_subject_label *)); | |
42963 | + | |
42964 | + err = copy_user_subjs(r_tmp->hash->first, r_tmp); | |
42965 | + | |
42966 | + if (err) | |
42967 | + goto cleanup; | |
42968 | + | |
42969 | + /* set nested subject list to null */ | |
42970 | + r_tmp->hash->first = NULL; | |
42971 | + | |
42972 | + insert_acl_role_label(r_tmp); | |
42973 | + } | |
42974 | + | |
42975 | + goto return_err; | |
42976 | + cleanup: | |
42977 | + free_variables(); | |
42978 | + return_err: | |
42979 | + return err; | |
42980 | + | |
42981 | +} | |
42982 | + | |
42983 | +static int | |
42984 | +gracl_init(struct gr_arg *args) | |
42985 | +{ | |
42986 | + int error = 0; | |
42987 | + | |
42988 | + memcpy(gr_system_salt, args->salt, GR_SALT_LEN); | |
42989 | + memcpy(gr_system_sum, args->sum, GR_SHA_LEN); | |
42990 | + | |
42991 | + if (init_variables(args)) { | |
42992 | + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION); | |
42993 | + error = -ENOMEM; | |
42994 | + free_variables(); | |
42995 | + goto out; | |
42996 | + } | |
42997 | + | |
42998 | + error = copy_user_acl(args); | |
42999 | + free_init_variables(); | |
43000 | + if (error) { | |
43001 | + free_variables(); | |
43002 | + goto out; | |
43003 | + } | |
43004 | + | |
43005 | + if ((error = gr_set_acls(0))) { | |
43006 | + free_variables(); | |
43007 | + goto out; | |
43008 | + } | |
43009 | + | |
43010 | + pax_open_kernel(); | |
43011 | + gr_status |= GR_READY; | |
43012 | + pax_close_kernel(); | |
43013 | + | |
43014 | + out: | |
43015 | + return error; | |
43016 | +} | |
43017 | + | |
43018 | +/* derived from glibc fnmatch() 0: match, 1: no match*/ | |
43019 | + | |
43020 | +static int | |
43021 | +glob_match(const char *p, const char *n) | |
43022 | +{ | |
43023 | + char c; | |
43024 | + | |
43025 | + while ((c = *p++) != '\0') { | |
43026 | + switch (c) { | |
43027 | + case '?': | |
43028 | + if (*n == '\0') | |
43029 | + return 1; | |
43030 | + else if (*n == '/') | |
43031 | + return 1; | |
43032 | + break; | |
43033 | + case '\\': | |
43034 | + if (*n != c) | |
43035 | + return 1; | |
43036 | + break; | |
43037 | + case '*': | |
43038 | + for (c = *p++; c == '?' || c == '*'; c = *p++) { | |
43039 | + if (*n == '/') | |
43040 | + return 1; | |
43041 | + else if (c == '?') { | |
43042 | + if (*n == '\0') | |
43043 | + return 1; | |
43044 | + else | |
43045 | + ++n; | |
43046 | + } | |
43047 | + } | |
43048 | + if (c == '\0') { | |
43049 | + return 0; | |
43050 | + } else { | |
43051 | + const char *endp; | |
43052 | + | |
43053 | + if ((endp = strchr(n, '/')) == NULL) | |
43054 | + endp = n + strlen(n); | |
43055 | + | |
43056 | + if (c == '[') { | |
43057 | + for (--p; n < endp; ++n) | |
43058 | + if (!glob_match(p, n)) | |
43059 | + return 0; | |
43060 | + } else if (c == '/') { | |
43061 | + while (*n != '\0' && *n != '/') | |
43062 | + ++n; | |
43063 | + if (*n == '/' && !glob_match(p, n + 1)) | |
43064 | + return 0; | |
43065 | + } else { | |
43066 | + for (--p; n < endp; ++n) | |
43067 | + if (*n == c && !glob_match(p, n)) | |
43068 | + return 0; | |
43069 | + } | |
43070 | + | |
43071 | + return 1; | |
43072 | + } | |
43073 | + case '[': | |
43074 | + { | |
43075 | + int not; | |
43076 | + char cold; | |
43077 | + | |
43078 | + if (*n == '\0' || *n == '/') | |
43079 | + return 1; | |
43080 | + | |
43081 | + not = (*p == '!' || *p == '^'); | |
43082 | + if (not) | |
43083 | + ++p; | |
43084 | + | |
43085 | + c = *p++; | |
43086 | + for (;;) { | |
43087 | + unsigned char fn = (unsigned char)*n; | |
43088 | + | |
43089 | + if (c == '\0') | |
43090 | + return 1; | |
43091 | + else { | |
43092 | + if (c == fn) | |
43093 | + goto matched; | |
43094 | + cold = c; | |
43095 | + c = *p++; | |
43096 | + | |
43097 | + if (c == '-' && *p != ']') { | |
43098 | + unsigned char cend = *p++; | |
43099 | + | |
43100 | + if (cend == '\0') | |
43101 | + return 1; | |
43102 | + | |
43103 | + if (cold <= fn && fn <= cend) | |
43104 | + goto matched; | |
43105 | + | |
43106 | + c = *p++; | |
43107 | + } | |
43108 | + } | |
43109 | + | |
43110 | + if (c == ']') | |
43111 | + break; | |
43112 | + } | |
43113 | + if (!not) | |
43114 | + return 1; | |
43115 | + break; | |
43116 | + matched: | |
43117 | + while (c != ']') { | |
43118 | + if (c == '\0') | |
43119 | + return 1; | |
43120 | + | |
43121 | + c = *p++; | |
43122 | + } | |
43123 | + if (not) | |
43124 | + return 1; | |
43125 | + } | |
43126 | + break; | |
43127 | + default: | |
43128 | + if (c != *n) | |
43129 | + return 1; | |
43130 | + } | |
43131 | + | |
43132 | + ++n; | |
43133 | + } | |
43134 | + | |
43135 | + if (*n == '\0') | |
43136 | + return 0; | |
43137 | + | |
43138 | + if (*n == '/') | |
43139 | + return 0; | |
43140 | + | |
43141 | + return 1; | |
43142 | +} | |
43143 | + | |
43144 | +static struct acl_object_label * | |
43145 | +chk_glob_label(struct acl_object_label *globbed, | |
43146 | + struct dentry *dentry, struct vfsmount *mnt, char **path) | |
43147 | +{ | |
43148 | + struct acl_object_label *tmp; | |
43149 | + | |
43150 | + if (*path == NULL) | |
43151 | + *path = gr_to_filename_nolock(dentry, mnt); | |
43152 | + | |
43153 | + tmp = globbed; | |
43154 | + | |
43155 | + while (tmp) { | |
43156 | + if (!glob_match(tmp->filename, *path)) | |
43157 | + return tmp; | |
43158 | + tmp = tmp->next; | |
43159 | + } | |
43160 | + | |
43161 | + return NULL; | |
43162 | +} | |
43163 | + | |
43164 | +static struct acl_object_label * | |
43165 | +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt, | |
43166 | + const ino_t curr_ino, const dev_t curr_dev, | |
43167 | + const struct acl_subject_label *subj, char **path, const int checkglob) | |
43168 | +{ | |
43169 | + struct acl_subject_label *tmpsubj; | |
43170 | + struct acl_object_label *retval; | |
43171 | + struct acl_object_label *retval2; | |
43172 | + | |
43173 | + tmpsubj = (struct acl_subject_label *) subj; | |
43174 | + read_lock(&gr_inode_lock); | |
43175 | + do { | |
43176 | + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj); | |
43177 | + if (retval) { | |
43178 | + if (checkglob && retval->globbed) { | |
43179 | + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry, | |
43180 | + (struct vfsmount *)orig_mnt, path); | |
43181 | + if (retval2) | |
43182 | + retval = retval2; | |
43183 | + } | |
43184 | + break; | |
43185 | + } | |
43186 | + } while ((tmpsubj = tmpsubj->parent_subject)); | |
43187 | + read_unlock(&gr_inode_lock); | |
43188 | + | |
43189 | + return retval; | |
43190 | +} | |
43191 | + | |
43192 | +static __inline__ struct acl_object_label * | |
43193 | +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt, | |
43194 | + struct dentry *curr_dentry, | |
43195 | + const struct acl_subject_label *subj, char **path, const int checkglob) | |
43196 | +{ | |
43197 | + int newglob = checkglob; | |
43198 | + ino_t inode; | |
43199 | + dev_t device; | |
43200 | + | |
43201 | + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking | |
43202 | + as we don't want a / * rule to match instead of the / object | |
43203 | + don't do this for create lookups that call this function though, since they're looking up | |
43204 | + on the parent and thus need globbing checks on all paths | |
43205 | + */ | |
43206 | + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB) | |
43207 | + newglob = GR_NO_GLOB; | |
43208 | + | |
43209 | + spin_lock(&curr_dentry->d_lock); | |
43210 | + inode = curr_dentry->d_inode->i_ino; | |
43211 | + device = __get_dev(curr_dentry); | |
43212 | + spin_unlock(&curr_dentry->d_lock); | |
43213 | + | |
43214 | + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob); | |
43215 | +} | |
43216 | + | |
43217 | +static struct acl_object_label * | |
43218 | +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt, | |
43219 | + const struct acl_subject_label *subj, char *path, const int checkglob) | |
43220 | +{ | |
43221 | + struct dentry *dentry = (struct dentry *) l_dentry; | |
43222 | + struct vfsmount *mnt = (struct vfsmount *) l_mnt; | |
43223 | + struct acl_object_label *retval; | |
43224 | + struct dentry *parent; | |
43225 | + | |
43226 | + write_seqlock(&rename_lock); | |
43227 | + br_read_lock(vfsmount_lock); | |
43228 | + | |
43229 | + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt || | |
43230 | +#ifdef CONFIG_NET | |
43231 | + mnt == sock_mnt || | |
43232 | +#endif | |
43233 | +#ifdef CONFIG_HUGETLBFS | |
43234 | + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) || | |
43235 | +#endif | |
43236 | + /* ignore Eric Biederman */ | |
43237 | + IS_PRIVATE(l_dentry->d_inode))) { | |
43238 | + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw; | |
43239 | + goto out; | |
43240 | + } | |
43241 | + | |
43242 | + for (;;) { | |
43243 | + if (dentry == real_root.dentry && mnt == real_root.mnt) | |
43244 | + break; | |
43245 | + | |
43246 | + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) { | |
43247 | + if (mnt->mnt_parent == mnt) | |
43248 | + break; | |
43249 | + | |
43250 | + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob); | |
43251 | + if (retval != NULL) | |
43252 | + goto out; | |
43253 | + | |
43254 | + dentry = mnt->mnt_mountpoint; | |
43255 | + mnt = mnt->mnt_parent; | |
43256 | + continue; | |
43257 | + } | |
43258 | + | |
43259 | + parent = dentry->d_parent; | |
43260 | + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob); | |
43261 | + if (retval != NULL) | |
43262 | + goto out; | |
43263 | + | |
43264 | + dentry = parent; | |
43265 | + } | |
43266 | + | |
43267 | + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob); | |
43268 | + | |
43269 | + /* real_root is pinned so we don't have to hold a reference */ | |
43270 | + if (retval == NULL) | |
43271 | + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob); | |
43272 | +out: | |
43273 | + br_read_unlock(vfsmount_lock); | |
43274 | + write_sequnlock(&rename_lock); | |
43275 | + | |
43276 | + BUG_ON(retval == NULL); | |
43277 | + | |
43278 | + return retval; | |
43279 | +} | |
43280 | + | |
43281 | +static __inline__ struct acl_object_label * | |
43282 | +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt, | |
43283 | + const struct acl_subject_label *subj) | |
43284 | +{ | |
43285 | + char *path = NULL; | |
43286 | + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB); | |
43287 | +} | |
43288 | + | |
43289 | +static __inline__ struct acl_object_label * | |
43290 | +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt, | |
43291 | + const struct acl_subject_label *subj) | |
43292 | +{ | |
43293 | + char *path = NULL; | |
43294 | + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB); | |
43295 | +} | |
43296 | + | |
43297 | +static __inline__ struct acl_object_label * | |
43298 | +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt, | |
43299 | + const struct acl_subject_label *subj, char *path) | |
43300 | +{ | |
43301 | + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB); | |
43302 | +} | |
43303 | + | |
43304 | +static struct acl_subject_label * | |
43305 | +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt, | |
43306 | + const struct acl_role_label *role) | |
43307 | +{ | |
43308 | + struct dentry *dentry = (struct dentry *) l_dentry; | |
43309 | + struct vfsmount *mnt = (struct vfsmount *) l_mnt; | |
43310 | + struct acl_subject_label *retval; | |
43311 | + struct dentry *parent; | |
43312 | + | |
43313 | + write_seqlock(&rename_lock); | |
43314 | + br_read_lock(vfsmount_lock); | |
43315 | + | |
43316 | + for (;;) { | |
43317 | + if (dentry == real_root.dentry && mnt == real_root.mnt) | |
43318 | + break; | |
43319 | + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) { | |
43320 | + if (mnt->mnt_parent == mnt) | |
43321 | + break; | |
43322 | + | |
43323 | + spin_lock(&dentry->d_lock); | |
43324 | + read_lock(&gr_inode_lock); | |
43325 | + retval = | |
43326 | + lookup_acl_subj_label(dentry->d_inode->i_ino, | |
43327 | + __get_dev(dentry), role); | |
43328 | + read_unlock(&gr_inode_lock); | |
43329 | + spin_unlock(&dentry->d_lock); | |
43330 | + if (retval != NULL) | |
43331 | + goto out; | |
43332 | + | |
43333 | + dentry = mnt->mnt_mountpoint; | |
43334 | + mnt = mnt->mnt_parent; | |
43335 | + continue; | |
43336 | + } | |
43337 | + | |
43338 | + spin_lock(&dentry->d_lock); | |
43339 | + read_lock(&gr_inode_lock); | |
43340 | + retval = lookup_acl_subj_label(dentry->d_inode->i_ino, | |
43341 | + __get_dev(dentry), role); | |
43342 | + read_unlock(&gr_inode_lock); | |
43343 | + parent = dentry->d_parent; | |
43344 | + spin_unlock(&dentry->d_lock); | |
43345 | + | |
43346 | + if (retval != NULL) | |
43347 | + goto out; | |
43348 | + | |
43349 | + dentry = parent; | |
43350 | + } | |
43351 | + | |
43352 | + spin_lock(&dentry->d_lock); | |
43353 | + read_lock(&gr_inode_lock); | |
43354 | + retval = lookup_acl_subj_label(dentry->d_inode->i_ino, | |
43355 | + __get_dev(dentry), role); | |
43356 | + read_unlock(&gr_inode_lock); | |
43357 | + spin_unlock(&dentry->d_lock); | |
43358 | + | |
43359 | + if (unlikely(retval == NULL)) { | |
43360 | + /* real_root is pinned, we don't need to hold a reference */ | |
43361 | + read_lock(&gr_inode_lock); | |
43362 | + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino, | |
43363 | + __get_dev(real_root.dentry), role); | |
43364 | + read_unlock(&gr_inode_lock); | |
43365 | + } | |
43366 | +out: | |
43367 | + br_read_unlock(vfsmount_lock); | |
43368 | + write_sequnlock(&rename_lock); | |
43369 | + | |
43370 | + BUG_ON(retval == NULL); | |
43371 | + | |
43372 | + return retval; | |
43373 | +} | |
43374 | + | |
43375 | +static void | |
43376 | +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode) | |
43377 | +{ | |
43378 | + struct task_struct *task = current; | |
43379 | + const struct cred *cred = current_cred(); | |
43380 | + | |
43381 | + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype, | |
43382 | + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry, | |
43383 | + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename, | |
43384 | + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip); | |
43385 | + | |
43386 | + return; | |
43387 | +} | |
43388 | + | |
43389 | +static void | |
43390 | +gr_log_learn_sysctl(const char *path, const __u32 mode) | |
43391 | +{ | |
43392 | + struct task_struct *task = current; | |
43393 | + const struct cred *cred = current_cred(); | |
43394 | + | |
43395 | + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype, | |
43396 | + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry, | |
43397 | + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename, | |
43398 | + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip); | |
43399 | + | |
43400 | + return; | |
43401 | +} | |
43402 | + | |
43403 | +static void | |
43404 | +gr_log_learn_id_change(const char type, const unsigned int real, | |
43405 | + const unsigned int effective, const unsigned int fs) | |
43406 | +{ | |
43407 | + struct task_struct *task = current; | |
43408 | + const struct cred *cred = current_cred(); | |
43409 | + | |
43410 | + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype, | |
43411 | + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry, | |
43412 | + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename, | |
43413 | + type, real, effective, fs, &task->signal->saved_ip); | |
43414 | + | |
43415 | + return; | |
43416 | +} | |
43417 | + | |
43418 | +__u32 | |
43419 | +gr_check_link(const struct dentry * new_dentry, | |
43420 | + const struct dentry * parent_dentry, | |
43421 | + const struct vfsmount * parent_mnt, | |
43422 | + const struct dentry * old_dentry, const struct vfsmount * old_mnt) | |
43423 | +{ | |
43424 | + struct acl_object_label *obj; | |
43425 | + __u32 oldmode, newmode; | |
43426 | + __u32 needmode; | |
43427 | + | |
43428 | + if (unlikely(!(gr_status & GR_READY))) | |
43429 | + return (GR_CREATE | GR_LINK); | |
43430 | + | |
43431 | + obj = chk_obj_label(old_dentry, old_mnt, current->acl); | |
43432 | + oldmode = obj->mode; | |
43433 | + | |
43434 | + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) | |
43435 | + oldmode |= (GR_CREATE | GR_LINK); | |
43436 | + | |
43437 | + needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS; | |
43438 | + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID)) | |
43439 | + needmode |= GR_SETID | GR_AUDIT_SETID; | |
43440 | + | |
43441 | + newmode = | |
43442 | + gr_check_create(new_dentry, parent_dentry, parent_mnt, | |
43443 | + oldmode | needmode); | |
43444 | + | |
43445 | + needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | | |
43446 | + GR_SETID | GR_READ | GR_FIND | GR_DELETE | | |
43447 | + GR_INHERIT | GR_AUDIT_INHERIT); | |
43448 | + | |
43449 | + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID)) | |
43450 | + goto bad; | |
43451 | + | |
43452 | + if ((oldmode & needmode) != needmode) | |
43453 | + goto bad; | |
43454 | + | |
43455 | + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS); | |
43456 | + if ((newmode & needmode) != needmode) | |
43457 | + goto bad; | |
43458 | + | |
43459 | + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK)) | |
43460 | + return newmode; | |
43461 | +bad: | |
43462 | + needmode = oldmode; | |
43463 | + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID)) | |
43464 | + needmode |= GR_SETID; | |
43465 | + | |
43466 | + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) { | |
43467 | + gr_log_learn(old_dentry, old_mnt, needmode); | |
43468 | + return (GR_CREATE | GR_LINK); | |
43469 | + } else if (newmode & GR_SUPPRESS) | |
43470 | + return GR_SUPPRESS; | |
43471 | + else | |
43472 | + return 0; | |
43473 | +} | |
43474 | + | |
43475 | +__u32 | |
43476 | +gr_search_file(const struct dentry * dentry, const __u32 mode, | |
43477 | + const struct vfsmount * mnt) | |
43478 | +{ | |
43479 | + __u32 retval = mode; | |
43480 | + struct acl_subject_label *curracl; | |
43481 | + struct acl_object_label *currobj; | |
43482 | + | |
43483 | + if (unlikely(!(gr_status & GR_READY))) | |
43484 | + return (mode & ~GR_AUDITS); | |
43485 | + | |
43486 | + curracl = current->acl; | |
43487 | + | |
43488 | + currobj = chk_obj_label(dentry, mnt, curracl); | |
43489 | + retval = currobj->mode & mode; | |
43490 | + | |
43491 | + /* if we're opening a specified transfer file for writing | |
43492 | + (e.g. /dev/initctl), then transfer our role to init | |
43493 | + */ | |
43494 | + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE && | |
43495 | + current->role->roletype & GR_ROLE_PERSIST)) { | |
43496 | + struct task_struct *task = init_pid_ns.child_reaper; | |
43497 | + | |
43498 | + if (task->role != current->role) { | |
43499 | + task->acl_sp_role = 0; | |
43500 | + task->acl_role_id = current->acl_role_id; | |
43501 | + task->role = current->role; | |
43502 | + rcu_read_lock(); | |
43503 | + read_lock(&grsec_exec_file_lock); | |
43504 | + gr_apply_subject_to_task(task); | |
43505 | + read_unlock(&grsec_exec_file_lock); | |
43506 | + rcu_read_unlock(); | |
43507 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG); | |
43508 | + } | |
43509 | + } | |
43510 | + | |
43511 | + if (unlikely | |
43512 | + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE) | |
43513 | + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) { | |
43514 | + __u32 new_mode = mode; | |
43515 | + | |
43516 | + new_mode &= ~(GR_AUDITS | GR_SUPPRESS); | |
43517 | + | |
43518 | + retval = new_mode; | |
43519 | + | |
43520 | + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN) | |
43521 | + new_mode |= GR_INHERIT; | |
43522 | + | |
43523 | + if (!(mode & GR_NOLEARN)) | |
43524 | + gr_log_learn(dentry, mnt, new_mode); | |
43525 | + } | |
43526 | + | |
43527 | + return retval; | |
43528 | +} | |
43529 | + | |
43530 | +__u32 | |
43531 | +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent, | |
43532 | + const struct vfsmount * mnt, const __u32 mode) | |
43533 | +{ | |
43534 | + struct name_entry *match; | |
43535 | + struct acl_object_label *matchpo; | |
43536 | + struct acl_subject_label *curracl; | |
43537 | + char *path; | |
43538 | + __u32 retval; | |
43539 | + | |
43540 | + if (unlikely(!(gr_status & GR_READY))) | |
43541 | + return (mode & ~GR_AUDITS); | |
43542 | + | |
43543 | + preempt_disable(); | |
43544 | + path = gr_to_filename_rbac(new_dentry, mnt); | |
43545 | + match = lookup_name_entry_create(path); | |
43546 | + | |
43547 | + if (!match) | |
43548 | + goto check_parent; | |
43549 | + | |
43550 | + curracl = current->acl; | |
43551 | + | |
43552 | + read_lock(&gr_inode_lock); | |
43553 | + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl); | |
43554 | + read_unlock(&gr_inode_lock); | |
43555 | + | |
43556 | + if (matchpo) { | |
43557 | + if ((matchpo->mode & mode) != | |
43558 | + (mode & ~(GR_AUDITS | GR_SUPPRESS)) | |
43559 | + && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) { | |
43560 | + __u32 new_mode = mode; | |
43561 | + | |
43562 | + new_mode &= ~(GR_AUDITS | GR_SUPPRESS); | |
43563 | + | |
43564 | + gr_log_learn(new_dentry, mnt, new_mode); | |
43565 | + | |
43566 | + preempt_enable(); | |
43567 | + return new_mode; | |
43568 | + } | |
43569 | + preempt_enable(); | |
43570 | + return (matchpo->mode & mode); | |
43571 | + } | |
43572 | + | |
43573 | + check_parent: | |
43574 | + curracl = current->acl; | |
43575 | + | |
43576 | + matchpo = chk_obj_create_label(parent, mnt, curracl, path); | |
43577 | + retval = matchpo->mode & mode; | |
43578 | + | |
43579 | + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))) | |
43580 | + && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) { | |
43581 | + __u32 new_mode = mode; | |
43582 | + | |
43583 | + new_mode &= ~(GR_AUDITS | GR_SUPPRESS); | |
43584 | + | |
43585 | + gr_log_learn(new_dentry, mnt, new_mode); | |
43586 | + preempt_enable(); | |
43587 | + return new_mode; | |
43588 | + } | |
43589 | + | |
43590 | + preempt_enable(); | |
43591 | + return retval; | |
43592 | +} | |
43593 | + | |
43594 | +int | |
43595 | +gr_check_hidden_task(const struct task_struct *task) | |
43596 | +{ | |
43597 | + if (unlikely(!(gr_status & GR_READY))) | |
43598 | + return 0; | |
43599 | + | |
43600 | + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW)) | |
43601 | + return 1; | |
43602 | + | |
43603 | + return 0; | |
43604 | +} | |
43605 | + | |
43606 | +int | |
43607 | +gr_check_protected_task(const struct task_struct *task) | |
43608 | +{ | |
43609 | + if (unlikely(!(gr_status & GR_READY) || !task)) | |
43610 | + return 0; | |
43611 | + | |
43612 | + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) && | |
43613 | + task->acl != current->acl) | |
43614 | + return 1; | |
43615 | + | |
43616 | + return 0; | |
43617 | +} | |
43618 | + | |
43619 | +int | |
43620 | +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type) | |
43621 | +{ | |
43622 | + struct task_struct *p; | |
43623 | + int ret = 0; | |
43624 | + | |
43625 | + if (unlikely(!(gr_status & GR_READY) || !pid)) | |
43626 | + return ret; | |
43627 | + | |
43628 | + read_lock(&tasklist_lock); | |
43629 | + do_each_pid_task(pid, type, p) { | |
43630 | + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) && | |
43631 | + p->acl != current->acl) { | |
43632 | + ret = 1; | |
43633 | + goto out; | |
43634 | + } | |
43635 | + } while_each_pid_task(pid, type, p); | |
43636 | +out: | |
43637 | + read_unlock(&tasklist_lock); | |
43638 | + | |
43639 | + return ret; | |
43640 | +} | |
43641 | + | |
43642 | +void | |
43643 | +gr_copy_label(struct task_struct *tsk) | |
43644 | +{ | |
43645 | + tsk->signal->used_accept = 0; | |
43646 | + tsk->acl_sp_role = 0; | |
43647 | + tsk->acl_role_id = current->acl_role_id; | |
43648 | + tsk->acl = current->acl; | |
43649 | + tsk->role = current->role; | |
43650 | + tsk->signal->curr_ip = current->signal->curr_ip; | |
43651 | + tsk->signal->saved_ip = current->signal->saved_ip; | |
43652 | + if (current->exec_file) | |
43653 | + get_file(current->exec_file); | |
43654 | + tsk->exec_file = current->exec_file; | |
43655 | + tsk->is_writable = current->is_writable; | |
43656 | + if (unlikely(current->signal->used_accept)) { | |
43657 | + current->signal->curr_ip = 0; | |
43658 | + current->signal->saved_ip = 0; | |
43659 | + } | |
43660 | + | |
43661 | + return; | |
43662 | +} | |
43663 | + | |
43664 | +static void | |
43665 | +gr_set_proc_res(struct task_struct *task) | |
43666 | +{ | |
43667 | + struct acl_subject_label *proc; | |
43668 | + unsigned short i; | |
43669 | + | |
43670 | + proc = task->acl; | |
43671 | + | |
43672 | + if (proc->mode & (GR_LEARN | GR_INHERITLEARN)) | |
43673 | + return; | |
43674 | + | |
43675 | + for (i = 0; i < RLIM_NLIMITS; i++) { | |
43676 | + if (!(proc->resmask & (1 << i))) | |
43677 | + continue; | |
43678 | + | |
43679 | + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur; | |
43680 | + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max; | |
43681 | + } | |
43682 | + | |
43683 | + return; | |
43684 | +} | |
43685 | + | |
43686 | +extern int __gr_process_user_ban(struct user_struct *user); | |
43687 | + | |
43688 | +int | |
43689 | +gr_check_user_change(int real, int effective, int fs) | |
43690 | +{ | |
43691 | + unsigned int i; | |
43692 | + __u16 num; | |
43693 | + uid_t *uidlist; | |
43694 | + int curuid; | |
43695 | + int realok = 0; | |
43696 | + int effectiveok = 0; | |
43697 | + int fsok = 0; | |
43698 | + | |
43699 | +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) | |
43700 | + struct user_struct *user; | |
43701 | + | |
43702 | + if (real == -1) | |
43703 | + goto skipit; | |
43704 | + | |
43705 | + user = find_user(real); | |
43706 | + if (user == NULL) | |
43707 | + goto skipit; | |
43708 | + | |
43709 | + if (__gr_process_user_ban(user)) { | |
43710 | + /* for find_user */ | |
43711 | + free_uid(user); | |
43712 | + return 1; | |
43713 | + } | |
43714 | + | |
43715 | + /* for find_user */ | |
43716 | + free_uid(user); | |
43717 | + | |
43718 | +skipit: | |
43719 | +#endif | |
43720 | + | |
43721 | + if (unlikely(!(gr_status & GR_READY))) | |
43722 | + return 0; | |
43723 | + | |
43724 | + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) | |
43725 | + gr_log_learn_id_change('u', real, effective, fs); | |
43726 | + | |
43727 | + num = current->acl->user_trans_num; | |
43728 | + uidlist = current->acl->user_transitions; | |
43729 | + | |
43730 | + if (uidlist == NULL) | |
43731 | + return 0; | |
43732 | + | |
43733 | + if (real == -1) | |
43734 | + realok = 1; | |
43735 | + if (effective == -1) | |
43736 | + effectiveok = 1; | |
43737 | + if (fs == -1) | |
43738 | + fsok = 1; | |
43739 | + | |
43740 | + if (current->acl->user_trans_type & GR_ID_ALLOW) { | |
43741 | + for (i = 0; i < num; i++) { | |
43742 | + curuid = (int)uidlist[i]; | |
43743 | + if (real == curuid) | |
43744 | + realok = 1; | |
43745 | + if (effective == curuid) | |
43746 | + effectiveok = 1; | |
43747 | + if (fs == curuid) | |
43748 | + fsok = 1; | |
43749 | + } | |
43750 | + } else if (current->acl->user_trans_type & GR_ID_DENY) { | |
43751 | + for (i = 0; i < num; i++) { | |
43752 | + curuid = (int)uidlist[i]; | |
43753 | + if (real == curuid) | |
43754 | + break; | |
43755 | + if (effective == curuid) | |
43756 | + break; | |
43757 | + if (fs == curuid) | |
43758 | + break; | |
43759 | + } | |
43760 | + /* not in deny list */ | |
43761 | + if (i == num) { | |
43762 | + realok = 1; | |
43763 | + effectiveok = 1; | |
43764 | + fsok = 1; | |
43765 | + } | |
43766 | + } | |
43767 | + | |
43768 | + if (realok && effectiveok && fsok) | |
43769 | + return 0; | |
43770 | + else { | |
43771 | + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real); | |
43772 | + return 1; | |
43773 | + } | |
43774 | +} | |
43775 | + | |
43776 | +int | |
43777 | +gr_check_group_change(int real, int effective, int fs) | |
43778 | +{ | |
43779 | + unsigned int i; | |
43780 | + __u16 num; | |
43781 | + gid_t *gidlist; | |
43782 | + int curgid; | |
43783 | + int realok = 0; | |
43784 | + int effectiveok = 0; | |
43785 | + int fsok = 0; | |
43786 | + | |
43787 | + if (unlikely(!(gr_status & GR_READY))) | |
43788 | + return 0; | |
43789 | + | |
43790 | + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) | |
43791 | + gr_log_learn_id_change('g', real, effective, fs); | |
43792 | + | |
43793 | + num = current->acl->group_trans_num; | |
43794 | + gidlist = current->acl->group_transitions; | |
43795 | + | |
43796 | + if (gidlist == NULL) | |
43797 | + return 0; | |
43798 | + | |
43799 | + if (real == -1) | |
43800 | + realok = 1; | |
43801 | + if (effective == -1) | |
43802 | + effectiveok = 1; | |
43803 | + if (fs == -1) | |
43804 | + fsok = 1; | |
43805 | + | |
43806 | + if (current->acl->group_trans_type & GR_ID_ALLOW) { | |
43807 | + for (i = 0; i < num; i++) { | |
43808 | + curgid = (int)gidlist[i]; | |
43809 | + if (real == curgid) | |
43810 | + realok = 1; | |
43811 | + if (effective == curgid) | |
43812 | + effectiveok = 1; | |
43813 | + if (fs == curgid) | |
43814 | + fsok = 1; | |
43815 | + } | |
43816 | + } else if (current->acl->group_trans_type & GR_ID_DENY) { | |
43817 | + for (i = 0; i < num; i++) { | |
43818 | + curgid = (int)gidlist[i]; | |
43819 | + if (real == curgid) | |
43820 | + break; | |
43821 | + if (effective == curgid) | |
43822 | + break; | |
43823 | + if (fs == curgid) | |
43824 | + break; | |
43825 | + } | |
43826 | + /* not in deny list */ | |
43827 | + if (i == num) { | |
43828 | + realok = 1; | |
43829 | + effectiveok = 1; | |
43830 | + fsok = 1; | |
43831 | + } | |
43832 | + } | |
43833 | + | |
43834 | + if (realok && effectiveok && fsok) | |
43835 | + return 0; | |
43836 | + else { | |
43837 | + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real); | |
43838 | + return 1; | |
43839 | + } | |
43840 | +} | |
43841 | + | |
43842 | +void | |
43843 | +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid) | |
43844 | +{ | |
43845 | + struct acl_role_label *role = task->role; | |
43846 | + struct acl_subject_label *subj = NULL; | |
43847 | + struct acl_object_label *obj; | |
43848 | + struct file *filp; | |
43849 | + | |
43850 | + if (unlikely(!(gr_status & GR_READY))) | |
43851 | + return; | |
43852 | + | |
43853 | + filp = task->exec_file; | |
43854 | + | |
43855 | + /* kernel process, we'll give them the kernel role */ | |
43856 | + if (unlikely(!filp)) { | |
43857 | + task->role = kernel_role; | |
43858 | + task->acl = kernel_role->root_label; | |
43859 | + return; | |
43860 | + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL)) | |
43861 | + role = lookup_acl_role_label(task, uid, gid); | |
43862 | + | |
43863 | + /* perform subject lookup in possibly new role | |
43864 | + we can use this result below in the case where role == task->role | |
43865 | + */ | |
43866 | + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role); | |
43867 | + | |
43868 | + /* if we changed uid/gid, but result in the same role | |
43869 | + and are using inheritance, don't lose the inherited subject | |
43870 | + if current subject is other than what normal lookup | |
43871 | + would result in, we arrived via inheritance, don't | |
43872 | + lose subject | |
43873 | + */ | |
43874 | + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) && | |
43875 | + (subj == task->acl))) | |
43876 | + task->acl = subj; | |
43877 | + | |
43878 | + task->role = role; | |
43879 | + | |
43880 | + task->is_writable = 0; | |
43881 | + | |
43882 | + /* ignore additional mmap checks for processes that are writable | |
43883 | + by the default ACL */ | |
43884 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label); | |
43885 | + if (unlikely(obj->mode & GR_WRITE)) | |
43886 | + task->is_writable = 1; | |
43887 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label); | |
43888 | + if (unlikely(obj->mode & GR_WRITE)) | |
43889 | + task->is_writable = 1; | |
43890 | + | |
43891 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
43892 | + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename); | |
43893 | +#endif | |
43894 | + | |
43895 | + gr_set_proc_res(task); | |
43896 | + | |
43897 | + return; | |
43898 | +} | |
43899 | + | |
43900 | +int | |
43901 | +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt, | |
43902 | + const int unsafe_share) | |
43903 | +{ | |
43904 | + struct task_struct *task = current; | |
43905 | + struct acl_subject_label *newacl; | |
43906 | + struct acl_object_label *obj; | |
43907 | + __u32 retmode; | |
43908 | + | |
43909 | + if (unlikely(!(gr_status & GR_READY))) | |
43910 | + return 0; | |
43911 | + | |
43912 | + newacl = chk_subj_label(dentry, mnt, task->role); | |
43913 | + | |
43914 | + task_lock(task); | |
43915 | + if ((((task->ptrace & PT_PTRACED) || unsafe_share) && | |
43916 | + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) && | |
43917 | + !(task->role->roletype & GR_ROLE_GOD) && | |
43918 | + !gr_search_file(dentry, GR_PTRACERD, mnt) && | |
43919 | + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) { | |
43920 | + task_unlock(task); | |
43921 | + if (unsafe_share) | |
43922 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt); | |
43923 | + else | |
43924 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt); | |
43925 | + return -EACCES; | |
43926 | + } | |
43927 | + task_unlock(task); | |
43928 | + | |
43929 | + obj = chk_obj_label(dentry, mnt, task->acl); | |
43930 | + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT); | |
43931 | + | |
43932 | + if (!(task->acl->mode & GR_INHERITLEARN) && | |
43933 | + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) { | |
43934 | + if (obj->nested) | |
43935 | + task->acl = obj->nested; | |
43936 | + else | |
43937 | + task->acl = newacl; | |
43938 | + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT) | |
43939 | + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt); | |
43940 | + | |
43941 | + task->is_writable = 0; | |
43942 | + | |
43943 | + /* ignore additional mmap checks for processes that are writable | |
43944 | + by the default ACL */ | |
43945 | + obj = chk_obj_label(dentry, mnt, default_role->root_label); | |
43946 | + if (unlikely(obj->mode & GR_WRITE)) | |
43947 | + task->is_writable = 1; | |
43948 | + obj = chk_obj_label(dentry, mnt, task->role->root_label); | |
43949 | + if (unlikely(obj->mode & GR_WRITE)) | |
43950 | + task->is_writable = 1; | |
43951 | + | |
43952 | + gr_set_proc_res(task); | |
43953 | + | |
43954 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
43955 | + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename); | |
43956 | +#endif | |
43957 | + return 0; | |
43958 | +} | |
43959 | + | |
43960 | +/* always called with valid inodev ptr */ | |
43961 | +static void | |
43962 | +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev) | |
43963 | +{ | |
43964 | + struct acl_object_label *matchpo; | |
43965 | + struct acl_subject_label *matchps; | |
43966 | + struct acl_subject_label *subj; | |
43967 | + struct acl_role_label *role; | |
43968 | + unsigned int x; | |
43969 | + | |
43970 | + FOR_EACH_ROLE_START(role) | |
43971 | + FOR_EACH_SUBJECT_START(role, subj, x) | |
43972 | + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL) | |
43973 | + matchpo->mode |= GR_DELETED; | |
43974 | + FOR_EACH_SUBJECT_END(subj,x) | |
43975 | + FOR_EACH_NESTED_SUBJECT_START(role, subj) | |
43976 | + if (subj->inode == ino && subj->device == dev) | |
43977 | + subj->mode |= GR_DELETED; | |
43978 | + FOR_EACH_NESTED_SUBJECT_END(subj) | |
43979 | + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL) | |
43980 | + matchps->mode |= GR_DELETED; | |
43981 | + FOR_EACH_ROLE_END(role) | |
43982 | + | |
43983 | + inodev->nentry->deleted = 1; | |
43984 | + | |
43985 | + return; | |
43986 | +} | |
43987 | + | |
43988 | +void | |
43989 | +gr_handle_delete(const ino_t ino, const dev_t dev) | |
43990 | +{ | |
43991 | + struct inodev_entry *inodev; | |
43992 | + | |
43993 | + if (unlikely(!(gr_status & GR_READY))) | |
43994 | + return; | |
43995 | + | |
43996 | + write_lock(&gr_inode_lock); | |
43997 | + inodev = lookup_inodev_entry(ino, dev); | |
43998 | + if (inodev != NULL) | |
43999 | + do_handle_delete(inodev, ino, dev); | |
44000 | + write_unlock(&gr_inode_lock); | |
44001 | + | |
44002 | + return; | |
44003 | +} | |
44004 | + | |
44005 | +static void | |
44006 | +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice, | |
44007 | + const ino_t newinode, const dev_t newdevice, | |
44008 | + struct acl_subject_label *subj) | |
44009 | +{ | |
44010 | + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size); | |
44011 | + struct acl_object_label *match; | |
44012 | + | |
44013 | + match = subj->obj_hash[index]; | |
44014 | + | |
44015 | + while (match && (match->inode != oldinode || | |
44016 | + match->device != olddevice || | |
44017 | + !(match->mode & GR_DELETED))) | |
44018 | + match = match->next; | |
44019 | + | |
44020 | + if (match && (match->inode == oldinode) | |
44021 | + && (match->device == olddevice) | |
44022 | + && (match->mode & GR_DELETED)) { | |
44023 | + if (match->prev == NULL) { | |
44024 | + subj->obj_hash[index] = match->next; | |
44025 | + if (match->next != NULL) | |
44026 | + match->next->prev = NULL; | |
44027 | + } else { | |
44028 | + match->prev->next = match->next; | |
44029 | + if (match->next != NULL) | |
44030 | + match->next->prev = match->prev; | |
44031 | + } | |
44032 | + match->prev = NULL; | |
44033 | + match->next = NULL; | |
44034 | + match->inode = newinode; | |
44035 | + match->device = newdevice; | |
44036 | + match->mode &= ~GR_DELETED; | |
44037 | + | |
44038 | + insert_acl_obj_label(match, subj); | |
44039 | + } | |
44040 | + | |
44041 | + return; | |
44042 | +} | |
44043 | + | |
44044 | +static void | |
44045 | +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice, | |
44046 | + const ino_t newinode, const dev_t newdevice, | |
44047 | + struct acl_role_label *role) | |
44048 | +{ | |
44049 | + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size); | |
44050 | + struct acl_subject_label *match; | |
44051 | + | |
44052 | + match = role->subj_hash[index]; | |
44053 | + | |
44054 | + while (match && (match->inode != oldinode || | |
44055 | + match->device != olddevice || | |
44056 | + !(match->mode & GR_DELETED))) | |
44057 | + match = match->next; | |
44058 | + | |
44059 | + if (match && (match->inode == oldinode) | |
44060 | + && (match->device == olddevice) | |
44061 | + && (match->mode & GR_DELETED)) { | |
44062 | + if (match->prev == NULL) { | |
44063 | + role->subj_hash[index] = match->next; | |
44064 | + if (match->next != NULL) | |
44065 | + match->next->prev = NULL; | |
44066 | + } else { | |
44067 | + match->prev->next = match->next; | |
44068 | + if (match->next != NULL) | |
44069 | + match->next->prev = match->prev; | |
44070 | + } | |
44071 | + match->prev = NULL; | |
44072 | + match->next = NULL; | |
44073 | + match->inode = newinode; | |
44074 | + match->device = newdevice; | |
44075 | + match->mode &= ~GR_DELETED; | |
44076 | + | |
44077 | + insert_acl_subj_label(match, role); | |
44078 | + } | |
44079 | + | |
44080 | + return; | |
44081 | +} | |
44082 | + | |
44083 | +static void | |
44084 | +update_inodev_entry(const ino_t oldinode, const dev_t olddevice, | |
44085 | + const ino_t newinode, const dev_t newdevice) | |
44086 | +{ | |
44087 | + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size); | |
44088 | + struct inodev_entry *match; | |
44089 | + | |
44090 | + match = inodev_set.i_hash[index]; | |
44091 | + | |
44092 | + while (match && (match->nentry->inode != oldinode || | |
44093 | + match->nentry->device != olddevice || !match->nentry->deleted)) | |
44094 | + match = match->next; | |
44095 | + | |
44096 | + if (match && (match->nentry->inode == oldinode) | |
44097 | + && (match->nentry->device == olddevice) && | |
44098 | + match->nentry->deleted) { | |
44099 | + if (match->prev == NULL) { | |
44100 | + inodev_set.i_hash[index] = match->next; | |
44101 | + if (match->next != NULL) | |
44102 | + match->next->prev = NULL; | |
44103 | + } else { | |
44104 | + match->prev->next = match->next; | |
44105 | + if (match->next != NULL) | |
44106 | + match->next->prev = match->prev; | |
44107 | + } | |
44108 | + match->prev = NULL; | |
44109 | + match->next = NULL; | |
44110 | + match->nentry->inode = newinode; | |
44111 | + match->nentry->device = newdevice; | |
44112 | + match->nentry->deleted = 0; | |
44113 | + | |
44114 | + insert_inodev_entry(match); | |
44115 | + } | |
44116 | + | |
44117 | + return; | |
44118 | +} | |
44119 | + | |
44120 | +static void | |
44121 | +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry, | |
44122 | + const struct vfsmount *mnt) | |
44123 | +{ | |
44124 | + struct acl_subject_label *subj; | |
44125 | + struct acl_role_label *role; | |
44126 | + unsigned int x; | |
44127 | + ino_t ino = dentry->d_inode->i_ino; | |
44128 | + dev_t dev = __get_dev(dentry); | |
44129 | + | |
44130 | + FOR_EACH_ROLE_START(role) | |
44131 | + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role); | |
44132 | + | |
44133 | + FOR_EACH_NESTED_SUBJECT_START(role, subj) | |
44134 | + if ((subj->inode == ino) && (subj->device == dev)) { | |
44135 | + subj->inode = ino; | |
44136 | + subj->device = dev; | |
44137 | + } | |
44138 | + FOR_EACH_NESTED_SUBJECT_END(subj) | |
44139 | + FOR_EACH_SUBJECT_START(role, subj, x) | |
44140 | + update_acl_obj_label(matchn->inode, matchn->device, | |
44141 | + ino, dev, subj); | |
44142 | + FOR_EACH_SUBJECT_END(subj,x) | |
44143 | + FOR_EACH_ROLE_END(role) | |
44144 | + | |
44145 | + update_inodev_entry(matchn->inode, matchn->device, ino, dev); | |
44146 | + | |
44147 | + return; | |
44148 | +} | |
44149 | + | |
44150 | +void | |
44151 | +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt) | |
44152 | +{ | |
44153 | + struct name_entry *matchn; | |
44154 | + | |
44155 | + if (unlikely(!(gr_status & GR_READY))) | |
44156 | + return; | |
44157 | + | |
44158 | + preempt_disable(); | |
44159 | + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt)); | |
44160 | + | |
44161 | + if (unlikely((unsigned long)matchn)) { | |
44162 | + write_lock(&gr_inode_lock); | |
44163 | + do_handle_create(matchn, dentry, mnt); | |
44164 | + write_unlock(&gr_inode_lock); | |
44165 | + } | |
44166 | + preempt_enable(); | |
44167 | + | |
44168 | + return; | |
44169 | +} | |
44170 | + | |
44171 | +void | |
44172 | +gr_handle_rename(struct inode *old_dir, struct inode *new_dir, | |
44173 | + struct dentry *old_dentry, | |
44174 | + struct dentry *new_dentry, | |
44175 | + struct vfsmount *mnt, const __u8 replace) | |
44176 | +{ | |
44177 | + struct name_entry *matchn; | |
44178 | + struct inodev_entry *inodev; | |
44179 | + ino_t old_ino = old_dentry->d_inode->i_ino; | |
44180 | + dev_t old_dev = __get_dev(old_dentry); | |
44181 | + | |
44182 | + /* vfs_rename swaps the name and parent link for old_dentry and | |
44183 | + new_dentry | |
44184 | + at this point, old_dentry has the new name, parent link, and inode | |
44185 | + for the renamed file | |
44186 | + if a file is being replaced by a rename, new_dentry has the inode | |
44187 | + and name for the replaced file | |
44188 | + */ | |
44189 | + | |
44190 | + if (unlikely(!(gr_status & GR_READY))) | |
44191 | + return; | |
44192 | + | |
44193 | + preempt_disable(); | |
44194 | + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt)); | |
44195 | + | |
44196 | + /* we wouldn't have to check d_inode if it weren't for | |
44197 | + NFS silly-renaming | |
44198 | + */ | |
44199 | + | |
44200 | + write_lock(&gr_inode_lock); | |
44201 | + if (unlikely(replace && new_dentry->d_inode)) { | |
44202 | + ino_t new_ino = new_dentry->d_inode->i_ino; | |
44203 | + dev_t new_dev = __get_dev(new_dentry); | |
44204 | + | |
44205 | + inodev = lookup_inodev_entry(new_ino, new_dev); | |
44206 | + if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1)) | |
44207 | + do_handle_delete(inodev, new_ino, new_dev); | |
44208 | + } | |
44209 | + | |
44210 | + inodev = lookup_inodev_entry(old_ino, old_dev); | |
44211 | + if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1)) | |
44212 | + do_handle_delete(inodev, old_ino, old_dev); | |
44213 | + | |
44214 | + if (unlikely((unsigned long)matchn)) | |
44215 | + do_handle_create(matchn, old_dentry, mnt); | |
44216 | + | |
44217 | + write_unlock(&gr_inode_lock); | |
44218 | + preempt_enable(); | |
44219 | + | |
44220 | + return; | |
44221 | +} | |
44222 | + | |
44223 | +static int | |
44224 | +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt, | |
44225 | + unsigned char **sum) | |
44226 | +{ | |
44227 | + struct acl_role_label *r; | |
44228 | + struct role_allowed_ip *ipp; | |
44229 | + struct role_transition *trans; | |
44230 | + unsigned int i; | |
44231 | + int found = 0; | |
44232 | + u32 curr_ip = current->signal->curr_ip; | |
44233 | + | |
44234 | + current->signal->saved_ip = curr_ip; | |
44235 | + | |
44236 | + /* check transition table */ | |
44237 | + | |
44238 | + for (trans = current->role->transitions; trans; trans = trans->next) { | |
44239 | + if (!strcmp(rolename, trans->rolename)) { | |
44240 | + found = 1; | |
44241 | + break; | |
44242 | + } | |
44243 | + } | |
44244 | + | |
44245 | + if (!found) | |
44246 | + return 0; | |
44247 | + | |
44248 | + /* handle special roles that do not require authentication | |
44249 | + and check ip */ | |
44250 | + | |
44251 | + FOR_EACH_ROLE_START(r) | |
44252 | + if (!strcmp(rolename, r->rolename) && | |
44253 | + (r->roletype & GR_ROLE_SPECIAL)) { | |
44254 | + found = 0; | |
44255 | + if (r->allowed_ips != NULL) { | |
44256 | + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) { | |
44257 | + if ((ntohl(curr_ip) & ipp->netmask) == | |
44258 | + (ntohl(ipp->addr) & ipp->netmask)) | |
44259 | + found = 1; | |
44260 | + } | |
44261 | + } else | |
44262 | + found = 2; | |
44263 | + if (!found) | |
44264 | + return 0; | |
44265 | + | |
44266 | + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) || | |
44267 | + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) { | |
44268 | + *salt = NULL; | |
44269 | + *sum = NULL; | |
44270 | + return 1; | |
44271 | + } | |
44272 | + } | |
44273 | + FOR_EACH_ROLE_END(r) | |
44274 | + | |
44275 | + for (i = 0; i < num_sprole_pws; i++) { | |
44276 | + if (!strcmp(rolename, acl_special_roles[i]->rolename)) { | |
44277 | + *salt = acl_special_roles[i]->salt; | |
44278 | + *sum = acl_special_roles[i]->sum; | |
44279 | + return 1; | |
44280 | + } | |
44281 | + } | |
44282 | + | |
44283 | + return 0; | |
44284 | +} | |
44285 | + | |
44286 | +static void | |
44287 | +assign_special_role(char *rolename) | |
44288 | +{ | |
44289 | + struct acl_object_label *obj; | |
44290 | + struct acl_role_label *r; | |
44291 | + struct acl_role_label *assigned = NULL; | |
44292 | + struct task_struct *tsk; | |
44293 | + struct file *filp; | |
44294 | + | |
44295 | + FOR_EACH_ROLE_START(r) | |
44296 | + if (!strcmp(rolename, r->rolename) && | |
44297 | + (r->roletype & GR_ROLE_SPECIAL)) { | |
44298 | + assigned = r; | |
44299 | + break; | |
44300 | + } | |
44301 | + FOR_EACH_ROLE_END(r) | |
44302 | + | |
44303 | + if (!assigned) | |
44304 | + return; | |
44305 | + | |
44306 | + read_lock(&tasklist_lock); | |
44307 | + read_lock(&grsec_exec_file_lock); | |
44308 | + | |
44309 | + tsk = current->real_parent; | |
44310 | + if (tsk == NULL) | |
44311 | + goto out_unlock; | |
44312 | + | |
44313 | + filp = tsk->exec_file; | |
44314 | + if (filp == NULL) | |
44315 | + goto out_unlock; | |
44316 | + | |
44317 | + tsk->is_writable = 0; | |
44318 | + | |
44319 | + tsk->acl_sp_role = 1; | |
44320 | + tsk->acl_role_id = ++acl_sp_role_value; | |
44321 | + tsk->role = assigned; | |
44322 | + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role); | |
44323 | + | |
44324 | + /* ignore additional mmap checks for processes that are writable | |
44325 | + by the default ACL */ | |
44326 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label); | |
44327 | + if (unlikely(obj->mode & GR_WRITE)) | |
44328 | + tsk->is_writable = 1; | |
44329 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label); | |
44330 | + if (unlikely(obj->mode & GR_WRITE)) | |
44331 | + tsk->is_writable = 1; | |
44332 | + | |
44333 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
44334 | + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid); | |
44335 | +#endif | |
44336 | + | |
44337 | +out_unlock: | |
44338 | + read_unlock(&grsec_exec_file_lock); | |
44339 | + read_unlock(&tasklist_lock); | |
44340 | + return; | |
44341 | +} | |
44342 | + | |
44343 | +int gr_check_secure_terminal(struct task_struct *task) | |
44344 | +{ | |
44345 | + struct task_struct *p, *p2, *p3; | |
44346 | + struct files_struct *files; | |
44347 | + struct fdtable *fdt; | |
44348 | + struct file *our_file = NULL, *file; | |
44349 | + int i; | |
44350 | + | |
44351 | + if (task->signal->tty == NULL) | |
44352 | + return 1; | |
44353 | + | |
44354 | + files = get_files_struct(task); | |
44355 | + if (files != NULL) { | |
44356 | + rcu_read_lock(); | |
44357 | + fdt = files_fdtable(files); | |
44358 | + for (i=0; i < fdt->max_fds; i++) { | |
44359 | + file = fcheck_files(files, i); | |
44360 | + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) { | |
44361 | + get_file(file); | |
44362 | + our_file = file; | |
44363 | + } | |
44364 | + } | |
44365 | + rcu_read_unlock(); | |
44366 | + put_files_struct(files); | |
44367 | + } | |
44368 | + | |
44369 | + if (our_file == NULL) | |
44370 | + return 1; | |
44371 | + | |
44372 | + read_lock(&tasklist_lock); | |
44373 | + do_each_thread(p2, p) { | |
44374 | + files = get_files_struct(p); | |
44375 | + if (files == NULL || | |
44376 | + (p->signal && p->signal->tty == task->signal->tty)) { | |
44377 | + if (files != NULL) | |
44378 | + put_files_struct(files); | |
44379 | + continue; | |
44380 | + } | |
44381 | + rcu_read_lock(); | |
44382 | + fdt = files_fdtable(files); | |
44383 | + for (i=0; i < fdt->max_fds; i++) { | |
44384 | + file = fcheck_files(files, i); | |
44385 | + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) && | |
44386 | + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) { | |
44387 | + p3 = task; | |
44388 | + while (p3->pid > 0) { | |
44389 | + if (p3 == p) | |
44390 | + break; | |
44391 | + p3 = p3->real_parent; | |
44392 | + } | |
44393 | + if (p3 == p) | |
44394 | + break; | |
44395 | + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p); | |
44396 | + gr_handle_alertkill(p); | |
44397 | + rcu_read_unlock(); | |
44398 | + put_files_struct(files); | |
44399 | + read_unlock(&tasklist_lock); | |
44400 | + fput(our_file); | |
44401 | + return 0; | |
44402 | + } | |
44403 | + } | |
44404 | + rcu_read_unlock(); | |
44405 | + put_files_struct(files); | |
44406 | + } while_each_thread(p2, p); | |
44407 | + read_unlock(&tasklist_lock); | |
44408 | + | |
44409 | + fput(our_file); | |
44410 | + return 1; | |
44411 | +} | |
44412 | + | |
44413 | +ssize_t | |
44414 | +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos) | |
44415 | +{ | |
44416 | + struct gr_arg_wrapper uwrap; | |
44417 | + unsigned char *sprole_salt = NULL; | |
44418 | + unsigned char *sprole_sum = NULL; | |
44419 | + int error = sizeof (struct gr_arg_wrapper); | |
44420 | + int error2 = 0; | |
44421 | + | |
44422 | + mutex_lock(&gr_dev_mutex); | |
44423 | + | |
44424 | + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) { | |
44425 | + error = -EPERM; | |
44426 | + goto out; | |
44427 | + } | |
44428 | + | |
44429 | + if (count != sizeof (struct gr_arg_wrapper)) { | |
44430 | + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper)); | |
44431 | + error = -EINVAL; | |
44432 | + goto out; | |
44433 | + } | |
44434 | + | |
44435 | + | |
44436 | + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) { | |
44437 | + gr_auth_expires = 0; | |
44438 | + gr_auth_attempts = 0; | |
44439 | + } | |
44440 | + | |
44441 | + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) { | |
44442 | + error = -EFAULT; | |
44443 | + goto out; | |
44444 | + } | |
44445 | + | |
44446 | + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) { | |
44447 | + error = -EINVAL; | |
44448 | + goto out; | |
44449 | + } | |
44450 | + | |
44451 | + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) { | |
44452 | + error = -EFAULT; | |
44453 | + goto out; | |
44454 | + } | |
44455 | + | |
44456 | + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM && | |
44457 | + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES && | |
44458 | + time_after(gr_auth_expires, get_seconds())) { | |
44459 | + error = -EBUSY; | |
44460 | + goto out; | |
44461 | + } | |
44462 | + | |
44463 | + /* if non-root trying to do anything other than use a special role, | |
44464 | + do not attempt authentication, do not count towards authentication | |
44465 | + locking | |
44466 | + */ | |
44467 | + | |
44468 | + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS && | |
44469 | + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM && | |
44470 | + current_uid()) { | |
44471 | + error = -EPERM; | |
44472 | + goto out; | |
44473 | + } | |
44474 | + | |
44475 | + /* ensure pw and special role name are null terminated */ | |
44476 | + | |
44477 | + gr_usermode->pw[GR_PW_LEN - 1] = '\0'; | |
44478 | + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0'; | |
44479 | + | |
44480 | + /* Okay. | |
44481 | + * We have our enough of the argument structure..(we have yet | |
44482 | + * to copy_from_user the tables themselves) . Copy the tables | |
44483 | + * only if we need them, i.e. for loading operations. */ | |
44484 | + | |
44485 | + switch (gr_usermode->mode) { | |
44486 | + case GR_STATUS: | |
44487 | + if (gr_status & GR_READY) { | |
44488 | + error = 1; | |
44489 | + if (!gr_check_secure_terminal(current)) | |
44490 | + error = 3; | |
44491 | + } else | |
44492 | + error = 2; | |
44493 | + goto out; | |
44494 | + case GR_SHUTDOWN: | |
44495 | + if ((gr_status & GR_READY) | |
44496 | + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) { | |
44497 | + pax_open_kernel(); | |
44498 | + gr_status &= ~GR_READY; | |
44499 | + pax_close_kernel(); | |
44500 | + | |
44501 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG); | |
44502 | + free_variables(); | |
44503 | + memset(gr_usermode, 0, sizeof (struct gr_arg)); | |
44504 | + memset(gr_system_salt, 0, GR_SALT_LEN); | |
44505 | + memset(gr_system_sum, 0, GR_SHA_LEN); | |
44506 | + } else if (gr_status & GR_READY) { | |
44507 | + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG); | |
44508 | + error = -EPERM; | |
44509 | + } else { | |
44510 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG); | |
44511 | + error = -EAGAIN; | |
44512 | + } | |
44513 | + break; | |
44514 | + case GR_ENABLE: | |
44515 | + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode))) | |
44516 | + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION); | |
44517 | + else { | |
44518 | + if (gr_status & GR_READY) | |
44519 | + error = -EAGAIN; | |
44520 | + else | |
44521 | + error = error2; | |
44522 | + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION); | |
44523 | + } | |
44524 | + break; | |
44525 | + case GR_RELOAD: | |
44526 | + if (!(gr_status & GR_READY)) { | |
44527 | + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION); | |
44528 | + error = -EAGAIN; | |
44529 | + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) { | |
44530 | + preempt_disable(); | |
44531 | + | |
44532 | + pax_open_kernel(); | |
44533 | + gr_status &= ~GR_READY; | |
44534 | + pax_close_kernel(); | |
44535 | + | |
44536 | + free_variables(); | |
44537 | + if (!(error2 = gracl_init(gr_usermode))) { | |
44538 | + preempt_enable(); | |
44539 | + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION); | |
44540 | + } else { | |
44541 | + preempt_enable(); | |
44542 | + error = error2; | |
44543 | + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION); | |
44544 | + } | |
44545 | + } else { | |
44546 | + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION); | |
44547 | + error = -EPERM; | |
44548 | + } | |
44549 | + break; | |
44550 | + case GR_SEGVMOD: | |
44551 | + if (unlikely(!(gr_status & GR_READY))) { | |
44552 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG); | |
44553 | + error = -EAGAIN; | |
44554 | + break; | |
44555 | + } | |
44556 | + | |
44557 | + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) { | |
44558 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG); | |
44559 | + if (gr_usermode->segv_device && gr_usermode->segv_inode) { | |
44560 | + struct acl_subject_label *segvacl; | |
44561 | + segvacl = | |
44562 | + lookup_acl_subj_label(gr_usermode->segv_inode, | |
44563 | + gr_usermode->segv_device, | |
44564 | + current->role); | |
44565 | + if (segvacl) { | |
44566 | + segvacl->crashes = 0; | |
44567 | + segvacl->expires = 0; | |
44568 | + } | |
44569 | + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) { | |
44570 | + gr_remove_uid(gr_usermode->segv_uid); | |
44571 | + } | |
44572 | + } else { | |
44573 | + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG); | |
44574 | + error = -EPERM; | |
44575 | + } | |
44576 | + break; | |
44577 | + case GR_SPROLE: | |
44578 | + case GR_SPROLEPAM: | |
44579 | + if (unlikely(!(gr_status & GR_READY))) { | |
44580 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG); | |
44581 | + error = -EAGAIN; | |
44582 | + break; | |
44583 | + } | |
44584 | + | |
44585 | + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) { | |
44586 | + current->role->expires = 0; | |
44587 | + current->role->auth_attempts = 0; | |
44588 | + } | |
44589 | + | |
44590 | + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES && | |
44591 | + time_after(current->role->expires, get_seconds())) { | |
44592 | + error = -EBUSY; | |
44593 | + goto out; | |
44594 | + } | |
44595 | + | |
44596 | + if (lookup_special_role_auth | |
44597 | + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum) | |
44598 | + && ((!sprole_salt && !sprole_sum) | |
44599 | + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) { | |
44600 | + char *p = ""; | |
44601 | + assign_special_role(gr_usermode->sp_role); | |
44602 | + read_lock(&tasklist_lock); | |
44603 | + if (current->real_parent) | |
44604 | + p = current->real_parent->role->rolename; | |
44605 | + read_unlock(&tasklist_lock); | |
44606 | + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG, | |
44607 | + p, acl_sp_role_value); | |
44608 | + } else { | |
44609 | + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role); | |
44610 | + error = -EPERM; | |
44611 | + if(!(current->role->auth_attempts++)) | |
44612 | + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT; | |
44613 | + | |
44614 | + goto out; | |
44615 | + } | |
44616 | + break; | |
44617 | + case GR_UNSPROLE: | |
44618 | + if (unlikely(!(gr_status & GR_READY))) { | |
44619 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG); | |
44620 | + error = -EAGAIN; | |
44621 | + break; | |
44622 | + } | |
44623 | + | |
44624 | + if (current->role->roletype & GR_ROLE_SPECIAL) { | |
44625 | + char *p = ""; | |
44626 | + int i = 0; | |
44627 | + | |
44628 | + read_lock(&tasklist_lock); | |
44629 | + if (current->real_parent) { | |
44630 | + p = current->real_parent->role->rolename; | |
44631 | + i = current->real_parent->acl_role_id; | |
44632 | + } | |
44633 | + read_unlock(&tasklist_lock); | |
44634 | + | |
44635 | + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i); | |
44636 | + gr_set_acls(1); | |
44637 | + } else { | |
44638 | + error = -EPERM; | |
44639 | + goto out; | |
44640 | + } | |
44641 | + break; | |
44642 | + default: | |
44643 | + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode); | |
44644 | + error = -EINVAL; | |
44645 | + break; | |
44646 | + } | |
44647 | + | |
44648 | + if (error != -EPERM) | |
44649 | + goto out; | |
44650 | + | |
44651 | + if(!(gr_auth_attempts++)) | |
44652 | + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT; | |
44653 | + | |
44654 | + out: | |
44655 | + mutex_unlock(&gr_dev_mutex); | |
44656 | + return error; | |
44657 | +} | |
44658 | + | |
44659 | +/* must be called with | |
44660 | + rcu_read_lock(); | |
44661 | + read_lock(&tasklist_lock); | |
44662 | + read_lock(&grsec_exec_file_lock); | |
44663 | +*/ | |
44664 | +int gr_apply_subject_to_task(struct task_struct *task) | |
44665 | +{ | |
44666 | + struct acl_object_label *obj; | |
44667 | + char *tmpname; | |
44668 | + struct acl_subject_label *tmpsubj; | |
44669 | + struct file *filp; | |
44670 | + struct name_entry *nmatch; | |
44671 | + | |
44672 | + filp = task->exec_file; | |
44673 | + if (filp == NULL) | |
44674 | + return 0; | |
44675 | + | |
44676 | + /* the following is to apply the correct subject | |
44677 | + on binaries running when the RBAC system | |
44678 | + is enabled, when the binaries have been | |
44679 | + replaced or deleted since their execution | |
44680 | + ----- | |
44681 | + when the RBAC system starts, the inode/dev | |
44682 | + from exec_file will be one the RBAC system | |
44683 | + is unaware of. It only knows the inode/dev | |
44684 | + of the present file on disk, or the absence | |
44685 | + of it. | |
44686 | + */ | |
44687 | + preempt_disable(); | |
44688 | + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt); | |
44689 | + | |
44690 | + nmatch = lookup_name_entry(tmpname); | |
44691 | + preempt_enable(); | |
44692 | + tmpsubj = NULL; | |
44693 | + if (nmatch) { | |
44694 | + if (nmatch->deleted) | |
44695 | + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role); | |
44696 | + else | |
44697 | + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role); | |
44698 | + if (tmpsubj != NULL) | |
44699 | + task->acl = tmpsubj; | |
44700 | + } | |
44701 | + if (tmpsubj == NULL) | |
44702 | + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, | |
44703 | + task->role); | |
44704 | + if (task->acl) { | |
44705 | + task->is_writable = 0; | |
44706 | + /* ignore additional mmap checks for processes that are writable | |
44707 | + by the default ACL */ | |
44708 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label); | |
44709 | + if (unlikely(obj->mode & GR_WRITE)) | |
44710 | + task->is_writable = 1; | |
44711 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label); | |
44712 | + if (unlikely(obj->mode & GR_WRITE)) | |
44713 | + task->is_writable = 1; | |
44714 | + | |
44715 | + gr_set_proc_res(task); | |
44716 | + | |
44717 | +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG | |
44718 | + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename); | |
44719 | +#endif | |
44720 | + } else { | |
44721 | + return 1; | |
44722 | + } | |
44723 | + | |
44724 | + return 0; | |
44725 | +} | |
44726 | + | |
44727 | +int | |
44728 | +gr_set_acls(const int type) | |
44729 | +{ | |
44730 | + struct task_struct *task, *task2; | |
44731 | + struct acl_role_label *role = current->role; | |
44732 | + __u16 acl_role_id = current->acl_role_id; | |
44733 | + const struct cred *cred; | |
44734 | + int ret; | |
44735 | + | |
44736 | + rcu_read_lock(); | |
44737 | + read_lock(&tasklist_lock); | |
44738 | + read_lock(&grsec_exec_file_lock); | |
44739 | + do_each_thread(task2, task) { | |
44740 | + /* check to see if we're called from the exit handler, | |
44741 | + if so, only replace ACLs that have inherited the admin | |
44742 | + ACL */ | |
44743 | + | |
44744 | + if (type && (task->role != role || | |
44745 | + task->acl_role_id != acl_role_id)) | |
44746 | + continue; | |
44747 | + | |
44748 | + task->acl_role_id = 0; | |
44749 | + task->acl_sp_role = 0; | |
44750 | + | |
44751 | + if (task->exec_file) { | |
44752 | + cred = __task_cred(task); | |
44753 | + task->role = lookup_acl_role_label(task, cred->uid, cred->gid); | |
44754 | + ret = gr_apply_subject_to_task(task); | |
44755 | + if (ret) { | |
44756 | + read_unlock(&grsec_exec_file_lock); | |
44757 | + read_unlock(&tasklist_lock); | |
44758 | + rcu_read_unlock(); | |
44759 | + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid); | |
44760 | + return ret; | |
44761 | + } | |
44762 | + } else { | |
44763 | + // it's a kernel process | |
44764 | + task->role = kernel_role; | |
44765 | + task->acl = kernel_role->root_label; | |
44766 | +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN | |
44767 | + task->acl->mode &= ~GR_PROCFIND; | |
44768 | +#endif | |
44769 | + } | |
44770 | + } while_each_thread(task2, task); | |
44771 | + read_unlock(&grsec_exec_file_lock); | |
44772 | + read_unlock(&tasklist_lock); | |
44773 | + rcu_read_unlock(); | |
44774 | + | |
44775 | + return 0; | |
44776 | +} | |
44777 | + | |
44778 | +void | |
44779 | +gr_learn_resource(const struct task_struct *task, | |
44780 | + const int res, const unsigned long wanted, const int gt) | |
44781 | +{ | |
44782 | + struct acl_subject_label *acl; | |
44783 | + const struct cred *cred; | |
44784 | + | |
44785 | + if (unlikely((gr_status & GR_READY) && | |
44786 | + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) | |
44787 | + goto skip_reslog; | |
44788 | + | |
44789 | +#ifdef CONFIG_GRKERNSEC_RESLOG | |
44790 | + gr_log_resource(task, res, wanted, gt); | |
44791 | +#endif | |
44792 | + skip_reslog: | |
44793 | + | |
44794 | + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS)) | |
44795 | + return; | |
44796 | + | |
44797 | + acl = task->acl; | |
44798 | + | |
44799 | + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) || | |
44800 | + !(acl->resmask & (1 << (unsigned short) res)))) | |
44801 | + return; | |
44802 | + | |
44803 | + if (wanted >= acl->res[res].rlim_cur) { | |
44804 | + unsigned long res_add; | |
44805 | + | |
44806 | + res_add = wanted; | |
44807 | + switch (res) { | |
44808 | + case RLIMIT_CPU: | |
44809 | + res_add += GR_RLIM_CPU_BUMP; | |
44810 | + break; | |
44811 | + case RLIMIT_FSIZE: | |
44812 | + res_add += GR_RLIM_FSIZE_BUMP; | |
44813 | + break; | |
44814 | + case RLIMIT_DATA: | |
44815 | + res_add += GR_RLIM_DATA_BUMP; | |
44816 | + break; | |
44817 | + case RLIMIT_STACK: | |
44818 | + res_add += GR_RLIM_STACK_BUMP; | |
44819 | + break; | |
44820 | + case RLIMIT_CORE: | |
44821 | + res_add += GR_RLIM_CORE_BUMP; | |
44822 | + break; | |
44823 | + case RLIMIT_RSS: | |
44824 | + res_add += GR_RLIM_RSS_BUMP; | |
44825 | + break; | |
44826 | + case RLIMIT_NPROC: | |
44827 | + res_add += GR_RLIM_NPROC_BUMP; | |
44828 | + break; | |
44829 | + case RLIMIT_NOFILE: | |
44830 | + res_add += GR_RLIM_NOFILE_BUMP; | |
44831 | + break; | |
44832 | + case RLIMIT_MEMLOCK: | |
44833 | + res_add += GR_RLIM_MEMLOCK_BUMP; | |
44834 | + break; | |
44835 | + case RLIMIT_AS: | |
44836 | + res_add += GR_RLIM_AS_BUMP; | |
44837 | + break; | |
44838 | + case RLIMIT_LOCKS: | |
44839 | + res_add += GR_RLIM_LOCKS_BUMP; | |
44840 | + break; | |
44841 | + case RLIMIT_SIGPENDING: | |
44842 | + res_add += GR_RLIM_SIGPENDING_BUMP; | |
44843 | + break; | |
44844 | + case RLIMIT_MSGQUEUE: | |
44845 | + res_add += GR_RLIM_MSGQUEUE_BUMP; | |
44846 | + break; | |
44847 | + case RLIMIT_NICE: | |
44848 | + res_add += GR_RLIM_NICE_BUMP; | |
44849 | + break; | |
44850 | + case RLIMIT_RTPRIO: | |
44851 | + res_add += GR_RLIM_RTPRIO_BUMP; | |
44852 | + break; | |
44853 | + case RLIMIT_RTTIME: | |
44854 | + res_add += GR_RLIM_RTTIME_BUMP; | |
44855 | + break; | |
44856 | + } | |
44857 | + | |
44858 | + acl->res[res].rlim_cur = res_add; | |
44859 | + | |
44860 | + if (wanted > acl->res[res].rlim_max) | |
44861 | + acl->res[res].rlim_max = res_add; | |
44862 | + | |
44863 | + /* only log the subject filename, since resource logging is supported for | |
44864 | + single-subject learning only */ | |
44865 | + rcu_read_lock(); | |
44866 | + cred = __task_cred(task); | |
44867 | + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, | |
44868 | + task->role->roletype, cred->uid, cred->gid, acl->filename, | |
44869 | + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max, | |
44870 | + "", (unsigned long) res, &task->signal->saved_ip); | |
44871 | + rcu_read_unlock(); | |
44872 | + } | |
44873 | + | |
44874 | + return; | |
44875 | +} | |
44876 | + | |
44877 | +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)) | |
44878 | +void | |
44879 | +pax_set_initial_flags(struct linux_binprm *bprm) | |
44880 | +{ | |
44881 | + struct task_struct *task = current; | |
44882 | + struct acl_subject_label *proc; | |
44883 | + unsigned long flags; | |
44884 | + | |
44885 | + if (unlikely(!(gr_status & GR_READY))) | |
44886 | + return; | |
44887 | + | |
44888 | + flags = pax_get_flags(task); | |
44889 | + | |
44890 | + proc = task->acl; | |
44891 | + | |
44892 | + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC) | |
44893 | + flags &= ~MF_PAX_PAGEEXEC; | |
44894 | + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC) | |
44895 | + flags &= ~MF_PAX_SEGMEXEC; | |
44896 | + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP) | |
44897 | + flags &= ~MF_PAX_RANDMMAP; | |
44898 | + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP) | |
44899 | + flags &= ~MF_PAX_EMUTRAMP; | |
44900 | + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT) | |
44901 | + flags &= ~MF_PAX_MPROTECT; | |
44902 | + | |
44903 | + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC) | |
44904 | + flags |= MF_PAX_PAGEEXEC; | |
44905 | + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC) | |
44906 | + flags |= MF_PAX_SEGMEXEC; | |
44907 | + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP) | |
44908 | + flags |= MF_PAX_RANDMMAP; | |
44909 | + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP) | |
44910 | + flags |= MF_PAX_EMUTRAMP; | |
44911 | + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT) | |
44912 | + flags |= MF_PAX_MPROTECT; | |
44913 | + | |
44914 | + pax_set_flags(task, flags); | |
44915 | + | |
44916 | + return; | |
44917 | +} | |
44918 | +#endif | |
44919 | + | |
44920 | +#ifdef CONFIG_SYSCTL | |
44921 | +/* Eric Biederman likes breaking userland ABI and every inode-based security | |
44922 | + system to save 35kb of memory */ | |
44923 | + | |
44924 | +/* we modify the passed in filename, but adjust it back before returning */ | |
44925 | +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len) | |
44926 | +{ | |
44927 | + struct name_entry *nmatch; | |
44928 | + char *p, *lastp = NULL; | |
44929 | + struct acl_object_label *obj = NULL, *tmp; | |
44930 | + struct acl_subject_label *tmpsubj; | |
44931 | + char c = '\0'; | |
44932 | + | |
44933 | + read_lock(&gr_inode_lock); | |
44934 | + | |
44935 | + p = name + len - 1; | |
44936 | + do { | |
44937 | + nmatch = lookup_name_entry(name); | |
44938 | + if (lastp != NULL) | |
44939 | + *lastp = c; | |
44940 | + | |
44941 | + if (nmatch == NULL) | |
44942 | + goto next_component; | |
44943 | + tmpsubj = current->acl; | |
44944 | + do { | |
44945 | + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj); | |
44946 | + if (obj != NULL) { | |
44947 | + tmp = obj->globbed; | |
44948 | + while (tmp) { | |
44949 | + if (!glob_match(tmp->filename, name)) { | |
44950 | + obj = tmp; | |
44951 | + goto found_obj; | |
44952 | + } | |
44953 | + tmp = tmp->next; | |
44954 | + } | |
44955 | + goto found_obj; | |
44956 | + } | |
44957 | + } while ((tmpsubj = tmpsubj->parent_subject)); | |
44958 | +next_component: | |
44959 | + /* end case */ | |
44960 | + if (p == name) | |
44961 | + break; | |
44962 | + | |
44963 | + while (*p != '/') | |
44964 | + p--; | |
44965 | + if (p == name) | |
44966 | + lastp = p + 1; | |
44967 | + else { | |
44968 | + lastp = p; | |
44969 | + p--; | |
44970 | + } | |
44971 | + c = *lastp; | |
44972 | + *lastp = '\0'; | |
44973 | + } while (1); | |
44974 | +found_obj: | |
44975 | + read_unlock(&gr_inode_lock); | |
44976 | + /* obj returned will always be non-null */ | |
44977 | + return obj; | |
44978 | +} | |
44979 | + | |
44980 | +/* returns 0 when allowing, non-zero on error | |
44981 | + op of 0 is used for readdir, so we don't log the names of hidden files | |
44982 | +*/ | |
44983 | +__u32 | |
44984 | +gr_handle_sysctl(const struct ctl_table *table, const int op) | |
44985 | +{ | |
44986 | + struct ctl_table *tmp; | |
44987 | + const char *proc_sys = "/proc/sys"; | |
44988 | + char *path; | |
44989 | + struct acl_object_label *obj; | |
44990 | + unsigned short len = 0, pos = 0, depth = 0, i; | |
44991 | + __u32 err = 0; | |
44992 | + __u32 mode = 0; | |
44993 | + | |
44994 | + if (unlikely(!(gr_status & GR_READY))) | |
44995 | + return 0; | |
44996 | + | |
44997 | + /* for now, ignore operations on non-sysctl entries if it's not a | |
44998 | + readdir*/ | |
44999 | + if (table->child != NULL && op != 0) | |
45000 | + return 0; | |
45001 | + | |
45002 | + mode |= GR_FIND; | |
45003 | + /* it's only a read if it's an entry, read on dirs is for readdir */ | |
45004 | + if (op & MAY_READ) | |
45005 | + mode |= GR_READ; | |
45006 | + if (op & MAY_WRITE) | |
45007 | + mode |= GR_WRITE; | |
45008 | + | |
45009 | + preempt_disable(); | |
45010 | + | |
45011 | + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id()); | |
45012 | + | |
45013 | + /* it's only a read/write if it's an actual entry, not a dir | |
45014 | + (which are opened for readdir) | |
45015 | + */ | |
45016 | + | |
45017 | + /* convert the requested sysctl entry into a pathname */ | |
45018 | + | |
45019 | + for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) { | |
45020 | + len += strlen(tmp->procname); | |
45021 | + len++; | |
45022 | + depth++; | |
45023 | + } | |
45024 | + | |
45025 | + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) { | |
45026 | + /* deny */ | |
45027 | + goto out; | |
45028 | + } | |
45029 | + | |
45030 | + memset(path, 0, PAGE_SIZE); | |
45031 | + | |
45032 | + memcpy(path, proc_sys, strlen(proc_sys)); | |
45033 | + | |
45034 | + pos += strlen(proc_sys); | |
45035 | + | |
45036 | + for (; depth > 0; depth--) { | |
45037 | + path[pos] = '/'; | |
45038 | + pos++; | |
45039 | + for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) { | |
45040 | + if (depth == i) { | |
45041 | + memcpy(path + pos, tmp->procname, | |
45042 | + strlen(tmp->procname)); | |
45043 | + pos += strlen(tmp->procname); | |
45044 | + } | |
45045 | + i++; | |
45046 | + } | |
45047 | + } | |
45048 | + | |
45049 | + obj = gr_lookup_by_name(path, pos); | |
45050 | + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS); | |
45051 | + | |
45052 | + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) && | |
45053 | + ((err & mode) != mode))) { | |
45054 | + __u32 new_mode = mode; | |
45055 | + | |
45056 | + new_mode &= ~(GR_AUDITS | GR_SUPPRESS); | |
45057 | + | |
45058 | + err = 0; | |
45059 | + gr_log_learn_sysctl(path, new_mode); | |
45060 | + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) { | |
45061 | + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path); | |
45062 | + err = -ENOENT; | |
45063 | + } else if (!(err & GR_FIND)) { | |
45064 | + err = -ENOENT; | |
45065 | + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) { | |
45066 | + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied", | |
45067 | + path, (mode & GR_READ) ? " reading" : "", | |
45068 | + (mode & GR_WRITE) ? " writing" : ""); | |
45069 | + err = -EACCES; | |
45070 | + } else if ((err & mode) != mode) { | |
45071 | + err = -EACCES; | |
45072 | + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) { | |
45073 | + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful", | |
45074 | + path, (mode & GR_READ) ? " reading" : "", | |
45075 | + (mode & GR_WRITE) ? " writing" : ""); | |
45076 | + err = 0; | |
45077 | + } else | |
45078 | + err = 0; | |
45079 | + | |
45080 | + out: | |
45081 | + preempt_enable(); | |
45082 | + | |
45083 | + return err; | |
45084 | +} | |
45085 | +#endif | |
45086 | + | |
45087 | +int | |
45088 | +gr_handle_proc_ptrace(struct task_struct *task) | |
45089 | +{ | |
45090 | + struct file *filp; | |
45091 | + struct task_struct *tmp = task; | |
45092 | + struct task_struct *curtemp = current; | |
45093 | + __u32 retmode; | |
45094 | + | |
45095 | +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
45096 | + if (unlikely(!(gr_status & GR_READY))) | |
45097 | + return 0; | |
45098 | +#endif | |
45099 | + | |
45100 | + read_lock(&tasklist_lock); | |
45101 | + read_lock(&grsec_exec_file_lock); | |
45102 | + filp = task->exec_file; | |
45103 | + | |
45104 | + while (tmp->pid > 0) { | |
45105 | + if (tmp == curtemp) | |
45106 | + break; | |
45107 | + tmp = tmp->real_parent; | |
45108 | + } | |
45109 | + | |
45110 | + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) || | |
45111 | + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) { | |
45112 | + read_unlock(&grsec_exec_file_lock); | |
45113 | + read_unlock(&tasklist_lock); | |
45114 | + return 1; | |
45115 | + } | |
45116 | + | |
45117 | +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
45118 | + if (!(gr_status & GR_READY)) { | |
45119 | + read_unlock(&grsec_exec_file_lock); | |
45120 | + read_unlock(&tasklist_lock); | |
45121 | + return 0; | |
45122 | + } | |
45123 | +#endif | |
45124 | + | |
45125 | + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt); | |
45126 | + read_unlock(&grsec_exec_file_lock); | |
45127 | + read_unlock(&tasklist_lock); | |
45128 | + | |
45129 | + if (retmode & GR_NOPTRACE) | |
45130 | + return 1; | |
45131 | + | |
45132 | + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD) | |
45133 | + && (current->acl != task->acl || (current->acl != current->role->root_label | |
45134 | + && current->pid != task->pid))) | |
45135 | + return 1; | |
45136 | + | |
45137 | + return 0; | |
45138 | +} | |
45139 | + | |
45140 | +void task_grsec_rbac(struct seq_file *m, struct task_struct *p) | |
45141 | +{ | |
45142 | + if (unlikely(!(gr_status & GR_READY))) | |
45143 | + return; | |
45144 | + | |
45145 | + if (!(current->role->roletype & GR_ROLE_GOD)) | |
45146 | + return; | |
45147 | + | |
45148 | + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n", | |
45149 | + p->role->rolename, gr_task_roletype_to_char(p), | |
45150 | + p->acl->filename); | |
45151 | +} | |
45152 | + | |
45153 | +int | |
45154 | +gr_handle_ptrace(struct task_struct *task, const long request) | |
45155 | +{ | |
45156 | + struct task_struct *tmp = task; | |
45157 | + struct task_struct *curtemp = current; | |
45158 | + __u32 retmode; | |
45159 | + | |
45160 | +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
45161 | + if (unlikely(!(gr_status & GR_READY))) | |
45162 | + return 0; | |
45163 | +#endif | |
45164 | + | |
45165 | + read_lock(&tasklist_lock); | |
45166 | + while (tmp->pid > 0) { | |
45167 | + if (tmp == curtemp) | |
45168 | + break; | |
45169 | + tmp = tmp->real_parent; | |
45170 | + } | |
45171 | + | |
45172 | + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) || | |
45173 | + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) { | |
45174 | + read_unlock(&tasklist_lock); | |
45175 | + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task); | |
45176 | + return 1; | |
45177 | + } | |
45178 | + read_unlock(&tasklist_lock); | |
45179 | + | |
45180 | +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
45181 | + if (!(gr_status & GR_READY)) | |
45182 | + return 0; | |
45183 | +#endif | |
45184 | + | |
45185 | + read_lock(&grsec_exec_file_lock); | |
45186 | + if (unlikely(!task->exec_file)) { | |
45187 | + read_unlock(&grsec_exec_file_lock); | |
45188 | + return 0; | |
45189 | + } | |
45190 | + | |
45191 | + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt); | |
45192 | + read_unlock(&grsec_exec_file_lock); | |
45193 | + | |
45194 | + if (retmode & GR_NOPTRACE) { | |
45195 | + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task); | |
45196 | + return 1; | |
45197 | + } | |
45198 | + | |
45199 | + if (retmode & GR_PTRACERD) { | |
45200 | + switch (request) { | |
45201 | + case PTRACE_POKETEXT: | |
45202 | + case PTRACE_POKEDATA: | |
45203 | + case PTRACE_POKEUSR: | |
45204 | +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64) | |
45205 | + case PTRACE_SETREGS: | |
45206 | + case PTRACE_SETFPREGS: | |
45207 | +#endif | |
45208 | +#ifdef CONFIG_X86 | |
45209 | + case PTRACE_SETFPXREGS: | |
45210 | +#endif | |
45211 | +#ifdef CONFIG_ALTIVEC | |
45212 | + case PTRACE_SETVRREGS: | |
45213 | +#endif | |
45214 | + return 1; | |
45215 | + default: | |
45216 | + return 0; | |
45217 | + } | |
45218 | + } else if (!(current->acl->mode & GR_POVERRIDE) && | |
45219 | + !(current->role->roletype & GR_ROLE_GOD) && | |
45220 | + (current->acl != task->acl)) { | |
45221 | + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task); | |
45222 | + return 1; | |
45223 | + } | |
45224 | + | |
45225 | + return 0; | |
45226 | +} | |
45227 | + | |
45228 | +static int is_writable_mmap(const struct file *filp) | |
45229 | +{ | |
45230 | + struct task_struct *task = current; | |
45231 | + struct acl_object_label *obj, *obj2; | |
45232 | + | |
45233 | + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) && | |
45234 | + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) { | |
45235 | + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label); | |
45236 | + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, | |
45237 | + task->role->root_label); | |
45238 | + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) { | |
45239 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt); | |
45240 | + return 1; | |
45241 | + } | |
45242 | + } | |
45243 | + return 0; | |
45244 | +} | |
45245 | + | |
45246 | +int | |
45247 | +gr_acl_handle_mmap(const struct file *file, const unsigned long prot) | |
45248 | +{ | |
45249 | + __u32 mode; | |
45250 | + | |
45251 | + if (unlikely(!file || !(prot & PROT_EXEC))) | |
45252 | + return 1; | |
45253 | + | |
45254 | + if (is_writable_mmap(file)) | |
45255 | + return 0; | |
45256 | + | |
45257 | + mode = | |
45258 | + gr_search_file(file->f_path.dentry, | |
45259 | + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS, | |
45260 | + file->f_path.mnt); | |
45261 | + | |
45262 | + if (!gr_tpe_allow(file)) | |
45263 | + return 0; | |
45264 | + | |
45265 | + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) { | |
45266 | + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt); | |
45267 | + return 0; | |
45268 | + } else if (unlikely(!(mode & GR_EXEC))) { | |
45269 | + return 0; | |
45270 | + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) { | |
45271 | + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt); | |
45272 | + return 1; | |
45273 | + } | |
45274 | + | |
45275 | + return 1; | |
45276 | +} | |
45277 | + | |
45278 | +int | |
45279 | +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot) | |
45280 | +{ | |
45281 | + __u32 mode; | |
45282 | + | |
45283 | + if (unlikely(!file || !(prot & PROT_EXEC))) | |
45284 | + return 1; | |
45285 | + | |
45286 | + if (is_writable_mmap(file)) | |
45287 | + return 0; | |
45288 | + | |
45289 | + mode = | |
45290 | + gr_search_file(file->f_path.dentry, | |
45291 | + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS, | |
45292 | + file->f_path.mnt); | |
45293 | + | |
45294 | + if (!gr_tpe_allow(file)) | |
45295 | + return 0; | |
45296 | + | |
45297 | + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) { | |
45298 | + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt); | |
45299 | + return 0; | |
45300 | + } else if (unlikely(!(mode & GR_EXEC))) { | |
45301 | + return 0; | |
45302 | + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) { | |
45303 | + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt); | |
45304 | + return 1; | |
45305 | + } | |
45306 | + | |
45307 | + return 1; | |
45308 | +} | |
45309 | + | |
45310 | +void | |
45311 | +gr_acl_handle_psacct(struct task_struct *task, const long code) | |
45312 | +{ | |
45313 | + unsigned long runtime; | |
45314 | + unsigned long cputime; | |
45315 | + unsigned int wday, cday; | |
45316 | + __u8 whr, chr; | |
45317 | + __u8 wmin, cmin; | |
45318 | + __u8 wsec, csec; | |
45319 | + struct timespec timeval; | |
45320 | + | |
45321 | + if (unlikely(!(gr_status & GR_READY) || !task->acl || | |
45322 | + !(task->acl->mode & GR_PROCACCT))) | |
45323 | + return; | |
45324 | + | |
45325 | + do_posix_clock_monotonic_gettime(&timeval); | |
45326 | + runtime = timeval.tv_sec - task->start_time.tv_sec; | |
45327 | + wday = runtime / (3600 * 24); | |
45328 | + runtime -= wday * (3600 * 24); | |
45329 | + whr = runtime / 3600; | |
45330 | + runtime -= whr * 3600; | |
45331 | + wmin = runtime / 60; | |
45332 | + runtime -= wmin * 60; | |
45333 | + wsec = runtime; | |
45334 | + | |
45335 | + cputime = (task->utime + task->stime) / HZ; | |
45336 | + cday = cputime / (3600 * 24); | |
45337 | + cputime -= cday * (3600 * 24); | |
45338 | + chr = cputime / 3600; | |
45339 | + cputime -= chr * 3600; | |
45340 | + cmin = cputime / 60; | |
45341 | + cputime -= cmin * 60; | |
45342 | + csec = cputime; | |
45343 | + | |
45344 | + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code); | |
45345 | + | |
45346 | + return; | |
45347 | +} | |
45348 | + | |
45349 | +void gr_set_kernel_label(struct task_struct *task) | |
45350 | +{ | |
45351 | + if (gr_status & GR_READY) { | |
45352 | + task->role = kernel_role; | |
45353 | + task->acl = kernel_role->root_label; | |
45354 | + } | |
45355 | + return; | |
45356 | +} | |
45357 | + | |
45358 | +#ifdef CONFIG_TASKSTATS | |
45359 | +int gr_is_taskstats_denied(int pid) | |
45360 | +{ | |
45361 | + struct task_struct *task; | |
45362 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
45363 | + const struct cred *cred; | |
45364 | +#endif | |
45365 | + int ret = 0; | |
45366 | + | |
45367 | + /* restrict taskstats viewing to un-chrooted root users | |
45368 | + who have the 'view' subject flag if the RBAC system is enabled | |
45369 | + */ | |
45370 | + | |
45371 | + rcu_read_lock(); | |
45372 | + read_lock(&tasklist_lock); | |
45373 | + task = find_task_by_vpid(pid); | |
45374 | + if (task) { | |
45375 | +#ifdef CONFIG_GRKERNSEC_CHROOT | |
45376 | + if (proc_is_chrooted(task)) | |
45377 | + ret = -EACCES; | |
45378 | +#endif | |
45379 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
45380 | + cred = __task_cred(task); | |
45381 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
45382 | + if (cred->uid != 0) | |
45383 | + ret = -EACCES; | |
45384 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
45385 | + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID)) | |
45386 | + ret = -EACCES; | |
45387 | +#endif | |
45388 | +#endif | |
45389 | + if (gr_status & GR_READY) { | |
45390 | + if (!(task->acl->mode & GR_VIEW)) | |
45391 | + ret = -EACCES; | |
45392 | + } | |
45393 | + } else | |
45394 | + ret = -ENOENT; | |
45395 | + | |
45396 | + read_unlock(&tasklist_lock); | |
45397 | + rcu_read_unlock(); | |
45398 | + | |
45399 | + return ret; | |
45400 | +} | |
45401 | +#endif | |
45402 | + | |
45403 | +/* AUXV entries are filled via a descendant of search_binary_handler | |
45404 | + after we've already applied the subject for the target | |
45405 | +*/ | |
45406 | +int gr_acl_enable_at_secure(void) | |
45407 | +{ | |
45408 | + if (unlikely(!(gr_status & GR_READY))) | |
45409 | + return 0; | |
45410 | + | |
45411 | + if (current->acl->mode & GR_ATSECURE) | |
45412 | + return 1; | |
45413 | + | |
45414 | + return 0; | |
45415 | +} | |
45416 | + | |
45417 | +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino) | |
45418 | +{ | |
45419 | + struct task_struct *task = current; | |
45420 | + struct dentry *dentry = file->f_path.dentry; | |
45421 | + struct vfsmount *mnt = file->f_path.mnt; | |
45422 | + struct acl_object_label *obj, *tmp; | |
45423 | + struct acl_subject_label *subj; | |
45424 | + unsigned int bufsize; | |
45425 | + int is_not_root; | |
45426 | + char *path; | |
45427 | + dev_t dev = __get_dev(dentry); | |
45428 | + | |
45429 | + if (unlikely(!(gr_status & GR_READY))) | |
45430 | + return 1; | |
45431 | + | |
45432 | + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN)) | |
45433 | + return 1; | |
45434 | + | |
45435 | + /* ignore Eric Biederman */ | |
45436 | + if (IS_PRIVATE(dentry->d_inode)) | |
45437 | + return 1; | |
45438 | + | |
45439 | + subj = task->acl; | |
45440 | + do { | |
45441 | + obj = lookup_acl_obj_label(ino, dev, subj); | |
45442 | + if (obj != NULL) | |
45443 | + return (obj->mode & GR_FIND) ? 1 : 0; | |
45444 | + } while ((subj = subj->parent_subject)); | |
45445 | + | |
45446 | + /* this is purely an optimization since we're looking for an object | |
45447 | + for the directory we're doing a readdir on | |
45448 | + if it's possible for any globbed object to match the entry we're | |
45449 | + filling into the directory, then the object we find here will be | |
45450 | + an anchor point with attached globbed objects | |
45451 | + */ | |
45452 | + obj = chk_obj_label_noglob(dentry, mnt, task->acl); | |
45453 | + if (obj->globbed == NULL) | |
45454 | + return (obj->mode & GR_FIND) ? 1 : 0; | |
45455 | + | |
45456 | + is_not_root = ((obj->filename[0] == '/') && | |
45457 | + (obj->filename[1] == '\0')) ? 0 : 1; | |
45458 | + bufsize = PAGE_SIZE - namelen - is_not_root; | |
45459 | + | |
45460 | + /* check bufsize > PAGE_SIZE || bufsize == 0 */ | |
45461 | + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1))) | |
45462 | + return 1; | |
45463 | + | |
45464 | + preempt_disable(); | |
45465 | + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()), | |
45466 | + bufsize); | |
45467 | + | |
45468 | + bufsize = strlen(path); | |
45469 | + | |
45470 | + /* if base is "/", don't append an additional slash */ | |
45471 | + if (is_not_root) | |
45472 | + *(path + bufsize) = '/'; | |
45473 | + memcpy(path + bufsize + is_not_root, name, namelen); | |
45474 | + *(path + bufsize + namelen + is_not_root) = '\0'; | |
45475 | + | |
45476 | + tmp = obj->globbed; | |
45477 | + while (tmp) { | |
45478 | + if (!glob_match(tmp->filename, path)) { | |
45479 | + preempt_enable(); | |
45480 | + return (tmp->mode & GR_FIND) ? 1 : 0; | |
45481 | + } | |
45482 | + tmp = tmp->next; | |
45483 | + } | |
45484 | + preempt_enable(); | |
45485 | + return (obj->mode & GR_FIND) ? 1 : 0; | |
45486 | +} | |
45487 | + | |
45488 | +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE | |
45489 | +EXPORT_SYMBOL(gr_acl_is_enabled); | |
45490 | +#endif | |
45491 | +EXPORT_SYMBOL(gr_learn_resource); | |
45492 | +EXPORT_SYMBOL(gr_set_kernel_label); | |
45493 | +#ifdef CONFIG_SECURITY | |
45494 | +EXPORT_SYMBOL(gr_check_user_change); | |
45495 | +EXPORT_SYMBOL(gr_check_group_change); | |
45496 | +#endif | |
45497 | + | |
45498 | diff -urNp linux-3.0.3/grsecurity/gracl_cap.c linux-3.0.3/grsecurity/gracl_cap.c | |
45499 | --- linux-3.0.3/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500 | |
45500 | +++ linux-3.0.3/grsecurity/gracl_cap.c 2011-08-23 21:48:14.000000000 -0400 | |
45501 | @@ -0,0 +1,139 @@ | |
45502 | +#include <linux/kernel.h> | |
45503 | +#include <linux/module.h> | |
45504 | +#include <linux/sched.h> | |
45505 | +#include <linux/gracl.h> | |
45506 | +#include <linux/grsecurity.h> | |
45507 | +#include <linux/grinternal.h> | |
45508 | + | |
45509 | +static const char *captab_log[] = { | |
45510 | + "CAP_CHOWN", | |
45511 | + "CAP_DAC_OVERRIDE", | |
45512 | + "CAP_DAC_READ_SEARCH", | |
45513 | + "CAP_FOWNER", | |
45514 | + "CAP_FSETID", | |
45515 | + "CAP_KILL", | |
45516 | + "CAP_SETGID", | |
45517 | + "CAP_SETUID", | |
45518 | + "CAP_SETPCAP", | |
45519 | + "CAP_LINUX_IMMUTABLE", | |
45520 | + "CAP_NET_BIND_SERVICE", | |
45521 | + "CAP_NET_BROADCAST", | |
45522 | + "CAP_NET_ADMIN", | |
45523 | + "CAP_NET_RAW", | |
45524 | + "CAP_IPC_LOCK", | |
45525 | + "CAP_IPC_OWNER", | |
45526 | + "CAP_SYS_MODULE", | |
45527 | + "CAP_SYS_RAWIO", | |
45528 | + "CAP_SYS_CHROOT", | |
45529 | + "CAP_SYS_PTRACE", | |
45530 | + "CAP_SYS_PACCT", | |
45531 | + "CAP_SYS_ADMIN", | |
45532 | + "CAP_SYS_BOOT", | |
45533 | + "CAP_SYS_NICE", | |
45534 | + "CAP_SYS_RESOURCE", | |
45535 | + "CAP_SYS_TIME", | |
45536 | + "CAP_SYS_TTY_CONFIG", | |
45537 | + "CAP_MKNOD", | |
45538 | + "CAP_LEASE", | |
45539 | + "CAP_AUDIT_WRITE", | |
45540 | + "CAP_AUDIT_CONTROL", | |
45541 | + "CAP_SETFCAP", | |
45542 | + "CAP_MAC_OVERRIDE", | |
45543 | + "CAP_MAC_ADMIN", | |
45544 | + "CAP_SYSLOG" | |
45545 | +}; | |
45546 | + | |
45547 | +EXPORT_SYMBOL(gr_is_capable); | |
45548 | +EXPORT_SYMBOL(gr_is_capable_nolog); | |
45549 | + | |
45550 | +int | |
45551 | +gr_is_capable(const int cap) | |
45552 | +{ | |
45553 | + struct task_struct *task = current; | |
45554 | + const struct cred *cred = current_cred(); | |
45555 | + struct acl_subject_label *curracl; | |
45556 | + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set; | |
45557 | + kernel_cap_t cap_audit = __cap_empty_set; | |
45558 | + | |
45559 | + if (!gr_acl_is_enabled()) | |
45560 | + return 1; | |
45561 | + | |
45562 | + curracl = task->acl; | |
45563 | + | |
45564 | + cap_drop = curracl->cap_lower; | |
45565 | + cap_mask = curracl->cap_mask; | |
45566 | + cap_audit = curracl->cap_invert_audit; | |
45567 | + | |
45568 | + while ((curracl = curracl->parent_subject)) { | |
45569 | + /* if the cap isn't specified in the current computed mask but is specified in the | |
45570 | + current level subject, and is lowered in the current level subject, then add | |
45571 | + it to the set of dropped capabilities | |
45572 | + otherwise, add the current level subject's mask to the current computed mask | |
45573 | + */ | |
45574 | + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) { | |
45575 | + cap_raise(cap_mask, cap); | |
45576 | + if (cap_raised(curracl->cap_lower, cap)) | |
45577 | + cap_raise(cap_drop, cap); | |
45578 | + if (cap_raised(curracl->cap_invert_audit, cap)) | |
45579 | + cap_raise(cap_audit, cap); | |
45580 | + } | |
45581 | + } | |
45582 | + | |
45583 | + if (!cap_raised(cap_drop, cap)) { | |
45584 | + if (cap_raised(cap_audit, cap)) | |
45585 | + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]); | |
45586 | + return 1; | |
45587 | + } | |
45588 | + | |
45589 | + curracl = task->acl; | |
45590 | + | |
45591 | + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) | |
45592 | + && cap_raised(cred->cap_effective, cap)) { | |
45593 | + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, | |
45594 | + task->role->roletype, cred->uid, | |
45595 | + cred->gid, task->exec_file ? | |
45596 | + gr_to_filename(task->exec_file->f_path.dentry, | |
45597 | + task->exec_file->f_path.mnt) : curracl->filename, | |
45598 | + curracl->filename, 0UL, | |
45599 | + 0UL, "", (unsigned long) cap, &task->signal->saved_ip); | |
45600 | + return 1; | |
45601 | + } | |
45602 | + | |
45603 | + if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap)) | |
45604 | + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]); | |
45605 | + return 0; | |
45606 | +} | |
45607 | + | |
45608 | +int | |
45609 | +gr_is_capable_nolog(const int cap) | |
45610 | +{ | |
45611 | + struct acl_subject_label *curracl; | |
45612 | + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set; | |
45613 | + | |
45614 | + if (!gr_acl_is_enabled()) | |
45615 | + return 1; | |
45616 | + | |
45617 | + curracl = current->acl; | |
45618 | + | |
45619 | + cap_drop = curracl->cap_lower; | |
45620 | + cap_mask = curracl->cap_mask; | |
45621 | + | |
45622 | + while ((curracl = curracl->parent_subject)) { | |
45623 | + /* if the cap isn't specified in the current computed mask but is specified in the | |
45624 | + current level subject, and is lowered in the current level subject, then add | |
45625 | + it to the set of dropped capabilities | |
45626 | + otherwise, add the current level subject's mask to the current computed mask | |
45627 | + */ | |
45628 | + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) { | |
45629 | + cap_raise(cap_mask, cap); | |
45630 | + if (cap_raised(curracl->cap_lower, cap)) | |
45631 | + cap_raise(cap_drop, cap); | |
45632 | + } | |
45633 | + } | |
45634 | + | |
45635 | + if (!cap_raised(cap_drop, cap)) | |
45636 | + return 1; | |
45637 | + | |
45638 | + return 0; | |
45639 | +} | |
45640 | + | |
45641 | diff -urNp linux-3.0.3/grsecurity/gracl_fs.c linux-3.0.3/grsecurity/gracl_fs.c | |
45642 | --- linux-3.0.3/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500 | |
45643 | +++ linux-3.0.3/grsecurity/gracl_fs.c 2011-08-23 21:48:14.000000000 -0400 | |
45644 | @@ -0,0 +1,431 @@ | |
45645 | +#include <linux/kernel.h> | |
45646 | +#include <linux/sched.h> | |
45647 | +#include <linux/types.h> | |
45648 | +#include <linux/fs.h> | |
45649 | +#include <linux/file.h> | |
45650 | +#include <linux/stat.h> | |
45651 | +#include <linux/grsecurity.h> | |
45652 | +#include <linux/grinternal.h> | |
45653 | +#include <linux/gracl.h> | |
45654 | + | |
45655 | +__u32 | |
45656 | +gr_acl_handle_hidden_file(const struct dentry * dentry, | |
45657 | + const struct vfsmount * mnt) | |
45658 | +{ | |
45659 | + __u32 mode; | |
45660 | + | |
45661 | + if (unlikely(!dentry->d_inode)) | |
45662 | + return GR_FIND; | |
45663 | + | |
45664 | + mode = | |
45665 | + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt); | |
45666 | + | |
45667 | + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) { | |
45668 | + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt); | |
45669 | + return mode; | |
45670 | + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) { | |
45671 | + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt); | |
45672 | + return 0; | |
45673 | + } else if (unlikely(!(mode & GR_FIND))) | |
45674 | + return 0; | |
45675 | + | |
45676 | + return GR_FIND; | |
45677 | +} | |
45678 | + | |
45679 | +__u32 | |
45680 | +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt, | |
45681 | + const int fmode) | |
45682 | +{ | |
45683 | + __u32 reqmode = GR_FIND; | |
45684 | + __u32 mode; | |
45685 | + | |
45686 | + if (unlikely(!dentry->d_inode)) | |
45687 | + return reqmode; | |
45688 | + | |
45689 | + if (unlikely(fmode & O_APPEND)) | |
45690 | + reqmode |= GR_APPEND; | |
45691 | + else if (unlikely(fmode & FMODE_WRITE)) | |
45692 | + reqmode |= GR_WRITE; | |
45693 | + if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY))) | |
45694 | + reqmode |= GR_READ; | |
45695 | + if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC)) | |
45696 | + reqmode &= ~GR_READ; | |
45697 | + mode = | |
45698 | + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, | |
45699 | + mnt); | |
45700 | + | |
45701 | + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) { | |
45702 | + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt, | |
45703 | + reqmode & GR_READ ? " reading" : "", | |
45704 | + reqmode & GR_WRITE ? " writing" : reqmode & | |
45705 | + GR_APPEND ? " appending" : ""); | |
45706 | + return reqmode; | |
45707 | + } else | |
45708 | + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS))) | |
45709 | + { | |
45710 | + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt, | |
45711 | + reqmode & GR_READ ? " reading" : "", | |
45712 | + reqmode & GR_WRITE ? " writing" : reqmode & | |
45713 | + GR_APPEND ? " appending" : ""); | |
45714 | + return 0; | |
45715 | + } else if (unlikely((mode & reqmode) != reqmode)) | |
45716 | + return 0; | |
45717 | + | |
45718 | + return reqmode; | |
45719 | +} | |
45720 | + | |
45721 | +__u32 | |
45722 | +gr_acl_handle_creat(const struct dentry * dentry, | |
45723 | + const struct dentry * p_dentry, | |
45724 | + const struct vfsmount * p_mnt, const int fmode, | |
45725 | + const int imode) | |
45726 | +{ | |
45727 | + __u32 reqmode = GR_WRITE | GR_CREATE; | |
45728 | + __u32 mode; | |
45729 | + | |
45730 | + if (unlikely(fmode & O_APPEND)) | |
45731 | + reqmode |= GR_APPEND; | |
45732 | + if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY))) | |
45733 | + reqmode |= GR_READ; | |
45734 | + if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID)))) | |
45735 | + reqmode |= GR_SETID; | |
45736 | + | |
45737 | + mode = | |
45738 | + gr_check_create(dentry, p_dentry, p_mnt, | |
45739 | + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS); | |
45740 | + | |
45741 | + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) { | |
45742 | + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt, | |
45743 | + reqmode & GR_READ ? " reading" : "", | |
45744 | + reqmode & GR_WRITE ? " writing" : reqmode & | |
45745 | + GR_APPEND ? " appending" : ""); | |
45746 | + return reqmode; | |
45747 | + } else | |
45748 | + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS))) | |
45749 | + { | |
45750 | + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt, | |
45751 | + reqmode & GR_READ ? " reading" : "", | |
45752 | + reqmode & GR_WRITE ? " writing" : reqmode & | |
45753 | + GR_APPEND ? " appending" : ""); | |
45754 | + return 0; | |
45755 | + } else if (unlikely((mode & reqmode) != reqmode)) | |
45756 | + return 0; | |
45757 | + | |
45758 | + return reqmode; | |
45759 | +} | |
45760 | + | |
45761 | +__u32 | |
45762 | +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt, | |
45763 | + const int fmode) | |
45764 | +{ | |
45765 | + __u32 mode, reqmode = GR_FIND; | |
45766 | + | |
45767 | + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode)) | |
45768 | + reqmode |= GR_EXEC; | |
45769 | + if (fmode & S_IWOTH) | |
45770 | + reqmode |= GR_WRITE; | |
45771 | + if (fmode & S_IROTH) | |
45772 | + reqmode |= GR_READ; | |
45773 | + | |
45774 | + mode = | |
45775 | + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, | |
45776 | + mnt); | |
45777 | + | |
45778 | + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) { | |
45779 | + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt, | |
45780 | + reqmode & GR_READ ? " reading" : "", | |
45781 | + reqmode & GR_WRITE ? " writing" : "", | |
45782 | + reqmode & GR_EXEC ? " executing" : ""); | |
45783 | + return reqmode; | |
45784 | + } else | |
45785 | + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS))) | |
45786 | + { | |
45787 | + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt, | |
45788 | + reqmode & GR_READ ? " reading" : "", | |
45789 | + reqmode & GR_WRITE ? " writing" : "", | |
45790 | + reqmode & GR_EXEC ? " executing" : ""); | |
45791 | + return 0; | |
45792 | + } else if (unlikely((mode & reqmode) != reqmode)) | |
45793 | + return 0; | |
45794 | + | |
45795 | + return reqmode; | |
45796 | +} | |
45797 | + | |
45798 | +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt) | |
45799 | +{ | |
45800 | + __u32 mode; | |
45801 | + | |
45802 | + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt); | |
45803 | + | |
45804 | + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) { | |
45805 | + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt); | |
45806 | + return mode; | |
45807 | + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) { | |
45808 | + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt); | |
45809 | + return 0; | |
45810 | + } else if (unlikely((mode & (reqmode)) != (reqmode))) | |
45811 | + return 0; | |
45812 | + | |
45813 | + return (reqmode); | |
45814 | +} | |
45815 | + | |
45816 | +__u32 | |
45817 | +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt) | |
45818 | +{ | |
45819 | + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG); | |
45820 | +} | |
45821 | + | |
45822 | +__u32 | |
45823 | +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt) | |
45824 | +{ | |
45825 | + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG); | |
45826 | +} | |
45827 | + | |
45828 | +__u32 | |
45829 | +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt) | |
45830 | +{ | |
45831 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG); | |
45832 | +} | |
45833 | + | |
45834 | +__u32 | |
45835 | +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt) | |
45836 | +{ | |
45837 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG); | |
45838 | +} | |
45839 | + | |
45840 | +__u32 | |
45841 | +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt, | |
45842 | + mode_t mode) | |
45843 | +{ | |
45844 | + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode))) | |
45845 | + return 1; | |
45846 | + | |
45847 | + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) { | |
45848 | + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID, | |
45849 | + GR_FCHMOD_ACL_MSG); | |
45850 | + } else { | |
45851 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG); | |
45852 | + } | |
45853 | +} | |
45854 | + | |
45855 | +__u32 | |
45856 | +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt, | |
45857 | + mode_t mode) | |
45858 | +{ | |
45859 | + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) { | |
45860 | + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID, | |
45861 | + GR_CHMOD_ACL_MSG); | |
45862 | + } else { | |
45863 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG); | |
45864 | + } | |
45865 | +} | |
45866 | + | |
45867 | +__u32 | |
45868 | +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt) | |
45869 | +{ | |
45870 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG); | |
45871 | +} | |
45872 | + | |
45873 | +__u32 | |
45874 | +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt) | |
45875 | +{ | |
45876 | + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG); | |
45877 | +} | |
45878 | + | |
45879 | +__u32 | |
45880 | +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt) | |
45881 | +{ | |
45882 | + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG); | |
45883 | +} | |
45884 | + | |
45885 | +__u32 | |
45886 | +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt) | |
45887 | +{ | |
45888 | + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE, | |
45889 | + GR_UNIXCONNECT_ACL_MSG); | |
45890 | +} | |
45891 | + | |
45892 | +/* hardlinks require at minimum create permission, | |
45893 | + any additional privilege required is based on the | |
45894 | + privilege of the file being linked to | |
45895 | +*/ | |
45896 | +__u32 | |
45897 | +gr_acl_handle_link(const struct dentry * new_dentry, | |
45898 | + const struct dentry * parent_dentry, | |
45899 | + const struct vfsmount * parent_mnt, | |
45900 | + const struct dentry * old_dentry, | |
45901 | + const struct vfsmount * old_mnt, const char *to) | |
45902 | +{ | |
45903 | + __u32 mode; | |
45904 | + __u32 needmode = GR_CREATE | GR_LINK; | |
45905 | + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK; | |
45906 | + | |
45907 | + mode = | |
45908 | + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry, | |
45909 | + old_mnt); | |
45910 | + | |
45911 | + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) { | |
45912 | + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to); | |
45913 | + return mode; | |
45914 | + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) { | |
45915 | + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to); | |
45916 | + return 0; | |
45917 | + } else if (unlikely((mode & needmode) != needmode)) | |
45918 | + return 0; | |
45919 | + | |
45920 | + return 1; | |
45921 | +} | |
45922 | + | |
45923 | +__u32 | |
45924 | +gr_acl_handle_symlink(const struct dentry * new_dentry, | |
45925 | + const struct dentry * parent_dentry, | |
45926 | + const struct vfsmount * parent_mnt, const char *from) | |
45927 | +{ | |
45928 | + __u32 needmode = GR_WRITE | GR_CREATE; | |
45929 | + __u32 mode; | |
45930 | + | |
45931 | + mode = | |
45932 | + gr_check_create(new_dentry, parent_dentry, parent_mnt, | |
45933 | + GR_CREATE | GR_AUDIT_CREATE | | |
45934 | + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS); | |
45935 | + | |
45936 | + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) { | |
45937 | + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt); | |
45938 | + return mode; | |
45939 | + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) { | |
45940 | + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt); | |
45941 | + return 0; | |
45942 | + } else if (unlikely((mode & needmode) != needmode)) | |
45943 | + return 0; | |
45944 | + | |
45945 | + return (GR_WRITE | GR_CREATE); | |
45946 | +} | |
45947 | + | |
45948 | +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt) | |
45949 | +{ | |
45950 | + __u32 mode; | |
45951 | + | |
45952 | + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS); | |
45953 | + | |
45954 | + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) { | |
45955 | + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt); | |
45956 | + return mode; | |
45957 | + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) { | |
45958 | + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt); | |
45959 | + return 0; | |
45960 | + } else if (unlikely((mode & (reqmode)) != (reqmode))) | |
45961 | + return 0; | |
45962 | + | |
45963 | + return (reqmode); | |
45964 | +} | |
45965 | + | |
45966 | +__u32 | |
45967 | +gr_acl_handle_mknod(const struct dentry * new_dentry, | |
45968 | + const struct dentry * parent_dentry, | |
45969 | + const struct vfsmount * parent_mnt, | |
45970 | + const int mode) | |
45971 | +{ | |
45972 | + __u32 reqmode = GR_WRITE | GR_CREATE; | |
45973 | + if (unlikely(mode & (S_ISUID | S_ISGID))) | |
45974 | + reqmode |= GR_SETID; | |
45975 | + | |
45976 | + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt, | |
45977 | + reqmode, GR_MKNOD_ACL_MSG); | |
45978 | +} | |
45979 | + | |
45980 | +__u32 | |
45981 | +gr_acl_handle_mkdir(const struct dentry *new_dentry, | |
45982 | + const struct dentry *parent_dentry, | |
45983 | + const struct vfsmount *parent_mnt) | |
45984 | +{ | |
45985 | + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt, | |
45986 | + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG); | |
45987 | +} | |
45988 | + | |
45989 | +#define RENAME_CHECK_SUCCESS(old, new) \ | |
45990 | + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \ | |
45991 | + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ))) | |
45992 | + | |
45993 | +int | |
45994 | +gr_acl_handle_rename(struct dentry *new_dentry, | |
45995 | + struct dentry *parent_dentry, | |
45996 | + const struct vfsmount *parent_mnt, | |
45997 | + struct dentry *old_dentry, | |
45998 | + struct inode *old_parent_inode, | |
45999 | + struct vfsmount *old_mnt, const char *newname) | |
46000 | +{ | |
46001 | + __u32 comp1, comp2; | |
46002 | + int error = 0; | |
46003 | + | |
46004 | + if (unlikely(!gr_acl_is_enabled())) | |
46005 | + return 0; | |
46006 | + | |
46007 | + if (!new_dentry->d_inode) { | |
46008 | + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt, | |
46009 | + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ | | |
46010 | + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS); | |
46011 | + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE | | |
46012 | + GR_DELETE | GR_AUDIT_DELETE | | |
46013 | + GR_AUDIT_READ | GR_AUDIT_WRITE | | |
46014 | + GR_SUPPRESS, old_mnt); | |
46015 | + } else { | |
46016 | + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE | | |
46017 | + GR_CREATE | GR_DELETE | | |
46018 | + GR_AUDIT_CREATE | GR_AUDIT_DELETE | | |
46019 | + GR_AUDIT_READ | GR_AUDIT_WRITE | | |
46020 | + GR_SUPPRESS, parent_mnt); | |
46021 | + comp2 = | |
46022 | + gr_search_file(old_dentry, | |
46023 | + GR_READ | GR_WRITE | GR_AUDIT_READ | | |
46024 | + GR_DELETE | GR_AUDIT_DELETE | | |
46025 | + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt); | |
46026 | + } | |
46027 | + | |
46028 | + if (RENAME_CHECK_SUCCESS(comp1, comp2) && | |
46029 | + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS))) | |
46030 | + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname); | |
46031 | + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS) | |
46032 | + && !(comp2 & GR_SUPPRESS)) { | |
46033 | + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname); | |
46034 | + error = -EACCES; | |
46035 | + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2))) | |
46036 | + error = -EACCES; | |
46037 | + | |
46038 | + return error; | |
46039 | +} | |
46040 | + | |
46041 | +void | |
46042 | +gr_acl_handle_exit(void) | |
46043 | +{ | |
46044 | + u16 id; | |
46045 | + char *rolename; | |
46046 | + struct file *exec_file; | |
46047 | + | |
46048 | + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() && | |
46049 | + !(current->role->roletype & GR_ROLE_PERSIST))) { | |
46050 | + id = current->acl_role_id; | |
46051 | + rolename = current->role->rolename; | |
46052 | + gr_set_acls(1); | |
46053 | + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id); | |
46054 | + } | |
46055 | + | |
46056 | + write_lock(&grsec_exec_file_lock); | |
46057 | + exec_file = current->exec_file; | |
46058 | + current->exec_file = NULL; | |
46059 | + write_unlock(&grsec_exec_file_lock); | |
46060 | + | |
46061 | + if (exec_file) | |
46062 | + fput(exec_file); | |
46063 | +} | |
46064 | + | |
46065 | +int | |
46066 | +gr_acl_handle_procpidmem(const struct task_struct *task) | |
46067 | +{ | |
46068 | + if (unlikely(!gr_acl_is_enabled())) | |
46069 | + return 0; | |
46070 | + | |
46071 | + if (task != current && task->acl->mode & GR_PROTPROCFD) | |
46072 | + return -EACCES; | |
46073 | + | |
46074 | + return 0; | |
46075 | +} | |
46076 | diff -urNp linux-3.0.3/grsecurity/gracl_ip.c linux-3.0.3/grsecurity/gracl_ip.c | |
46077 | --- linux-3.0.3/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500 | |
46078 | +++ linux-3.0.3/grsecurity/gracl_ip.c 2011-08-23 21:48:14.000000000 -0400 | |
46079 | @@ -0,0 +1,381 @@ | |
46080 | +#include <linux/kernel.h> | |
46081 | +#include <asm/uaccess.h> | |
46082 | +#include <asm/errno.h> | |
46083 | +#include <net/sock.h> | |
46084 | +#include <linux/file.h> | |
46085 | +#include <linux/fs.h> | |
46086 | +#include <linux/net.h> | |
46087 | +#include <linux/in.h> | |
46088 | +#include <linux/skbuff.h> | |
46089 | +#include <linux/ip.h> | |
46090 | +#include <linux/udp.h> | |
46091 | +#include <linux/types.h> | |
46092 | +#include <linux/sched.h> | |
46093 | +#include <linux/netdevice.h> | |
46094 | +#include <linux/inetdevice.h> | |
46095 | +#include <linux/gracl.h> | |
46096 | +#include <linux/grsecurity.h> | |
46097 | +#include <linux/grinternal.h> | |
46098 | + | |
46099 | +#define GR_BIND 0x01 | |
46100 | +#define GR_CONNECT 0x02 | |
46101 | +#define GR_INVERT 0x04 | |
46102 | +#define GR_BINDOVERRIDE 0x08 | |
46103 | +#define GR_CONNECTOVERRIDE 0x10 | |
46104 | +#define GR_SOCK_FAMILY 0x20 | |
46105 | + | |
46106 | +static const char * gr_protocols[IPPROTO_MAX] = { | |
46107 | + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt", | |
46108 | + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet", | |
46109 | + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1", | |
46110 | + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp", | |
46111 | + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++", | |
46112 | + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre", | |
46113 | + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile", | |
46114 | + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63", | |
46115 | + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv", | |
46116 | + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", | |
46117 | + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", | |
46118 | + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp", | |
46119 | + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim", | |
46120 | + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip", | |
46121 | + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp", | |
46122 | + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup", | |
46123 | + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135", | |
46124 | + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143", | |
46125 | + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151", | |
46126 | + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159", | |
46127 | + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167", | |
46128 | + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175", | |
46129 | + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183", | |
46130 | + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191", | |
46131 | + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199", | |
46132 | + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207", | |
46133 | + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215", | |
46134 | + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223", | |
46135 | + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231", | |
46136 | + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239", | |
46137 | + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247", | |
46138 | + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255", | |
46139 | + }; | |
46140 | + | |
46141 | +static const char * gr_socktypes[SOCK_MAX] = { | |
46142 | + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", | |
46143 | + "unknown:7", "unknown:8", "unknown:9", "packet" | |
46144 | + }; | |
46145 | + | |
46146 | +static const char * gr_sockfamilies[AF_MAX+1] = { | |
46147 | + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25", | |
46148 | + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash", | |
46149 | + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28", | |
46150 | + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf" | |
46151 | + }; | |
46152 | + | |
46153 | +const char * | |
46154 | +gr_proto_to_name(unsigned char proto) | |
46155 | +{ | |
46156 | + return gr_protocols[proto]; | |
46157 | +} | |
46158 | + | |
46159 | +const char * | |
46160 | +gr_socktype_to_name(unsigned char type) | |
46161 | +{ | |
46162 | + return gr_socktypes[type]; | |
46163 | +} | |
46164 | + | |
46165 | +const char * | |
46166 | +gr_sockfamily_to_name(unsigned char family) | |
46167 | +{ | |
46168 | + return gr_sockfamilies[family]; | |
46169 | +} | |
46170 | + | |
46171 | +int | |
46172 | +gr_search_socket(const int domain, const int type, const int protocol) | |
46173 | +{ | |
46174 | + struct acl_subject_label *curr; | |
46175 | + const struct cred *cred = current_cred(); | |
46176 | + | |
46177 | + if (unlikely(!gr_acl_is_enabled())) | |
46178 | + goto exit; | |
46179 | + | |
46180 | + if ((domain < 0) || (type < 0) || (protocol < 0) || | |
46181 | + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX)) | |
46182 | + goto exit; // let the kernel handle it | |
46183 | + | |
46184 | + curr = current->acl; | |
46185 | + | |
46186 | + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) { | |
46187 | + /* the family is allowed, if this is PF_INET allow it only if | |
46188 | + the extra sock type/protocol checks pass */ | |
46189 | + if (domain == PF_INET) | |
46190 | + goto inet_check; | |
46191 | + goto exit; | |
46192 | + } else { | |
46193 | + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) { | |
46194 | + __u32 fakeip = 0; | |
46195 | + security_learn(GR_IP_LEARN_MSG, current->role->rolename, | |
46196 | + current->role->roletype, cred->uid, | |
46197 | + cred->gid, current->exec_file ? | |
46198 | + gr_to_filename(current->exec_file->f_path.dentry, | |
46199 | + current->exec_file->f_path.mnt) : | |
46200 | + curr->filename, curr->filename, | |
46201 | + &fakeip, domain, 0, 0, GR_SOCK_FAMILY, | |
46202 | + ¤t->signal->saved_ip); | |
46203 | + goto exit; | |
46204 | + } | |
46205 | + goto exit_fail; | |
46206 | + } | |
46207 | + | |
46208 | +inet_check: | |
46209 | + /* the rest of this checking is for IPv4 only */ | |
46210 | + if (!curr->ips) | |
46211 | + goto exit; | |
46212 | + | |
46213 | + if ((curr->ip_type & (1 << type)) && | |
46214 | + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32)))) | |
46215 | + goto exit; | |
46216 | + | |
46217 | + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) { | |
46218 | + /* we don't place acls on raw sockets , and sometimes | |
46219 | + dgram/ip sockets are opened for ioctl and not | |
46220 | + bind/connect, so we'll fake a bind learn log */ | |
46221 | + if (type == SOCK_RAW || type == SOCK_PACKET) { | |
46222 | + __u32 fakeip = 0; | |
46223 | + security_learn(GR_IP_LEARN_MSG, current->role->rolename, | |
46224 | + current->role->roletype, cred->uid, | |
46225 | + cred->gid, current->exec_file ? | |
46226 | + gr_to_filename(current->exec_file->f_path.dentry, | |
46227 | + current->exec_file->f_path.mnt) : | |
46228 | + curr->filename, curr->filename, | |
46229 | + &fakeip, 0, type, | |
46230 | + protocol, GR_CONNECT, ¤t->signal->saved_ip); | |
46231 | + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) { | |
46232 | + __u32 fakeip = 0; | |
46233 | + security_learn(GR_IP_LEARN_MSG, current->role->rolename, | |
46234 | + current->role->roletype, cred->uid, | |
46235 | + cred->gid, current->exec_file ? | |
46236 | + gr_to_filename(current->exec_file->f_path.dentry, | |
46237 | + current->exec_file->f_path.mnt) : | |
46238 | + curr->filename, curr->filename, | |
46239 | + &fakeip, 0, type, | |
46240 | + protocol, GR_BIND, ¤t->signal->saved_ip); | |
46241 | + } | |
46242 | + /* we'll log when they use connect or bind */ | |
46243 | + goto exit; | |
46244 | + } | |
46245 | + | |
46246 | +exit_fail: | |
46247 | + if (domain == PF_INET) | |
46248 | + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain), | |
46249 | + gr_socktype_to_name(type), gr_proto_to_name(protocol)); | |
46250 | + else | |
46251 | + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain), | |
46252 | + gr_socktype_to_name(type), protocol); | |
46253 | + | |
46254 | + return 0; | |
46255 | +exit: | |
46256 | + return 1; | |
46257 | +} | |
46258 | + | |
46259 | +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask) | |
46260 | +{ | |
46261 | + if ((ip->mode & mode) && | |
46262 | + (ip_port >= ip->low) && | |
46263 | + (ip_port <= ip->high) && | |
46264 | + ((ntohl(ip_addr) & our_netmask) == | |
46265 | + (ntohl(our_addr) & our_netmask)) | |
46266 | + && (ip->proto[protocol / 32] & (1 << (protocol % 32))) | |
46267 | + && (ip->type & (1 << type))) { | |
46268 | + if (ip->mode & GR_INVERT) | |
46269 | + return 2; // specifically denied | |
46270 | + else | |
46271 | + return 1; // allowed | |
46272 | + } | |
46273 | + | |
46274 | + return 0; // not specifically allowed, may continue parsing | |
46275 | +} | |
46276 | + | |
46277 | +static int | |
46278 | +gr_search_connectbind(const int full_mode, struct sock *sk, | |
46279 | + struct sockaddr_in *addr, const int type) | |
46280 | +{ | |
46281 | + char iface[IFNAMSIZ] = {0}; | |
46282 | + struct acl_subject_label *curr; | |
46283 | + struct acl_ip_label *ip; | |
46284 | + struct inet_sock *isk; | |
46285 | + struct net_device *dev; | |
46286 | + struct in_device *idev; | |
46287 | + unsigned long i; | |
46288 | + int ret; | |
46289 | + int mode = full_mode & (GR_BIND | GR_CONNECT); | |
46290 | + __u32 ip_addr = 0; | |
46291 | + __u32 our_addr; | |
46292 | + __u32 our_netmask; | |
46293 | + char *p; | |
46294 | + __u16 ip_port = 0; | |
46295 | + const struct cred *cred = current_cred(); | |
46296 | + | |
46297 | + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET)) | |
46298 | + return 0; | |
46299 | + | |
46300 | + curr = current->acl; | |
46301 | + isk = inet_sk(sk); | |
46302 | + | |
46303 | + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */ | |
46304 | + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) | |
46305 | + addr->sin_addr.s_addr = curr->inaddr_any_override; | |
46306 | + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) { | |
46307 | + struct sockaddr_in saddr; | |
46308 | + int err; | |
46309 | + | |
46310 | + saddr.sin_family = AF_INET; | |
46311 | + saddr.sin_addr.s_addr = curr->inaddr_any_override; | |
46312 | + saddr.sin_port = isk->inet_sport; | |
46313 | + | |
46314 | + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in)); | |
46315 | + if (err) | |
46316 | + return err; | |
46317 | + | |
46318 | + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in)); | |
46319 | + if (err) | |
46320 | + return err; | |
46321 | + } | |
46322 | + | |
46323 | + if (!curr->ips) | |
46324 | + return 0; | |
46325 | + | |
46326 | + ip_addr = addr->sin_addr.s_addr; | |
46327 | + ip_port = ntohs(addr->sin_port); | |
46328 | + | |
46329 | + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) { | |
46330 | + security_learn(GR_IP_LEARN_MSG, current->role->rolename, | |
46331 | + current->role->roletype, cred->uid, | |
46332 | + cred->gid, current->exec_file ? | |
46333 | + gr_to_filename(current->exec_file->f_path.dentry, | |
46334 | + current->exec_file->f_path.mnt) : | |
46335 | + curr->filename, curr->filename, | |
46336 | + &ip_addr, ip_port, type, | |
46337 | + sk->sk_protocol, mode, ¤t->signal->saved_ip); | |
46338 | + return 0; | |
46339 | + } | |
46340 | + | |
46341 | + for (i = 0; i < curr->ip_num; i++) { | |
46342 | + ip = *(curr->ips + i); | |
46343 | + if (ip->iface != NULL) { | |
46344 | + strncpy(iface, ip->iface, IFNAMSIZ - 1); | |
46345 | + p = strchr(iface, ':'); | |
46346 | + if (p != NULL) | |
46347 | + *p = '\0'; | |
46348 | + dev = dev_get_by_name(sock_net(sk), iface); | |
46349 | + if (dev == NULL) | |
46350 | + continue; | |
46351 | + idev = in_dev_get(dev); | |
46352 | + if (idev == NULL) { | |
46353 | + dev_put(dev); | |
46354 | + continue; | |
46355 | + } | |
46356 | + rcu_read_lock(); | |
46357 | + for_ifa(idev) { | |
46358 | + if (!strcmp(ip->iface, ifa->ifa_label)) { | |
46359 | + our_addr = ifa->ifa_address; | |
46360 | + our_netmask = 0xffffffff; | |
46361 | + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask); | |
46362 | + if (ret == 1) { | |
46363 | + rcu_read_unlock(); | |
46364 | + in_dev_put(idev); | |
46365 | + dev_put(dev); | |
46366 | + return 0; | |
46367 | + } else if (ret == 2) { | |
46368 | + rcu_read_unlock(); | |
46369 | + in_dev_put(idev); | |
46370 | + dev_put(dev); | |
46371 | + goto denied; | |
46372 | + } | |
46373 | + } | |
46374 | + } endfor_ifa(idev); | |
46375 | + rcu_read_unlock(); | |
46376 | + in_dev_put(idev); | |
46377 | + dev_put(dev); | |
46378 | + } else { | |
46379 | + our_addr = ip->addr; | |
46380 | + our_netmask = ip->netmask; | |
46381 | + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask); | |
46382 | + if (ret == 1) | |
46383 | + return 0; | |
46384 | + else if (ret == 2) | |
46385 | + goto denied; | |
46386 | + } | |
46387 | + } | |
46388 | + | |
46389 | +denied: | |
46390 | + if (mode == GR_BIND) | |
46391 | + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol)); | |
46392 | + else if (mode == GR_CONNECT) | |
46393 | + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol)); | |
46394 | + | |
46395 | + return -EACCES; | |
46396 | +} | |
46397 | + | |
46398 | +int | |
46399 | +gr_search_connect(struct socket *sock, struct sockaddr_in *addr) | |
46400 | +{ | |
46401 | + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type); | |
46402 | +} | |
46403 | + | |
46404 | +int | |
46405 | +gr_search_bind(struct socket *sock, struct sockaddr_in *addr) | |
46406 | +{ | |
46407 | + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type); | |
46408 | +} | |
46409 | + | |
46410 | +int gr_search_listen(struct socket *sock) | |
46411 | +{ | |
46412 | + struct sock *sk = sock->sk; | |
46413 | + struct sockaddr_in addr; | |
46414 | + | |
46415 | + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr; | |
46416 | + addr.sin_port = inet_sk(sk)->inet_sport; | |
46417 | + | |
46418 | + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type); | |
46419 | +} | |
46420 | + | |
46421 | +int gr_search_accept(struct socket *sock) | |
46422 | +{ | |
46423 | + struct sock *sk = sock->sk; | |
46424 | + struct sockaddr_in addr; | |
46425 | + | |
46426 | + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr; | |
46427 | + addr.sin_port = inet_sk(sk)->inet_sport; | |
46428 | + | |
46429 | + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type); | |
46430 | +} | |
46431 | + | |
46432 | +int | |
46433 | +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr) | |
46434 | +{ | |
46435 | + if (addr) | |
46436 | + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM); | |
46437 | + else { | |
46438 | + struct sockaddr_in sin; | |
46439 | + const struct inet_sock *inet = inet_sk(sk); | |
46440 | + | |
46441 | + sin.sin_addr.s_addr = inet->inet_daddr; | |
46442 | + sin.sin_port = inet->inet_dport; | |
46443 | + | |
46444 | + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM); | |
46445 | + } | |
46446 | +} | |
46447 | + | |
46448 | +int | |
46449 | +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb) | |
46450 | +{ | |
46451 | + struct sockaddr_in sin; | |
46452 | + | |
46453 | + if (unlikely(skb->len < sizeof (struct udphdr))) | |
46454 | + return 0; // skip this packet | |
46455 | + | |
46456 | + sin.sin_addr.s_addr = ip_hdr(skb)->saddr; | |
46457 | + sin.sin_port = udp_hdr(skb)->source; | |
46458 | + | |
46459 | + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM); | |
46460 | +} | |
46461 | diff -urNp linux-3.0.3/grsecurity/gracl_learn.c linux-3.0.3/grsecurity/gracl_learn.c | |
46462 | --- linux-3.0.3/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500 | |
46463 | +++ linux-3.0.3/grsecurity/gracl_learn.c 2011-08-23 21:48:14.000000000 -0400 | |
46464 | @@ -0,0 +1,207 @@ | |
46465 | +#include <linux/kernel.h> | |
46466 | +#include <linux/mm.h> | |
46467 | +#include <linux/sched.h> | |
46468 | +#include <linux/poll.h> | |
46469 | +#include <linux/string.h> | |
46470 | +#include <linux/file.h> | |
46471 | +#include <linux/types.h> | |
46472 | +#include <linux/vmalloc.h> | |
46473 | +#include <linux/grinternal.h> | |
46474 | + | |
46475 | +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf, | |
46476 | + size_t count, loff_t *ppos); | |
46477 | +extern int gr_acl_is_enabled(void); | |
46478 | + | |
46479 | +static DECLARE_WAIT_QUEUE_HEAD(learn_wait); | |
46480 | +static int gr_learn_attached; | |
46481 | + | |
46482 | +/* use a 512k buffer */ | |
46483 | +#define LEARN_BUFFER_SIZE (512 * 1024) | |
46484 | + | |
46485 | +static DEFINE_SPINLOCK(gr_learn_lock); | |
46486 | +static DEFINE_MUTEX(gr_learn_user_mutex); | |
46487 | + | |
46488 | +/* we need to maintain two buffers, so that the kernel context of grlearn | |
46489 | + uses a semaphore around the userspace copying, and the other kernel contexts | |
46490 | + use a spinlock when copying into the buffer, since they cannot sleep | |
46491 | +*/ | |
46492 | +static char *learn_buffer; | |
46493 | +static char *learn_buffer_user; | |
46494 | +static int learn_buffer_len; | |
46495 | +static int learn_buffer_user_len; | |
46496 | + | |
46497 | +static ssize_t | |
46498 | +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos) | |
46499 | +{ | |
46500 | + DECLARE_WAITQUEUE(wait, current); | |
46501 | + ssize_t retval = 0; | |
46502 | + | |
46503 | + add_wait_queue(&learn_wait, &wait); | |
46504 | + set_current_state(TASK_INTERRUPTIBLE); | |
46505 | + do { | |
46506 | + mutex_lock(&gr_learn_user_mutex); | |
46507 | + spin_lock(&gr_learn_lock); | |
46508 | + if (learn_buffer_len) | |
46509 | + break; | |
46510 | + spin_unlock(&gr_learn_lock); | |
46511 | + mutex_unlock(&gr_learn_user_mutex); | |
46512 | + if (file->f_flags & O_NONBLOCK) { | |
46513 | + retval = -EAGAIN; | |
46514 | + goto out; | |
46515 | + } | |
46516 | + if (signal_pending(current)) { | |
46517 | + retval = -ERESTARTSYS; | |
46518 | + goto out; | |
46519 | + } | |
46520 | + | |
46521 | + schedule(); | |
46522 | + } while (1); | |
46523 | + | |
46524 | + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len); | |
46525 | + learn_buffer_user_len = learn_buffer_len; | |
46526 | + retval = learn_buffer_len; | |
46527 | + learn_buffer_len = 0; | |
46528 | + | |
46529 | + spin_unlock(&gr_learn_lock); | |
46530 | + | |
46531 | + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len)) | |
46532 | + retval = -EFAULT; | |
46533 | + | |
46534 | + mutex_unlock(&gr_learn_user_mutex); | |
46535 | +out: | |
46536 | + set_current_state(TASK_RUNNING); | |
46537 | + remove_wait_queue(&learn_wait, &wait); | |
46538 | + return retval; | |
46539 | +} | |
46540 | + | |
46541 | +static unsigned int | |
46542 | +poll_learn(struct file * file, poll_table * wait) | |
46543 | +{ | |
46544 | + poll_wait(file, &learn_wait, wait); | |
46545 | + | |
46546 | + if (learn_buffer_len) | |
46547 | + return (POLLIN | POLLRDNORM); | |
46548 | + | |
46549 | + return 0; | |
46550 | +} | |
46551 | + | |
46552 | +void | |
46553 | +gr_clear_learn_entries(void) | |
46554 | +{ | |
46555 | + char *tmp; | |
46556 | + | |
46557 | + mutex_lock(&gr_learn_user_mutex); | |
46558 | + spin_lock(&gr_learn_lock); | |
46559 | + tmp = learn_buffer; | |
46560 | + learn_buffer = NULL; | |
46561 | + spin_unlock(&gr_learn_lock); | |
46562 | + if (tmp) | |
46563 | + vfree(tmp); | |
46564 | + if (learn_buffer_user != NULL) { | |
46565 | + vfree(learn_buffer_user); | |
46566 | + learn_buffer_user = NULL; | |
46567 | + } | |
46568 | + learn_buffer_len = 0; | |
46569 | + mutex_unlock(&gr_learn_user_mutex); | |
46570 | + | |
46571 | + return; | |
46572 | +} | |
46573 | + | |
46574 | +void | |
46575 | +gr_add_learn_entry(const char *fmt, ...) | |
46576 | +{ | |
46577 | + va_list args; | |
46578 | + unsigned int len; | |
46579 | + | |
46580 | + if (!gr_learn_attached) | |
46581 | + return; | |
46582 | + | |
46583 | + spin_lock(&gr_learn_lock); | |
46584 | + | |
46585 | + /* leave a gap at the end so we know when it's "full" but don't have to | |
46586 | + compute the exact length of the string we're trying to append | |
46587 | + */ | |
46588 | + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) { | |
46589 | + spin_unlock(&gr_learn_lock); | |
46590 | + wake_up_interruptible(&learn_wait); | |
46591 | + return; | |
46592 | + } | |
46593 | + if (learn_buffer == NULL) { | |
46594 | + spin_unlock(&gr_learn_lock); | |
46595 | + return; | |
46596 | + } | |
46597 | + | |
46598 | + va_start(args, fmt); | |
46599 | + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args); | |
46600 | + va_end(args); | |
46601 | + | |
46602 | + learn_buffer_len += len + 1; | |
46603 | + | |
46604 | + spin_unlock(&gr_learn_lock); | |
46605 | + wake_up_interruptible(&learn_wait); | |
46606 | + | |
46607 | + return; | |
46608 | +} | |
46609 | + | |
46610 | +static int | |
46611 | +open_learn(struct inode *inode, struct file *file) | |
46612 | +{ | |
46613 | + if (file->f_mode & FMODE_READ && gr_learn_attached) | |
46614 | + return -EBUSY; | |
46615 | + if (file->f_mode & FMODE_READ) { | |
46616 | + int retval = 0; | |
46617 | + mutex_lock(&gr_learn_user_mutex); | |
46618 | + if (learn_buffer == NULL) | |
46619 | + learn_buffer = vmalloc(LEARN_BUFFER_SIZE); | |
46620 | + if (learn_buffer_user == NULL) | |
46621 | + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE); | |
46622 | + if (learn_buffer == NULL) { | |
46623 | + retval = -ENOMEM; | |
46624 | + goto out_error; | |
46625 | + } | |
46626 | + if (learn_buffer_user == NULL) { | |
46627 | + retval = -ENOMEM; | |
46628 | + goto out_error; | |
46629 | + } | |
46630 | + learn_buffer_len = 0; | |
46631 | + learn_buffer_user_len = 0; | |
46632 | + gr_learn_attached = 1; | |
46633 | +out_error: | |
46634 | + mutex_unlock(&gr_learn_user_mutex); | |
46635 | + return retval; | |
46636 | + } | |
46637 | + return 0; | |
46638 | +} | |
46639 | + | |
46640 | +static int | |
46641 | +close_learn(struct inode *inode, struct file *file) | |
46642 | +{ | |
46643 | + if (file->f_mode & FMODE_READ) { | |
46644 | + char *tmp = NULL; | |
46645 | + mutex_lock(&gr_learn_user_mutex); | |
46646 | + spin_lock(&gr_learn_lock); | |
46647 | + tmp = learn_buffer; | |
46648 | + learn_buffer = NULL; | |
46649 | + spin_unlock(&gr_learn_lock); | |
46650 | + if (tmp) | |
46651 | + vfree(tmp); | |
46652 | + if (learn_buffer_user != NULL) { | |
46653 | + vfree(learn_buffer_user); | |
46654 | + learn_buffer_user = NULL; | |
46655 | + } | |
46656 | + learn_buffer_len = 0; | |
46657 | + learn_buffer_user_len = 0; | |
46658 | + gr_learn_attached = 0; | |
46659 | + mutex_unlock(&gr_learn_user_mutex); | |
46660 | + } | |
46661 | + | |
46662 | + return 0; | |
46663 | +} | |
46664 | + | |
46665 | +const struct file_operations grsec_fops = { | |
46666 | + .read = read_learn, | |
46667 | + .write = write_grsec_handler, | |
46668 | + .open = open_learn, | |
46669 | + .release = close_learn, | |
46670 | + .poll = poll_learn, | |
46671 | +}; | |
46672 | diff -urNp linux-3.0.3/grsecurity/gracl_res.c linux-3.0.3/grsecurity/gracl_res.c | |
46673 | --- linux-3.0.3/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500 | |
46674 | +++ linux-3.0.3/grsecurity/gracl_res.c 2011-08-23 21:48:14.000000000 -0400 | |
46675 | @@ -0,0 +1,68 @@ | |
46676 | +#include <linux/kernel.h> | |
46677 | +#include <linux/sched.h> | |
46678 | +#include <linux/gracl.h> | |
46679 | +#include <linux/grinternal.h> | |
46680 | + | |
46681 | +static const char *restab_log[] = { | |
46682 | + [RLIMIT_CPU] = "RLIMIT_CPU", | |
46683 | + [RLIMIT_FSIZE] = "RLIMIT_FSIZE", | |
46684 | + [RLIMIT_DATA] = "RLIMIT_DATA", | |
46685 | + [RLIMIT_STACK] = "RLIMIT_STACK", | |
46686 | + [RLIMIT_CORE] = "RLIMIT_CORE", | |
46687 | + [RLIMIT_RSS] = "RLIMIT_RSS", | |
46688 | + [RLIMIT_NPROC] = "RLIMIT_NPROC", | |
46689 | + [RLIMIT_NOFILE] = "RLIMIT_NOFILE", | |
46690 | + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK", | |
46691 | + [RLIMIT_AS] = "RLIMIT_AS", | |
46692 | + [RLIMIT_LOCKS] = "RLIMIT_LOCKS", | |
46693 | + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING", | |
46694 | + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE", | |
46695 | + [RLIMIT_NICE] = "RLIMIT_NICE", | |
46696 | + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO", | |
46697 | + [RLIMIT_RTTIME] = "RLIMIT_RTTIME", | |
46698 | + [GR_CRASH_RES] = "RLIMIT_CRASH" | |
46699 | +}; | |
46700 | + | |
46701 | +void | |
46702 | +gr_log_resource(const struct task_struct *task, | |
46703 | + const int res, const unsigned long wanted, const int gt) | |
46704 | +{ | |
46705 | + const struct cred *cred; | |
46706 | + unsigned long rlim; | |
46707 | + | |
46708 | + if (!gr_acl_is_enabled() && !grsec_resource_logging) | |
46709 | + return; | |
46710 | + | |
46711 | + // not yet supported resource | |
46712 | + if (unlikely(!restab_log[res])) | |
46713 | + return; | |
46714 | + | |
46715 | + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME) | |
46716 | + rlim = task_rlimit_max(task, res); | |
46717 | + else | |
46718 | + rlim = task_rlimit(task, res); | |
46719 | + | |
46720 | + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim))) | |
46721 | + return; | |
46722 | + | |
46723 | + rcu_read_lock(); | |
46724 | + cred = __task_cred(task); | |
46725 | + | |
46726 | + if (res == RLIMIT_NPROC && | |
46727 | + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || | |
46728 | + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE))) | |
46729 | + goto out_rcu_unlock; | |
46730 | + else if (res == RLIMIT_MEMLOCK && | |
46731 | + cap_raised(cred->cap_effective, CAP_IPC_LOCK)) | |
46732 | + goto out_rcu_unlock; | |
46733 | + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE)) | |
46734 | + goto out_rcu_unlock; | |
46735 | + rcu_read_unlock(); | |
46736 | + | |
46737 | + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim); | |
46738 | + | |
46739 | + return; | |
46740 | +out_rcu_unlock: | |
46741 | + rcu_read_unlock(); | |
46742 | + return; | |
46743 | +} | |
46744 | diff -urNp linux-3.0.3/grsecurity/gracl_segv.c linux-3.0.3/grsecurity/gracl_segv.c | |
46745 | --- linux-3.0.3/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500 | |
46746 | +++ linux-3.0.3/grsecurity/gracl_segv.c 2011-08-23 21:48:14.000000000 -0400 | |
46747 | @@ -0,0 +1,299 @@ | |
46748 | +#include <linux/kernel.h> | |
46749 | +#include <linux/mm.h> | |
46750 | +#include <asm/uaccess.h> | |
46751 | +#include <asm/errno.h> | |
46752 | +#include <asm/mman.h> | |
46753 | +#include <net/sock.h> | |
46754 | +#include <linux/file.h> | |
46755 | +#include <linux/fs.h> | |
46756 | +#include <linux/net.h> | |
46757 | +#include <linux/in.h> | |
46758 | +#include <linux/slab.h> | |
46759 | +#include <linux/types.h> | |
46760 | +#include <linux/sched.h> | |
46761 | +#include <linux/timer.h> | |
46762 | +#include <linux/gracl.h> | |
46763 | +#include <linux/grsecurity.h> | |
46764 | +#include <linux/grinternal.h> | |
46765 | + | |
46766 | +static struct crash_uid *uid_set; | |
46767 | +static unsigned short uid_used; | |
46768 | +static DEFINE_SPINLOCK(gr_uid_lock); | |
46769 | +extern rwlock_t gr_inode_lock; | |
46770 | +extern struct acl_subject_label * | |
46771 | + lookup_acl_subj_label(const ino_t inode, const dev_t dev, | |
46772 | + struct acl_role_label *role); | |
46773 | + | |
46774 | +#ifdef CONFIG_BTRFS_FS | |
46775 | +extern dev_t get_btrfs_dev_from_inode(struct inode *inode); | |
46776 | +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat); | |
46777 | +#endif | |
46778 | + | |
46779 | +static inline dev_t __get_dev(const struct dentry *dentry) | |
46780 | +{ | |
46781 | +#ifdef CONFIG_BTRFS_FS | |
46782 | + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr) | |
46783 | + return get_btrfs_dev_from_inode(dentry->d_inode); | |
46784 | + else | |
46785 | +#endif | |
46786 | + return dentry->d_inode->i_sb->s_dev; | |
46787 | +} | |
46788 | + | |
46789 | +int | |
46790 | +gr_init_uidset(void) | |
46791 | +{ | |
46792 | + uid_set = | |
46793 | + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL); | |
46794 | + uid_used = 0; | |
46795 | + | |
46796 | + return uid_set ? 1 : 0; | |
46797 | +} | |
46798 | + | |
46799 | +void | |
46800 | +gr_free_uidset(void) | |
46801 | +{ | |
46802 | + if (uid_set) | |
46803 | + kfree(uid_set); | |
46804 | + | |
46805 | + return; | |
46806 | +} | |
46807 | + | |
46808 | +int | |
46809 | +gr_find_uid(const uid_t uid) | |
46810 | +{ | |
46811 | + struct crash_uid *tmp = uid_set; | |
46812 | + uid_t buid; | |
46813 | + int low = 0, high = uid_used - 1, mid; | |
46814 | + | |
46815 | + while (high >= low) { | |
46816 | + mid = (low + high) >> 1; | |
46817 | + buid = tmp[mid].uid; | |
46818 | + if (buid == uid) | |
46819 | + return mid; | |
46820 | + if (buid > uid) | |
46821 | + high = mid - 1; | |
46822 | + if (buid < uid) | |
46823 | + low = mid + 1; | |
46824 | + } | |
46825 | + | |
46826 | + return -1; | |
46827 | +} | |
46828 | + | |
46829 | +static __inline__ void | |
46830 | +gr_insertsort(void) | |
46831 | +{ | |
46832 | + unsigned short i, j; | |
46833 | + struct crash_uid index; | |
46834 | + | |
46835 | + for (i = 1; i < uid_used; i++) { | |
46836 | + index = uid_set[i]; | |
46837 | + j = i; | |
46838 | + while ((j > 0) && uid_set[j - 1].uid > index.uid) { | |
46839 | + uid_set[j] = uid_set[j - 1]; | |
46840 | + j--; | |
46841 | + } | |
46842 | + uid_set[j] = index; | |
46843 | + } | |
46844 | + | |
46845 | + return; | |
46846 | +} | |
46847 | + | |
46848 | +static __inline__ void | |
46849 | +gr_insert_uid(const uid_t uid, const unsigned long expires) | |
46850 | +{ | |
46851 | + int loc; | |
46852 | + | |
46853 | + if (uid_used == GR_UIDTABLE_MAX) | |
46854 | + return; | |
46855 | + | |
46856 | + loc = gr_find_uid(uid); | |
46857 | + | |
46858 | + if (loc >= 0) { | |
46859 | + uid_set[loc].expires = expires; | |
46860 | + return; | |
46861 | + } | |
46862 | + | |
46863 | + uid_set[uid_used].uid = uid; | |
46864 | + uid_set[uid_used].expires = expires; | |
46865 | + uid_used++; | |
46866 | + | |
46867 | + gr_insertsort(); | |
46868 | + | |
46869 | + return; | |
46870 | +} | |
46871 | + | |
46872 | +void | |
46873 | +gr_remove_uid(const unsigned short loc) | |
46874 | +{ | |
46875 | + unsigned short i; | |
46876 | + | |
46877 | + for (i = loc + 1; i < uid_used; i++) | |
46878 | + uid_set[i - 1] = uid_set[i]; | |
46879 | + | |
46880 | + uid_used--; | |
46881 | + | |
46882 | + return; | |
46883 | +} | |
46884 | + | |
46885 | +int | |
46886 | +gr_check_crash_uid(const uid_t uid) | |
46887 | +{ | |
46888 | + int loc; | |
46889 | + int ret = 0; | |
46890 | + | |
46891 | + if (unlikely(!gr_acl_is_enabled())) | |
46892 | + return 0; | |
46893 | + | |
46894 | + spin_lock(&gr_uid_lock); | |
46895 | + loc = gr_find_uid(uid); | |
46896 | + | |
46897 | + if (loc < 0) | |
46898 | + goto out_unlock; | |
46899 | + | |
46900 | + if (time_before_eq(uid_set[loc].expires, get_seconds())) | |
46901 | + gr_remove_uid(loc); | |
46902 | + else | |
46903 | + ret = 1; | |
46904 | + | |
46905 | +out_unlock: | |
46906 | + spin_unlock(&gr_uid_lock); | |
46907 | + return ret; | |
46908 | +} | |
46909 | + | |
46910 | +static __inline__ int | |
46911 | +proc_is_setxid(const struct cred *cred) | |
46912 | +{ | |
46913 | + if (cred->uid != cred->euid || cred->uid != cred->suid || | |
46914 | + cred->uid != cred->fsuid) | |
46915 | + return 1; | |
46916 | + if (cred->gid != cred->egid || cred->gid != cred->sgid || | |
46917 | + cred->gid != cred->fsgid) | |
46918 | + return 1; | |
46919 | + | |
46920 | + return 0; | |
46921 | +} | |
46922 | + | |
46923 | +extern int gr_fake_force_sig(int sig, struct task_struct *t); | |
46924 | + | |
46925 | +void | |
46926 | +gr_handle_crash(struct task_struct *task, const int sig) | |
46927 | +{ | |
46928 | + struct acl_subject_label *curr; | |
46929 | + struct acl_subject_label *curr2; | |
46930 | + struct task_struct *tsk, *tsk2; | |
46931 | + const struct cred *cred; | |
46932 | + const struct cred *cred2; | |
46933 | + | |
46934 | + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL) | |
46935 | + return; | |
46936 | + | |
46937 | + if (unlikely(!gr_acl_is_enabled())) | |
46938 | + return; | |
46939 | + | |
46940 | + curr = task->acl; | |
46941 | + | |
46942 | + if (!(curr->resmask & (1 << GR_CRASH_RES))) | |
46943 | + return; | |
46944 | + | |
46945 | + if (time_before_eq(curr->expires, get_seconds())) { | |
46946 | + curr->expires = 0; | |
46947 | + curr->crashes = 0; | |
46948 | + } | |
46949 | + | |
46950 | + curr->crashes++; | |
46951 | + | |
46952 | + if (!curr->expires) | |
46953 | + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max; | |
46954 | + | |
46955 | + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) && | |
46956 | + time_after(curr->expires, get_seconds())) { | |
46957 | + rcu_read_lock(); | |
46958 | + cred = __task_cred(task); | |
46959 | + if (cred->uid && proc_is_setxid(cred)) { | |
46960 | + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max); | |
46961 | + spin_lock(&gr_uid_lock); | |
46962 | + gr_insert_uid(cred->uid, curr->expires); | |
46963 | + spin_unlock(&gr_uid_lock); | |
46964 | + curr->expires = 0; | |
46965 | + curr->crashes = 0; | |
46966 | + read_lock(&tasklist_lock); | |
46967 | + do_each_thread(tsk2, tsk) { | |
46968 | + cred2 = __task_cred(tsk); | |
46969 | + if (tsk != task && cred2->uid == cred->uid) | |
46970 | + gr_fake_force_sig(SIGKILL, tsk); | |
46971 | + } while_each_thread(tsk2, tsk); | |
46972 | + read_unlock(&tasklist_lock); | |
46973 | + } else { | |
46974 | + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max); | |
46975 | + read_lock(&tasklist_lock); | |
46976 | + do_each_thread(tsk2, tsk) { | |
46977 | + if (likely(tsk != task)) { | |
46978 | + curr2 = tsk->acl; | |
46979 | + | |
46980 | + if (curr2->device == curr->device && | |
46981 | + curr2->inode == curr->inode) | |
46982 | + gr_fake_force_sig(SIGKILL, tsk); | |
46983 | + } | |
46984 | + } while_each_thread(tsk2, tsk); | |
46985 | + read_unlock(&tasklist_lock); | |
46986 | + } | |
46987 | + rcu_read_unlock(); | |
46988 | + } | |
46989 | + | |
46990 | + return; | |
46991 | +} | |
46992 | + | |
46993 | +int | |
46994 | +gr_check_crash_exec(const struct file *filp) | |
46995 | +{ | |
46996 | + struct acl_subject_label *curr; | |
46997 | + | |
46998 | + if (unlikely(!gr_acl_is_enabled())) | |
46999 | + return 0; | |
47000 | + | |
47001 | + read_lock(&gr_inode_lock); | |
47002 | + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino, | |
47003 | + __get_dev(filp->f_path.dentry), | |
47004 | + current->role); | |
47005 | + read_unlock(&gr_inode_lock); | |
47006 | + | |
47007 | + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) || | |
47008 | + (!curr->crashes && !curr->expires)) | |
47009 | + return 0; | |
47010 | + | |
47011 | + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) && | |
47012 | + time_after(curr->expires, get_seconds())) | |
47013 | + return 1; | |
47014 | + else if (time_before_eq(curr->expires, get_seconds())) { | |
47015 | + curr->crashes = 0; | |
47016 | + curr->expires = 0; | |
47017 | + } | |
47018 | + | |
47019 | + return 0; | |
47020 | +} | |
47021 | + | |
47022 | +void | |
47023 | +gr_handle_alertkill(struct task_struct *task) | |
47024 | +{ | |
47025 | + struct acl_subject_label *curracl; | |
47026 | + __u32 curr_ip; | |
47027 | + struct task_struct *p, *p2; | |
47028 | + | |
47029 | + if (unlikely(!gr_acl_is_enabled())) | |
47030 | + return; | |
47031 | + | |
47032 | + curracl = task->acl; | |
47033 | + curr_ip = task->signal->curr_ip; | |
47034 | + | |
47035 | + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) { | |
47036 | + read_lock(&tasklist_lock); | |
47037 | + do_each_thread(p2, p) { | |
47038 | + if (p->signal->curr_ip == curr_ip) | |
47039 | + gr_fake_force_sig(SIGKILL, p); | |
47040 | + } while_each_thread(p2, p); | |
47041 | + read_unlock(&tasklist_lock); | |
47042 | + } else if (curracl->mode & GR_KILLPROC) | |
47043 | + gr_fake_force_sig(SIGKILL, task); | |
47044 | + | |
47045 | + return; | |
47046 | +} | |
47047 | diff -urNp linux-3.0.3/grsecurity/gracl_shm.c linux-3.0.3/grsecurity/gracl_shm.c | |
47048 | --- linux-3.0.3/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500 | |
47049 | +++ linux-3.0.3/grsecurity/gracl_shm.c 2011-08-23 21:48:14.000000000 -0400 | |
47050 | @@ -0,0 +1,40 @@ | |
47051 | +#include <linux/kernel.h> | |
47052 | +#include <linux/mm.h> | |
47053 | +#include <linux/sched.h> | |
47054 | +#include <linux/file.h> | |
47055 | +#include <linux/ipc.h> | |
47056 | +#include <linux/gracl.h> | |
47057 | +#include <linux/grsecurity.h> | |
47058 | +#include <linux/grinternal.h> | |
47059 | + | |
47060 | +int | |
47061 | +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid, | |
47062 | + const time_t shm_createtime, const uid_t cuid, const int shmid) | |
47063 | +{ | |
47064 | + struct task_struct *task; | |
47065 | + | |
47066 | + if (!gr_acl_is_enabled()) | |
47067 | + return 1; | |
47068 | + | |
47069 | + rcu_read_lock(); | |
47070 | + read_lock(&tasklist_lock); | |
47071 | + | |
47072 | + task = find_task_by_vpid(shm_cprid); | |
47073 | + | |
47074 | + if (unlikely(!task)) | |
47075 | + task = find_task_by_vpid(shm_lapid); | |
47076 | + | |
47077 | + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) || | |
47078 | + (task->pid == shm_lapid)) && | |
47079 | + (task->acl->mode & GR_PROTSHM) && | |
47080 | + (task->acl != current->acl))) { | |
47081 | + read_unlock(&tasklist_lock); | |
47082 | + rcu_read_unlock(); | |
47083 | + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid); | |
47084 | + return 0; | |
47085 | + } | |
47086 | + read_unlock(&tasklist_lock); | |
47087 | + rcu_read_unlock(); | |
47088 | + | |
47089 | + return 1; | |
47090 | +} | |
47091 | diff -urNp linux-3.0.3/grsecurity/grsec_chdir.c linux-3.0.3/grsecurity/grsec_chdir.c | |
47092 | --- linux-3.0.3/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500 | |
47093 | +++ linux-3.0.3/grsecurity/grsec_chdir.c 2011-08-23 21:48:14.000000000 -0400 | |
47094 | @@ -0,0 +1,19 @@ | |
47095 | +#include <linux/kernel.h> | |
47096 | +#include <linux/sched.h> | |
47097 | +#include <linux/fs.h> | |
47098 | +#include <linux/file.h> | |
47099 | +#include <linux/grsecurity.h> | |
47100 | +#include <linux/grinternal.h> | |
47101 | + | |
47102 | +void | |
47103 | +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt) | |
47104 | +{ | |
47105 | +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR | |
47106 | + if ((grsec_enable_chdir && grsec_enable_group && | |
47107 | + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir && | |
47108 | + !grsec_enable_group)) { | |
47109 | + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt); | |
47110 | + } | |
47111 | +#endif | |
47112 | + return; | |
47113 | +} | |
47114 | diff -urNp linux-3.0.3/grsecurity/grsec_chroot.c linux-3.0.3/grsecurity/grsec_chroot.c | |
47115 | --- linux-3.0.3/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500 | |
47116 | +++ linux-3.0.3/grsecurity/grsec_chroot.c 2011-08-23 21:48:14.000000000 -0400 | |
47117 | @@ -0,0 +1,349 @@ | |
47118 | +#include <linux/kernel.h> | |
47119 | +#include <linux/module.h> | |
47120 | +#include <linux/sched.h> | |
47121 | +#include <linux/file.h> | |
47122 | +#include <linux/fs.h> | |
47123 | +#include <linux/mount.h> | |
47124 | +#include <linux/types.h> | |
47125 | +#include <linux/pid_namespace.h> | |
47126 | +#include <linux/grsecurity.h> | |
47127 | +#include <linux/grinternal.h> | |
47128 | + | |
47129 | +void gr_set_chroot_entries(struct task_struct *task, struct path *path) | |
47130 | +{ | |
47131 | +#ifdef CONFIG_GRKERNSEC | |
47132 | + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry && | |
47133 | + path->dentry != task->nsproxy->mnt_ns->root->mnt_root) | |
47134 | + task->gr_is_chrooted = 1; | |
47135 | + else | |
47136 | + task->gr_is_chrooted = 0; | |
47137 | + | |
47138 | + task->gr_chroot_dentry = path->dentry; | |
47139 | +#endif | |
47140 | + return; | |
47141 | +} | |
47142 | + | |
47143 | +void gr_clear_chroot_entries(struct task_struct *task) | |
47144 | +{ | |
47145 | +#ifdef CONFIG_GRKERNSEC | |
47146 | + task->gr_is_chrooted = 0; | |
47147 | + task->gr_chroot_dentry = NULL; | |
47148 | +#endif | |
47149 | + return; | |
47150 | +} | |
47151 | + | |
47152 | +int | |
47153 | +gr_handle_chroot_unix(const pid_t pid) | |
47154 | +{ | |
47155 | +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX | |
47156 | + struct task_struct *p; | |
47157 | + | |
47158 | + if (unlikely(!grsec_enable_chroot_unix)) | |
47159 | + return 1; | |
47160 | + | |
47161 | + if (likely(!proc_is_chrooted(current))) | |
47162 | + return 1; | |
47163 | + | |
47164 | + rcu_read_lock(); | |
47165 | + read_lock(&tasklist_lock); | |
47166 | + p = find_task_by_vpid_unrestricted(pid); | |
47167 | + if (unlikely(p && !have_same_root(current, p))) { | |
47168 | + read_unlock(&tasklist_lock); | |
47169 | + rcu_read_unlock(); | |
47170 | + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG); | |
47171 | + return 0; | |
47172 | + } | |
47173 | + read_unlock(&tasklist_lock); | |
47174 | + rcu_read_unlock(); | |
47175 | +#endif | |
47176 | + return 1; | |
47177 | +} | |
47178 | + | |
47179 | +int | |
47180 | +gr_handle_chroot_nice(void) | |
47181 | +{ | |
47182 | +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE | |
47183 | + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) { | |
47184 | + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG); | |
47185 | + return -EPERM; | |
47186 | + } | |
47187 | +#endif | |
47188 | + return 0; | |
47189 | +} | |
47190 | + | |
47191 | +int | |
47192 | +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval) | |
47193 | +{ | |
47194 | +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE | |
47195 | + if (grsec_enable_chroot_nice && (niceval < task_nice(p)) | |
47196 | + && proc_is_chrooted(current)) { | |
47197 | + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid); | |
47198 | + return -EACCES; | |
47199 | + } | |
47200 | +#endif | |
47201 | + return 0; | |
47202 | +} | |
47203 | + | |
47204 | +int | |
47205 | +gr_handle_chroot_rawio(const struct inode *inode) | |
47206 | +{ | |
47207 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS | |
47208 | + if (grsec_enable_chroot_caps && proc_is_chrooted(current) && | |
47209 | + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO)) | |
47210 | + return 1; | |
47211 | +#endif | |
47212 | + return 0; | |
47213 | +} | |
47214 | + | |
47215 | +int | |
47216 | +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type) | |
47217 | +{ | |
47218 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
47219 | + struct task_struct *p; | |
47220 | + int ret = 0; | |
47221 | + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid) | |
47222 | + return ret; | |
47223 | + | |
47224 | + read_lock(&tasklist_lock); | |
47225 | + do_each_pid_task(pid, type, p) { | |
47226 | + if (!have_same_root(current, p)) { | |
47227 | + ret = 1; | |
47228 | + goto out; | |
47229 | + } | |
47230 | + } while_each_pid_task(pid, type, p); | |
47231 | +out: | |
47232 | + read_unlock(&tasklist_lock); | |
47233 | + return ret; | |
47234 | +#endif | |
47235 | + return 0; | |
47236 | +} | |
47237 | + | |
47238 | +int | |
47239 | +gr_pid_is_chrooted(struct task_struct *p) | |
47240 | +{ | |
47241 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
47242 | + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL) | |
47243 | + return 0; | |
47244 | + | |
47245 | + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) || | |
47246 | + !have_same_root(current, p)) { | |
47247 | + return 1; | |
47248 | + } | |
47249 | +#endif | |
47250 | + return 0; | |
47251 | +} | |
47252 | + | |
47253 | +EXPORT_SYMBOL(gr_pid_is_chrooted); | |
47254 | + | |
47255 | +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR) | |
47256 | +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt) | |
47257 | +{ | |
47258 | + struct path path, currentroot; | |
47259 | + int ret = 0; | |
47260 | + | |
47261 | + path.dentry = (struct dentry *)u_dentry; | |
47262 | + path.mnt = (struct vfsmount *)u_mnt; | |
47263 | + get_fs_root(current->fs, ¤troot); | |
47264 | + if (path_is_under(&path, ¤troot)) | |
47265 | + ret = 1; | |
47266 | + path_put(¤troot); | |
47267 | + | |
47268 | + return ret; | |
47269 | +} | |
47270 | +#endif | |
47271 | + | |
47272 | +int | |
47273 | +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt) | |
47274 | +{ | |
47275 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR | |
47276 | + if (!grsec_enable_chroot_fchdir) | |
47277 | + return 1; | |
47278 | + | |
47279 | + if (!proc_is_chrooted(current)) | |
47280 | + return 1; | |
47281 | + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) { | |
47282 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt); | |
47283 | + return 0; | |
47284 | + } | |
47285 | +#endif | |
47286 | + return 1; | |
47287 | +} | |
47288 | + | |
47289 | +int | |
47290 | +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid, | |
47291 | + const time_t shm_createtime) | |
47292 | +{ | |
47293 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT | |
47294 | + struct task_struct *p; | |
47295 | + time_t starttime; | |
47296 | + | |
47297 | + if (unlikely(!grsec_enable_chroot_shmat)) | |
47298 | + return 1; | |
47299 | + | |
47300 | + if (likely(!proc_is_chrooted(current))) | |
47301 | + return 1; | |
47302 | + | |
47303 | + rcu_read_lock(); | |
47304 | + read_lock(&tasklist_lock); | |
47305 | + | |
47306 | + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) { | |
47307 | + starttime = p->start_time.tv_sec; | |
47308 | + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) { | |
47309 | + if (have_same_root(current, p)) { | |
47310 | + goto allow; | |
47311 | + } else { | |
47312 | + read_unlock(&tasklist_lock); | |
47313 | + rcu_read_unlock(); | |
47314 | + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG); | |
47315 | + return 0; | |
47316 | + } | |
47317 | + } | |
47318 | + /* creator exited, pid reuse, fall through to next check */ | |
47319 | + } | |
47320 | + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) { | |
47321 | + if (unlikely(!have_same_root(current, p))) { | |
47322 | + read_unlock(&tasklist_lock); | |
47323 | + rcu_read_unlock(); | |
47324 | + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG); | |
47325 | + return 0; | |
47326 | + } | |
47327 | + } | |
47328 | + | |
47329 | +allow: | |
47330 | + read_unlock(&tasklist_lock); | |
47331 | + rcu_read_unlock(); | |
47332 | +#endif | |
47333 | + return 1; | |
47334 | +} | |
47335 | + | |
47336 | +void | |
47337 | +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt) | |
47338 | +{ | |
47339 | +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG | |
47340 | + if (grsec_enable_chroot_execlog && proc_is_chrooted(current)) | |
47341 | + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt); | |
47342 | +#endif | |
47343 | + return; | |
47344 | +} | |
47345 | + | |
47346 | +int | |
47347 | +gr_handle_chroot_mknod(const struct dentry *dentry, | |
47348 | + const struct vfsmount *mnt, const int mode) | |
47349 | +{ | |
47350 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD | |
47351 | + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && | |
47352 | + proc_is_chrooted(current)) { | |
47353 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt); | |
47354 | + return -EPERM; | |
47355 | + } | |
47356 | +#endif | |
47357 | + return 0; | |
47358 | +} | |
47359 | + | |
47360 | +int | |
47361 | +gr_handle_chroot_mount(const struct dentry *dentry, | |
47362 | + const struct vfsmount *mnt, const char *dev_name) | |
47363 | +{ | |
47364 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT | |
47365 | + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) { | |
47366 | + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt); | |
47367 | + return -EPERM; | |
47368 | + } | |
47369 | +#endif | |
47370 | + return 0; | |
47371 | +} | |
47372 | + | |
47373 | +int | |
47374 | +gr_handle_chroot_pivot(void) | |
47375 | +{ | |
47376 | +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT | |
47377 | + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) { | |
47378 | + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG); | |
47379 | + return -EPERM; | |
47380 | + } | |
47381 | +#endif | |
47382 | + return 0; | |
47383 | +} | |
47384 | + | |
47385 | +int | |
47386 | +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt) | |
47387 | +{ | |
47388 | +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE | |
47389 | + if (grsec_enable_chroot_double && proc_is_chrooted(current) && | |
47390 | + !gr_is_outside_chroot(dentry, mnt)) { | |
47391 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt); | |
47392 | + return -EPERM; | |
47393 | + } | |
47394 | +#endif | |
47395 | + return 0; | |
47396 | +} | |
47397 | + | |
47398 | +int | |
47399 | +gr_handle_chroot_caps(struct path *path) | |
47400 | +{ | |
47401 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS | |
47402 | + if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL && | |
47403 | + (init_task.fs->root.dentry != path->dentry) && | |
47404 | + (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) { | |
47405 | + | |
47406 | + kernel_cap_t chroot_caps = GR_CHROOT_CAPS; | |
47407 | + const struct cred *old = current_cred(); | |
47408 | + struct cred *new = prepare_creds(); | |
47409 | + if (new == NULL) | |
47410 | + return 1; | |
47411 | + | |
47412 | + new->cap_permitted = cap_drop(old->cap_permitted, | |
47413 | + chroot_caps); | |
47414 | + new->cap_inheritable = cap_drop(old->cap_inheritable, | |
47415 | + chroot_caps); | |
47416 | + new->cap_effective = cap_drop(old->cap_effective, | |
47417 | + chroot_caps); | |
47418 | + | |
47419 | + commit_creds(new); | |
47420 | + | |
47421 | + return 0; | |
47422 | + } | |
47423 | +#endif | |
47424 | + return 0; | |
47425 | +} | |
47426 | + | |
47427 | +int | |
47428 | +gr_handle_chroot_sysctl(const int op) | |
47429 | +{ | |
47430 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL | |
47431 | + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) && | |
47432 | + proc_is_chrooted(current)) | |
47433 | + return -EACCES; | |
47434 | +#endif | |
47435 | + return 0; | |
47436 | +} | |
47437 | + | |
47438 | +void | |
47439 | +gr_handle_chroot_chdir(struct path *path) | |
47440 | +{ | |
47441 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR | |
47442 | + if (grsec_enable_chroot_chdir) | |
47443 | + set_fs_pwd(current->fs, path); | |
47444 | +#endif | |
47445 | + return; | |
47446 | +} | |
47447 | + | |
47448 | +int | |
47449 | +gr_handle_chroot_chmod(const struct dentry *dentry, | |
47450 | + const struct vfsmount *mnt, const int mode) | |
47451 | +{ | |
47452 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD | |
47453 | + /* allow chmod +s on directories, but not files */ | |
47454 | + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) && | |
47455 | + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) && | |
47456 | + proc_is_chrooted(current)) { | |
47457 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt); | |
47458 | + return -EPERM; | |
47459 | + } | |
47460 | +#endif | |
47461 | + return 0; | |
47462 | +} | |
47463 | + | |
47464 | +#ifdef CONFIG_SECURITY | |
47465 | +EXPORT_SYMBOL(gr_handle_chroot_caps); | |
47466 | +#endif | |
47467 | diff -urNp linux-3.0.3/grsecurity/grsec_disabled.c linux-3.0.3/grsecurity/grsec_disabled.c | |
47468 | --- linux-3.0.3/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500 | |
47469 | +++ linux-3.0.3/grsecurity/grsec_disabled.c 2011-08-23 21:48:14.000000000 -0400 | |
47470 | @@ -0,0 +1,447 @@ | |
47471 | +#include <linux/kernel.h> | |
47472 | +#include <linux/module.h> | |
47473 | +#include <linux/sched.h> | |
47474 | +#include <linux/file.h> | |
47475 | +#include <linux/fs.h> | |
47476 | +#include <linux/kdev_t.h> | |
47477 | +#include <linux/net.h> | |
47478 | +#include <linux/in.h> | |
47479 | +#include <linux/ip.h> | |
47480 | +#include <linux/skbuff.h> | |
47481 | +#include <linux/sysctl.h> | |
47482 | + | |
47483 | +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS | |
47484 | +void | |
47485 | +pax_set_initial_flags(struct linux_binprm *bprm) | |
47486 | +{ | |
47487 | + return; | |
47488 | +} | |
47489 | +#endif | |
47490 | + | |
47491 | +#ifdef CONFIG_SYSCTL | |
47492 | +__u32 | |
47493 | +gr_handle_sysctl(const struct ctl_table * table, const int op) | |
47494 | +{ | |
47495 | + return 0; | |
47496 | +} | |
47497 | +#endif | |
47498 | + | |
47499 | +#ifdef CONFIG_TASKSTATS | |
47500 | +int gr_is_taskstats_denied(int pid) | |
47501 | +{ | |
47502 | + return 0; | |
47503 | +} | |
47504 | +#endif | |
47505 | + | |
47506 | +int | |
47507 | +gr_acl_is_enabled(void) | |
47508 | +{ | |
47509 | + return 0; | |
47510 | +} | |
47511 | + | |
47512 | +int | |
47513 | +gr_handle_rawio(const struct inode *inode) | |
47514 | +{ | |
47515 | + return 0; | |
47516 | +} | |
47517 | + | |
47518 | +void | |
47519 | +gr_acl_handle_psacct(struct task_struct *task, const long code) | |
47520 | +{ | |
47521 | + return; | |
47522 | +} | |
47523 | + | |
47524 | +int | |
47525 | +gr_handle_ptrace(struct task_struct *task, const long request) | |
47526 | +{ | |
47527 | + return 0; | |
47528 | +} | |
47529 | + | |
47530 | +int | |
47531 | +gr_handle_proc_ptrace(struct task_struct *task) | |
47532 | +{ | |
47533 | + return 0; | |
47534 | +} | |
47535 | + | |
47536 | +void | |
47537 | +gr_learn_resource(const struct task_struct *task, | |
47538 | + const int res, const unsigned long wanted, const int gt) | |
47539 | +{ | |
47540 | + return; | |
47541 | +} | |
47542 | + | |
47543 | +int | |
47544 | +gr_set_acls(const int type) | |
47545 | +{ | |
47546 | + return 0; | |
47547 | +} | |
47548 | + | |
47549 | +int | |
47550 | +gr_check_hidden_task(const struct task_struct *tsk) | |
47551 | +{ | |
47552 | + return 0; | |
47553 | +} | |
47554 | + | |
47555 | +int | |
47556 | +gr_check_protected_task(const struct task_struct *task) | |
47557 | +{ | |
47558 | + return 0; | |
47559 | +} | |
47560 | + | |
47561 | +int | |
47562 | +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type) | |
47563 | +{ | |
47564 | + return 0; | |
47565 | +} | |
47566 | + | |
47567 | +void | |
47568 | +gr_copy_label(struct task_struct *tsk) | |
47569 | +{ | |
47570 | + return; | |
47571 | +} | |
47572 | + | |
47573 | +void | |
47574 | +gr_set_pax_flags(struct task_struct *task) | |
47575 | +{ | |
47576 | + return; | |
47577 | +} | |
47578 | + | |
47579 | +int | |
47580 | +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt, | |
47581 | + const int unsafe_share) | |
47582 | +{ | |
47583 | + return 0; | |
47584 | +} | |
47585 | + | |
47586 | +void | |
47587 | +gr_handle_delete(const ino_t ino, const dev_t dev) | |
47588 | +{ | |
47589 | + return; | |
47590 | +} | |
47591 | + | |
47592 | +void | |
47593 | +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt) | |
47594 | +{ | |
47595 | + return; | |
47596 | +} | |
47597 | + | |
47598 | +void | |
47599 | +gr_handle_crash(struct task_struct *task, const int sig) | |
47600 | +{ | |
47601 | + return; | |
47602 | +} | |
47603 | + | |
47604 | +int | |
47605 | +gr_check_crash_exec(const struct file *filp) | |
47606 | +{ | |
47607 | + return 0; | |
47608 | +} | |
47609 | + | |
47610 | +int | |
47611 | +gr_check_crash_uid(const uid_t uid) | |
47612 | +{ | |
47613 | + return 0; | |
47614 | +} | |
47615 | + | |
47616 | +void | |
47617 | +gr_handle_rename(struct inode *old_dir, struct inode *new_dir, | |
47618 | + struct dentry *old_dentry, | |
47619 | + struct dentry *new_dentry, | |
47620 | + struct vfsmount *mnt, const __u8 replace) | |
47621 | +{ | |
47622 | + return; | |
47623 | +} | |
47624 | + | |
47625 | +int | |
47626 | +gr_search_socket(const int family, const int type, const int protocol) | |
47627 | +{ | |
47628 | + return 1; | |
47629 | +} | |
47630 | + | |
47631 | +int | |
47632 | +gr_search_connectbind(const int mode, const struct socket *sock, | |
47633 | + const struct sockaddr_in *addr) | |
47634 | +{ | |
47635 | + return 0; | |
47636 | +} | |
47637 | + | |
47638 | +int | |
47639 | +gr_is_capable(const int cap) | |
47640 | +{ | |
47641 | + return 1; | |
47642 | +} | |
47643 | + | |
47644 | +int | |
47645 | +gr_is_capable_nolog(const int cap) | |
47646 | +{ | |
47647 | + return 1; | |
47648 | +} | |
47649 | + | |
47650 | +void | |
47651 | +gr_handle_alertkill(struct task_struct *task) | |
47652 | +{ | |
47653 | + return; | |
47654 | +} | |
47655 | + | |
47656 | +__u32 | |
47657 | +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt) | |
47658 | +{ | |
47659 | + return 1; | |
47660 | +} | |
47661 | + | |
47662 | +__u32 | |
47663 | +gr_acl_handle_hidden_file(const struct dentry * dentry, | |
47664 | + const struct vfsmount * mnt) | |
47665 | +{ | |
47666 | + return 1; | |
47667 | +} | |
47668 | + | |
47669 | +__u32 | |
47670 | +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt, | |
47671 | + const int fmode) | |
47672 | +{ | |
47673 | + return 1; | |
47674 | +} | |
47675 | + | |
47676 | +__u32 | |
47677 | +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt) | |
47678 | +{ | |
47679 | + return 1; | |
47680 | +} | |
47681 | + | |
47682 | +__u32 | |
47683 | +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt) | |
47684 | +{ | |
47685 | + return 1; | |
47686 | +} | |
47687 | + | |
47688 | +int | |
47689 | +gr_acl_handle_mmap(const struct file *file, const unsigned long prot, | |
47690 | + unsigned int *vm_flags) | |
47691 | +{ | |
47692 | + return 1; | |
47693 | +} | |
47694 | + | |
47695 | +__u32 | |
47696 | +gr_acl_handle_truncate(const struct dentry * dentry, | |
47697 | + const struct vfsmount * mnt) | |
47698 | +{ | |
47699 | + return 1; | |
47700 | +} | |
47701 | + | |
47702 | +__u32 | |
47703 | +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt) | |
47704 | +{ | |
47705 | + return 1; | |
47706 | +} | |
47707 | + | |
47708 | +__u32 | |
47709 | +gr_acl_handle_access(const struct dentry * dentry, | |
47710 | + const struct vfsmount * mnt, const int fmode) | |
47711 | +{ | |
47712 | + return 1; | |
47713 | +} | |
47714 | + | |
47715 | +__u32 | |
47716 | +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt, | |
47717 | + mode_t mode) | |
47718 | +{ | |
47719 | + return 1; | |
47720 | +} | |
47721 | + | |
47722 | +__u32 | |
47723 | +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt, | |
47724 | + mode_t mode) | |
47725 | +{ | |
47726 | + return 1; | |
47727 | +} | |
47728 | + | |
47729 | +__u32 | |
47730 | +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt) | |
47731 | +{ | |
47732 | + return 1; | |
47733 | +} | |
47734 | + | |
47735 | +__u32 | |
47736 | +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt) | |
47737 | +{ | |
47738 | + return 1; | |
47739 | +} | |
47740 | + | |
47741 | +void | |
47742 | +grsecurity_init(void) | |
47743 | +{ | |
47744 | + return; | |
47745 | +} | |
47746 | + | |
47747 | +__u32 | |
47748 | +gr_acl_handle_mknod(const struct dentry * new_dentry, | |
47749 | + const struct dentry * parent_dentry, | |
47750 | + const struct vfsmount * parent_mnt, | |
47751 | + const int mode) | |
47752 | +{ | |
47753 | + return 1; | |
47754 | +} | |
47755 | + | |
47756 | +__u32 | |
47757 | +gr_acl_handle_mkdir(const struct dentry * new_dentry, | |
47758 | + const struct dentry * parent_dentry, | |
47759 | + const struct vfsmount * parent_mnt) | |
47760 | +{ | |
47761 | + return 1; | |
47762 | +} | |
47763 | + | |
47764 | +__u32 | |
47765 | +gr_acl_handle_symlink(const struct dentry * new_dentry, | |
47766 | + const struct dentry * parent_dentry, | |
47767 | + const struct vfsmount * parent_mnt, const char *from) | |
47768 | +{ | |
47769 | + return 1; | |
47770 | +} | |
47771 | + | |
47772 | +__u32 | |
47773 | +gr_acl_handle_link(const struct dentry * new_dentry, | |
47774 | + const struct dentry * parent_dentry, | |
47775 | + const struct vfsmount * parent_mnt, | |
47776 | + const struct dentry * old_dentry, | |
47777 | + const struct vfsmount * old_mnt, const char *to) | |
47778 | +{ | |
47779 | + return 1; | |
47780 | +} | |
47781 | + | |
47782 | +int | |
47783 | +gr_acl_handle_rename(const struct dentry *new_dentry, | |
47784 | + const struct dentry *parent_dentry, | |
47785 | + const struct vfsmount *parent_mnt, | |
47786 | + const struct dentry *old_dentry, | |
47787 | + const struct inode *old_parent_inode, | |
47788 | + const struct vfsmount *old_mnt, const char *newname) | |
47789 | +{ | |
47790 | + return 0; | |
47791 | +} | |
47792 | + | |
47793 | +int | |
47794 | +gr_acl_handle_filldir(const struct file *file, const char *name, | |
47795 | + const int namelen, const ino_t ino) | |
47796 | +{ | |
47797 | + return 1; | |
47798 | +} | |
47799 | + | |
47800 | +int | |
47801 | +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid, | |
47802 | + const time_t shm_createtime, const uid_t cuid, const int shmid) | |
47803 | +{ | |
47804 | + return 1; | |
47805 | +} | |
47806 | + | |
47807 | +int | |
47808 | +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr) | |
47809 | +{ | |
47810 | + return 0; | |
47811 | +} | |
47812 | + | |
47813 | +int | |
47814 | +gr_search_accept(const struct socket *sock) | |
47815 | +{ | |
47816 | + return 0; | |
47817 | +} | |
47818 | + | |
47819 | +int | |
47820 | +gr_search_listen(const struct socket *sock) | |
47821 | +{ | |
47822 | + return 0; | |
47823 | +} | |
47824 | + | |
47825 | +int | |
47826 | +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr) | |
47827 | +{ | |
47828 | + return 0; | |
47829 | +} | |
47830 | + | |
47831 | +__u32 | |
47832 | +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt) | |
47833 | +{ | |
47834 | + return 1; | |
47835 | +} | |
47836 | + | |
47837 | +__u32 | |
47838 | +gr_acl_handle_creat(const struct dentry * dentry, | |
47839 | + const struct dentry * p_dentry, | |
47840 | + const struct vfsmount * p_mnt, const int fmode, | |
47841 | + const int imode) | |
47842 | +{ | |
47843 | + return 1; | |
47844 | +} | |
47845 | + | |
47846 | +void | |
47847 | +gr_acl_handle_exit(void) | |
47848 | +{ | |
47849 | + return; | |
47850 | +} | |
47851 | + | |
47852 | +int | |
47853 | +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot) | |
47854 | +{ | |
47855 | + return 1; | |
47856 | +} | |
47857 | + | |
47858 | +void | |
47859 | +gr_set_role_label(const uid_t uid, const gid_t gid) | |
47860 | +{ | |
47861 | + return; | |
47862 | +} | |
47863 | + | |
47864 | +int | |
47865 | +gr_acl_handle_procpidmem(const struct task_struct *task) | |
47866 | +{ | |
47867 | + return 0; | |
47868 | +} | |
47869 | + | |
47870 | +int | |
47871 | +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb) | |
47872 | +{ | |
47873 | + return 0; | |
47874 | +} | |
47875 | + | |
47876 | +int | |
47877 | +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr) | |
47878 | +{ | |
47879 | + return 0; | |
47880 | +} | |
47881 | + | |
47882 | +void | |
47883 | +gr_set_kernel_label(struct task_struct *task) | |
47884 | +{ | |
47885 | + return; | |
47886 | +} | |
47887 | + | |
47888 | +int | |
47889 | +gr_check_user_change(int real, int effective, int fs) | |
47890 | +{ | |
47891 | + return 0; | |
47892 | +} | |
47893 | + | |
47894 | +int | |
47895 | +gr_check_group_change(int real, int effective, int fs) | |
47896 | +{ | |
47897 | + return 0; | |
47898 | +} | |
47899 | + | |
47900 | +int gr_acl_enable_at_secure(void) | |
47901 | +{ | |
47902 | + return 0; | |
47903 | +} | |
47904 | + | |
47905 | +dev_t gr_get_dev_from_dentry(struct dentry *dentry) | |
47906 | +{ | |
47907 | + return dentry->d_inode->i_sb->s_dev; | |
47908 | +} | |
47909 | + | |
47910 | +EXPORT_SYMBOL(gr_is_capable); | |
47911 | +EXPORT_SYMBOL(gr_is_capable_nolog); | |
47912 | +EXPORT_SYMBOL(gr_learn_resource); | |
47913 | +EXPORT_SYMBOL(gr_set_kernel_label); | |
47914 | +#ifdef CONFIG_SECURITY | |
47915 | +EXPORT_SYMBOL(gr_check_user_change); | |
47916 | +EXPORT_SYMBOL(gr_check_group_change); | |
47917 | +#endif | |
47918 | diff -urNp linux-3.0.3/grsecurity/grsec_exec.c linux-3.0.3/grsecurity/grsec_exec.c | |
47919 | --- linux-3.0.3/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500 | |
47920 | +++ linux-3.0.3/grsecurity/grsec_exec.c 2011-08-25 17:25:59.000000000 -0400 | |
47921 | @@ -0,0 +1,72 @@ | |
47922 | +#include <linux/kernel.h> | |
47923 | +#include <linux/sched.h> | |
47924 | +#include <linux/file.h> | |
47925 | +#include <linux/binfmts.h> | |
47926 | +#include <linux/fs.h> | |
47927 | +#include <linux/types.h> | |
47928 | +#include <linux/grdefs.h> | |
47929 | +#include <linux/grsecurity.h> | |
47930 | +#include <linux/grinternal.h> | |
47931 | +#include <linux/capability.h> | |
47932 | + | |
47933 | +#include <asm/uaccess.h> | |
47934 | + | |
47935 | +#ifdef CONFIG_GRKERNSEC_EXECLOG | |
47936 | +static char gr_exec_arg_buf[132]; | |
47937 | +static DEFINE_MUTEX(gr_exec_arg_mutex); | |
47938 | +#endif | |
47939 | + | |
47940 | +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr); | |
47941 | + | |
47942 | +void | |
47943 | +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv) | |
47944 | +{ | |
47945 | +#ifdef CONFIG_GRKERNSEC_EXECLOG | |
47946 | + char *grarg = gr_exec_arg_buf; | |
47947 | + unsigned int i, x, execlen = 0; | |
47948 | + char c; | |
47949 | + | |
47950 | + if (!((grsec_enable_execlog && grsec_enable_group && | |
47951 | + in_group_p(grsec_audit_gid)) | |
47952 | + || (grsec_enable_execlog && !grsec_enable_group))) | |
47953 | + return; | |
47954 | + | |
47955 | + mutex_lock(&gr_exec_arg_mutex); | |
47956 | + memset(grarg, 0, sizeof(gr_exec_arg_buf)); | |
47957 | + | |
47958 | + for (i = 0; i < bprm->argc && execlen < 128; i++) { | |
47959 | + const char __user *p; | |
47960 | + unsigned int len; | |
47961 | + | |
47962 | + p = get_user_arg_ptr(argv, i); | |
47963 | + if (IS_ERR(p)) | |
47964 | + goto log; | |
47965 | + | |
47966 | + len = strnlen_user(p, 128 - execlen); | |
47967 | + if (len > 128 - execlen) | |
47968 | + len = 128 - execlen; | |
47969 | + else if (len > 0) | |
47970 | + len--; | |
47971 | + if (copy_from_user(grarg + execlen, p, len)) | |
47972 | + goto log; | |
47973 | + | |
47974 | + /* rewrite unprintable characters */ | |
47975 | + for (x = 0; x < len; x++) { | |
47976 | + c = *(grarg + execlen + x); | |
47977 | + if (c < 32 || c > 126) | |
47978 | + *(grarg + execlen + x) = ' '; | |
47979 | + } | |
47980 | + | |
47981 | + execlen += len; | |
47982 | + *(grarg + execlen) = ' '; | |
47983 | + *(grarg + execlen + 1) = '\0'; | |
47984 | + execlen++; | |
47985 | + } | |
47986 | + | |
47987 | + log: | |
47988 | + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry, | |
47989 | + bprm->file->f_path.mnt, grarg); | |
47990 | + mutex_unlock(&gr_exec_arg_mutex); | |
47991 | +#endif | |
47992 | + return; | |
47993 | +} | |
47994 | diff -urNp linux-3.0.3/grsecurity/grsec_fifo.c linux-3.0.3/grsecurity/grsec_fifo.c | |
47995 | --- linux-3.0.3/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500 | |
47996 | +++ linux-3.0.3/grsecurity/grsec_fifo.c 2011-08-23 21:48:14.000000000 -0400 | |
47997 | @@ -0,0 +1,24 @@ | |
47998 | +#include <linux/kernel.h> | |
47999 | +#include <linux/sched.h> | |
48000 | +#include <linux/fs.h> | |
48001 | +#include <linux/file.h> | |
48002 | +#include <linux/grinternal.h> | |
48003 | + | |
48004 | +int | |
48005 | +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt, | |
48006 | + const struct dentry *dir, const int flag, const int acc_mode) | |
48007 | +{ | |
48008 | +#ifdef CONFIG_GRKERNSEC_FIFO | |
48009 | + const struct cred *cred = current_cred(); | |
48010 | + | |
48011 | + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) && | |
48012 | + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) && | |
48013 | + (dentry->d_inode->i_uid != dir->d_inode->i_uid) && | |
48014 | + (cred->fsuid != dentry->d_inode->i_uid)) { | |
48015 | + if (!inode_permission(dentry->d_inode, acc_mode)) | |
48016 | + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid); | |
48017 | + return -EACCES; | |
48018 | + } | |
48019 | +#endif | |
48020 | + return 0; | |
48021 | +} | |
48022 | diff -urNp linux-3.0.3/grsecurity/grsec_fork.c linux-3.0.3/grsecurity/grsec_fork.c | |
48023 | --- linux-3.0.3/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500 | |
48024 | +++ linux-3.0.3/grsecurity/grsec_fork.c 2011-08-23 21:48:14.000000000 -0400 | |
48025 | @@ -0,0 +1,23 @@ | |
48026 | +#include <linux/kernel.h> | |
48027 | +#include <linux/sched.h> | |
48028 | +#include <linux/grsecurity.h> | |
48029 | +#include <linux/grinternal.h> | |
48030 | +#include <linux/errno.h> | |
48031 | + | |
48032 | +void | |
48033 | +gr_log_forkfail(const int retval) | |
48034 | +{ | |
48035 | +#ifdef CONFIG_GRKERNSEC_FORKFAIL | |
48036 | + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) { | |
48037 | + switch (retval) { | |
48038 | + case -EAGAIN: | |
48039 | + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN"); | |
48040 | + break; | |
48041 | + case -ENOMEM: | |
48042 | + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM"); | |
48043 | + break; | |
48044 | + } | |
48045 | + } | |
48046 | +#endif | |
48047 | + return; | |
48048 | +} | |
48049 | diff -urNp linux-3.0.3/grsecurity/grsec_init.c linux-3.0.3/grsecurity/grsec_init.c | |
48050 | --- linux-3.0.3/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500 | |
48051 | +++ linux-3.0.3/grsecurity/grsec_init.c 2011-08-25 17:25:12.000000000 -0400 | |
48052 | @@ -0,0 +1,269 @@ | |
48053 | +#include <linux/kernel.h> | |
48054 | +#include <linux/sched.h> | |
48055 | +#include <linux/mm.h> | |
48056 | +#include <linux/gracl.h> | |
48057 | +#include <linux/slab.h> | |
48058 | +#include <linux/vmalloc.h> | |
48059 | +#include <linux/percpu.h> | |
48060 | +#include <linux/module.h> | |
48061 | + | |
48062 | +int grsec_enable_brute; | |
48063 | +int grsec_enable_link; | |
48064 | +int grsec_enable_dmesg; | |
48065 | +int grsec_enable_harden_ptrace; | |
48066 | +int grsec_enable_fifo; | |
48067 | +int grsec_enable_execlog; | |
48068 | +int grsec_enable_signal; | |
48069 | +int grsec_enable_forkfail; | |
48070 | +int grsec_enable_audit_ptrace; | |
48071 | +int grsec_enable_time; | |
48072 | +int grsec_enable_audit_textrel; | |
48073 | +int grsec_enable_group; | |
48074 | +int grsec_audit_gid; | |
48075 | +int grsec_enable_chdir; | |
48076 | +int grsec_enable_mount; | |
48077 | +int grsec_enable_rofs; | |
48078 | +int grsec_enable_chroot_findtask; | |
48079 | +int grsec_enable_chroot_mount; | |
48080 | +int grsec_enable_chroot_shmat; | |
48081 | +int grsec_enable_chroot_fchdir; | |
48082 | +int grsec_enable_chroot_double; | |
48083 | +int grsec_enable_chroot_pivot; | |
48084 | +int grsec_enable_chroot_chdir; | |
48085 | +int grsec_enable_chroot_chmod; | |
48086 | +int grsec_enable_chroot_mknod; | |
48087 | +int grsec_enable_chroot_nice; | |
48088 | +int grsec_enable_chroot_execlog; | |
48089 | +int grsec_enable_chroot_caps; | |
48090 | +int grsec_enable_chroot_sysctl; | |
48091 | +int grsec_enable_chroot_unix; | |
48092 | +int grsec_enable_tpe; | |
48093 | +int grsec_tpe_gid; | |
48094 | +int grsec_enable_blackhole; | |
48095 | +#ifdef CONFIG_IPV6_MODULE | |
48096 | +EXPORT_SYMBOL(grsec_enable_blackhole); | |
48097 | +#endif | |
48098 | +int grsec_lastack_retries; | |
48099 | +int grsec_enable_tpe_all; | |
48100 | +int grsec_enable_tpe_invert; | |
48101 | +int grsec_enable_socket_all; | |
48102 | +int grsec_socket_all_gid; | |
48103 | +int grsec_enable_socket_client; | |
48104 | +int grsec_socket_client_gid; | |
48105 | +int grsec_enable_socket_server; | |
48106 | +int grsec_socket_server_gid; | |
48107 | +int grsec_resource_logging; | |
48108 | +int grsec_disable_privio; | |
48109 | +int grsec_enable_log_rwxmaps; | |
48110 | +int grsec_lock; | |
48111 | + | |
48112 | +DEFINE_SPINLOCK(grsec_alert_lock); | |
48113 | +unsigned long grsec_alert_wtime = 0; | |
48114 | +unsigned long grsec_alert_fyet = 0; | |
48115 | + | |
48116 | +DEFINE_SPINLOCK(grsec_audit_lock); | |
48117 | + | |
48118 | +DEFINE_RWLOCK(grsec_exec_file_lock); | |
48119 | + | |
48120 | +char *gr_shared_page[4]; | |
48121 | + | |
48122 | +char *gr_alert_log_fmt; | |
48123 | +char *gr_audit_log_fmt; | |
48124 | +char *gr_alert_log_buf; | |
48125 | +char *gr_audit_log_buf; | |
48126 | + | |
48127 | +extern struct gr_arg *gr_usermode; | |
48128 | +extern unsigned char *gr_system_salt; | |
48129 | +extern unsigned char *gr_system_sum; | |
48130 | + | |
48131 | +void __init | |
48132 | +grsecurity_init(void) | |
48133 | +{ | |
48134 | + int j; | |
48135 | + /* create the per-cpu shared pages */ | |
48136 | + | |
48137 | +#ifdef CONFIG_X86 | |
48138 | + memset((char *)(0x41a + PAGE_OFFSET), 0, 36); | |
48139 | +#endif | |
48140 | + | |
48141 | + for (j = 0; j < 4; j++) { | |
48142 | + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long)); | |
48143 | + if (gr_shared_page[j] == NULL) { | |
48144 | + panic("Unable to allocate grsecurity shared page"); | |
48145 | + return; | |
48146 | + } | |
48147 | + } | |
48148 | + | |
48149 | + /* allocate log buffers */ | |
48150 | + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL); | |
48151 | + if (!gr_alert_log_fmt) { | |
48152 | + panic("Unable to allocate grsecurity alert log format buffer"); | |
48153 | + return; | |
48154 | + } | |
48155 | + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL); | |
48156 | + if (!gr_audit_log_fmt) { | |
48157 | + panic("Unable to allocate grsecurity audit log format buffer"); | |
48158 | + return; | |
48159 | + } | |
48160 | + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL); | |
48161 | + if (!gr_alert_log_buf) { | |
48162 | + panic("Unable to allocate grsecurity alert log buffer"); | |
48163 | + return; | |
48164 | + } | |
48165 | + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL); | |
48166 | + if (!gr_audit_log_buf) { | |
48167 | + panic("Unable to allocate grsecurity audit log buffer"); | |
48168 | + return; | |
48169 | + } | |
48170 | + | |
48171 | + /* allocate memory for authentication structure */ | |
48172 | + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL); | |
48173 | + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL); | |
48174 | + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL); | |
48175 | + | |
48176 | + if (!gr_usermode || !gr_system_salt || !gr_system_sum) { | |
48177 | + panic("Unable to allocate grsecurity authentication structure"); | |
48178 | + return; | |
48179 | + } | |
48180 | + | |
48181 | + | |
48182 | +#ifdef CONFIG_GRKERNSEC_IO | |
48183 | +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO) | |
48184 | + grsec_disable_privio = 1; | |
48185 | +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON) | |
48186 | + grsec_disable_privio = 1; | |
48187 | +#else | |
48188 | + grsec_disable_privio = 0; | |
48189 | +#endif | |
48190 | +#endif | |
48191 | + | |
48192 | +#ifdef CONFIG_GRKERNSEC_TPE_INVERT | |
48193 | + /* for backward compatibility, tpe_invert always defaults to on if | |
48194 | + enabled in the kernel | |
48195 | + */ | |
48196 | + grsec_enable_tpe_invert = 1; | |
48197 | +#endif | |
48198 | + | |
48199 | +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON) | |
48200 | +#ifndef CONFIG_GRKERNSEC_SYSCTL | |
48201 | + grsec_lock = 1; | |
48202 | +#endif | |
48203 | + | |
48204 | +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL | |
48205 | + grsec_enable_audit_textrel = 1; | |
48206 | +#endif | |
48207 | +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG | |
48208 | + grsec_enable_log_rwxmaps = 1; | |
48209 | +#endif | |
48210 | +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP | |
48211 | + grsec_enable_group = 1; | |
48212 | + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID; | |
48213 | +#endif | |
48214 | +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR | |
48215 | + grsec_enable_chdir = 1; | |
48216 | +#endif | |
48217 | +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
48218 | + grsec_enable_harden_ptrace = 1; | |
48219 | +#endif | |
48220 | +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT | |
48221 | + grsec_enable_mount = 1; | |
48222 | +#endif | |
48223 | +#ifdef CONFIG_GRKERNSEC_LINK | |
48224 | + grsec_enable_link = 1; | |
48225 | +#endif | |
48226 | +#ifdef CONFIG_GRKERNSEC_BRUTE | |
48227 | + grsec_enable_brute = 1; | |
48228 | +#endif | |
48229 | +#ifdef CONFIG_GRKERNSEC_DMESG | |
48230 | + grsec_enable_dmesg = 1; | |
48231 | +#endif | |
48232 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
48233 | + grsec_enable_blackhole = 1; | |
48234 | + grsec_lastack_retries = 4; | |
48235 | +#endif | |
48236 | +#ifdef CONFIG_GRKERNSEC_FIFO | |
48237 | + grsec_enable_fifo = 1; | |
48238 | +#endif | |
48239 | +#ifdef CONFIG_GRKERNSEC_EXECLOG | |
48240 | + grsec_enable_execlog = 1; | |
48241 | +#endif | |
48242 | +#ifdef CONFIG_GRKERNSEC_SIGNAL | |
48243 | + grsec_enable_signal = 1; | |
48244 | +#endif | |
48245 | +#ifdef CONFIG_GRKERNSEC_FORKFAIL | |
48246 | + grsec_enable_forkfail = 1; | |
48247 | +#endif | |
48248 | +#ifdef CONFIG_GRKERNSEC_TIME | |
48249 | + grsec_enable_time = 1; | |
48250 | +#endif | |
48251 | +#ifdef CONFIG_GRKERNSEC_RESLOG | |
48252 | + grsec_resource_logging = 1; | |
48253 | +#endif | |
48254 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
48255 | + grsec_enable_chroot_findtask = 1; | |
48256 | +#endif | |
48257 | +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX | |
48258 | + grsec_enable_chroot_unix = 1; | |
48259 | +#endif | |
48260 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT | |
48261 | + grsec_enable_chroot_mount = 1; | |
48262 | +#endif | |
48263 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR | |
48264 | + grsec_enable_chroot_fchdir = 1; | |
48265 | +#endif | |
48266 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT | |
48267 | + grsec_enable_chroot_shmat = 1; | |
48268 | +#endif | |
48269 | +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE | |
48270 | + grsec_enable_audit_ptrace = 1; | |
48271 | +#endif | |
48272 | +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE | |
48273 | + grsec_enable_chroot_double = 1; | |
48274 | +#endif | |
48275 | +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT | |
48276 | + grsec_enable_chroot_pivot = 1; | |
48277 | +#endif | |
48278 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR | |
48279 | + grsec_enable_chroot_chdir = 1; | |
48280 | +#endif | |
48281 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD | |
48282 | + grsec_enable_chroot_chmod = 1; | |
48283 | +#endif | |
48284 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD | |
48285 | + grsec_enable_chroot_mknod = 1; | |
48286 | +#endif | |
48287 | +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE | |
48288 | + grsec_enable_chroot_nice = 1; | |
48289 | +#endif | |
48290 | +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG | |
48291 | + grsec_enable_chroot_execlog = 1; | |
48292 | +#endif | |
48293 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS | |
48294 | + grsec_enable_chroot_caps = 1; | |
48295 | +#endif | |
48296 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL | |
48297 | + grsec_enable_chroot_sysctl = 1; | |
48298 | +#endif | |
48299 | +#ifdef CONFIG_GRKERNSEC_TPE | |
48300 | + grsec_enable_tpe = 1; | |
48301 | + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID; | |
48302 | +#ifdef CONFIG_GRKERNSEC_TPE_ALL | |
48303 | + grsec_enable_tpe_all = 1; | |
48304 | +#endif | |
48305 | +#endif | |
48306 | +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL | |
48307 | + grsec_enable_socket_all = 1; | |
48308 | + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID; | |
48309 | +#endif | |
48310 | +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT | |
48311 | + grsec_enable_socket_client = 1; | |
48312 | + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID; | |
48313 | +#endif | |
48314 | +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER | |
48315 | + grsec_enable_socket_server = 1; | |
48316 | + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID; | |
48317 | +#endif | |
48318 | +#endif | |
48319 | + | |
48320 | + return; | |
48321 | +} | |
48322 | diff -urNp linux-3.0.3/grsecurity/grsec_link.c linux-3.0.3/grsecurity/grsec_link.c | |
48323 | --- linux-3.0.3/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500 | |
48324 | +++ linux-3.0.3/grsecurity/grsec_link.c 2011-08-23 21:48:14.000000000 -0400 | |
48325 | @@ -0,0 +1,43 @@ | |
48326 | +#include <linux/kernel.h> | |
48327 | +#include <linux/sched.h> | |
48328 | +#include <linux/fs.h> | |
48329 | +#include <linux/file.h> | |
48330 | +#include <linux/grinternal.h> | |
48331 | + | |
48332 | +int | |
48333 | +gr_handle_follow_link(const struct inode *parent, | |
48334 | + const struct inode *inode, | |
48335 | + const struct dentry *dentry, const struct vfsmount *mnt) | |
48336 | +{ | |
48337 | +#ifdef CONFIG_GRKERNSEC_LINK | |
48338 | + const struct cred *cred = current_cred(); | |
48339 | + | |
48340 | + if (grsec_enable_link && S_ISLNK(inode->i_mode) && | |
48341 | + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) && | |
48342 | + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) { | |
48343 | + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid); | |
48344 | + return -EACCES; | |
48345 | + } | |
48346 | +#endif | |
48347 | + return 0; | |
48348 | +} | |
48349 | + | |
48350 | +int | |
48351 | +gr_handle_hardlink(const struct dentry *dentry, | |
48352 | + const struct vfsmount *mnt, | |
48353 | + struct inode *inode, const int mode, const char *to) | |
48354 | +{ | |
48355 | +#ifdef CONFIG_GRKERNSEC_LINK | |
48356 | + const struct cred *cred = current_cred(); | |
48357 | + | |
48358 | + if (grsec_enable_link && cred->fsuid != inode->i_uid && | |
48359 | + (!S_ISREG(mode) || (mode & S_ISUID) || | |
48360 | + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) || | |
48361 | + (inode_permission(inode, MAY_READ | MAY_WRITE))) && | |
48362 | + !capable(CAP_FOWNER) && cred->uid) { | |
48363 | + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to); | |
48364 | + return -EPERM; | |
48365 | + } | |
48366 | +#endif | |
48367 | + return 0; | |
48368 | +} | |
48369 | diff -urNp linux-3.0.3/grsecurity/grsec_log.c linux-3.0.3/grsecurity/grsec_log.c | |
48370 | --- linux-3.0.3/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500 | |
48371 | +++ linux-3.0.3/grsecurity/grsec_log.c 2011-08-23 21:48:14.000000000 -0400 | |
48372 | @@ -0,0 +1,310 @@ | |
48373 | +#include <linux/kernel.h> | |
48374 | +#include <linux/sched.h> | |
48375 | +#include <linux/file.h> | |
48376 | +#include <linux/tty.h> | |
48377 | +#include <linux/fs.h> | |
48378 | +#include <linux/grinternal.h> | |
48379 | + | |
48380 | +#ifdef CONFIG_TREE_PREEMPT_RCU | |
48381 | +#define DISABLE_PREEMPT() preempt_disable() | |
48382 | +#define ENABLE_PREEMPT() preempt_enable() | |
48383 | +#else | |
48384 | +#define DISABLE_PREEMPT() | |
48385 | +#define ENABLE_PREEMPT() | |
48386 | +#endif | |
48387 | + | |
48388 | +#define BEGIN_LOCKS(x) \ | |
48389 | + DISABLE_PREEMPT(); \ | |
48390 | + rcu_read_lock(); \ | |
48391 | + read_lock(&tasklist_lock); \ | |
48392 | + read_lock(&grsec_exec_file_lock); \ | |
48393 | + if (x != GR_DO_AUDIT) \ | |
48394 | + spin_lock(&grsec_alert_lock); \ | |
48395 | + else \ | |
48396 | + spin_lock(&grsec_audit_lock) | |
48397 | + | |
48398 | +#define END_LOCKS(x) \ | |
48399 | + if (x != GR_DO_AUDIT) \ | |
48400 | + spin_unlock(&grsec_alert_lock); \ | |
48401 | + else \ | |
48402 | + spin_unlock(&grsec_audit_lock); \ | |
48403 | + read_unlock(&grsec_exec_file_lock); \ | |
48404 | + read_unlock(&tasklist_lock); \ | |
48405 | + rcu_read_unlock(); \ | |
48406 | + ENABLE_PREEMPT(); \ | |
48407 | + if (x == GR_DONT_AUDIT) \ | |
48408 | + gr_handle_alertkill(current) | |
48409 | + | |
48410 | +enum { | |
48411 | + FLOODING, | |
48412 | + NO_FLOODING | |
48413 | +}; | |
48414 | + | |
48415 | +extern char *gr_alert_log_fmt; | |
48416 | +extern char *gr_audit_log_fmt; | |
48417 | +extern char *gr_alert_log_buf; | |
48418 | +extern char *gr_audit_log_buf; | |
48419 | + | |
48420 | +static int gr_log_start(int audit) | |
48421 | +{ | |
48422 | + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT; | |
48423 | + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt; | |
48424 | + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf; | |
48425 | + | |
48426 | + if (audit == GR_DO_AUDIT) | |
48427 | + goto set_fmt; | |
48428 | + | |
48429 | + if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) { | |
48430 | + grsec_alert_wtime = jiffies; | |
48431 | + grsec_alert_fyet = 0; | |
48432 | + } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) { | |
48433 | + grsec_alert_fyet++; | |
48434 | + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) { | |
48435 | + grsec_alert_wtime = jiffies; | |
48436 | + grsec_alert_fyet++; | |
48437 | + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME); | |
48438 | + return FLOODING; | |
48439 | + } else return FLOODING; | |
48440 | + | |
48441 | +set_fmt: | |
48442 | + memset(buf, 0, PAGE_SIZE); | |
48443 | + if (current->signal->curr_ip && gr_acl_is_enabled()) { | |
48444 | + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) "); | |
48445 | + snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename); | |
48446 | + } else if (current->signal->curr_ip) { | |
48447 | + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: "); | |
48448 | + snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip); | |
48449 | + } else if (gr_acl_is_enabled()) { | |
48450 | + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) "); | |
48451 | + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename); | |
48452 | + } else { | |
48453 | + sprintf(fmt, "%s%s", loglevel, "grsec: "); | |
48454 | + strcpy(buf, fmt); | |
48455 | + } | |
48456 | + | |
48457 | + return NO_FLOODING; | |
48458 | +} | |
48459 | + | |
48460 | +static void gr_log_middle(int audit, const char *msg, va_list ap) | |
48461 | + __attribute__ ((format (printf, 2, 0))); | |
48462 | + | |
48463 | +static void gr_log_middle(int audit, const char *msg, va_list ap) | |
48464 | +{ | |
48465 | + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf; | |
48466 | + unsigned int len = strlen(buf); | |
48467 | + | |
48468 | + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap); | |
48469 | + | |
48470 | + return; | |
48471 | +} | |
48472 | + | |
48473 | +static void gr_log_middle_varargs(int audit, const char *msg, ...) | |
48474 | + __attribute__ ((format (printf, 2, 3))); | |
48475 | + | |
48476 | +static void gr_log_middle_varargs(int audit, const char *msg, ...) | |
48477 | +{ | |
48478 | + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf; | |
48479 | + unsigned int len = strlen(buf); | |
48480 | + va_list ap; | |
48481 | + | |
48482 | + va_start(ap, msg); | |
48483 | + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap); | |
48484 | + va_end(ap); | |
48485 | + | |
48486 | + return; | |
48487 | +} | |
48488 | + | |
48489 | +static void gr_log_end(int audit) | |
48490 | +{ | |
48491 | + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf; | |
48492 | + unsigned int len = strlen(buf); | |
48493 | + | |
48494 | + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent))); | |
48495 | + printk("%s\n", buf); | |
48496 | + | |
48497 | + return; | |
48498 | +} | |
48499 | + | |
48500 | +void gr_log_varargs(int audit, const char *msg, int argtypes, ...) | |
48501 | +{ | |
48502 | + int logtype; | |
48503 | + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied"; | |
48504 | + char *str1 = NULL, *str2 = NULL, *str3 = NULL; | |
48505 | + void *voidptr = NULL; | |
48506 | + int num1 = 0, num2 = 0; | |
48507 | + unsigned long ulong1 = 0, ulong2 = 0; | |
48508 | + struct dentry *dentry = NULL; | |
48509 | + struct vfsmount *mnt = NULL; | |
48510 | + struct file *file = NULL; | |
48511 | + struct task_struct *task = NULL; | |
48512 | + const struct cred *cred, *pcred; | |
48513 | + va_list ap; | |
48514 | + | |
48515 | + BEGIN_LOCKS(audit); | |
48516 | + logtype = gr_log_start(audit); | |
48517 | + if (logtype == FLOODING) { | |
48518 | + END_LOCKS(audit); | |
48519 | + return; | |
48520 | + } | |
48521 | + va_start(ap, argtypes); | |
48522 | + switch (argtypes) { | |
48523 | + case GR_TTYSNIFF: | |
48524 | + task = va_arg(ap, struct task_struct *); | |
48525 | + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid); | |
48526 | + break; | |
48527 | + case GR_SYSCTL_HIDDEN: | |
48528 | + str1 = va_arg(ap, char *); | |
48529 | + gr_log_middle_varargs(audit, msg, result, str1); | |
48530 | + break; | |
48531 | + case GR_RBAC: | |
48532 | + dentry = va_arg(ap, struct dentry *); | |
48533 | + mnt = va_arg(ap, struct vfsmount *); | |
48534 | + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt)); | |
48535 | + break; | |
48536 | + case GR_RBAC_STR: | |
48537 | + dentry = va_arg(ap, struct dentry *); | |
48538 | + mnt = va_arg(ap, struct vfsmount *); | |
48539 | + str1 = va_arg(ap, char *); | |
48540 | + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1); | |
48541 | + break; | |
48542 | + case GR_STR_RBAC: | |
48543 | + str1 = va_arg(ap, char *); | |
48544 | + dentry = va_arg(ap, struct dentry *); | |
48545 | + mnt = va_arg(ap, struct vfsmount *); | |
48546 | + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt)); | |
48547 | + break; | |
48548 | + case GR_RBAC_MODE2: | |
48549 | + dentry = va_arg(ap, struct dentry *); | |
48550 | + mnt = va_arg(ap, struct vfsmount *); | |
48551 | + str1 = va_arg(ap, char *); | |
48552 | + str2 = va_arg(ap, char *); | |
48553 | + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2); | |
48554 | + break; | |
48555 | + case GR_RBAC_MODE3: | |
48556 | + dentry = va_arg(ap, struct dentry *); | |
48557 | + mnt = va_arg(ap, struct vfsmount *); | |
48558 | + str1 = va_arg(ap, char *); | |
48559 | + str2 = va_arg(ap, char *); | |
48560 | + str3 = va_arg(ap, char *); | |
48561 | + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3); | |
48562 | + break; | |
48563 | + case GR_FILENAME: | |
48564 | + dentry = va_arg(ap, struct dentry *); | |
48565 | + mnt = va_arg(ap, struct vfsmount *); | |
48566 | + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt)); | |
48567 | + break; | |
48568 | + case GR_STR_FILENAME: | |
48569 | + str1 = va_arg(ap, char *); | |
48570 | + dentry = va_arg(ap, struct dentry *); | |
48571 | + mnt = va_arg(ap, struct vfsmount *); | |
48572 | + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt)); | |
48573 | + break; | |
48574 | + case GR_FILENAME_STR: | |
48575 | + dentry = va_arg(ap, struct dentry *); | |
48576 | + mnt = va_arg(ap, struct vfsmount *); | |
48577 | + str1 = va_arg(ap, char *); | |
48578 | + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1); | |
48579 | + break; | |
48580 | + case GR_FILENAME_TWO_INT: | |
48581 | + dentry = va_arg(ap, struct dentry *); | |
48582 | + mnt = va_arg(ap, struct vfsmount *); | |
48583 | + num1 = va_arg(ap, int); | |
48584 | + num2 = va_arg(ap, int); | |
48585 | + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2); | |
48586 | + break; | |
48587 | + case GR_FILENAME_TWO_INT_STR: | |
48588 | + dentry = va_arg(ap, struct dentry *); | |
48589 | + mnt = va_arg(ap, struct vfsmount *); | |
48590 | + num1 = va_arg(ap, int); | |
48591 | + num2 = va_arg(ap, int); | |
48592 | + str1 = va_arg(ap, char *); | |
48593 | + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1); | |
48594 | + break; | |
48595 | + case GR_TEXTREL: | |
48596 | + file = va_arg(ap, struct file *); | |
48597 | + ulong1 = va_arg(ap, unsigned long); | |
48598 | + ulong2 = va_arg(ap, unsigned long); | |
48599 | + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2); | |
48600 | + break; | |
48601 | + case GR_PTRACE: | |
48602 | + task = va_arg(ap, struct task_struct *); | |
48603 | + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid); | |
48604 | + break; | |
48605 | + case GR_RESOURCE: | |
48606 | + task = va_arg(ap, struct task_struct *); | |
48607 | + cred = __task_cred(task); | |
48608 | + pcred = __task_cred(task->real_parent); | |
48609 | + ulong1 = va_arg(ap, unsigned long); | |
48610 | + str1 = va_arg(ap, char *); | |
48611 | + ulong2 = va_arg(ap, unsigned long); | |
48612 | + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid); | |
48613 | + break; | |
48614 | + case GR_CAP: | |
48615 | + task = va_arg(ap, struct task_struct *); | |
48616 | + cred = __task_cred(task); | |
48617 | + pcred = __task_cred(task->real_parent); | |
48618 | + str1 = va_arg(ap, char *); | |
48619 | + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid); | |
48620 | + break; | |
48621 | + case GR_SIG: | |
48622 | + str1 = va_arg(ap, char *); | |
48623 | + voidptr = va_arg(ap, void *); | |
48624 | + gr_log_middle_varargs(audit, msg, str1, voidptr); | |
48625 | + break; | |
48626 | + case GR_SIG2: | |
48627 | + task = va_arg(ap, struct task_struct *); | |
48628 | + cred = __task_cred(task); | |
48629 | + pcred = __task_cred(task->real_parent); | |
48630 | + num1 = va_arg(ap, int); | |
48631 | + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid); | |
48632 | + break; | |
48633 | + case GR_CRASH1: | |
48634 | + task = va_arg(ap, struct task_struct *); | |
48635 | + cred = __task_cred(task); | |
48636 | + pcred = __task_cred(task->real_parent); | |
48637 | + ulong1 = va_arg(ap, unsigned long); | |
48638 | + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1); | |
48639 | + break; | |
48640 | + case GR_CRASH2: | |
48641 | + task = va_arg(ap, struct task_struct *); | |
48642 | + cred = __task_cred(task); | |
48643 | + pcred = __task_cred(task->real_parent); | |
48644 | + ulong1 = va_arg(ap, unsigned long); | |
48645 | + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1); | |
48646 | + break; | |
48647 | + case GR_RWXMAP: | |
48648 | + file = va_arg(ap, struct file *); | |
48649 | + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>"); | |
48650 | + break; | |
48651 | + case GR_PSACCT: | |
48652 | + { | |
48653 | + unsigned int wday, cday; | |
48654 | + __u8 whr, chr; | |
48655 | + __u8 wmin, cmin; | |
48656 | + __u8 wsec, csec; | |
48657 | + char cur_tty[64] = { 0 }; | |
48658 | + char parent_tty[64] = { 0 }; | |
48659 | + | |
48660 | + task = va_arg(ap, struct task_struct *); | |
48661 | + wday = va_arg(ap, unsigned int); | |
48662 | + cday = va_arg(ap, unsigned int); | |
48663 | + whr = va_arg(ap, int); | |
48664 | + chr = va_arg(ap, int); | |
48665 | + wmin = va_arg(ap, int); | |
48666 | + cmin = va_arg(ap, int); | |
48667 | + wsec = va_arg(ap, int); | |
48668 | + csec = va_arg(ap, int); | |
48669 | + ulong1 = va_arg(ap, unsigned long); | |
48670 | + cred = __task_cred(task); | |
48671 | + pcred = __task_cred(task->real_parent); | |
48672 | + | |
48673 | + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid); | |
48674 | + } | |
48675 | + break; | |
48676 | + default: | |
48677 | + gr_log_middle(audit, msg, ap); | |
48678 | + } | |
48679 | + va_end(ap); | |
48680 | + gr_log_end(audit); | |
48681 | + END_LOCKS(audit); | |
48682 | +} | |
48683 | diff -urNp linux-3.0.3/grsecurity/grsec_mem.c linux-3.0.3/grsecurity/grsec_mem.c | |
48684 | --- linux-3.0.3/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500 | |
48685 | +++ linux-3.0.3/grsecurity/grsec_mem.c 2011-08-23 21:48:14.000000000 -0400 | |
48686 | @@ -0,0 +1,33 @@ | |
48687 | +#include <linux/kernel.h> | |
48688 | +#include <linux/sched.h> | |
48689 | +#include <linux/mm.h> | |
48690 | +#include <linux/mman.h> | |
48691 | +#include <linux/grinternal.h> | |
48692 | + | |
48693 | +void | |
48694 | +gr_handle_ioperm(void) | |
48695 | +{ | |
48696 | + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG); | |
48697 | + return; | |
48698 | +} | |
48699 | + | |
48700 | +void | |
48701 | +gr_handle_iopl(void) | |
48702 | +{ | |
48703 | + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG); | |
48704 | + return; | |
48705 | +} | |
48706 | + | |
48707 | +void | |
48708 | +gr_handle_mem_readwrite(u64 from, u64 to) | |
48709 | +{ | |
48710 | + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to); | |
48711 | + return; | |
48712 | +} | |
48713 | + | |
48714 | +void | |
48715 | +gr_handle_vm86(void) | |
48716 | +{ | |
48717 | + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG); | |
48718 | + return; | |
48719 | +} | |
48720 | diff -urNp linux-3.0.3/grsecurity/grsec_mount.c linux-3.0.3/grsecurity/grsec_mount.c | |
48721 | --- linux-3.0.3/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500 | |
48722 | +++ linux-3.0.3/grsecurity/grsec_mount.c 2011-08-23 21:48:14.000000000 -0400 | |
48723 | @@ -0,0 +1,62 @@ | |
48724 | +#include <linux/kernel.h> | |
48725 | +#include <linux/sched.h> | |
48726 | +#include <linux/mount.h> | |
48727 | +#include <linux/grsecurity.h> | |
48728 | +#include <linux/grinternal.h> | |
48729 | + | |
48730 | +void | |
48731 | +gr_log_remount(const char *devname, const int retval) | |
48732 | +{ | |
48733 | +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT | |
48734 | + if (grsec_enable_mount && (retval >= 0)) | |
48735 | + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none"); | |
48736 | +#endif | |
48737 | + return; | |
48738 | +} | |
48739 | + | |
48740 | +void | |
48741 | +gr_log_unmount(const char *devname, const int retval) | |
48742 | +{ | |
48743 | +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT | |
48744 | + if (grsec_enable_mount && (retval >= 0)) | |
48745 | + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none"); | |
48746 | +#endif | |
48747 | + return; | |
48748 | +} | |
48749 | + | |
48750 | +void | |
48751 | +gr_log_mount(const char *from, const char *to, const int retval) | |
48752 | +{ | |
48753 | +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT | |
48754 | + if (grsec_enable_mount && (retval >= 0)) | |
48755 | + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to); | |
48756 | +#endif | |
48757 | + return; | |
48758 | +} | |
48759 | + | |
48760 | +int | |
48761 | +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags) | |
48762 | +{ | |
48763 | +#ifdef CONFIG_GRKERNSEC_ROFS | |
48764 | + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) { | |
48765 | + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt); | |
48766 | + return -EPERM; | |
48767 | + } else | |
48768 | + return 0; | |
48769 | +#endif | |
48770 | + return 0; | |
48771 | +} | |
48772 | + | |
48773 | +int | |
48774 | +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode) | |
48775 | +{ | |
48776 | +#ifdef CONFIG_GRKERNSEC_ROFS | |
48777 | + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) && | |
48778 | + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) { | |
48779 | + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt); | |
48780 | + return -EPERM; | |
48781 | + } else | |
48782 | + return 0; | |
48783 | +#endif | |
48784 | + return 0; | |
48785 | +} | |
48786 | diff -urNp linux-3.0.3/grsecurity/grsec_pax.c linux-3.0.3/grsecurity/grsec_pax.c | |
48787 | --- linux-3.0.3/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500 | |
48788 | +++ linux-3.0.3/grsecurity/grsec_pax.c 2011-08-23 21:48:14.000000000 -0400 | |
48789 | @@ -0,0 +1,36 @@ | |
48790 | +#include <linux/kernel.h> | |
48791 | +#include <linux/sched.h> | |
48792 | +#include <linux/mm.h> | |
48793 | +#include <linux/file.h> | |
48794 | +#include <linux/grinternal.h> | |
48795 | +#include <linux/grsecurity.h> | |
48796 | + | |
48797 | +void | |
48798 | +gr_log_textrel(struct vm_area_struct * vma) | |
48799 | +{ | |
48800 | +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL | |
48801 | + if (grsec_enable_audit_textrel) | |
48802 | + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff); | |
48803 | +#endif | |
48804 | + return; | |
48805 | +} | |
48806 | + | |
48807 | +void | |
48808 | +gr_log_rwxmmap(struct file *file) | |
48809 | +{ | |
48810 | +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG | |
48811 | + if (grsec_enable_log_rwxmaps) | |
48812 | + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file); | |
48813 | +#endif | |
48814 | + return; | |
48815 | +} | |
48816 | + | |
48817 | +void | |
48818 | +gr_log_rwxmprotect(struct file *file) | |
48819 | +{ | |
48820 | +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG | |
48821 | + if (grsec_enable_log_rwxmaps) | |
48822 | + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file); | |
48823 | +#endif | |
48824 | + return; | |
48825 | +} | |
48826 | diff -urNp linux-3.0.3/grsecurity/grsec_ptrace.c linux-3.0.3/grsecurity/grsec_ptrace.c | |
48827 | --- linux-3.0.3/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500 | |
48828 | +++ linux-3.0.3/grsecurity/grsec_ptrace.c 2011-08-23 21:48:14.000000000 -0400 | |
48829 | @@ -0,0 +1,14 @@ | |
48830 | +#include <linux/kernel.h> | |
48831 | +#include <linux/sched.h> | |
48832 | +#include <linux/grinternal.h> | |
48833 | +#include <linux/grsecurity.h> | |
48834 | + | |
48835 | +void | |
48836 | +gr_audit_ptrace(struct task_struct *task) | |
48837 | +{ | |
48838 | +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE | |
48839 | + if (grsec_enable_audit_ptrace) | |
48840 | + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task); | |
48841 | +#endif | |
48842 | + return; | |
48843 | +} | |
48844 | diff -urNp linux-3.0.3/grsecurity/grsec_sig.c linux-3.0.3/grsecurity/grsec_sig.c | |
48845 | --- linux-3.0.3/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500 | |
48846 | +++ linux-3.0.3/grsecurity/grsec_sig.c 2011-08-23 21:48:14.000000000 -0400 | |
48847 | @@ -0,0 +1,206 @@ | |
48848 | +#include <linux/kernel.h> | |
48849 | +#include <linux/sched.h> | |
48850 | +#include <linux/delay.h> | |
48851 | +#include <linux/grsecurity.h> | |
48852 | +#include <linux/grinternal.h> | |
48853 | +#include <linux/hardirq.h> | |
48854 | + | |
48855 | +char *signames[] = { | |
48856 | + [SIGSEGV] = "Segmentation fault", | |
48857 | + [SIGILL] = "Illegal instruction", | |
48858 | + [SIGABRT] = "Abort", | |
48859 | + [SIGBUS] = "Invalid alignment/Bus error" | |
48860 | +}; | |
48861 | + | |
48862 | +void | |
48863 | +gr_log_signal(const int sig, const void *addr, const struct task_struct *t) | |
48864 | +{ | |
48865 | +#ifdef CONFIG_GRKERNSEC_SIGNAL | |
48866 | + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) || | |
48867 | + (sig == SIGABRT) || (sig == SIGBUS))) { | |
48868 | + if (t->pid == current->pid) { | |
48869 | + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr); | |
48870 | + } else { | |
48871 | + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig); | |
48872 | + } | |
48873 | + } | |
48874 | +#endif | |
48875 | + return; | |
48876 | +} | |
48877 | + | |
48878 | +int | |
48879 | +gr_handle_signal(const struct task_struct *p, const int sig) | |
48880 | +{ | |
48881 | +#ifdef CONFIG_GRKERNSEC | |
48882 | + if (current->pid > 1 && gr_check_protected_task(p)) { | |
48883 | + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig); | |
48884 | + return -EPERM; | |
48885 | + } else if (gr_pid_is_chrooted((struct task_struct *)p)) { | |
48886 | + return -EPERM; | |
48887 | + } | |
48888 | +#endif | |
48889 | + return 0; | |
48890 | +} | |
48891 | + | |
48892 | +#ifdef CONFIG_GRKERNSEC | |
48893 | +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t); | |
48894 | + | |
48895 | +int gr_fake_force_sig(int sig, struct task_struct *t) | |
48896 | +{ | |
48897 | + unsigned long int flags; | |
48898 | + int ret, blocked, ignored; | |
48899 | + struct k_sigaction *action; | |
48900 | + | |
48901 | + spin_lock_irqsave(&t->sighand->siglock, flags); | |
48902 | + action = &t->sighand->action[sig-1]; | |
48903 | + ignored = action->sa.sa_handler == SIG_IGN; | |
48904 | + blocked = sigismember(&t->blocked, sig); | |
48905 | + if (blocked || ignored) { | |
48906 | + action->sa.sa_handler = SIG_DFL; | |
48907 | + if (blocked) { | |
48908 | + sigdelset(&t->blocked, sig); | |
48909 | + recalc_sigpending_and_wake(t); | |
48910 | + } | |
48911 | + } | |
48912 | + if (action->sa.sa_handler == SIG_DFL) | |
48913 | + t->signal->flags &= ~SIGNAL_UNKILLABLE; | |
48914 | + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t); | |
48915 | + | |
48916 | + spin_unlock_irqrestore(&t->sighand->siglock, flags); | |
48917 | + | |
48918 | + return ret; | |
48919 | +} | |
48920 | +#endif | |
48921 | + | |
48922 | +#ifdef CONFIG_GRKERNSEC_BRUTE | |
48923 | +#define GR_USER_BAN_TIME (15 * 60) | |
48924 | + | |
48925 | +static int __get_dumpable(unsigned long mm_flags) | |
48926 | +{ | |
48927 | + int ret; | |
48928 | + | |
48929 | + ret = mm_flags & MMF_DUMPABLE_MASK; | |
48930 | + return (ret >= 2) ? 2 : ret; | |
48931 | +} | |
48932 | +#endif | |
48933 | + | |
48934 | +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags) | |
48935 | +{ | |
48936 | +#ifdef CONFIG_GRKERNSEC_BRUTE | |
48937 | + uid_t uid = 0; | |
48938 | + | |
48939 | + if (!grsec_enable_brute) | |
48940 | + return; | |
48941 | + | |
48942 | + rcu_read_lock(); | |
48943 | + read_lock(&tasklist_lock); | |
48944 | + read_lock(&grsec_exec_file_lock); | |
48945 | + if (p->real_parent && p->real_parent->exec_file == p->exec_file) | |
48946 | + p->real_parent->brute = 1; | |
48947 | + else { | |
48948 | + const struct cred *cred = __task_cred(p), *cred2; | |
48949 | + struct task_struct *tsk, *tsk2; | |
48950 | + | |
48951 | + if (!__get_dumpable(mm_flags) && cred->uid) { | |
48952 | + struct user_struct *user; | |
48953 | + | |
48954 | + uid = cred->uid; | |
48955 | + | |
48956 | + /* this is put upon execution past expiration */ | |
48957 | + user = find_user(uid); | |
48958 | + if (user == NULL) | |
48959 | + goto unlock; | |
48960 | + user->banned = 1; | |
48961 | + user->ban_expires = get_seconds() + GR_USER_BAN_TIME; | |
48962 | + if (user->ban_expires == ~0UL) | |
48963 | + user->ban_expires--; | |
48964 | + | |
48965 | + do_each_thread(tsk2, tsk) { | |
48966 | + cred2 = __task_cred(tsk); | |
48967 | + if (tsk != p && cred2->uid == uid) | |
48968 | + gr_fake_force_sig(SIGKILL, tsk); | |
48969 | + } while_each_thread(tsk2, tsk); | |
48970 | + } | |
48971 | + } | |
48972 | +unlock: | |
48973 | + read_unlock(&grsec_exec_file_lock); | |
48974 | + read_unlock(&tasklist_lock); | |
48975 | + rcu_read_unlock(); | |
48976 | + | |
48977 | + if (uid) | |
48978 | + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60); | |
48979 | + | |
48980 | +#endif | |
48981 | + return; | |
48982 | +} | |
48983 | + | |
48984 | +void gr_handle_brute_check(void) | |
48985 | +{ | |
48986 | +#ifdef CONFIG_GRKERNSEC_BRUTE | |
48987 | + if (current->brute) | |
48988 | + msleep(30 * 1000); | |
48989 | +#endif | |
48990 | + return; | |
48991 | +} | |
48992 | + | |
48993 | +void gr_handle_kernel_exploit(void) | |
48994 | +{ | |
48995 | +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT | |
48996 | + const struct cred *cred; | |
48997 | + struct task_struct *tsk, *tsk2; | |
48998 | + struct user_struct *user; | |
48999 | + uid_t uid; | |
49000 | + | |
49001 | + if (in_irq() || in_serving_softirq() || in_nmi()) | |
49002 | + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context"); | |
49003 | + | |
49004 | + uid = current_uid(); | |
49005 | + | |
49006 | + if (uid == 0) | |
49007 | + panic("grsec: halting the system due to suspicious kernel crash caused by root"); | |
49008 | + else { | |
49009 | + /* kill all the processes of this user, hold a reference | |
49010 | + to their creds struct, and prevent them from creating | |
49011 | + another process until system reset | |
49012 | + */ | |
49013 | + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid); | |
49014 | + /* we intentionally leak this ref */ | |
49015 | + user = get_uid(current->cred->user); | |
49016 | + if (user) { | |
49017 | + user->banned = 1; | |
49018 | + user->ban_expires = ~0UL; | |
49019 | + } | |
49020 | + | |
49021 | + read_lock(&tasklist_lock); | |
49022 | + do_each_thread(tsk2, tsk) { | |
49023 | + cred = __task_cred(tsk); | |
49024 | + if (cred->uid == uid) | |
49025 | + gr_fake_force_sig(SIGKILL, tsk); | |
49026 | + } while_each_thread(tsk2, tsk); | |
49027 | + read_unlock(&tasklist_lock); | |
49028 | + } | |
49029 | +#endif | |
49030 | +} | |
49031 | + | |
49032 | +int __gr_process_user_ban(struct user_struct *user) | |
49033 | +{ | |
49034 | +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) | |
49035 | + if (unlikely(user->banned)) { | |
49036 | + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) { | |
49037 | + user->banned = 0; | |
49038 | + user->ban_expires = 0; | |
49039 | + free_uid(user); | |
49040 | + } else | |
49041 | + return -EPERM; | |
49042 | + } | |
49043 | +#endif | |
49044 | + return 0; | |
49045 | +} | |
49046 | + | |
49047 | +int gr_process_user_ban(void) | |
49048 | +{ | |
49049 | +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) | |
49050 | + return __gr_process_user_ban(current->cred->user); | |
49051 | +#endif | |
49052 | + return 0; | |
49053 | +} | |
49054 | diff -urNp linux-3.0.3/grsecurity/grsec_sock.c linux-3.0.3/grsecurity/grsec_sock.c | |
49055 | --- linux-3.0.3/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500 | |
49056 | +++ linux-3.0.3/grsecurity/grsec_sock.c 2011-08-23 21:48:14.000000000 -0400 | |
49057 | @@ -0,0 +1,244 @@ | |
49058 | +#include <linux/kernel.h> | |
49059 | +#include <linux/module.h> | |
49060 | +#include <linux/sched.h> | |
49061 | +#include <linux/file.h> | |
49062 | +#include <linux/net.h> | |
49063 | +#include <linux/in.h> | |
49064 | +#include <linux/ip.h> | |
49065 | +#include <net/sock.h> | |
49066 | +#include <net/inet_sock.h> | |
49067 | +#include <linux/grsecurity.h> | |
49068 | +#include <linux/grinternal.h> | |
49069 | +#include <linux/gracl.h> | |
49070 | + | |
49071 | +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb); | |
49072 | +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr); | |
49073 | + | |
49074 | +EXPORT_SYMBOL(gr_search_udp_recvmsg); | |
49075 | +EXPORT_SYMBOL(gr_search_udp_sendmsg); | |
49076 | + | |
49077 | +#ifdef CONFIG_UNIX_MODULE | |
49078 | +EXPORT_SYMBOL(gr_acl_handle_unix); | |
49079 | +EXPORT_SYMBOL(gr_acl_handle_mknod); | |
49080 | +EXPORT_SYMBOL(gr_handle_chroot_unix); | |
49081 | +EXPORT_SYMBOL(gr_handle_create); | |
49082 | +#endif | |
49083 | + | |
49084 | +#ifdef CONFIG_GRKERNSEC | |
49085 | +#define gr_conn_table_size 32749 | |
49086 | +struct conn_table_entry { | |
49087 | + struct conn_table_entry *next; | |
49088 | + struct signal_struct *sig; | |
49089 | +}; | |
49090 | + | |
49091 | +struct conn_table_entry *gr_conn_table[gr_conn_table_size]; | |
49092 | +DEFINE_SPINLOCK(gr_conn_table_lock); | |
49093 | + | |
49094 | +extern const char * gr_socktype_to_name(unsigned char type); | |
49095 | +extern const char * gr_proto_to_name(unsigned char proto); | |
49096 | +extern const char * gr_sockfamily_to_name(unsigned char family); | |
49097 | + | |
49098 | +static __inline__ int | |
49099 | +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size) | |
49100 | +{ | |
49101 | + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size); | |
49102 | +} | |
49103 | + | |
49104 | +static __inline__ int | |
49105 | +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, | |
49106 | + __u16 sport, __u16 dport) | |
49107 | +{ | |
49108 | + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr && | |
49109 | + sig->gr_sport == sport && sig->gr_dport == dport)) | |
49110 | + return 1; | |
49111 | + else | |
49112 | + return 0; | |
49113 | +} | |
49114 | + | |
49115 | +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent) | |
49116 | +{ | |
49117 | + struct conn_table_entry **match; | |
49118 | + unsigned int index; | |
49119 | + | |
49120 | + index = conn_hash(sig->gr_saddr, sig->gr_daddr, | |
49121 | + sig->gr_sport, sig->gr_dport, | |
49122 | + gr_conn_table_size); | |
49123 | + | |
49124 | + newent->sig = sig; | |
49125 | + | |
49126 | + match = &gr_conn_table[index]; | |
49127 | + newent->next = *match; | |
49128 | + *match = newent; | |
49129 | + | |
49130 | + return; | |
49131 | +} | |
49132 | + | |
49133 | +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig) | |
49134 | +{ | |
49135 | + struct conn_table_entry *match, *last = NULL; | |
49136 | + unsigned int index; | |
49137 | + | |
49138 | + index = conn_hash(sig->gr_saddr, sig->gr_daddr, | |
49139 | + sig->gr_sport, sig->gr_dport, | |
49140 | + gr_conn_table_size); | |
49141 | + | |
49142 | + match = gr_conn_table[index]; | |
49143 | + while (match && !conn_match(match->sig, | |
49144 | + sig->gr_saddr, sig->gr_daddr, sig->gr_sport, | |
49145 | + sig->gr_dport)) { | |
49146 | + last = match; | |
49147 | + match = match->next; | |
49148 | + } | |
49149 | + | |
49150 | + if (match) { | |
49151 | + if (last) | |
49152 | + last->next = match->next; | |
49153 | + else | |
49154 | + gr_conn_table[index] = NULL; | |
49155 | + kfree(match); | |
49156 | + } | |
49157 | + | |
49158 | + return; | |
49159 | +} | |
49160 | + | |
49161 | +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr, | |
49162 | + __u16 sport, __u16 dport) | |
49163 | +{ | |
49164 | + struct conn_table_entry *match; | |
49165 | + unsigned int index; | |
49166 | + | |
49167 | + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size); | |
49168 | + | |
49169 | + match = gr_conn_table[index]; | |
49170 | + while (match && !conn_match(match->sig, saddr, daddr, sport, dport)) | |
49171 | + match = match->next; | |
49172 | + | |
49173 | + if (match) | |
49174 | + return match->sig; | |
49175 | + else | |
49176 | + return NULL; | |
49177 | +} | |
49178 | + | |
49179 | +#endif | |
49180 | + | |
49181 | +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet) | |
49182 | +{ | |
49183 | +#ifdef CONFIG_GRKERNSEC | |
49184 | + struct signal_struct *sig = task->signal; | |
49185 | + struct conn_table_entry *newent; | |
49186 | + | |
49187 | + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC); | |
49188 | + if (newent == NULL) | |
49189 | + return; | |
49190 | + /* no bh lock needed since we are called with bh disabled */ | |
49191 | + spin_lock(&gr_conn_table_lock); | |
49192 | + gr_del_task_from_ip_table_nolock(sig); | |
49193 | + sig->gr_saddr = inet->inet_rcv_saddr; | |
49194 | + sig->gr_daddr = inet->inet_daddr; | |
49195 | + sig->gr_sport = inet->inet_sport; | |
49196 | + sig->gr_dport = inet->inet_dport; | |
49197 | + gr_add_to_task_ip_table_nolock(sig, newent); | |
49198 | + spin_unlock(&gr_conn_table_lock); | |
49199 | +#endif | |
49200 | + return; | |
49201 | +} | |
49202 | + | |
49203 | +void gr_del_task_from_ip_table(struct task_struct *task) | |
49204 | +{ | |
49205 | +#ifdef CONFIG_GRKERNSEC | |
49206 | + spin_lock_bh(&gr_conn_table_lock); | |
49207 | + gr_del_task_from_ip_table_nolock(task->signal); | |
49208 | + spin_unlock_bh(&gr_conn_table_lock); | |
49209 | +#endif | |
49210 | + return; | |
49211 | +} | |
49212 | + | |
49213 | +void | |
49214 | +gr_attach_curr_ip(const struct sock *sk) | |
49215 | +{ | |
49216 | +#ifdef CONFIG_GRKERNSEC | |
49217 | + struct signal_struct *p, *set; | |
49218 | + const struct inet_sock *inet = inet_sk(sk); | |
49219 | + | |
49220 | + if (unlikely(sk->sk_protocol != IPPROTO_TCP)) | |
49221 | + return; | |
49222 | + | |
49223 | + set = current->signal; | |
49224 | + | |
49225 | + spin_lock_bh(&gr_conn_table_lock); | |
49226 | + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr, | |
49227 | + inet->inet_dport, inet->inet_sport); | |
49228 | + if (unlikely(p != NULL)) { | |
49229 | + set->curr_ip = p->curr_ip; | |
49230 | + set->used_accept = 1; | |
49231 | + gr_del_task_from_ip_table_nolock(p); | |
49232 | + spin_unlock_bh(&gr_conn_table_lock); | |
49233 | + return; | |
49234 | + } | |
49235 | + spin_unlock_bh(&gr_conn_table_lock); | |
49236 | + | |
49237 | + set->curr_ip = inet->inet_daddr; | |
49238 | + set->used_accept = 1; | |
49239 | +#endif | |
49240 | + return; | |
49241 | +} | |
49242 | + | |
49243 | +int | |
49244 | +gr_handle_sock_all(const int family, const int type, const int protocol) | |
49245 | +{ | |
49246 | +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL | |
49247 | + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) && | |
49248 | + (family != AF_UNIX)) { | |
49249 | + if (family == AF_INET) | |
49250 | + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol)); | |
49251 | + else | |
49252 | + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol); | |
49253 | + return -EACCES; | |
49254 | + } | |
49255 | +#endif | |
49256 | + return 0; | |
49257 | +} | |
49258 | + | |
49259 | +int | |
49260 | +gr_handle_sock_server(const struct sockaddr *sck) | |
49261 | +{ | |
49262 | +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER | |
49263 | + if (grsec_enable_socket_server && | |
49264 | + in_group_p(grsec_socket_server_gid) && | |
49265 | + sck && (sck->sa_family != AF_UNIX) && | |
49266 | + (sck->sa_family != AF_LOCAL)) { | |
49267 | + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG); | |
49268 | + return -EACCES; | |
49269 | + } | |
49270 | +#endif | |
49271 | + return 0; | |
49272 | +} | |
49273 | + | |
49274 | +int | |
49275 | +gr_handle_sock_server_other(const struct sock *sck) | |
49276 | +{ | |
49277 | +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER | |
49278 | + if (grsec_enable_socket_server && | |
49279 | + in_group_p(grsec_socket_server_gid) && | |
49280 | + sck && (sck->sk_family != AF_UNIX) && | |
49281 | + (sck->sk_family != AF_LOCAL)) { | |
49282 | + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG); | |
49283 | + return -EACCES; | |
49284 | + } | |
49285 | +#endif | |
49286 | + return 0; | |
49287 | +} | |
49288 | + | |
49289 | +int | |
49290 | +gr_handle_sock_client(const struct sockaddr *sck) | |
49291 | +{ | |
49292 | +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT | |
49293 | + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) && | |
49294 | + sck && (sck->sa_family != AF_UNIX) && | |
49295 | + (sck->sa_family != AF_LOCAL)) { | |
49296 | + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG); | |
49297 | + return -EACCES; | |
49298 | + } | |
49299 | +#endif | |
49300 | + return 0; | |
49301 | +} | |
49302 | diff -urNp linux-3.0.3/grsecurity/grsec_sysctl.c linux-3.0.3/grsecurity/grsec_sysctl.c | |
49303 | --- linux-3.0.3/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500 | |
49304 | +++ linux-3.0.3/grsecurity/grsec_sysctl.c 2011-08-25 17:26:15.000000000 -0400 | |
49305 | @@ -0,0 +1,433 @@ | |
49306 | +#include <linux/kernel.h> | |
49307 | +#include <linux/sched.h> | |
49308 | +#include <linux/sysctl.h> | |
49309 | +#include <linux/grsecurity.h> | |
49310 | +#include <linux/grinternal.h> | |
49311 | + | |
49312 | +int | |
49313 | +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op) | |
49314 | +{ | |
49315 | +#ifdef CONFIG_GRKERNSEC_SYSCTL | |
49316 | + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) { | |
49317 | + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name); | |
49318 | + return -EACCES; | |
49319 | + } | |
49320 | +#endif | |
49321 | + return 0; | |
49322 | +} | |
49323 | + | |
49324 | +#ifdef CONFIG_GRKERNSEC_ROFS | |
49325 | +static int __maybe_unused one = 1; | |
49326 | +#endif | |
49327 | + | |
49328 | +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS) | |
49329 | +struct ctl_table grsecurity_table[] = { | |
49330 | +#ifdef CONFIG_GRKERNSEC_SYSCTL | |
49331 | +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO | |
49332 | +#ifdef CONFIG_GRKERNSEC_IO | |
49333 | + { | |
49334 | + .procname = "disable_priv_io", | |
49335 | + .data = &grsec_disable_privio, | |
49336 | + .maxlen = sizeof(int), | |
49337 | + .mode = 0600, | |
49338 | + .proc_handler = &proc_dointvec, | |
49339 | + }, | |
49340 | +#endif | |
49341 | +#endif | |
49342 | +#ifdef CONFIG_GRKERNSEC_LINK | |
49343 | + { | |
49344 | + .procname = "linking_restrictions", | |
49345 | + .data = &grsec_enable_link, | |
49346 | + .maxlen = sizeof(int), | |
49347 | + .mode = 0600, | |
49348 | + .proc_handler = &proc_dointvec, | |
49349 | + }, | |
49350 | +#endif | |
49351 | +#ifdef CONFIG_GRKERNSEC_BRUTE | |
49352 | + { | |
49353 | + .procname = "deter_bruteforce", | |
49354 | + .data = &grsec_enable_brute, | |
49355 | + .maxlen = sizeof(int), | |
49356 | + .mode = 0600, | |
49357 | + .proc_handler = &proc_dointvec, | |
49358 | + }, | |
49359 | +#endif | |
49360 | +#ifdef CONFIG_GRKERNSEC_FIFO | |
49361 | + { | |
49362 | + .procname = "fifo_restrictions", | |
49363 | + .data = &grsec_enable_fifo, | |
49364 | + .maxlen = sizeof(int), | |
49365 | + .mode = 0600, | |
49366 | + .proc_handler = &proc_dointvec, | |
49367 | + }, | |
49368 | +#endif | |
49369 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
49370 | + { | |
49371 | + .procname = "ip_blackhole", | |
49372 | + .data = &grsec_enable_blackhole, | |
49373 | + .maxlen = sizeof(int), | |
49374 | + .mode = 0600, | |
49375 | + .proc_handler = &proc_dointvec, | |
49376 | + }, | |
49377 | + { | |
49378 | + .procname = "lastack_retries", | |
49379 | + .data = &grsec_lastack_retries, | |
49380 | + .maxlen = sizeof(int), | |
49381 | + .mode = 0600, | |
49382 | + .proc_handler = &proc_dointvec, | |
49383 | + }, | |
49384 | +#endif | |
49385 | +#ifdef CONFIG_GRKERNSEC_EXECLOG | |
49386 | + { | |
49387 | + .procname = "exec_logging", | |
49388 | + .data = &grsec_enable_execlog, | |
49389 | + .maxlen = sizeof(int), | |
49390 | + .mode = 0600, | |
49391 | + .proc_handler = &proc_dointvec, | |
49392 | + }, | |
49393 | +#endif | |
49394 | +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG | |
49395 | + { | |
49396 | + .procname = "rwxmap_logging", | |
49397 | + .data = &grsec_enable_log_rwxmaps, | |
49398 | + .maxlen = sizeof(int), | |
49399 | + .mode = 0600, | |
49400 | + .proc_handler = &proc_dointvec, | |
49401 | + }, | |
49402 | +#endif | |
49403 | +#ifdef CONFIG_GRKERNSEC_SIGNAL | |
49404 | + { | |
49405 | + .procname = "signal_logging", | |
49406 | + .data = &grsec_enable_signal, | |
49407 | + .maxlen = sizeof(int), | |
49408 | + .mode = 0600, | |
49409 | + .proc_handler = &proc_dointvec, | |
49410 | + }, | |
49411 | +#endif | |
49412 | +#ifdef CONFIG_GRKERNSEC_FORKFAIL | |
49413 | + { | |
49414 | + .procname = "forkfail_logging", | |
49415 | + .data = &grsec_enable_forkfail, | |
49416 | + .maxlen = sizeof(int), | |
49417 | + .mode = 0600, | |
49418 | + .proc_handler = &proc_dointvec, | |
49419 | + }, | |
49420 | +#endif | |
49421 | +#ifdef CONFIG_GRKERNSEC_TIME | |
49422 | + { | |
49423 | + .procname = "timechange_logging", | |
49424 | + .data = &grsec_enable_time, | |
49425 | + .maxlen = sizeof(int), | |
49426 | + .mode = 0600, | |
49427 | + .proc_handler = &proc_dointvec, | |
49428 | + }, | |
49429 | +#endif | |
49430 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT | |
49431 | + { | |
49432 | + .procname = "chroot_deny_shmat", | |
49433 | + .data = &grsec_enable_chroot_shmat, | |
49434 | + .maxlen = sizeof(int), | |
49435 | + .mode = 0600, | |
49436 | + .proc_handler = &proc_dointvec, | |
49437 | + }, | |
49438 | +#endif | |
49439 | +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX | |
49440 | + { | |
49441 | + .procname = "chroot_deny_unix", | |
49442 | + .data = &grsec_enable_chroot_unix, | |
49443 | + .maxlen = sizeof(int), | |
49444 | + .mode = 0600, | |
49445 | + .proc_handler = &proc_dointvec, | |
49446 | + }, | |
49447 | +#endif | |
49448 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT | |
49449 | + { | |
49450 | + .procname = "chroot_deny_mount", | |
49451 | + .data = &grsec_enable_chroot_mount, | |
49452 | + .maxlen = sizeof(int), | |
49453 | + .mode = 0600, | |
49454 | + .proc_handler = &proc_dointvec, | |
49455 | + }, | |
49456 | +#endif | |
49457 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR | |
49458 | + { | |
49459 | + .procname = "chroot_deny_fchdir", | |
49460 | + .data = &grsec_enable_chroot_fchdir, | |
49461 | + .maxlen = sizeof(int), | |
49462 | + .mode = 0600, | |
49463 | + .proc_handler = &proc_dointvec, | |
49464 | + }, | |
49465 | +#endif | |
49466 | +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE | |
49467 | + { | |
49468 | + .procname = "chroot_deny_chroot", | |
49469 | + .data = &grsec_enable_chroot_double, | |
49470 | + .maxlen = sizeof(int), | |
49471 | + .mode = 0600, | |
49472 | + .proc_handler = &proc_dointvec, | |
49473 | + }, | |
49474 | +#endif | |
49475 | +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT | |
49476 | + { | |
49477 | + .procname = "chroot_deny_pivot", | |
49478 | + .data = &grsec_enable_chroot_pivot, | |
49479 | + .maxlen = sizeof(int), | |
49480 | + .mode = 0600, | |
49481 | + .proc_handler = &proc_dointvec, | |
49482 | + }, | |
49483 | +#endif | |
49484 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR | |
49485 | + { | |
49486 | + .procname = "chroot_enforce_chdir", | |
49487 | + .data = &grsec_enable_chroot_chdir, | |
49488 | + .maxlen = sizeof(int), | |
49489 | + .mode = 0600, | |
49490 | + .proc_handler = &proc_dointvec, | |
49491 | + }, | |
49492 | +#endif | |
49493 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD | |
49494 | + { | |
49495 | + .procname = "chroot_deny_chmod", | |
49496 | + .data = &grsec_enable_chroot_chmod, | |
49497 | + .maxlen = sizeof(int), | |
49498 | + .mode = 0600, | |
49499 | + .proc_handler = &proc_dointvec, | |
49500 | + }, | |
49501 | +#endif | |
49502 | +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD | |
49503 | + { | |
49504 | + .procname = "chroot_deny_mknod", | |
49505 | + .data = &grsec_enable_chroot_mknod, | |
49506 | + .maxlen = sizeof(int), | |
49507 | + .mode = 0600, | |
49508 | + .proc_handler = &proc_dointvec, | |
49509 | + }, | |
49510 | +#endif | |
49511 | +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE | |
49512 | + { | |
49513 | + .procname = "chroot_restrict_nice", | |
49514 | + .data = &grsec_enable_chroot_nice, | |
49515 | + .maxlen = sizeof(int), | |
49516 | + .mode = 0600, | |
49517 | + .proc_handler = &proc_dointvec, | |
49518 | + }, | |
49519 | +#endif | |
49520 | +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG | |
49521 | + { | |
49522 | + .procname = "chroot_execlog", | |
49523 | + .data = &grsec_enable_chroot_execlog, | |
49524 | + .maxlen = sizeof(int), | |
49525 | + .mode = 0600, | |
49526 | + .proc_handler = &proc_dointvec, | |
49527 | + }, | |
49528 | +#endif | |
49529 | +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS | |
49530 | + { | |
49531 | + .procname = "chroot_caps", | |
49532 | + .data = &grsec_enable_chroot_caps, | |
49533 | + .maxlen = sizeof(int), | |
49534 | + .mode = 0600, | |
49535 | + .proc_handler = &proc_dointvec, | |
49536 | + }, | |
49537 | +#endif | |
49538 | +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL | |
49539 | + { | |
49540 | + .procname = "chroot_deny_sysctl", | |
49541 | + .data = &grsec_enable_chroot_sysctl, | |
49542 | + .maxlen = sizeof(int), | |
49543 | + .mode = 0600, | |
49544 | + .proc_handler = &proc_dointvec, | |
49545 | + }, | |
49546 | +#endif | |
49547 | +#ifdef CONFIG_GRKERNSEC_TPE | |
49548 | + { | |
49549 | + .procname = "tpe", | |
49550 | + .data = &grsec_enable_tpe, | |
49551 | + .maxlen = sizeof(int), | |
49552 | + .mode = 0600, | |
49553 | + .proc_handler = &proc_dointvec, | |
49554 | + }, | |
49555 | + { | |
49556 | + .procname = "tpe_gid", | |
49557 | + .data = &grsec_tpe_gid, | |
49558 | + .maxlen = sizeof(int), | |
49559 | + .mode = 0600, | |
49560 | + .proc_handler = &proc_dointvec, | |
49561 | + }, | |
49562 | +#endif | |
49563 | +#ifdef CONFIG_GRKERNSEC_TPE_INVERT | |
49564 | + { | |
49565 | + .procname = "tpe_invert", | |
49566 | + .data = &grsec_enable_tpe_invert, | |
49567 | + .maxlen = sizeof(int), | |
49568 | + .mode = 0600, | |
49569 | + .proc_handler = &proc_dointvec, | |
49570 | + }, | |
49571 | +#endif | |
49572 | +#ifdef CONFIG_GRKERNSEC_TPE_ALL | |
49573 | + { | |
49574 | + .procname = "tpe_restrict_all", | |
49575 | + .data = &grsec_enable_tpe_all, | |
49576 | + .maxlen = sizeof(int), | |
49577 | + .mode = 0600, | |
49578 | + .proc_handler = &proc_dointvec, | |
49579 | + }, | |
49580 | +#endif | |
49581 | +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL | |
49582 | + { | |
49583 | + .procname = "socket_all", | |
49584 | + .data = &grsec_enable_socket_all, | |
49585 | + .maxlen = sizeof(int), | |
49586 | + .mode = 0600, | |
49587 | + .proc_handler = &proc_dointvec, | |
49588 | + }, | |
49589 | + { | |
49590 | + .procname = "socket_all_gid", | |
49591 | + .data = &grsec_socket_all_gid, | |
49592 | + .maxlen = sizeof(int), | |
49593 | + .mode = 0600, | |
49594 | + .proc_handler = &proc_dointvec, | |
49595 | + }, | |
49596 | +#endif | |
49597 | +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT | |
49598 | + { | |
49599 | + .procname = "socket_client", | |
49600 | + .data = &grsec_enable_socket_client, | |
49601 | + .maxlen = sizeof(int), | |
49602 | + .mode = 0600, | |
49603 | + .proc_handler = &proc_dointvec, | |
49604 | + }, | |
49605 | + { | |
49606 | + .procname = "socket_client_gid", | |
49607 | + .data = &grsec_socket_client_gid, | |
49608 | + .maxlen = sizeof(int), | |
49609 | + .mode = 0600, | |
49610 | + .proc_handler = &proc_dointvec, | |
49611 | + }, | |
49612 | +#endif | |
49613 | +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER | |
49614 | + { | |
49615 | + .procname = "socket_server", | |
49616 | + .data = &grsec_enable_socket_server, | |
49617 | + .maxlen = sizeof(int), | |
49618 | + .mode = 0600, | |
49619 | + .proc_handler = &proc_dointvec, | |
49620 | + }, | |
49621 | + { | |
49622 | + .procname = "socket_server_gid", | |
49623 | + .data = &grsec_socket_server_gid, | |
49624 | + .maxlen = sizeof(int), | |
49625 | + .mode = 0600, | |
49626 | + .proc_handler = &proc_dointvec, | |
49627 | + }, | |
49628 | +#endif | |
49629 | +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP | |
49630 | + { | |
49631 | + .procname = "audit_group", | |
49632 | + .data = &grsec_enable_group, | |
49633 | + .maxlen = sizeof(int), | |
49634 | + .mode = 0600, | |
49635 | + .proc_handler = &proc_dointvec, | |
49636 | + }, | |
49637 | + { | |
49638 | + .procname = "audit_gid", | |
49639 | + .data = &grsec_audit_gid, | |
49640 | + .maxlen = sizeof(int), | |
49641 | + .mode = 0600, | |
49642 | + .proc_handler = &proc_dointvec, | |
49643 | + }, | |
49644 | +#endif | |
49645 | +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR | |
49646 | + { | |
49647 | + .procname = "audit_chdir", | |
49648 | + .data = &grsec_enable_chdir, | |
49649 | + .maxlen = sizeof(int), | |
49650 | + .mode = 0600, | |
49651 | + .proc_handler = &proc_dointvec, | |
49652 | + }, | |
49653 | +#endif | |
49654 | +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT | |
49655 | + { | |
49656 | + .procname = "audit_mount", | |
49657 | + .data = &grsec_enable_mount, | |
49658 | + .maxlen = sizeof(int), | |
49659 | + .mode = 0600, | |
49660 | + .proc_handler = &proc_dointvec, | |
49661 | + }, | |
49662 | +#endif | |
49663 | +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL | |
49664 | + { | |
49665 | + .procname = "audit_textrel", | |
49666 | + .data = &grsec_enable_audit_textrel, | |
49667 | + .maxlen = sizeof(int), | |
49668 | + .mode = 0600, | |
49669 | + .proc_handler = &proc_dointvec, | |
49670 | + }, | |
49671 | +#endif | |
49672 | +#ifdef CONFIG_GRKERNSEC_DMESG | |
49673 | + { | |
49674 | + .procname = "dmesg", | |
49675 | + .data = &grsec_enable_dmesg, | |
49676 | + .maxlen = sizeof(int), | |
49677 | + .mode = 0600, | |
49678 | + .proc_handler = &proc_dointvec, | |
49679 | + }, | |
49680 | +#endif | |
49681 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
49682 | + { | |
49683 | + .procname = "chroot_findtask", | |
49684 | + .data = &grsec_enable_chroot_findtask, | |
49685 | + .maxlen = sizeof(int), | |
49686 | + .mode = 0600, | |
49687 | + .proc_handler = &proc_dointvec, | |
49688 | + }, | |
49689 | +#endif | |
49690 | +#ifdef CONFIG_GRKERNSEC_RESLOG | |
49691 | + { | |
49692 | + .procname = "resource_logging", | |
49693 | + .data = &grsec_resource_logging, | |
49694 | + .maxlen = sizeof(int), | |
49695 | + .mode = 0600, | |
49696 | + .proc_handler = &proc_dointvec, | |
49697 | + }, | |
49698 | +#endif | |
49699 | +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE | |
49700 | + { | |
49701 | + .procname = "audit_ptrace", | |
49702 | + .data = &grsec_enable_audit_ptrace, | |
49703 | + .maxlen = sizeof(int), | |
49704 | + .mode = 0600, | |
49705 | + .proc_handler = &proc_dointvec, | |
49706 | + }, | |
49707 | +#endif | |
49708 | +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE | |
49709 | + { | |
49710 | + .procname = "harden_ptrace", | |
49711 | + .data = &grsec_enable_harden_ptrace, | |
49712 | + .maxlen = sizeof(int), | |
49713 | + .mode = 0600, | |
49714 | + .proc_handler = &proc_dointvec, | |
49715 | + }, | |
49716 | +#endif | |
49717 | + { | |
49718 | + .procname = "grsec_lock", | |
49719 | + .data = &grsec_lock, | |
49720 | + .maxlen = sizeof(int), | |
49721 | + .mode = 0600, | |
49722 | + .proc_handler = &proc_dointvec, | |
49723 | + }, | |
49724 | +#endif | |
49725 | +#ifdef CONFIG_GRKERNSEC_ROFS | |
49726 | + { | |
49727 | + .procname = "romount_protect", | |
49728 | + .data = &grsec_enable_rofs, | |
49729 | + .maxlen = sizeof(int), | |
49730 | + .mode = 0600, | |
49731 | + .proc_handler = &proc_dointvec_minmax, | |
49732 | + .extra1 = &one, | |
49733 | + .extra2 = &one, | |
49734 | + }, | |
49735 | +#endif | |
49736 | + { } | |
49737 | +}; | |
49738 | +#endif | |
49739 | diff -urNp linux-3.0.3/grsecurity/grsec_time.c linux-3.0.3/grsecurity/grsec_time.c | |
49740 | --- linux-3.0.3/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500 | |
49741 | +++ linux-3.0.3/grsecurity/grsec_time.c 2011-08-23 21:48:14.000000000 -0400 | |
49742 | @@ -0,0 +1,16 @@ | |
49743 | +#include <linux/kernel.h> | |
49744 | +#include <linux/sched.h> | |
49745 | +#include <linux/grinternal.h> | |
49746 | +#include <linux/module.h> | |
49747 | + | |
49748 | +void | |
49749 | +gr_log_timechange(void) | |
49750 | +{ | |
49751 | +#ifdef CONFIG_GRKERNSEC_TIME | |
49752 | + if (grsec_enable_time) | |
49753 | + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG); | |
49754 | +#endif | |
49755 | + return; | |
49756 | +} | |
49757 | + | |
49758 | +EXPORT_SYMBOL(gr_log_timechange); | |
49759 | diff -urNp linux-3.0.3/grsecurity/grsec_tpe.c linux-3.0.3/grsecurity/grsec_tpe.c | |
49760 | --- linux-3.0.3/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500 | |
49761 | +++ linux-3.0.3/grsecurity/grsec_tpe.c 2011-08-23 21:48:14.000000000 -0400 | |
49762 | @@ -0,0 +1,39 @@ | |
49763 | +#include <linux/kernel.h> | |
49764 | +#include <linux/sched.h> | |
49765 | +#include <linux/file.h> | |
49766 | +#include <linux/fs.h> | |
49767 | +#include <linux/grinternal.h> | |
49768 | + | |
49769 | +extern int gr_acl_tpe_check(void); | |
49770 | + | |
49771 | +int | |
49772 | +gr_tpe_allow(const struct file *file) | |
49773 | +{ | |
49774 | +#ifdef CONFIG_GRKERNSEC | |
49775 | + struct inode *inode = file->f_path.dentry->d_parent->d_inode; | |
49776 | + const struct cred *cred = current_cred(); | |
49777 | + | |
49778 | + if (cred->uid && ((grsec_enable_tpe && | |
49779 | +#ifdef CONFIG_GRKERNSEC_TPE_INVERT | |
49780 | + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) || | |
49781 | + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))) | |
49782 | +#else | |
49783 | + in_group_p(grsec_tpe_gid) | |
49784 | +#endif | |
49785 | + ) || gr_acl_tpe_check()) && | |
49786 | + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) || | |
49787 | + (inode->i_mode & S_IWOTH))))) { | |
49788 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt); | |
49789 | + return 0; | |
49790 | + } | |
49791 | +#ifdef CONFIG_GRKERNSEC_TPE_ALL | |
49792 | + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all && | |
49793 | + ((inode->i_uid && (inode->i_uid != cred->uid)) || | |
49794 | + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) { | |
49795 | + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt); | |
49796 | + return 0; | |
49797 | + } | |
49798 | +#endif | |
49799 | +#endif | |
49800 | + return 1; | |
49801 | +} | |
49802 | diff -urNp linux-3.0.3/grsecurity/grsum.c linux-3.0.3/grsecurity/grsum.c | |
49803 | --- linux-3.0.3/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500 | |
49804 | +++ linux-3.0.3/grsecurity/grsum.c 2011-08-23 21:48:14.000000000 -0400 | |
49805 | @@ -0,0 +1,61 @@ | |
49806 | +#include <linux/err.h> | |
49807 | +#include <linux/kernel.h> | |
49808 | +#include <linux/sched.h> | |
49809 | +#include <linux/mm.h> | |
49810 | +#include <linux/scatterlist.h> | |
49811 | +#include <linux/crypto.h> | |
49812 | +#include <linux/gracl.h> | |
49813 | + | |
49814 | + | |
49815 | +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE) | |
49816 | +#error "crypto and sha256 must be built into the kernel" | |
49817 | +#endif | |
49818 | + | |
49819 | +int | |
49820 | +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum) | |
49821 | +{ | |
49822 | + char *p; | |
49823 | + struct crypto_hash *tfm; | |
49824 | + struct hash_desc desc; | |
49825 | + struct scatterlist sg; | |
49826 | + unsigned char temp_sum[GR_SHA_LEN]; | |
49827 | + volatile int retval = 0; | |
49828 | + volatile int dummy = 0; | |
49829 | + unsigned int i; | |
49830 | + | |
49831 | + sg_init_table(&sg, 1); | |
49832 | + | |
49833 | + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC); | |
49834 | + if (IS_ERR(tfm)) { | |
49835 | + /* should never happen, since sha256 should be built in */ | |
49836 | + return 1; | |
49837 | + } | |
49838 | + | |
49839 | + desc.tfm = tfm; | |
49840 | + desc.flags = 0; | |
49841 | + | |
49842 | + crypto_hash_init(&desc); | |
49843 | + | |
49844 | + p = salt; | |
49845 | + sg_set_buf(&sg, p, GR_SALT_LEN); | |
49846 | + crypto_hash_update(&desc, &sg, sg.length); | |
49847 | + | |
49848 | + p = entry->pw; | |
49849 | + sg_set_buf(&sg, p, strlen(p)); | |
49850 | + | |
49851 | + crypto_hash_update(&desc, &sg, sg.length); | |
49852 | + | |
49853 | + crypto_hash_final(&desc, temp_sum); | |
49854 | + | |
49855 | + memset(entry->pw, 0, GR_PW_LEN); | |
49856 | + | |
49857 | + for (i = 0; i < GR_SHA_LEN; i++) | |
49858 | + if (sum[i] != temp_sum[i]) | |
49859 | + retval = 1; | |
49860 | + else | |
49861 | + dummy = 1; // waste a cycle | |
49862 | + | |
49863 | + crypto_free_hash(tfm); | |
49864 | + | |
49865 | + return retval; | |
49866 | +} | |
49867 | diff -urNp linux-3.0.3/grsecurity/Kconfig linux-3.0.3/grsecurity/Kconfig | |
49868 | --- linux-3.0.3/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500 | |
49869 | +++ linux-3.0.3/grsecurity/Kconfig 2011-08-25 17:25:34.000000000 -0400 | |
49870 | @@ -0,0 +1,1038 @@ | |
49871 | +# | |
49872 | +# grecurity configuration | |
49873 | +# | |
49874 | + | |
49875 | +menu "Grsecurity" | |
49876 | + | |
49877 | +config GRKERNSEC | |
49878 | + bool "Grsecurity" | |
49879 | + select CRYPTO | |
49880 | + select CRYPTO_SHA256 | |
49881 | + help | |
49882 | + If you say Y here, you will be able to configure many features | |
49883 | + that will enhance the security of your system. It is highly | |
49884 | + recommended that you say Y here and read through the help | |
49885 | + for each option so that you fully understand the features and | |
49886 | + can evaluate their usefulness for your machine. | |
49887 | + | |
49888 | +choice | |
49889 | + prompt "Security Level" | |
49890 | + depends on GRKERNSEC | |
49891 | + default GRKERNSEC_CUSTOM | |
49892 | + | |
49893 | +config GRKERNSEC_LOW | |
49894 | + bool "Low" | |
49895 | + select GRKERNSEC_LINK | |
49896 | + select GRKERNSEC_FIFO | |
49897 | + select GRKERNSEC_RANDNET | |
49898 | + select GRKERNSEC_DMESG | |
49899 | + select GRKERNSEC_CHROOT | |
49900 | + select GRKERNSEC_CHROOT_CHDIR | |
49901 | + | |
49902 | + help | |
49903 | + If you choose this option, several of the grsecurity options will | |
49904 | + be enabled that will give you greater protection against a number | |
49905 | + of attacks, while assuring that none of your software will have any | |
49906 | + conflicts with the additional security measures. If you run a lot | |
49907 | + of unusual software, or you are having problems with the higher | |
49908 | + security levels, you should say Y here. With this option, the | |
49909 | + following features are enabled: | |
49910 | + | |
49911 | + - Linking restrictions | |
49912 | + - FIFO restrictions | |
49913 | + - Restricted dmesg | |
49914 | + - Enforced chdir("/") on chroot | |
49915 | + - Runtime module disabling | |
49916 | + | |
49917 | +config GRKERNSEC_MEDIUM | |
49918 | + bool "Medium" | |
49919 | + select PAX | |
49920 | + select PAX_EI_PAX | |
49921 | + select PAX_PT_PAX_FLAGS | |
49922 | + select PAX_HAVE_ACL_FLAGS | |
49923 | + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR) | |
49924 | + select GRKERNSEC_CHROOT | |
49925 | + select GRKERNSEC_CHROOT_SYSCTL | |
49926 | + select GRKERNSEC_LINK | |
49927 | + select GRKERNSEC_FIFO | |
49928 | + select GRKERNSEC_DMESG | |
49929 | + select GRKERNSEC_RANDNET | |
49930 | + select GRKERNSEC_FORKFAIL | |
49931 | + select GRKERNSEC_TIME | |
49932 | + select GRKERNSEC_SIGNAL | |
49933 | + select GRKERNSEC_CHROOT | |
49934 | + select GRKERNSEC_CHROOT_UNIX | |
49935 | + select GRKERNSEC_CHROOT_MOUNT | |
49936 | + select GRKERNSEC_CHROOT_PIVOT | |
49937 | + select GRKERNSEC_CHROOT_DOUBLE | |
49938 | + select GRKERNSEC_CHROOT_CHDIR | |
49939 | + select GRKERNSEC_CHROOT_MKNOD | |
49940 | + select GRKERNSEC_PROC | |
49941 | + select GRKERNSEC_PROC_USERGROUP | |
49942 | + select PAX_RANDUSTACK | |
49943 | + select PAX_ASLR | |
49944 | + select PAX_RANDMMAP | |
49945 | + select PAX_REFCOUNT if (X86 || SPARC64) | |
49946 | + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB)) | |
49947 | + | |
49948 | + help | |
49949 | + If you say Y here, several features in addition to those included | |
49950 | + in the low additional security level will be enabled. These | |
49951 | + features provide even more security to your system, though in rare | |
49952 | + cases they may be incompatible with very old or poorly written | |
49953 | + software. If you enable this option, make sure that your auth | |
49954 | + service (identd) is running as gid 1001. With this option, | |
49955 | + the following features (in addition to those provided in the | |
49956 | + low additional security level) will be enabled: | |
49957 | + | |
49958 | + - Failed fork logging | |
49959 | + - Time change logging | |
49960 | + - Signal logging | |
49961 | + - Deny mounts in chroot | |
49962 | + - Deny double chrooting | |
49963 | + - Deny sysctl writes in chroot | |
49964 | + - Deny mknod in chroot | |
49965 | + - Deny access to abstract AF_UNIX sockets out of chroot | |
49966 | + - Deny pivot_root in chroot | |
49967 | + - Denied writes of /dev/kmem, /dev/mem, and /dev/port | |
49968 | + - /proc restrictions with special GID set to 10 (usually wheel) | |
49969 | + - Address Space Layout Randomization (ASLR) | |
49970 | + - Prevent exploitation of most refcount overflows | |
49971 | + - Bounds checking of copying between the kernel and userland | |
49972 | + | |
49973 | +config GRKERNSEC_HIGH | |
49974 | + bool "High" | |
49975 | + select GRKERNSEC_LINK | |
49976 | + select GRKERNSEC_FIFO | |
49977 | + select GRKERNSEC_DMESG | |
49978 | + select GRKERNSEC_FORKFAIL | |
49979 | + select GRKERNSEC_TIME | |
49980 | + select GRKERNSEC_SIGNAL | |
49981 | + select GRKERNSEC_CHROOT | |
49982 | + select GRKERNSEC_CHROOT_SHMAT | |
49983 | + select GRKERNSEC_CHROOT_UNIX | |
49984 | + select GRKERNSEC_CHROOT_MOUNT | |
49985 | + select GRKERNSEC_CHROOT_FCHDIR | |
49986 | + select GRKERNSEC_CHROOT_PIVOT | |
49987 | + select GRKERNSEC_CHROOT_DOUBLE | |
49988 | + select GRKERNSEC_CHROOT_CHDIR | |
49989 | + select GRKERNSEC_CHROOT_MKNOD | |
49990 | + select GRKERNSEC_CHROOT_CAPS | |
49991 | + select GRKERNSEC_CHROOT_SYSCTL | |
49992 | + select GRKERNSEC_CHROOT_FINDTASK | |
49993 | + select GRKERNSEC_SYSFS_RESTRICT | |
49994 | + select GRKERNSEC_PROC | |
49995 | + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR) | |
49996 | + select GRKERNSEC_HIDESYM | |
49997 | + select GRKERNSEC_BRUTE | |
49998 | + select GRKERNSEC_PROC_USERGROUP | |
49999 | + select GRKERNSEC_KMEM | |
50000 | + select GRKERNSEC_RESLOG | |
50001 | + select GRKERNSEC_RANDNET | |
50002 | + select GRKERNSEC_PROC_ADD | |
50003 | + select GRKERNSEC_CHROOT_CHMOD | |
50004 | + select GRKERNSEC_CHROOT_NICE | |
50005 | + select GRKERNSEC_AUDIT_MOUNT | |
50006 | + select GRKERNSEC_MODHARDEN if (MODULES) | |
50007 | + select GRKERNSEC_HARDEN_PTRACE | |
50008 | + select GRKERNSEC_VM86 if (X86_32) | |
50009 | + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC) | |
50010 | + select PAX | |
50011 | + select PAX_RANDUSTACK | |
50012 | + select PAX_ASLR | |
50013 | + select PAX_RANDMMAP | |
50014 | + select PAX_NOEXEC | |
50015 | + select PAX_MPROTECT | |
50016 | + select PAX_EI_PAX | |
50017 | + select PAX_PT_PAX_FLAGS | |
50018 | + select PAX_HAVE_ACL_FLAGS | |
50019 | + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN) | |
50020 | + select PAX_MEMORY_UDEREF if (X86 && !XEN) | |
50021 | + select PAX_RANDKSTACK if (X86_TSC && X86) | |
50022 | + select PAX_SEGMEXEC if (X86_32) | |
50023 | + select PAX_PAGEEXEC | |
50024 | + select PAX_EMUPLT if (ALPHA || PARISC || SPARC) | |
50025 | + select PAX_EMUTRAMP if (PARISC) | |
50026 | + select PAX_EMUSIGRT if (PARISC) | |
50027 | + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC) | |
50028 | + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86)) | |
50029 | + select PAX_REFCOUNT if (X86 || SPARC64) | |
50030 | + select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB)) | |
50031 | + help | |
50032 | + If you say Y here, many of the features of grsecurity will be | |
50033 | + enabled, which will protect you against many kinds of attacks | |
50034 | + against your system. The heightened security comes at a cost | |
50035 | + of an increased chance of incompatibilities with rare software | |
50036 | + on your machine. Since this security level enables PaX, you should | |
50037 | + view <http://pax.grsecurity.net> and read about the PaX | |
50038 | + project. While you are there, download chpax and run it on | |
50039 | + binaries that cause problems with PaX. Also remember that | |
50040 | + since the /proc restrictions are enabled, you must run your | |
50041 | + identd as gid 1001. This security level enables the following | |
50042 | + features in addition to those listed in the low and medium | |
50043 | + security levels: | |
50044 | + | |
50045 | + - Additional /proc restrictions | |
50046 | + - Chmod restrictions in chroot | |
50047 | + - No signals, ptrace, or viewing of processes outside of chroot | |
50048 | + - Capability restrictions in chroot | |
50049 | + - Deny fchdir out of chroot | |
50050 | + - Priority restrictions in chroot | |
50051 | + - Segmentation-based implementation of PaX | |
50052 | + - Mprotect restrictions | |
50053 | + - Removal of addresses from /proc/<pid>/[smaps|maps|stat] | |
50054 | + - Kernel stack randomization | |
50055 | + - Mount/unmount/remount logging | |
50056 | + - Kernel symbol hiding | |
50057 | + - Prevention of memory exhaustion-based exploits | |
50058 | + - Hardening of module auto-loading | |
50059 | + - Ptrace restrictions | |
50060 | + - Restricted vm86 mode | |
50061 | + - Restricted sysfs/debugfs | |
50062 | + - Active kernel exploit response | |
50063 | + | |
50064 | +config GRKERNSEC_CUSTOM | |
50065 | + bool "Custom" | |
50066 | + help | |
50067 | + If you say Y here, you will be able to configure every grsecurity | |
50068 | + option, which allows you to enable many more features that aren't | |
50069 | + covered in the basic security levels. These additional features | |
50070 | + include TPE, socket restrictions, and the sysctl system for | |
50071 | + grsecurity. It is advised that you read through the help for | |
50072 | + each option to determine its usefulness in your situation. | |
50073 | + | |
50074 | +endchoice | |
50075 | + | |
50076 | +menu "Address Space Protection" | |
50077 | +depends on GRKERNSEC | |
50078 | + | |
50079 | +config GRKERNSEC_KMEM | |
50080 | + bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port" | |
50081 | + select STRICT_DEVMEM if (X86 || ARM || TILE || S390) | |
50082 | + help | |
50083 | + If you say Y here, /dev/kmem and /dev/mem won't be allowed to | |
50084 | + be written to via mmap or otherwise to modify the running kernel. | |
50085 | + /dev/port will also not be allowed to be opened. If you have module | |
50086 | + support disabled, enabling this will close up four ways that are | |
50087 | + currently used to insert malicious code into the running kernel. | |
50088 | + Even with all these features enabled, we still highly recommend that | |
50089 | + you use the RBAC system, as it is still possible for an attacker to | |
50090 | + modify the running kernel through privileged I/O granted by ioperm/iopl. | |
50091 | + If you are not using XFree86, you may be able to stop this additional | |
50092 | + case by enabling the 'Disable privileged I/O' option. Though nothing | |
50093 | + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem, | |
50094 | + but only to video memory, which is the only writing we allow in this | |
50095 | + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will | |
50096 | + not be allowed to mprotect it with PROT_WRITE later. | |
50097 | + It is highly recommended that you say Y here if you meet all the | |
50098 | + conditions above. | |
50099 | + | |
50100 | +config GRKERNSEC_VM86 | |
50101 | + bool "Restrict VM86 mode" | |
50102 | + depends on X86_32 | |
50103 | + | |
50104 | + help | |
50105 | + If you say Y here, only processes with CAP_SYS_RAWIO will be able to | |
50106 | + make use of a special execution mode on 32bit x86 processors called | |
50107 | + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain | |
50108 | + video cards and will still work with this option enabled. The purpose | |
50109 | + of the option is to prevent exploitation of emulation errors in | |
50110 | + virtualization of vm86 mode like the one discovered in VMWare in 2009. | |
50111 | + Nearly all users should be able to enable this option. | |
50112 | + | |
50113 | +config GRKERNSEC_IO | |
50114 | + bool "Disable privileged I/O" | |
50115 | + depends on X86 | |
50116 | + select RTC_CLASS | |
50117 | + select RTC_INTF_DEV | |
50118 | + select RTC_DRV_CMOS | |
50119 | + | |
50120 | + help | |
50121 | + If you say Y here, all ioperm and iopl calls will return an error. | |
50122 | + Ioperm and iopl can be used to modify the running kernel. | |
50123 | + Unfortunately, some programs need this access to operate properly, | |
50124 | + the most notable of which are XFree86 and hwclock. hwclock can be | |
50125 | + remedied by having RTC support in the kernel, so real-time | |
50126 | + clock support is enabled if this option is enabled, to ensure | |
50127 | + that hwclock operates correctly. XFree86 still will not | |
50128 | + operate correctly with this option enabled, so DO NOT CHOOSE Y | |
50129 | + IF YOU USE XFree86. If you use XFree86 and you still want to | |
50130 | + protect your kernel against modification, use the RBAC system. | |
50131 | + | |
50132 | +config GRKERNSEC_PROC_MEMMAP | |
50133 | + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]" | |
50134 | + default y if (PAX_NOEXEC || PAX_ASLR) | |
50135 | + depends on PAX_NOEXEC || PAX_ASLR | |
50136 | + help | |
50137 | + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will | |
50138 | + give no information about the addresses of its mappings if | |
50139 | + PaX features that rely on random addresses are enabled on the task. | |
50140 | + If you use PaX it is greatly recommended that you say Y here as it | |
50141 | + closes up a hole that makes the full ASLR useless for suid | |
50142 | + binaries. | |
50143 | + | |
50144 | +config GRKERNSEC_BRUTE | |
50145 | + bool "Deter exploit bruteforcing" | |
50146 | + help | |
50147 | + If you say Y here, attempts to bruteforce exploits against forking | |
50148 | + daemons such as apache or sshd, as well as against suid/sgid binaries | |
50149 | + will be deterred. When a child of a forking daemon is killed by PaX | |
50150 | + or crashes due to an illegal instruction or other suspicious signal, | |
50151 | + the parent process will be delayed 30 seconds upon every subsequent | |
50152 | + fork until the administrator is able to assess the situation and | |
50153 | + restart the daemon. | |
50154 | + In the suid/sgid case, the attempt is logged, the user has all their | |
50155 | + processes terminated, and they are prevented from executing any further | |
50156 | + processes for 15 minutes. | |
50157 | + It is recommended that you also enable signal logging in the auditing | |
50158 | + section so that logs are generated when a process triggers a suspicious | |
50159 | + signal. | |
50160 | + If the sysctl option is enabled, a sysctl option with name | |
50161 | + "deter_bruteforce" is created. | |
50162 | + | |
50163 | + | |
50164 | +config GRKERNSEC_MODHARDEN | |
50165 | + bool "Harden module auto-loading" | |
50166 | + depends on MODULES | |
50167 | + help | |
50168 | + If you say Y here, module auto-loading in response to use of some | |
50169 | + feature implemented by an unloaded module will be restricted to | |
50170 | + root users. Enabling this option helps defend against attacks | |
50171 | + by unprivileged users who abuse the auto-loading behavior to | |
50172 | + cause a vulnerable module to load that is then exploited. | |
50173 | + | |
50174 | + If this option prevents a legitimate use of auto-loading for a | |
50175 | + non-root user, the administrator can execute modprobe manually | |
50176 | + with the exact name of the module mentioned in the alert log. | |
50177 | + Alternatively, the administrator can add the module to the list | |
50178 | + of modules loaded at boot by modifying init scripts. | |
50179 | + | |
50180 | + Modification of init scripts will most likely be needed on | |
50181 | + Ubuntu servers with encrypted home directory support enabled, | |
50182 | + as the first non-root user logging in will cause the ecb(aes), | |
50183 | + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded. | |
50184 | + | |
50185 | +config GRKERNSEC_HIDESYM | |
50186 | + bool "Hide kernel symbols" | |
50187 | + help | |
50188 | + If you say Y here, getting information on loaded modules, and | |
50189 | + displaying all kernel symbols through a syscall will be restricted | |
50190 | + to users with CAP_SYS_MODULE. For software compatibility reasons, | |
50191 | + /proc/kallsyms will be restricted to the root user. The RBAC | |
50192 | + system can hide that entry even from root. | |
50193 | + | |
50194 | + This option also prevents leaking of kernel addresses through | |
50195 | + several /proc entries. | |
50196 | + | |
50197 | + Note that this option is only effective provided the following | |
50198 | + conditions are met: | |
50199 | + 1) The kernel using grsecurity is not precompiled by some distribution | |
50200 | + 2) You have also enabled GRKERNSEC_DMESG | |
50201 | + 3) You are using the RBAC system and hiding other files such as your | |
50202 | + kernel image and System.map. Alternatively, enabling this option | |
50203 | + causes the permissions on /boot, /lib/modules, and the kernel | |
50204 | + source directory to change at compile time to prevent | |
50205 | + reading by non-root users. | |
50206 | + If the above conditions are met, this option will aid in providing a | |
50207 | + useful protection against local kernel exploitation of overflows | |
50208 | + and arbitrary read/write vulnerabilities. | |
50209 | + | |
50210 | +config GRKERNSEC_KERN_LOCKOUT | |
50211 | + bool "Active kernel exploit response" | |
50212 | + depends on X86 || ARM || PPC || SPARC | |
50213 | + help | |
50214 | + If you say Y here, when a PaX alert is triggered due to suspicious | |
50215 | + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY) | |
50216 | + or an OOPs occurs due to bad memory accesses, instead of just | |
50217 | + terminating the offending process (and potentially allowing | |
50218 | + a subsequent exploit from the same user), we will take one of two | |
50219 | + actions: | |
50220 | + If the user was root, we will panic the system | |
50221 | + If the user was non-root, we will log the attempt, terminate | |
50222 | + all processes owned by the user, then prevent them from creating | |
50223 | + any new processes until the system is restarted | |
50224 | + This deters repeated kernel exploitation/bruteforcing attempts | |
50225 | + and is useful for later forensics. | |
50226 | + | |
50227 | +endmenu | |
50228 | +menu "Role Based Access Control Options" | |
50229 | +depends on GRKERNSEC | |
50230 | + | |
50231 | +config GRKERNSEC_RBAC_DEBUG | |
50232 | + bool | |
50233 | + | |
50234 | +config GRKERNSEC_NO_RBAC | |
50235 | + bool "Disable RBAC system" | |
50236 | + help | |
50237 | + If you say Y here, the /dev/grsec device will be removed from the kernel, | |
50238 | + preventing the RBAC system from being enabled. You should only say Y | |
50239 | + here if you have no intention of using the RBAC system, so as to prevent | |
50240 | + an attacker with root access from misusing the RBAC system to hide files | |
50241 | + and processes when loadable module support and /dev/[k]mem have been | |
50242 | + locked down. | |
50243 | + | |
50244 | +config GRKERNSEC_ACL_HIDEKERN | |
50245 | + bool "Hide kernel processes" | |
50246 | + help | |
50247 | + If you say Y here, all kernel threads will be hidden to all | |
50248 | + processes but those whose subject has the "view hidden processes" | |
50249 | + flag. | |
50250 | + | |
50251 | +config GRKERNSEC_ACL_MAXTRIES | |
50252 | + int "Maximum tries before password lockout" | |
50253 | + default 3 | |
50254 | + help | |
50255 | + This option enforces the maximum number of times a user can attempt | |
50256 | + to authorize themselves with the grsecurity RBAC system before being | |
50257 | + denied the ability to attempt authorization again for a specified time. | |
50258 | + The lower the number, the harder it will be to brute-force a password. | |
50259 | + | |
50260 | +config GRKERNSEC_ACL_TIMEOUT | |
50261 | + int "Time to wait after max password tries, in seconds" | |
50262 | + default 30 | |
50263 | + help | |
50264 | + This option specifies the time the user must wait after attempting to | |
50265 | + authorize to the RBAC system with the maximum number of invalid | |
50266 | + passwords. The higher the number, the harder it will be to brute-force | |
50267 | + a password. | |
50268 | + | |
50269 | +endmenu | |
50270 | +menu "Filesystem Protections" | |
50271 | +depends on GRKERNSEC | |
50272 | + | |
50273 | +config GRKERNSEC_PROC | |
50274 | + bool "Proc restrictions" | |
50275 | + help | |
50276 | + If you say Y here, the permissions of the /proc filesystem | |
50277 | + will be altered to enhance system security and privacy. You MUST | |
50278 | + choose either a user only restriction or a user and group restriction. | |
50279 | + Depending upon the option you choose, you can either restrict users to | |
50280 | + see only the processes they themselves run, or choose a group that can | |
50281 | + view all processes and files normally restricted to root if you choose | |
50282 | + the "restrict to user only" option. NOTE: If you're running identd as | |
50283 | + a non-root user, you will have to run it as the group you specify here. | |
50284 | + | |
50285 | +config GRKERNSEC_PROC_USER | |
50286 | + bool "Restrict /proc to user only" | |
50287 | + depends on GRKERNSEC_PROC | |
50288 | + help | |
50289 | + If you say Y here, non-root users will only be able to view their own | |
50290 | + processes, and restricts them from viewing network-related information, | |
50291 | + and viewing kernel symbol and module information. | |
50292 | + | |
50293 | +config GRKERNSEC_PROC_USERGROUP | |
50294 | + bool "Allow special group" | |
50295 | + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER | |
50296 | + help | |
50297 | + If you say Y here, you will be able to select a group that will be | |
50298 | + able to view all processes and network-related information. If you've | |
50299 | + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still | |
50300 | + remain hidden. This option is useful if you want to run identd as | |
50301 | + a non-root user. | |
50302 | + | |
50303 | +config GRKERNSEC_PROC_GID | |
50304 | + int "GID for special group" | |
50305 | + depends on GRKERNSEC_PROC_USERGROUP | |
50306 | + default 1001 | |
50307 | + | |
50308 | +config GRKERNSEC_PROC_ADD | |
50309 | + bool "Additional restrictions" | |
50310 | + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP | |
50311 | + help | |
50312 | + If you say Y here, additional restrictions will be placed on | |
50313 | + /proc that keep normal users from viewing device information and | |
50314 | + slabinfo information that could be useful for exploits. | |
50315 | + | |
50316 | +config GRKERNSEC_LINK | |
50317 | + bool "Linking restrictions" | |
50318 | + help | |
50319 | + If you say Y here, /tmp race exploits will be prevented, since users | |
50320 | + will no longer be able to follow symlinks owned by other users in | |
50321 | + world-writable +t directories (e.g. /tmp), unless the owner of the | |
50322 | + symlink is the owner of the directory. users will also not be | |
50323 | + able to hardlink to files they do not own. If the sysctl option is | |
50324 | + enabled, a sysctl option with name "linking_restrictions" is created. | |
50325 | + | |
50326 | +config GRKERNSEC_FIFO | |
50327 | + bool "FIFO restrictions" | |
50328 | + help | |
50329 | + If you say Y here, users will not be able to write to FIFOs they don't | |
50330 | + own in world-writable +t directories (e.g. /tmp), unless the owner of | |
50331 | + the FIFO is the same owner of the directory it's held in. If the sysctl | |
50332 | + option is enabled, a sysctl option with name "fifo_restrictions" is | |
50333 | + created. | |
50334 | + | |
50335 | +config GRKERNSEC_SYSFS_RESTRICT | |
50336 | + bool "Sysfs/debugfs restriction" | |
50337 | + depends on SYSFS | |
50338 | + help | |
50339 | + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and | |
50340 | + any filesystem normally mounted under it (e.g. debugfs) will only | |
50341 | + be accessible by root. These filesystems generally provide access | |
50342 | + to hardware and debug information that isn't appropriate for unprivileged | |
50343 | + users of the system. Sysfs and debugfs have also become a large source | |
50344 | + of new vulnerabilities, ranging from infoleaks to local compromise. | |
50345 | + There has been very little oversight with an eye toward security involved | |
50346 | + in adding new exporters of information to these filesystems, so their | |
50347 | + use is discouraged. | |
50348 | + This option is equivalent to a chmod 0700 of the mount paths. | |
50349 | + | |
50350 | +config GRKERNSEC_ROFS | |
50351 | + bool "Runtime read-only mount protection" | |
50352 | + help | |
50353 | + If you say Y here, a sysctl option with name "romount_protect" will | |
50354 | + be created. By setting this option to 1 at runtime, filesystems | |
50355 | + will be protected in the following ways: | |
50356 | + * No new writable mounts will be allowed | |
50357 | + * Existing read-only mounts won't be able to be remounted read/write | |
50358 | + * Write operations will be denied on all block devices | |
50359 | + This option acts independently of grsec_lock: once it is set to 1, | |
50360 | + it cannot be turned off. Therefore, please be mindful of the resulting | |
50361 | + behavior if this option is enabled in an init script on a read-only | |
50362 | + filesystem. This feature is mainly intended for secure embedded systems. | |
50363 | + | |
50364 | +config GRKERNSEC_CHROOT | |
50365 | + bool "Chroot jail restrictions" | |
50366 | + help | |
50367 | + If you say Y here, you will be able to choose several options that will | |
50368 | + make breaking out of a chrooted jail much more difficult. If you | |
50369 | + encounter no software incompatibilities with the following options, it | |
50370 | + is recommended that you enable each one. | |
50371 | + | |
50372 | +config GRKERNSEC_CHROOT_MOUNT | |
50373 | + bool "Deny mounts" | |
50374 | + depends on GRKERNSEC_CHROOT | |
50375 | + help | |
50376 | + If you say Y here, processes inside a chroot will not be able to | |
50377 | + mount or remount filesystems. If the sysctl option is enabled, a | |
50378 | + sysctl option with name "chroot_deny_mount" is created. | |
50379 | + | |
50380 | +config GRKERNSEC_CHROOT_DOUBLE | |
50381 | + bool "Deny double-chroots" | |
50382 | + depends on GRKERNSEC_CHROOT | |
50383 | + help | |
50384 | + If you say Y here, processes inside a chroot will not be able to chroot | |
50385 | + again outside the chroot. This is a widely used method of breaking | |
50386 | + out of a chroot jail and should not be allowed. If the sysctl | |
50387 | + option is enabled, a sysctl option with name | |
50388 | + "chroot_deny_chroot" is created. | |
50389 | + | |
50390 | +config GRKERNSEC_CHROOT_PIVOT | |
50391 | + bool "Deny pivot_root in chroot" | |
50392 | + depends on GRKERNSEC_CHROOT | |
50393 | + help | |
50394 | + If you say Y here, processes inside a chroot will not be able to use | |
50395 | + a function called pivot_root() that was introduced in Linux 2.3.41. It | |
50396 | + works similar to chroot in that it changes the root filesystem. This | |
50397 | + function could be misused in a chrooted process to attempt to break out | |
50398 | + of the chroot, and therefore should not be allowed. If the sysctl | |
50399 | + option is enabled, a sysctl option with name "chroot_deny_pivot" is | |
50400 | + created. | |
50401 | + | |
50402 | +config GRKERNSEC_CHROOT_CHDIR | |
50403 | + bool "Enforce chdir(\"/\") on all chroots" | |
50404 | + depends on GRKERNSEC_CHROOT | |
50405 | + help | |
50406 | + If you say Y here, the current working directory of all newly-chrooted | |
50407 | + applications will be set to the the root directory of the chroot. | |
50408 | + The man page on chroot(2) states: | |
50409 | + Note that this call does not change the current working | |
50410 | + directory, so that `.' can be outside the tree rooted at | |
50411 | + `/'. In particular, the super-user can escape from a | |
50412 | + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'. | |
50413 | + | |
50414 | + It is recommended that you say Y here, since it's not known to break | |
50415 | + any software. If the sysctl option is enabled, a sysctl option with | |
50416 | + name "chroot_enforce_chdir" is created. | |
50417 | + | |
50418 | +config GRKERNSEC_CHROOT_CHMOD | |
50419 | + bool "Deny (f)chmod +s" | |
50420 | + depends on GRKERNSEC_CHROOT | |
50421 | + help | |
50422 | + If you say Y here, processes inside a chroot will not be able to chmod | |
50423 | + or fchmod files to make them have suid or sgid bits. This protects | |
50424 | + against another published method of breaking a chroot. If the sysctl | |
50425 | + option is enabled, a sysctl option with name "chroot_deny_chmod" is | |
50426 | + created. | |
50427 | + | |
50428 | +config GRKERNSEC_CHROOT_FCHDIR | |
50429 | + bool "Deny fchdir out of chroot" | |
50430 | + depends on GRKERNSEC_CHROOT | |
50431 | + help | |
50432 | + If you say Y here, a well-known method of breaking chroots by fchdir'ing | |
50433 | + to a file descriptor of the chrooting process that points to a directory | |
50434 | + outside the filesystem will be stopped. If the sysctl option | |
50435 | + is enabled, a sysctl option with name "chroot_deny_fchdir" is created. | |
50436 | + | |
50437 | +config GRKERNSEC_CHROOT_MKNOD | |
50438 | + bool "Deny mknod" | |
50439 | + depends on GRKERNSEC_CHROOT | |
50440 | + help | |
50441 | + If you say Y here, processes inside a chroot will not be allowed to | |
50442 | + mknod. The problem with using mknod inside a chroot is that it | |
50443 | + would allow an attacker to create a device entry that is the same | |
50444 | + as one on the physical root of your system, which could range from | |
50445 | + anything from the console device to a device for your harddrive (which | |
50446 | + they could then use to wipe the drive or steal data). It is recommended | |
50447 | + that you say Y here, unless you run into software incompatibilities. | |
50448 | + If the sysctl option is enabled, a sysctl option with name | |
50449 | + "chroot_deny_mknod" is created. | |
50450 | + | |
50451 | +config GRKERNSEC_CHROOT_SHMAT | |
50452 | + bool "Deny shmat() out of chroot" | |
50453 | + depends on GRKERNSEC_CHROOT | |
50454 | + help | |
50455 | + If you say Y here, processes inside a chroot will not be able to attach | |
50456 | + to shared memory segments that were created outside of the chroot jail. | |
50457 | + It is recommended that you say Y here. If the sysctl option is enabled, | |
50458 | + a sysctl option with name "chroot_deny_shmat" is created. | |
50459 | + | |
50460 | +config GRKERNSEC_CHROOT_UNIX | |
50461 | + bool "Deny access to abstract AF_UNIX sockets out of chroot" | |
50462 | + depends on GRKERNSEC_CHROOT | |
50463 | + help | |
50464 | + If you say Y here, processes inside a chroot will not be able to | |
50465 | + connect to abstract (meaning not belonging to a filesystem) Unix | |
50466 | + domain sockets that were bound outside of a chroot. It is recommended | |
50467 | + that you say Y here. If the sysctl option is enabled, a sysctl option | |
50468 | + with name "chroot_deny_unix" is created. | |
50469 | + | |
50470 | +config GRKERNSEC_CHROOT_FINDTASK | |
50471 | + bool "Protect outside processes" | |
50472 | + depends on GRKERNSEC_CHROOT | |
50473 | + help | |
50474 | + If you say Y here, processes inside a chroot will not be able to | |
50475 | + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, | |
50476 | + getsid, or view any process outside of the chroot. If the sysctl | |
50477 | + option is enabled, a sysctl option with name "chroot_findtask" is | |
50478 | + created. | |
50479 | + | |
50480 | +config GRKERNSEC_CHROOT_NICE | |
50481 | + bool "Restrict priority changes" | |
50482 | + depends on GRKERNSEC_CHROOT | |
50483 | + help | |
50484 | + If you say Y here, processes inside a chroot will not be able to raise | |
50485 | + the priority of processes in the chroot, or alter the priority of | |
50486 | + processes outside the chroot. This provides more security than simply | |
50487 | + removing CAP_SYS_NICE from the process' capability set. If the | |
50488 | + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice" | |
50489 | + is created. | |
50490 | + | |
50491 | +config GRKERNSEC_CHROOT_SYSCTL | |
50492 | + bool "Deny sysctl writes" | |
50493 | + depends on GRKERNSEC_CHROOT | |
50494 | + help | |
50495 | + If you say Y here, an attacker in a chroot will not be able to | |
50496 | + write to sysctl entries, either by sysctl(2) or through a /proc | |
50497 | + interface. It is strongly recommended that you say Y here. If the | |
50498 | + sysctl option is enabled, a sysctl option with name | |
50499 | + "chroot_deny_sysctl" is created. | |
50500 | + | |
50501 | +config GRKERNSEC_CHROOT_CAPS | |
50502 | + bool "Capability restrictions" | |
50503 | + depends on GRKERNSEC_CHROOT | |
50504 | + help | |
50505 | + If you say Y here, the capabilities on all root processes within a | |
50506 | + chroot jail will be lowered to stop module insertion, raw i/o, | |
50507 | + system and net admin tasks, rebooting the system, modifying immutable | |
50508 | + files, modifying IPC owned by another, and changing the system time. | |
50509 | + This is left an option because it can break some apps. Disable this | |
50510 | + if your chrooted apps are having problems performing those kinds of | |
50511 | + tasks. If the sysctl option is enabled, a sysctl option with | |
50512 | + name "chroot_caps" is created. | |
50513 | + | |
50514 | +endmenu | |
50515 | +menu "Kernel Auditing" | |
50516 | +depends on GRKERNSEC | |
50517 | + | |
50518 | +config GRKERNSEC_AUDIT_GROUP | |
50519 | + bool "Single group for auditing" | |
50520 | + help | |
50521 | + If you say Y here, the exec, chdir, and (un)mount logging features | |
50522 | + will only operate on a group you specify. This option is recommended | |
50523 | + if you only want to watch certain users instead of having a large | |
50524 | + amount of logs from the entire system. If the sysctl option is enabled, | |
50525 | + a sysctl option with name "audit_group" is created. | |
50526 | + | |
50527 | +config GRKERNSEC_AUDIT_GID | |
50528 | + int "GID for auditing" | |
50529 | + depends on GRKERNSEC_AUDIT_GROUP | |
50530 | + default 1007 | |
50531 | + | |
50532 | +config GRKERNSEC_EXECLOG | |
50533 | + bool "Exec logging" | |
50534 | + help | |
50535 | + If you say Y here, all execve() calls will be logged (since the | |
50536 | + other exec*() calls are frontends to execve(), all execution | |
50537 | + will be logged). Useful for shell-servers that like to keep track | |
50538 | + of their users. If the sysctl option is enabled, a sysctl option with | |
50539 | + name "exec_logging" is created. | |
50540 | + WARNING: This option when enabled will produce a LOT of logs, especially | |
50541 | + on an active system. | |
50542 | + | |
50543 | +config GRKERNSEC_RESLOG | |
50544 | + bool "Resource logging" | |
50545 | + help | |
50546 | + If you say Y here, all attempts to overstep resource limits will | |
50547 | + be logged with the resource name, the requested size, and the current | |
50548 | + limit. It is highly recommended that you say Y here. If the sysctl | |
50549 | + option is enabled, a sysctl option with name "resource_logging" is | |
50550 | + created. If the RBAC system is enabled, the sysctl value is ignored. | |
50551 | + | |
50552 | +config GRKERNSEC_CHROOT_EXECLOG | |
50553 | + bool "Log execs within chroot" | |
50554 | + help | |
50555 | + If you say Y here, all executions inside a chroot jail will be logged | |
50556 | + to syslog. This can cause a large amount of logs if certain | |
50557 | + applications (eg. djb's daemontools) are installed on the system, and | |
50558 | + is therefore left as an option. If the sysctl option is enabled, a | |
50559 | + sysctl option with name "chroot_execlog" is created. | |
50560 | + | |
50561 | +config GRKERNSEC_AUDIT_PTRACE | |
50562 | + bool "Ptrace logging" | |
50563 | + help | |
50564 | + If you say Y here, all attempts to attach to a process via ptrace | |
50565 | + will be logged. If the sysctl option is enabled, a sysctl option | |
50566 | + with name "audit_ptrace" is created. | |
50567 | + | |
50568 | +config GRKERNSEC_AUDIT_CHDIR | |
50569 | + bool "Chdir logging" | |
50570 | + help | |
50571 | + If you say Y here, all chdir() calls will be logged. If the sysctl | |
50572 | + option is enabled, a sysctl option with name "audit_chdir" is created. | |
50573 | + | |
50574 | +config GRKERNSEC_AUDIT_MOUNT | |
50575 | + bool "(Un)Mount logging" | |
50576 | + help | |
50577 | + If you say Y here, all mounts and unmounts will be logged. If the | |
50578 | + sysctl option is enabled, a sysctl option with name "audit_mount" is | |
50579 | + created. | |
50580 | + | |
50581 | +config GRKERNSEC_SIGNAL | |
50582 | + bool "Signal logging" | |
50583 | + help | |
50584 | + If you say Y here, certain important signals will be logged, such as | |
50585 | + SIGSEGV, which will as a result inform you of when a error in a program | |
50586 | + occurred, which in some cases could mean a possible exploit attempt. | |
50587 | + If the sysctl option is enabled, a sysctl option with name | |
50588 | + "signal_logging" is created. | |
50589 | + | |
50590 | +config GRKERNSEC_FORKFAIL | |
50591 | + bool "Fork failure logging" | |
50592 | + help | |
50593 | + If you say Y here, all failed fork() attempts will be logged. | |
50594 | + This could suggest a fork bomb, or someone attempting to overstep | |
50595 | + their process limit. If the sysctl option is enabled, a sysctl option | |
50596 | + with name "forkfail_logging" is created. | |
50597 | + | |
50598 | +config GRKERNSEC_TIME | |
50599 | + bool "Time change logging" | |
50600 | + help | |
50601 | + If you say Y here, any changes of the system clock will be logged. | |
50602 | + If the sysctl option is enabled, a sysctl option with name | |
50603 | + "timechange_logging" is created. | |
50604 | + | |
50605 | +config GRKERNSEC_PROC_IPADDR | |
50606 | + bool "/proc/<pid>/ipaddr support" | |
50607 | + help | |
50608 | + If you say Y here, a new entry will be added to each /proc/<pid> | |
50609 | + directory that contains the IP address of the person using the task. | |
50610 | + The IP is carried across local TCP and AF_UNIX stream sockets. | |
50611 | + This information can be useful for IDS/IPSes to perform remote response | |
50612 | + to a local attack. The entry is readable by only the owner of the | |
50613 | + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via | |
50614 | + the RBAC system), and thus does not create privacy concerns. | |
50615 | + | |
50616 | +config GRKERNSEC_RWXMAP_LOG | |
50617 | + bool 'Denied RWX mmap/mprotect logging' | |
50618 | + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT | |
50619 | + help | |
50620 | + If you say Y here, calls to mmap() and mprotect() with explicit | |
50621 | + usage of PROT_WRITE and PROT_EXEC together will be logged when | |
50622 | + denied by the PAX_MPROTECT feature. If the sysctl option is | |
50623 | + enabled, a sysctl option with name "rwxmap_logging" is created. | |
50624 | + | |
50625 | +config GRKERNSEC_AUDIT_TEXTREL | |
50626 | + bool 'ELF text relocations logging (READ HELP)' | |
50627 | + depends on PAX_MPROTECT | |
50628 | + help | |
50629 | + If you say Y here, text relocations will be logged with the filename | |
50630 | + of the offending library or binary. The purpose of the feature is | |
50631 | + to help Linux distribution developers get rid of libraries and | |
50632 | + binaries that need text relocations which hinder the future progress | |
50633 | + of PaX. Only Linux distribution developers should say Y here, and | |
50634 | + never on a production machine, as this option creates an information | |
50635 | + leak that could aid an attacker in defeating the randomization of | |
50636 | + a single memory region. If the sysctl option is enabled, a sysctl | |
50637 | + option with name "audit_textrel" is created. | |
50638 | + | |
50639 | +endmenu | |
50640 | + | |
50641 | +menu "Executable Protections" | |
50642 | +depends on GRKERNSEC | |
50643 | + | |
50644 | +config GRKERNSEC_DMESG | |
50645 | + bool "Dmesg(8) restriction" | |
50646 | + help | |
50647 | + If you say Y here, non-root users will not be able to use dmesg(8) | |
50648 | + to view up to the last 4kb of messages in the kernel's log buffer. | |
50649 | + The kernel's log buffer often contains kernel addresses and other | |
50650 | + identifying information useful to an attacker in fingerprinting a | |
50651 | + system for a targeted exploit. | |
50652 | + If the sysctl option is enabled, a sysctl option with name "dmesg" is | |
50653 | + created. | |
50654 | + | |
50655 | +config GRKERNSEC_HARDEN_PTRACE | |
50656 | + bool "Deter ptrace-based process snooping" | |
50657 | + help | |
50658 | + If you say Y here, TTY sniffers and other malicious monitoring | |
50659 | + programs implemented through ptrace will be defeated. If you | |
50660 | + have been using the RBAC system, this option has already been | |
50661 | + enabled for several years for all users, with the ability to make | |
50662 | + fine-grained exceptions. | |
50663 | + | |
50664 | + This option only affects the ability of non-root users to ptrace | |
50665 | + processes that are not a descendent of the ptracing process. | |
50666 | + This means that strace ./binary and gdb ./binary will still work, | |
50667 | + but attaching to arbitrary processes will not. If the sysctl | |
50668 | + option is enabled, a sysctl option with name "harden_ptrace" is | |
50669 | + created. | |
50670 | + | |
50671 | +config GRKERNSEC_TPE | |
50672 | + bool "Trusted Path Execution (TPE)" | |
50673 | + help | |
50674 | + If you say Y here, you will be able to choose a gid to add to the | |
50675 | + supplementary groups of users you want to mark as "untrusted." | |
50676 | + These users will not be able to execute any files that are not in | |
50677 | + root-owned directories writable only by root. If the sysctl option | |
50678 | + is enabled, a sysctl option with name "tpe" is created. | |
50679 | + | |
50680 | +config GRKERNSEC_TPE_ALL | |
50681 | + bool "Partially restrict all non-root users" | |
50682 | + depends on GRKERNSEC_TPE | |
50683 | + help | |
50684 | + If you say Y here, all non-root users will be covered under | |
50685 | + a weaker TPE restriction. This is separate from, and in addition to, | |
50686 | + the main TPE options that you have selected elsewhere. Thus, if a | |
50687 | + "trusted" GID is chosen, this restriction applies to even that GID. | |
50688 | + Under this restriction, all non-root users will only be allowed to | |
50689 | + execute files in directories they own that are not group or | |
50690 | + world-writable, or in directories owned by root and writable only by | |
50691 | + root. If the sysctl option is enabled, a sysctl option with name | |
50692 | + "tpe_restrict_all" is created. | |
50693 | + | |
50694 | +config GRKERNSEC_TPE_INVERT | |
50695 | + bool "Invert GID option" | |
50696 | + depends on GRKERNSEC_TPE | |
50697 | + help | |
50698 | + If you say Y here, the group you specify in the TPE configuration will | |
50699 | + decide what group TPE restrictions will be *disabled* for. This | |
50700 | + option is useful if you want TPE restrictions to be applied to most | |
50701 | + users on the system. If the sysctl option is enabled, a sysctl option | |
50702 | + with name "tpe_invert" is created. Unlike other sysctl options, this | |
50703 | + entry will default to on for backward-compatibility. | |
50704 | + | |
50705 | +config GRKERNSEC_TPE_GID | |
50706 | + int "GID for untrusted users" | |
50707 | + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT | |
50708 | + default 1005 | |
50709 | + help | |
50710 | + Setting this GID determines what group TPE restrictions will be | |
50711 | + *enabled* for. If the sysctl option is enabled, a sysctl option | |
50712 | + with name "tpe_gid" is created. | |
50713 | + | |
50714 | +config GRKERNSEC_TPE_GID | |
50715 | + int "GID for trusted users" | |
50716 | + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT | |
50717 | + default 1005 | |
50718 | + help | |
50719 | + Setting this GID determines what group TPE restrictions will be | |
50720 | + *disabled* for. If the sysctl option is enabled, a sysctl option | |
50721 | + with name "tpe_gid" is created. | |
50722 | + | |
50723 | +endmenu | |
50724 | +menu "Network Protections" | |
50725 | +depends on GRKERNSEC | |
50726 | + | |
50727 | +config GRKERNSEC_RANDNET | |
50728 | + bool "Larger entropy pools" | |
50729 | + help | |
50730 | + If you say Y here, the entropy pools used for many features of Linux | |
50731 | + and grsecurity will be doubled in size. Since several grsecurity | |
50732 | + features use additional randomness, it is recommended that you say Y | |
50733 | + here. Saying Y here has a similar effect as modifying | |
50734 | + /proc/sys/kernel/random/poolsize. | |
50735 | + | |
50736 | +config GRKERNSEC_BLACKHOLE | |
50737 | + bool "TCP/UDP blackhole and LAST_ACK DoS prevention" | |
50738 | + depends on NET | |
50739 | + help | |
50740 | + If you say Y here, neither TCP resets nor ICMP | |
50741 | + destination-unreachable packets will be sent in response to packets | |
50742 | + sent to ports for which no associated listening process exists. | |
50743 | + This feature supports both IPV4 and IPV6 and exempts the | |
50744 | + loopback interface from blackholing. Enabling this feature | |
50745 | + makes a host more resilient to DoS attacks and reduces network | |
50746 | + visibility against scanners. | |
50747 | + | |
50748 | + The blackhole feature as-implemented is equivalent to the FreeBSD | |
50749 | + blackhole feature, as it prevents RST responses to all packets, not | |
50750 | + just SYNs. Under most application behavior this causes no | |
50751 | + problems, but applications (like haproxy) may not close certain | |
50752 | + connections in a way that cleanly terminates them on the remote | |
50753 | + end, leaving the remote host in LAST_ACK state. Because of this | |
50754 | + side-effect and to prevent intentional LAST_ACK DoSes, this | |
50755 | + feature also adds automatic mitigation against such attacks. | |
50756 | + The mitigation drastically reduces the amount of time a socket | |
50757 | + can spend in LAST_ACK state. If you're using haproxy and not | |
50758 | + all servers it connects to have this option enabled, consider | |
50759 | + disabling this feature on the haproxy host. | |
50760 | + | |
50761 | + If the sysctl option is enabled, two sysctl options with names | |
50762 | + "ip_blackhole" and "lastack_retries" will be created. | |
50763 | + While "ip_blackhole" takes the standard zero/non-zero on/off | |
50764 | + toggle, "lastack_retries" uses the same kinds of values as | |
50765 | + "tcp_retries1" and "tcp_retries2". The default value of 4 | |
50766 | + prevents a socket from lasting more than 45 seconds in LAST_ACK | |
50767 | + state. | |
50768 | + | |
50769 | +config GRKERNSEC_SOCKET | |
50770 | + bool "Socket restrictions" | |
50771 | + depends on NET | |
50772 | + help | |
50773 | + If you say Y here, you will be able to choose from several options. | |
50774 | + If you assign a GID on your system and add it to the supplementary | |
50775 | + groups of users you want to restrict socket access to, this patch | |
50776 | + will perform up to three things, based on the option(s) you choose. | |
50777 | + | |
50778 | +config GRKERNSEC_SOCKET_ALL | |
50779 | + bool "Deny any sockets to group" | |
50780 | + depends on GRKERNSEC_SOCKET | |
50781 | + help | |
50782 | + If you say Y here, you will be able to choose a GID of whose users will | |
50783 | + be unable to connect to other hosts from your machine or run server | |
50784 | + applications from your machine. If the sysctl option is enabled, a | |
50785 | + sysctl option with name "socket_all" is created. | |
50786 | + | |
50787 | +config GRKERNSEC_SOCKET_ALL_GID | |
50788 | + int "GID to deny all sockets for" | |
50789 | + depends on GRKERNSEC_SOCKET_ALL | |
50790 | + default 1004 | |
50791 | + help | |
50792 | + Here you can choose the GID to disable socket access for. Remember to | |
50793 | + add the users you want socket access disabled for to the GID | |
50794 | + specified here. If the sysctl option is enabled, a sysctl option | |
50795 | + with name "socket_all_gid" is created. | |
50796 | + | |
50797 | +config GRKERNSEC_SOCKET_CLIENT | |
50798 | + bool "Deny client sockets to group" | |
50799 | + depends on GRKERNSEC_SOCKET | |
50800 | + help | |
50801 | + If you say Y here, you will be able to choose a GID of whose users will | |
50802 | + be unable to connect to other hosts from your machine, but will be | |
50803 | + able to run servers. If this option is enabled, all users in the group | |
50804 | + you specify will have to use passive mode when initiating ftp transfers | |
50805 | + from the shell on your machine. If the sysctl option is enabled, a | |
50806 | + sysctl option with name "socket_client" is created. | |
50807 | + | |
50808 | +config GRKERNSEC_SOCKET_CLIENT_GID | |
50809 | + int "GID to deny client sockets for" | |
50810 | + depends on GRKERNSEC_SOCKET_CLIENT | |
50811 | + default 1003 | |
50812 | + help | |
50813 | + Here you can choose the GID to disable client socket access for. | |
50814 | + Remember to add the users you want client socket access disabled for to | |
50815 | + the GID specified here. If the sysctl option is enabled, a sysctl | |
50816 | + option with name "socket_client_gid" is created. | |
50817 | + | |
50818 | +config GRKERNSEC_SOCKET_SERVER | |
50819 | + bool "Deny server sockets to group" | |
50820 | + depends on GRKERNSEC_SOCKET | |
50821 | + help | |
50822 | + If you say Y here, you will be able to choose a GID of whose users will | |
50823 | + be unable to run server applications from your machine. If the sysctl | |
50824 | + option is enabled, a sysctl option with name "socket_server" is created. | |
50825 | + | |
50826 | +config GRKERNSEC_SOCKET_SERVER_GID | |
50827 | + int "GID to deny server sockets for" | |
50828 | + depends on GRKERNSEC_SOCKET_SERVER | |
50829 | + default 1002 | |
50830 | + help | |
50831 | + Here you can choose the GID to disable server socket access for. | |
50832 | + Remember to add the users you want server socket access disabled for to | |
50833 | + the GID specified here. If the sysctl option is enabled, a sysctl | |
50834 | + option with name "socket_server_gid" is created. | |
50835 | + | |
50836 | +endmenu | |
50837 | +menu "Sysctl support" | |
50838 | +depends on GRKERNSEC && SYSCTL | |
50839 | + | |
50840 | +config GRKERNSEC_SYSCTL | |
50841 | + bool "Sysctl support" | |
50842 | + help | |
50843 | + If you say Y here, you will be able to change the options that | |
50844 | + grsecurity runs with at bootup, without having to recompile your | |
50845 | + kernel. You can echo values to files in /proc/sys/kernel/grsecurity | |
50846 | + to enable (1) or disable (0) various features. All the sysctl entries | |
50847 | + are mutable until the "grsec_lock" entry is set to a non-zero value. | |
50848 | + All features enabled in the kernel configuration are disabled at boot | |
50849 | + if you do not say Y to the "Turn on features by default" option. | |
50850 | + All options should be set at startup, and the grsec_lock entry should | |
50851 | + be set to a non-zero value after all the options are set. | |
50852 | + *THIS IS EXTREMELY IMPORTANT* | |
50853 | + | |
50854 | +config GRKERNSEC_SYSCTL_DISTRO | |
50855 | + bool "Extra sysctl support for distro makers (READ HELP)" | |
50856 | + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO | |
50857 | + help | |
50858 | + If you say Y here, additional sysctl options will be created | |
50859 | + for features that affect processes running as root. Therefore, | |
50860 | + it is critical when using this option that the grsec_lock entry be | |
50861 | + enabled after boot. Only distros with prebuilt kernel packages | |
50862 | + with this option enabled that can ensure grsec_lock is enabled | |
50863 | + after boot should use this option. | |
50864 | + *Failure to set grsec_lock after boot makes all grsec features | |
50865 | + this option covers useless* | |
50866 | + | |
50867 | + Currently this option creates the following sysctl entries: | |
50868 | + "Disable Privileged I/O": "disable_priv_io" | |
50869 | + | |
50870 | +config GRKERNSEC_SYSCTL_ON | |
50871 | + bool "Turn on features by default" | |
50872 | + depends on GRKERNSEC_SYSCTL | |
50873 | + help | |
50874 | + If you say Y here, instead of having all features enabled in the | |
50875 | + kernel configuration disabled at boot time, the features will be | |
50876 | + enabled at boot time. It is recommended you say Y here unless | |
50877 | + there is some reason you would want all sysctl-tunable features to | |
50878 | + be disabled by default. As mentioned elsewhere, it is important | |
50879 | + to enable the grsec_lock entry once you have finished modifying | |
50880 | + the sysctl entries. | |
50881 | + | |
50882 | +endmenu | |
50883 | +menu "Logging Options" | |
50884 | +depends on GRKERNSEC | |
50885 | + | |
50886 | +config GRKERNSEC_FLOODTIME | |
50887 | + int "Seconds in between log messages (minimum)" | |
50888 | + default 10 | |
50889 | + help | |
50890 | + This option allows you to enforce the number of seconds between | |
50891 | + grsecurity log messages. The default should be suitable for most | |
50892 | + people, however, if you choose to change it, choose a value small enough | |
50893 | + to allow informative logs to be produced, but large enough to | |
50894 | + prevent flooding. | |
50895 | + | |
50896 | +config GRKERNSEC_FLOODBURST | |
50897 | + int "Number of messages in a burst (maximum)" | |
50898 | + default 4 | |
50899 | + help | |
50900 | + This option allows you to choose the maximum number of messages allowed | |
50901 | + within the flood time interval you chose in a separate option. The | |
50902 | + default should be suitable for most people, however if you find that | |
50903 | + many of your logs are being interpreted as flooding, you may want to | |
50904 | + raise this value. | |
50905 | + | |
50906 | +endmenu | |
50907 | + | |
50908 | +endmenu | |
50909 | diff -urNp linux-3.0.3/grsecurity/Makefile linux-3.0.3/grsecurity/Makefile | |
50910 | --- linux-3.0.3/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500 | |
50911 | +++ linux-3.0.3/grsecurity/Makefile 2011-08-23 21:48:14.000000000 -0400 | |
50912 | @@ -0,0 +1,34 @@ | |
50913 | +# grsecurity's ACL system was originally written in 2001 by Michael Dalton | |
50914 | +# during 2001-2009 it has been completely redesigned by Brad Spengler | |
50915 | +# into an RBAC system | |
50916 | +# | |
50917 | +# All code in this directory and various hooks inserted throughout the kernel | |
50918 | +# are copyright Brad Spengler - Open Source Security, Inc., and released | |
50919 | +# under the GPL v2 or higher | |
50920 | + | |
50921 | +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \ | |
50922 | + grsec_mount.o grsec_sig.o grsec_sysctl.o \ | |
50923 | + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o | |
50924 | + | |
50925 | +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \ | |
50926 | + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \ | |
50927 | + gracl_learn.o grsec_log.o | |
50928 | +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o | |
50929 | + | |
50930 | +ifdef CONFIG_NET | |
50931 | +obj-y += grsec_sock.o | |
50932 | +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o | |
50933 | +endif | |
50934 | + | |
50935 | +ifndef CONFIG_GRKERNSEC | |
50936 | +obj-y += grsec_disabled.o | |
50937 | +endif | |
50938 | + | |
50939 | +ifdef CONFIG_GRKERNSEC_HIDESYM | |
50940 | +extra-y := grsec_hidesym.o | |
50941 | +$(obj)/grsec_hidesym.o: | |
50942 | + @-chmod -f 500 /boot | |
50943 | + @-chmod -f 500 /lib/modules | |
50944 | + @-chmod -f 700 . | |
50945 | + @echo ' grsec: protected kernel image paths' | |
50946 | +endif | |
50947 | diff -urNp linux-3.0.3/include/acpi/acpi_bus.h linux-3.0.3/include/acpi/acpi_bus.h | |
50948 | --- linux-3.0.3/include/acpi/acpi_bus.h 2011-07-21 22:17:23.000000000 -0400 | |
50949 | +++ linux-3.0.3/include/acpi/acpi_bus.h 2011-08-23 21:47:56.000000000 -0400 | |
50950 | @@ -107,7 +107,7 @@ struct acpi_device_ops { | |
50951 | acpi_op_bind bind; | |
50952 | acpi_op_unbind unbind; | |
50953 | acpi_op_notify notify; | |
50954 | -}; | |
50955 | +} __no_const; | |
50956 | ||
50957 | #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */ | |
50958 | ||
50959 | diff -urNp linux-3.0.3/include/asm-generic/atomic-long.h linux-3.0.3/include/asm-generic/atomic-long.h | |
50960 | --- linux-3.0.3/include/asm-generic/atomic-long.h 2011-07-21 22:17:23.000000000 -0400 | |
50961 | +++ linux-3.0.3/include/asm-generic/atomic-long.h 2011-08-23 21:47:56.000000000 -0400 | |
50962 | @@ -22,6 +22,12 @@ | |
50963 | ||
50964 | typedef atomic64_t atomic_long_t; | |
50965 | ||
50966 | +#ifdef CONFIG_PAX_REFCOUNT | |
50967 | +typedef atomic64_unchecked_t atomic_long_unchecked_t; | |
50968 | +#else | |
50969 | +typedef atomic64_t atomic_long_unchecked_t; | |
50970 | +#endif | |
50971 | + | |
50972 | #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i) | |
50973 | ||
50974 | static inline long atomic_long_read(atomic_long_t *l) | |
50975 | @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom | |
50976 | return (long)atomic64_read(v); | |
50977 | } | |
50978 | ||
50979 | +#ifdef CONFIG_PAX_REFCOUNT | |
50980 | +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l) | |
50981 | +{ | |
50982 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
50983 | + | |
50984 | + return (long)atomic64_read_unchecked(v); | |
50985 | +} | |
50986 | +#endif | |
50987 | + | |
50988 | static inline void atomic_long_set(atomic_long_t *l, long i) | |
50989 | { | |
50990 | atomic64_t *v = (atomic64_t *)l; | |
50991 | @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi | |
50992 | atomic64_set(v, i); | |
50993 | } | |
50994 | ||
50995 | +#ifdef CONFIG_PAX_REFCOUNT | |
50996 | +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i) | |
50997 | +{ | |
50998 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
50999 | + | |
51000 | + atomic64_set_unchecked(v, i); | |
51001 | +} | |
51002 | +#endif | |
51003 | + | |
51004 | static inline void atomic_long_inc(atomic_long_t *l) | |
51005 | { | |
51006 | atomic64_t *v = (atomic64_t *)l; | |
51007 | @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi | |
51008 | atomic64_inc(v); | |
51009 | } | |
51010 | ||
51011 | +#ifdef CONFIG_PAX_REFCOUNT | |
51012 | +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l) | |
51013 | +{ | |
51014 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
51015 | + | |
51016 | + atomic64_inc_unchecked(v); | |
51017 | +} | |
51018 | +#endif | |
51019 | + | |
51020 | static inline void atomic_long_dec(atomic_long_t *l) | |
51021 | { | |
51022 | atomic64_t *v = (atomic64_t *)l; | |
51023 | @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi | |
51024 | atomic64_dec(v); | |
51025 | } | |
51026 | ||
51027 | +#ifdef CONFIG_PAX_REFCOUNT | |
51028 | +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l) | |
51029 | +{ | |
51030 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
51031 | + | |
51032 | + atomic64_dec_unchecked(v); | |
51033 | +} | |
51034 | +#endif | |
51035 | + | |
51036 | static inline void atomic_long_add(long i, atomic_long_t *l) | |
51037 | { | |
51038 | atomic64_t *v = (atomic64_t *)l; | |
51039 | @@ -59,6 +101,15 @@ static inline void atomic_long_add(long | |
51040 | atomic64_add(i, v); | |
51041 | } | |
51042 | ||
51043 | +#ifdef CONFIG_PAX_REFCOUNT | |
51044 | +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l) | |
51045 | +{ | |
51046 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
51047 | + | |
51048 | + atomic64_add_unchecked(i, v); | |
51049 | +} | |
51050 | +#endif | |
51051 | + | |
51052 | static inline void atomic_long_sub(long i, atomic_long_t *l) | |
51053 | { | |
51054 | atomic64_t *v = (atomic64_t *)l; | |
51055 | @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long | |
51056 | atomic64_sub(i, v); | |
51057 | } | |
51058 | ||
51059 | +#ifdef CONFIG_PAX_REFCOUNT | |
51060 | +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l) | |
51061 | +{ | |
51062 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
51063 | + | |
51064 | + atomic64_sub_unchecked(i, v); | |
51065 | +} | |
51066 | +#endif | |
51067 | + | |
51068 | static inline int atomic_long_sub_and_test(long i, atomic_long_t *l) | |
51069 | { | |
51070 | atomic64_t *v = (atomic64_t *)l; | |
51071 | @@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur | |
51072 | return (long)atomic64_inc_return(v); | |
51073 | } | |
51074 | ||
51075 | +#ifdef CONFIG_PAX_REFCOUNT | |
51076 | +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l) | |
51077 | +{ | |
51078 | + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l; | |
51079 | + | |
51080 | + return (long)atomic64_inc_return_unchecked(v); | |
51081 | +} | |
51082 | +#endif | |
51083 | + | |
51084 | static inline long atomic_long_dec_return(atomic_long_t *l) | |
51085 | { | |
51086 | atomic64_t *v = (atomic64_t *)l; | |
51087 | @@ -140,6 +209,12 @@ static inline long atomic_long_add_unles | |
51088 | ||
51089 | typedef atomic_t atomic_long_t; | |
51090 | ||
51091 | +#ifdef CONFIG_PAX_REFCOUNT | |
51092 | +typedef atomic_unchecked_t atomic_long_unchecked_t; | |
51093 | +#else | |
51094 | +typedef atomic_t atomic_long_unchecked_t; | |
51095 | +#endif | |
51096 | + | |
51097 | #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i) | |
51098 | static inline long atomic_long_read(atomic_long_t *l) | |
51099 | { | |
51100 | @@ -148,6 +223,15 @@ static inline long atomic_long_read(atom | |
51101 | return (long)atomic_read(v); | |
51102 | } | |
51103 | ||
51104 | +#ifdef CONFIG_PAX_REFCOUNT | |
51105 | +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l) | |
51106 | +{ | |
51107 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51108 | + | |
51109 | + return (long)atomic_read_unchecked(v); | |
51110 | +} | |
51111 | +#endif | |
51112 | + | |
51113 | static inline void atomic_long_set(atomic_long_t *l, long i) | |
51114 | { | |
51115 | atomic_t *v = (atomic_t *)l; | |
51116 | @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi | |
51117 | atomic_set(v, i); | |
51118 | } | |
51119 | ||
51120 | +#ifdef CONFIG_PAX_REFCOUNT | |
51121 | +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i) | |
51122 | +{ | |
51123 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51124 | + | |
51125 | + atomic_set_unchecked(v, i); | |
51126 | +} | |
51127 | +#endif | |
51128 | + | |
51129 | static inline void atomic_long_inc(atomic_long_t *l) | |
51130 | { | |
51131 | atomic_t *v = (atomic_t *)l; | |
51132 | @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi | |
51133 | atomic_inc(v); | |
51134 | } | |
51135 | ||
51136 | +#ifdef CONFIG_PAX_REFCOUNT | |
51137 | +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l) | |
51138 | +{ | |
51139 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51140 | + | |
51141 | + atomic_inc_unchecked(v); | |
51142 | +} | |
51143 | +#endif | |
51144 | + | |
51145 | static inline void atomic_long_dec(atomic_long_t *l) | |
51146 | { | |
51147 | atomic_t *v = (atomic_t *)l; | |
51148 | @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi | |
51149 | atomic_dec(v); | |
51150 | } | |
51151 | ||
51152 | +#ifdef CONFIG_PAX_REFCOUNT | |
51153 | +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l) | |
51154 | +{ | |
51155 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51156 | + | |
51157 | + atomic_dec_unchecked(v); | |
51158 | +} | |
51159 | +#endif | |
51160 | + | |
51161 | static inline void atomic_long_add(long i, atomic_long_t *l) | |
51162 | { | |
51163 | atomic_t *v = (atomic_t *)l; | |
51164 | @@ -176,6 +287,15 @@ static inline void atomic_long_add(long | |
51165 | atomic_add(i, v); | |
51166 | } | |
51167 | ||
51168 | +#ifdef CONFIG_PAX_REFCOUNT | |
51169 | +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l) | |
51170 | +{ | |
51171 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51172 | + | |
51173 | + atomic_add_unchecked(i, v); | |
51174 | +} | |
51175 | +#endif | |
51176 | + | |
51177 | static inline void atomic_long_sub(long i, atomic_long_t *l) | |
51178 | { | |
51179 | atomic_t *v = (atomic_t *)l; | |
51180 | @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long | |
51181 | atomic_sub(i, v); | |
51182 | } | |
51183 | ||
51184 | +#ifdef CONFIG_PAX_REFCOUNT | |
51185 | +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l) | |
51186 | +{ | |
51187 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51188 | + | |
51189 | + atomic_sub_unchecked(i, v); | |
51190 | +} | |
51191 | +#endif | |
51192 | + | |
51193 | static inline int atomic_long_sub_and_test(long i, atomic_long_t *l) | |
51194 | { | |
51195 | atomic_t *v = (atomic_t *)l; | |
51196 | @@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur | |
51197 | return (long)atomic_inc_return(v); | |
51198 | } | |
51199 | ||
51200 | +#ifdef CONFIG_PAX_REFCOUNT | |
51201 | +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l) | |
51202 | +{ | |
51203 | + atomic_unchecked_t *v = (atomic_unchecked_t *)l; | |
51204 | + | |
51205 | + return (long)atomic_inc_return_unchecked(v); | |
51206 | +} | |
51207 | +#endif | |
51208 | + | |
51209 | static inline long atomic_long_dec_return(atomic_long_t *l) | |
51210 | { | |
51211 | atomic_t *v = (atomic_t *)l; | |
51212 | @@ -255,4 +393,49 @@ static inline long atomic_long_add_unles | |
51213 | ||
51214 | #endif /* BITS_PER_LONG == 64 */ | |
51215 | ||
51216 | +#ifdef CONFIG_PAX_REFCOUNT | |
51217 | +static inline void pax_refcount_needs_these_functions(void) | |
51218 | +{ | |
51219 | + atomic_read_unchecked((atomic_unchecked_t *)NULL); | |
51220 | + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0); | |
51221 | + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL); | |
51222 | + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL); | |
51223 | + atomic_inc_unchecked((atomic_unchecked_t *)NULL); | |
51224 | + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL); | |
51225 | + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL); | |
51226 | + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL); | |
51227 | + atomic_dec_unchecked((atomic_unchecked_t *)NULL); | |
51228 | + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0); | |
51229 | + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0); | |
51230 | + | |
51231 | + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL); | |
51232 | + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0); | |
51233 | + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL); | |
51234 | + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL); | |
51235 | + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL); | |
51236 | + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL); | |
51237 | + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL); | |
51238 | +} | |
51239 | +#else | |
51240 | +#define atomic_read_unchecked(v) atomic_read(v) | |
51241 | +#define atomic_set_unchecked(v, i) atomic_set((v), (i)) | |
51242 | +#define atomic_add_unchecked(i, v) atomic_add((i), (v)) | |
51243 | +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v)) | |
51244 | +#define atomic_inc_unchecked(v) atomic_inc(v) | |
51245 | +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v) | |
51246 | +#define atomic_inc_return_unchecked(v) atomic_inc_return(v) | |
51247 | +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v)) | |
51248 | +#define atomic_dec_unchecked(v) atomic_dec(v) | |
51249 | +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n)) | |
51250 | +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i)) | |
51251 | + | |
51252 | +#define atomic_long_read_unchecked(v) atomic_long_read(v) | |
51253 | +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i)) | |
51254 | +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v)) | |
51255 | +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v)) | |
51256 | +#define atomic_long_inc_unchecked(v) atomic_long_inc(v) | |
51257 | +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v) | |
51258 | +#define atomic_long_dec_unchecked(v) atomic_long_dec(v) | |
51259 | +#endif | |
51260 | + | |
51261 | #endif /* _ASM_GENERIC_ATOMIC_LONG_H */ | |
51262 | diff -urNp linux-3.0.3/include/asm-generic/cache.h linux-3.0.3/include/asm-generic/cache.h | |
51263 | --- linux-3.0.3/include/asm-generic/cache.h 2011-07-21 22:17:23.000000000 -0400 | |
51264 | +++ linux-3.0.3/include/asm-generic/cache.h 2011-08-23 21:47:56.000000000 -0400 | |
51265 | @@ -6,7 +6,7 @@ | |
51266 | * cache lines need to provide their own cache.h. | |
51267 | */ | |
51268 | ||
51269 | -#define L1_CACHE_SHIFT 5 | |
51270 | -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) | |
51271 | +#define L1_CACHE_SHIFT 5UL | |
51272 | +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT) | |
51273 | ||
51274 | #endif /* __ASM_GENERIC_CACHE_H */ | |
51275 | diff -urNp linux-3.0.3/include/asm-generic/int-l64.h linux-3.0.3/include/asm-generic/int-l64.h | |
51276 | --- linux-3.0.3/include/asm-generic/int-l64.h 2011-07-21 22:17:23.000000000 -0400 | |
51277 | +++ linux-3.0.3/include/asm-generic/int-l64.h 2011-08-23 21:47:56.000000000 -0400 | |
51278 | @@ -46,6 +46,8 @@ typedef unsigned int u32; | |
51279 | typedef signed long s64; | |
51280 | typedef unsigned long u64; | |
51281 | ||
51282 | +typedef unsigned int intoverflow_t __attribute__ ((mode(TI))); | |
51283 | + | |
51284 | #define S8_C(x) x | |
51285 | #define U8_C(x) x ## U | |
51286 | #define S16_C(x) x | |
51287 | diff -urNp linux-3.0.3/include/asm-generic/int-ll64.h linux-3.0.3/include/asm-generic/int-ll64.h | |
51288 | --- linux-3.0.3/include/asm-generic/int-ll64.h 2011-07-21 22:17:23.000000000 -0400 | |
51289 | +++ linux-3.0.3/include/asm-generic/int-ll64.h 2011-08-23 21:47:56.000000000 -0400 | |
51290 | @@ -51,6 +51,8 @@ typedef unsigned int u32; | |
51291 | typedef signed long long s64; | |
51292 | typedef unsigned long long u64; | |
51293 | ||
51294 | +typedef unsigned long long intoverflow_t; | |
51295 | + | |
51296 | #define S8_C(x) x | |
51297 | #define U8_C(x) x ## U | |
51298 | #define S16_C(x) x | |
51299 | diff -urNp linux-3.0.3/include/asm-generic/kmap_types.h linux-3.0.3/include/asm-generic/kmap_types.h | |
51300 | --- linux-3.0.3/include/asm-generic/kmap_types.h 2011-07-21 22:17:23.000000000 -0400 | |
51301 | +++ linux-3.0.3/include/asm-generic/kmap_types.h 2011-08-23 21:47:56.000000000 -0400 | |
51302 | @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE, | |
51303 | KMAP_D(17) KM_NMI, | |
51304 | KMAP_D(18) KM_NMI_PTE, | |
51305 | KMAP_D(19) KM_KDB, | |
51306 | +KMAP_D(20) KM_CLEARPAGE, | |
51307 | /* | |
51308 | * Remember to update debug_kmap_atomic() when adding new kmap types! | |
51309 | */ | |
51310 | -KMAP_D(20) KM_TYPE_NR | |
51311 | +KMAP_D(21) KM_TYPE_NR | |
51312 | }; | |
51313 | ||
51314 | #undef KMAP_D | |
51315 | diff -urNp linux-3.0.3/include/asm-generic/pgtable.h linux-3.0.3/include/asm-generic/pgtable.h | |
51316 | --- linux-3.0.3/include/asm-generic/pgtable.h 2011-07-21 22:17:23.000000000 -0400 | |
51317 | +++ linux-3.0.3/include/asm-generic/pgtable.h 2011-08-23 21:47:56.000000000 -0400 | |
51318 | @@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd) | |
51319 | #endif /* __HAVE_ARCH_PMD_WRITE */ | |
51320 | #endif | |
51321 | ||
51322 | +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL | |
51323 | +static inline unsigned long pax_open_kernel(void) { return 0; } | |
51324 | +#endif | |
51325 | + | |
51326 | +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL | |
51327 | +static inline unsigned long pax_close_kernel(void) { return 0; } | |
51328 | +#endif | |
51329 | + | |
51330 | #endif /* !__ASSEMBLY__ */ | |
51331 | ||
51332 | #endif /* _ASM_GENERIC_PGTABLE_H */ | |
51333 | diff -urNp linux-3.0.3/include/asm-generic/pgtable-nopmd.h linux-3.0.3/include/asm-generic/pgtable-nopmd.h | |
51334 | --- linux-3.0.3/include/asm-generic/pgtable-nopmd.h 2011-07-21 22:17:23.000000000 -0400 | |
51335 | +++ linux-3.0.3/include/asm-generic/pgtable-nopmd.h 2011-08-23 21:47:56.000000000 -0400 | |
51336 | @@ -1,14 +1,19 @@ | |
51337 | #ifndef _PGTABLE_NOPMD_H | |
51338 | #define _PGTABLE_NOPMD_H | |
51339 | ||
51340 | -#ifndef __ASSEMBLY__ | |
51341 | - | |
51342 | #include <asm-generic/pgtable-nopud.h> | |
51343 | ||
51344 | -struct mm_struct; | |
51345 | - | |
51346 | #define __PAGETABLE_PMD_FOLDED | |
51347 | ||
51348 | +#define PMD_SHIFT PUD_SHIFT | |
51349 | +#define PTRS_PER_PMD 1 | |
51350 | +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT) | |
51351 | +#define PMD_MASK (~(PMD_SIZE-1)) | |
51352 | + | |
51353 | +#ifndef __ASSEMBLY__ | |
51354 | + | |
51355 | +struct mm_struct; | |
51356 | + | |
51357 | /* | |
51358 | * Having the pmd type consist of a pud gets the size right, and allows | |
51359 | * us to conceptually access the pud entry that this pmd is folded into | |
51360 | @@ -16,11 +21,6 @@ struct mm_struct; | |
51361 | */ | |
51362 | typedef struct { pud_t pud; } pmd_t; | |
51363 | ||
51364 | -#define PMD_SHIFT PUD_SHIFT | |
51365 | -#define PTRS_PER_PMD 1 | |
51366 | -#define PMD_SIZE (1UL << PMD_SHIFT) | |
51367 | -#define PMD_MASK (~(PMD_SIZE-1)) | |
51368 | - | |
51369 | /* | |
51370 | * The "pud_xxx()" functions here are trivial for a folded two-level | |
51371 | * setup: the pmd is never bad, and a pmd always exists (as it's folded | |
51372 | diff -urNp linux-3.0.3/include/asm-generic/pgtable-nopud.h linux-3.0.3/include/asm-generic/pgtable-nopud.h | |
51373 | --- linux-3.0.3/include/asm-generic/pgtable-nopud.h 2011-07-21 22:17:23.000000000 -0400 | |
51374 | +++ linux-3.0.3/include/asm-generic/pgtable-nopud.h 2011-08-23 21:47:56.000000000 -0400 | |
51375 | @@ -1,10 +1,15 @@ | |
51376 | #ifndef _PGTABLE_NOPUD_H | |
51377 | #define _PGTABLE_NOPUD_H | |
51378 | ||
51379 | -#ifndef __ASSEMBLY__ | |
51380 | - | |
51381 | #define __PAGETABLE_PUD_FOLDED | |
51382 | ||
51383 | +#define PUD_SHIFT PGDIR_SHIFT | |
51384 | +#define PTRS_PER_PUD 1 | |
51385 | +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT) | |
51386 | +#define PUD_MASK (~(PUD_SIZE-1)) | |
51387 | + | |
51388 | +#ifndef __ASSEMBLY__ | |
51389 | + | |
51390 | /* | |
51391 | * Having the pud type consist of a pgd gets the size right, and allows | |
51392 | * us to conceptually access the pgd entry that this pud is folded into | |
51393 | @@ -12,11 +17,6 @@ | |
51394 | */ | |
51395 | typedef struct { pgd_t pgd; } pud_t; | |
51396 | ||
51397 | -#define PUD_SHIFT PGDIR_SHIFT | |
51398 | -#define PTRS_PER_PUD 1 | |
51399 | -#define PUD_SIZE (1UL << PUD_SHIFT) | |
51400 | -#define PUD_MASK (~(PUD_SIZE-1)) | |
51401 | - | |
51402 | /* | |
51403 | * The "pgd_xxx()" functions here are trivial for a folded two-level | |
51404 | * setup: the pud is never bad, and a pud always exists (as it's folded | |
51405 | diff -urNp linux-3.0.3/include/asm-generic/vmlinux.lds.h linux-3.0.3/include/asm-generic/vmlinux.lds.h | |
51406 | --- linux-3.0.3/include/asm-generic/vmlinux.lds.h 2011-07-21 22:17:23.000000000 -0400 | |
51407 | +++ linux-3.0.3/include/asm-generic/vmlinux.lds.h 2011-08-23 21:47:56.000000000 -0400 | |
51408 | @@ -217,6 +217,7 @@ | |
51409 | .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \ | |
51410 | VMLINUX_SYMBOL(__start_rodata) = .; \ | |
51411 | *(.rodata) *(.rodata.*) \ | |
51412 | + *(.data..read_only) \ | |
51413 | *(__vermagic) /* Kernel version magic */ \ | |
51414 | . = ALIGN(8); \ | |
51415 | VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \ | |
51416 | @@ -723,17 +724,18 @@ | |
51417 | * section in the linker script will go there too. @phdr should have | |
51418 | * a leading colon. | |
51419 | * | |
51420 | - * Note that this macros defines __per_cpu_load as an absolute symbol. | |
51421 | + * Note that this macros defines per_cpu_load as an absolute symbol. | |
51422 | * If there is no need to put the percpu section at a predetermined | |
51423 | * address, use PERCPU_SECTION. | |
51424 | */ | |
51425 | #define PERCPU_VADDR(cacheline, vaddr, phdr) \ | |
51426 | - VMLINUX_SYMBOL(__per_cpu_load) = .; \ | |
51427 | - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \ | |
51428 | + per_cpu_load = .; \ | |
51429 | + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \ | |
51430 | - LOAD_OFFSET) { \ | |
51431 | + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \ | |
51432 | PERCPU_INPUT(cacheline) \ | |
51433 | } phdr \ | |
51434 | - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu); | |
51435 | + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu); | |
51436 | ||
51437 | /** | |
51438 | * PERCPU_SECTION - define output section for percpu area, simple version | |
51439 | diff -urNp linux-3.0.3/include/drm/drm_crtc_helper.h linux-3.0.3/include/drm/drm_crtc_helper.h | |
51440 | --- linux-3.0.3/include/drm/drm_crtc_helper.h 2011-07-21 22:17:23.000000000 -0400 | |
51441 | +++ linux-3.0.3/include/drm/drm_crtc_helper.h 2011-08-23 21:47:56.000000000 -0400 | |
51442 | @@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs { | |
51443 | ||
51444 | /* disable crtc when not in use - more explicit than dpms off */ | |
51445 | void (*disable)(struct drm_crtc *crtc); | |
51446 | -}; | |
51447 | +} __no_const; | |
51448 | ||
51449 | struct drm_encoder_helper_funcs { | |
51450 | void (*dpms)(struct drm_encoder *encoder, int mode); | |
51451 | @@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs { | |
51452 | struct drm_connector *connector); | |
51453 | /* disable encoder when not in use - more explicit than dpms off */ | |
51454 | void (*disable)(struct drm_encoder *encoder); | |
51455 | -}; | |
51456 | +} __no_const; | |
51457 | ||
51458 | struct drm_connector_helper_funcs { | |
51459 | int (*get_modes)(struct drm_connector *connector); | |
51460 | diff -urNp linux-3.0.3/include/drm/drmP.h linux-3.0.3/include/drm/drmP.h | |
51461 | --- linux-3.0.3/include/drm/drmP.h 2011-07-21 22:17:23.000000000 -0400 | |
51462 | +++ linux-3.0.3/include/drm/drmP.h 2011-08-23 21:47:56.000000000 -0400 | |
51463 | @@ -73,6 +73,7 @@ | |
51464 | #include <linux/workqueue.h> | |
51465 | #include <linux/poll.h> | |
51466 | #include <asm/pgalloc.h> | |
51467 | +#include <asm/local.h> | |
51468 | #include "drm.h" | |
51469 | ||
51470 | #include <linux/idr.h> | |
51471 | @@ -1033,7 +1034,7 @@ struct drm_device { | |
51472 | ||
51473 | /** \name Usage Counters */ | |
51474 | /*@{ */ | |
51475 | - int open_count; /**< Outstanding files open */ | |
51476 | + local_t open_count; /**< Outstanding files open */ | |
51477 | atomic_t ioctl_count; /**< Outstanding IOCTLs pending */ | |
51478 | atomic_t vma_count; /**< Outstanding vma areas open */ | |
51479 | int buf_use; /**< Buffers in use -- cannot alloc */ | |
51480 | @@ -1044,7 +1045,7 @@ struct drm_device { | |
51481 | /*@{ */ | |
51482 | unsigned long counters; | |
51483 | enum drm_stat_type types[15]; | |
51484 | - atomic_t counts[15]; | |
51485 | + atomic_unchecked_t counts[15]; | |
51486 | /*@} */ | |
51487 | ||
51488 | struct list_head filelist; | |
51489 | diff -urNp linux-3.0.3/include/drm/ttm/ttm_memory.h linux-3.0.3/include/drm/ttm/ttm_memory.h | |
51490 | --- linux-3.0.3/include/drm/ttm/ttm_memory.h 2011-07-21 22:17:23.000000000 -0400 | |
51491 | +++ linux-3.0.3/include/drm/ttm/ttm_memory.h 2011-08-23 21:47:56.000000000 -0400 | |
51492 | @@ -47,7 +47,7 @@ | |
51493 | ||
51494 | struct ttm_mem_shrink { | |
51495 | int (*do_shrink) (struct ttm_mem_shrink *); | |
51496 | -}; | |
51497 | +} __no_const; | |
51498 | ||
51499 | /** | |
51500 | * struct ttm_mem_global - Global memory accounting structure. | |
51501 | diff -urNp linux-3.0.3/include/linux/a.out.h linux-3.0.3/include/linux/a.out.h | |
51502 | --- linux-3.0.3/include/linux/a.out.h 2011-07-21 22:17:23.000000000 -0400 | |
51503 | +++ linux-3.0.3/include/linux/a.out.h 2011-08-23 21:47:56.000000000 -0400 | |
51504 | @@ -39,6 +39,14 @@ enum machine_type { | |
51505 | M_MIPS2 = 152 /* MIPS R6000/R4000 binary */ | |
51506 | }; | |
51507 | ||
51508 | +/* Constants for the N_FLAGS field */ | |
51509 | +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */ | |
51510 | +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */ | |
51511 | +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */ | |
51512 | +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */ | |
51513 | +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */ | |
51514 | +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */ | |
51515 | + | |
51516 | #if !defined (N_MAGIC) | |
51517 | #define N_MAGIC(exec) ((exec).a_info & 0xffff) | |
51518 | #endif | |
51519 | diff -urNp linux-3.0.3/include/linux/atmdev.h linux-3.0.3/include/linux/atmdev.h | |
51520 | --- linux-3.0.3/include/linux/atmdev.h 2011-07-21 22:17:23.000000000 -0400 | |
51521 | +++ linux-3.0.3/include/linux/atmdev.h 2011-08-23 21:47:56.000000000 -0400 | |
51522 | @@ -237,7 +237,7 @@ struct compat_atm_iobuf { | |
51523 | #endif | |
51524 | ||
51525 | struct k_atm_aal_stats { | |
51526 | -#define __HANDLE_ITEM(i) atomic_t i | |
51527 | +#define __HANDLE_ITEM(i) atomic_unchecked_t i | |
51528 | __AAL_STAT_ITEMS | |
51529 | #undef __HANDLE_ITEM | |
51530 | }; | |
51531 | diff -urNp linux-3.0.3/include/linux/binfmts.h linux-3.0.3/include/linux/binfmts.h | |
51532 | --- linux-3.0.3/include/linux/binfmts.h 2011-07-21 22:17:23.000000000 -0400 | |
51533 | +++ linux-3.0.3/include/linux/binfmts.h 2011-08-23 21:47:56.000000000 -0400 | |
51534 | @@ -88,6 +88,7 @@ struct linux_binfmt { | |
51535 | int (*load_binary)(struct linux_binprm *, struct pt_regs * regs); | |
51536 | int (*load_shlib)(struct file *); | |
51537 | int (*core_dump)(struct coredump_params *cprm); | |
51538 | + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags); | |
51539 | unsigned long min_coredump; /* minimal dump size */ | |
51540 | }; | |
51541 | ||
51542 | diff -urNp linux-3.0.3/include/linux/blkdev.h linux-3.0.3/include/linux/blkdev.h | |
51543 | --- linux-3.0.3/include/linux/blkdev.h 2011-07-21 22:17:23.000000000 -0400 | |
51544 | +++ linux-3.0.3/include/linux/blkdev.h 2011-08-26 19:49:56.000000000 -0400 | |
51545 | @@ -1308,7 +1308,7 @@ struct block_device_operations { | |
51546 | /* this callback is with swap_lock and sometimes page table lock held */ | |
51547 | void (*swap_slot_free_notify) (struct block_device *, unsigned long); | |
51548 | struct module *owner; | |
51549 | -}; | |
51550 | +} __do_const; | |
51551 | ||
51552 | extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int, | |
51553 | unsigned long); | |
51554 | diff -urNp linux-3.0.3/include/linux/blktrace_api.h linux-3.0.3/include/linux/blktrace_api.h | |
51555 | --- linux-3.0.3/include/linux/blktrace_api.h 2011-07-21 22:17:23.000000000 -0400 | |
51556 | +++ linux-3.0.3/include/linux/blktrace_api.h 2011-08-23 21:47:56.000000000 -0400 | |
51557 | @@ -161,7 +161,7 @@ struct blk_trace { | |
51558 | struct dentry *dir; | |
51559 | struct dentry *dropped_file; | |
51560 | struct dentry *msg_file; | |
51561 | - atomic_t dropped; | |
51562 | + atomic_unchecked_t dropped; | |
51563 | }; | |
51564 | ||
51565 | extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *); | |
51566 | diff -urNp linux-3.0.3/include/linux/byteorder/little_endian.h linux-3.0.3/include/linux/byteorder/little_endian.h | |
51567 | --- linux-3.0.3/include/linux/byteorder/little_endian.h 2011-07-21 22:17:23.000000000 -0400 | |
51568 | +++ linux-3.0.3/include/linux/byteorder/little_endian.h 2011-08-23 21:47:56.000000000 -0400 | |
51569 | @@ -42,51 +42,51 @@ | |
51570 | ||
51571 | static inline __le64 __cpu_to_le64p(const __u64 *p) | |
51572 | { | |
51573 | - return (__force __le64)*p; | |
51574 | + return (__force const __le64)*p; | |
51575 | } | |
51576 | static inline __u64 __le64_to_cpup(const __le64 *p) | |
51577 | { | |
51578 | - return (__force __u64)*p; | |
51579 | + return (__force const __u64)*p; | |
51580 | } | |
51581 | static inline __le32 __cpu_to_le32p(const __u32 *p) | |
51582 | { | |
51583 | - return (__force __le32)*p; | |
51584 | + return (__force const __le32)*p; | |
51585 | } | |
51586 | static inline __u32 __le32_to_cpup(const __le32 *p) | |
51587 | { | |
51588 | - return (__force __u32)*p; | |
51589 | + return (__force const __u32)*p; | |
51590 | } | |
51591 | static inline __le16 __cpu_to_le16p(const __u16 *p) | |
51592 | { | |
51593 | - return (__force __le16)*p; | |
51594 | + return (__force const __le16)*p; | |
51595 | } | |
51596 | static inline __u16 __le16_to_cpup(const __le16 *p) | |
51597 | { | |
51598 | - return (__force __u16)*p; | |
51599 | + return (__force const __u16)*p; | |
51600 | } | |
51601 | static inline __be64 __cpu_to_be64p(const __u64 *p) | |
51602 | { | |
51603 | - return (__force __be64)__swab64p(p); | |
51604 | + return (__force const __be64)__swab64p(p); | |
51605 | } | |
51606 | static inline __u64 __be64_to_cpup(const __be64 *p) | |
51607 | { | |
51608 | - return __swab64p((__u64 *)p); | |
51609 | + return __swab64p((const __u64 *)p); | |
51610 | } | |
51611 | static inline __be32 __cpu_to_be32p(const __u32 *p) | |
51612 | { | |
51613 | - return (__force __be32)__swab32p(p); | |
51614 | + return (__force const __be32)__swab32p(p); | |
51615 | } | |
51616 | static inline __u32 __be32_to_cpup(const __be32 *p) | |
51617 | { | |
51618 | - return __swab32p((__u32 *)p); | |
51619 | + return __swab32p((const __u32 *)p); | |
51620 | } | |
51621 | static inline __be16 __cpu_to_be16p(const __u16 *p) | |
51622 | { | |
51623 | - return (__force __be16)__swab16p(p); | |
51624 | + return (__force const __be16)__swab16p(p); | |
51625 | } | |
51626 | static inline __u16 __be16_to_cpup(const __be16 *p) | |
51627 | { | |
51628 | - return __swab16p((__u16 *)p); | |
51629 | + return __swab16p((const __u16 *)p); | |
51630 | } | |
51631 | #define __cpu_to_le64s(x) do { (void)(x); } while (0) | |
51632 | #define __le64_to_cpus(x) do { (void)(x); } while (0) | |
51633 | diff -urNp linux-3.0.3/include/linux/cache.h linux-3.0.3/include/linux/cache.h | |
51634 | --- linux-3.0.3/include/linux/cache.h 2011-07-21 22:17:23.000000000 -0400 | |
51635 | +++ linux-3.0.3/include/linux/cache.h 2011-08-23 21:47:56.000000000 -0400 | |
51636 | @@ -16,6 +16,10 @@ | |
51637 | #define __read_mostly | |
51638 | #endif | |
51639 | ||
51640 | +#ifndef __read_only | |
51641 | +#define __read_only __read_mostly | |
51642 | +#endif | |
51643 | + | |
51644 | #ifndef ____cacheline_aligned | |
51645 | #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES))) | |
51646 | #endif | |
51647 | diff -urNp linux-3.0.3/include/linux/capability.h linux-3.0.3/include/linux/capability.h | |
51648 | --- linux-3.0.3/include/linux/capability.h 2011-07-21 22:17:23.000000000 -0400 | |
51649 | +++ linux-3.0.3/include/linux/capability.h 2011-08-23 21:48:14.000000000 -0400 | |
51650 | @@ -547,6 +547,9 @@ extern bool capable(int cap); | |
51651 | extern bool ns_capable(struct user_namespace *ns, int cap); | |
51652 | extern bool task_ns_capable(struct task_struct *t, int cap); | |
51653 | extern bool nsown_capable(int cap); | |
51654 | +extern bool task_ns_capable_nolog(struct task_struct *t, int cap); | |
51655 | +extern bool ns_capable_nolog(struct user_namespace *ns, int cap); | |
51656 | +extern bool capable_nolog(int cap); | |
51657 | ||
51658 | /* audit system wants to get cap info from files as well */ | |
51659 | extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); | |
51660 | diff -urNp linux-3.0.3/include/linux/cleancache.h linux-3.0.3/include/linux/cleancache.h | |
51661 | --- linux-3.0.3/include/linux/cleancache.h 2011-07-21 22:17:23.000000000 -0400 | |
51662 | +++ linux-3.0.3/include/linux/cleancache.h 2011-08-23 21:47:56.000000000 -0400 | |
51663 | @@ -31,7 +31,7 @@ struct cleancache_ops { | |
51664 | void (*flush_page)(int, struct cleancache_filekey, pgoff_t); | |
51665 | void (*flush_inode)(int, struct cleancache_filekey); | |
51666 | void (*flush_fs)(int); | |
51667 | -}; | |
51668 | +} __no_const; | |
51669 | ||
51670 | extern struct cleancache_ops | |
51671 | cleancache_register_ops(struct cleancache_ops *ops); | |
51672 | diff -urNp linux-3.0.3/include/linux/compiler-gcc4.h linux-3.0.3/include/linux/compiler-gcc4.h | |
51673 | --- linux-3.0.3/include/linux/compiler-gcc4.h 2011-07-21 22:17:23.000000000 -0400 | |
51674 | +++ linux-3.0.3/include/linux/compiler-gcc4.h 2011-08-26 19:49:56.000000000 -0400 | |
51675 | @@ -31,6 +31,12 @@ | |
51676 | ||
51677 | ||
51678 | #if __GNUC_MINOR__ >= 5 | |
51679 | + | |
51680 | +#ifdef CONSTIFY_PLUGIN | |
51681 | +#define __no_const __attribute__((no_const)) | |
51682 | +#define __do_const __attribute__((do_const)) | |
51683 | +#endif | |
51684 | + | |
51685 | /* | |
51686 | * Mark a position in code as unreachable. This can be used to | |
51687 | * suppress control flow warnings after asm blocks that transfer | |
51688 | @@ -46,6 +52,11 @@ | |
51689 | #define __noclone __attribute__((__noclone__)) | |
51690 | ||
51691 | #endif | |
51692 | + | |
51693 | +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__))) | |
51694 | +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg)) | |
51695 | +#define __bos0(ptr) __bos((ptr), 0) | |
51696 | +#define __bos1(ptr) __bos((ptr), 1) | |
51697 | #endif | |
51698 | ||
51699 | #if __GNUC_MINOR__ > 0 | |
51700 | diff -urNp linux-3.0.3/include/linux/compiler.h linux-3.0.3/include/linux/compiler.h | |
51701 | --- linux-3.0.3/include/linux/compiler.h 2011-07-21 22:17:23.000000000 -0400 | |
51702 | +++ linux-3.0.3/include/linux/compiler.h 2011-08-26 19:49:56.000000000 -0400 | |
51703 | @@ -264,6 +264,14 @@ void ftrace_likely_update(struct ftrace_ | |
51704 | # define __attribute_const__ /* unimplemented */ | |
51705 | #endif | |
51706 | ||
51707 | +#ifndef __no_const | |
51708 | +# define __no_const | |
51709 | +#endif | |
51710 | + | |
51711 | +#ifndef __do_const | |
51712 | +# define __do_const | |
51713 | +#endif | |
51714 | + | |
51715 | /* | |
51716 | * Tell gcc if a function is cold. The compiler will assume any path | |
51717 | * directly leading to the call is unlikely. | |
51718 | @@ -273,6 +281,22 @@ void ftrace_likely_update(struct ftrace_ | |
51719 | #define __cold | |
51720 | #endif | |
51721 | ||
51722 | +#ifndef __alloc_size | |
51723 | +#define __alloc_size(...) | |
51724 | +#endif | |
51725 | + | |
51726 | +#ifndef __bos | |
51727 | +#define __bos(ptr, arg) | |
51728 | +#endif | |
51729 | + | |
51730 | +#ifndef __bos0 | |
51731 | +#define __bos0(ptr) | |
51732 | +#endif | |
51733 | + | |
51734 | +#ifndef __bos1 | |
51735 | +#define __bos1(ptr) | |
51736 | +#endif | |
51737 | + | |
51738 | /* Simple shorthand for a section definition */ | |
51739 | #ifndef __section | |
51740 | # define __section(S) __attribute__ ((__section__(#S))) | |
51741 | @@ -306,6 +330,7 @@ void ftrace_likely_update(struct ftrace_ | |
51742 | * use is to mediate communication between process-level code and irq/NMI | |
51743 | * handlers, all running on the same CPU. | |
51744 | */ | |
51745 | -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x)) | |
51746 | +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x)) | |
51747 | +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x)) | |
51748 | ||
51749 | #endif /* __LINUX_COMPILER_H */ | |
51750 | diff -urNp linux-3.0.3/include/linux/cpuset.h linux-3.0.3/include/linux/cpuset.h | |
51751 | --- linux-3.0.3/include/linux/cpuset.h 2011-07-21 22:17:23.000000000 -0400 | |
51752 | +++ linux-3.0.3/include/linux/cpuset.h 2011-08-23 21:47:56.000000000 -0400 | |
51753 | @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void | |
51754 | * nodemask. | |
51755 | */ | |
51756 | smp_mb(); | |
51757 | - --ACCESS_ONCE(current->mems_allowed_change_disable); | |
51758 | + --ACCESS_ONCE_RW(current->mems_allowed_change_disable); | |
51759 | } | |
51760 | ||
51761 | static inline void set_mems_allowed(nodemask_t nodemask) | |
51762 | diff -urNp linux-3.0.3/include/linux/crypto.h linux-3.0.3/include/linux/crypto.h | |
51763 | --- linux-3.0.3/include/linux/crypto.h 2011-07-21 22:17:23.000000000 -0400 | |
51764 | +++ linux-3.0.3/include/linux/crypto.h 2011-08-23 21:47:56.000000000 -0400 | |
51765 | @@ -361,7 +361,7 @@ struct cipher_tfm { | |
51766 | const u8 *key, unsigned int keylen); | |
51767 | void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src); | |
51768 | void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src); | |
51769 | -}; | |
51770 | +} __no_const; | |
51771 | ||
51772 | struct hash_tfm { | |
51773 | int (*init)(struct hash_desc *desc); | |
51774 | @@ -382,13 +382,13 @@ struct compress_tfm { | |
51775 | int (*cot_decompress)(struct crypto_tfm *tfm, | |
51776 | const u8 *src, unsigned int slen, | |
51777 | u8 *dst, unsigned int *dlen); | |
51778 | -}; | |
51779 | +} __no_const; | |
51780 | ||
51781 | struct rng_tfm { | |
51782 | int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata, | |
51783 | unsigned int dlen); | |
51784 | int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen); | |
51785 | -}; | |
51786 | +} __no_const; | |
51787 | ||
51788 | #define crt_ablkcipher crt_u.ablkcipher | |
51789 | #define crt_aead crt_u.aead | |
51790 | diff -urNp linux-3.0.3/include/linux/decompress/mm.h linux-3.0.3/include/linux/decompress/mm.h | |
51791 | --- linux-3.0.3/include/linux/decompress/mm.h 2011-07-21 22:17:23.000000000 -0400 | |
51792 | +++ linux-3.0.3/include/linux/decompress/mm.h 2011-08-23 21:47:56.000000000 -0400 | |
51793 | @@ -77,7 +77,7 @@ static void free(void *where) | |
51794 | * warnings when not needed (indeed large_malloc / large_free are not | |
51795 | * needed by inflate */ | |
51796 | ||
51797 | -#define malloc(a) kmalloc(a, GFP_KERNEL) | |
51798 | +#define malloc(a) kmalloc((a), GFP_KERNEL) | |
51799 | #define free(a) kfree(a) | |
51800 | ||
51801 | #define large_malloc(a) vmalloc(a) | |
51802 | diff -urNp linux-3.0.3/include/linux/dma-mapping.h linux-3.0.3/include/linux/dma-mapping.h | |
51803 | --- linux-3.0.3/include/linux/dma-mapping.h 2011-07-21 22:17:23.000000000 -0400 | |
51804 | +++ linux-3.0.3/include/linux/dma-mapping.h 2011-08-26 19:49:56.000000000 -0400 | |
51805 | @@ -50,7 +50,7 @@ struct dma_map_ops { | |
51806 | int (*dma_supported)(struct device *dev, u64 mask); | |
51807 | int (*set_dma_mask)(struct device *dev, u64 mask); | |
51808 | int is_phys; | |
51809 | -}; | |
51810 | +} __do_const; | |
51811 | ||
51812 | #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) | |
51813 | ||
51814 | diff -urNp linux-3.0.3/include/linux/efi.h linux-3.0.3/include/linux/efi.h | |
51815 | --- linux-3.0.3/include/linux/efi.h 2011-07-21 22:17:23.000000000 -0400 | |
51816 | +++ linux-3.0.3/include/linux/efi.h 2011-08-23 21:47:56.000000000 -0400 | |
51817 | @@ -410,7 +410,7 @@ struct efivar_operations { | |
51818 | efi_get_variable_t *get_variable; | |
51819 | efi_get_next_variable_t *get_next_variable; | |
51820 | efi_set_variable_t *set_variable; | |
51821 | -}; | |
51822 | +} __no_const; | |
51823 | ||
51824 | struct efivars { | |
51825 | /* | |
51826 | diff -urNp linux-3.0.3/include/linux/elf.h linux-3.0.3/include/linux/elf.h | |
51827 | --- linux-3.0.3/include/linux/elf.h 2011-07-21 22:17:23.000000000 -0400 | |
51828 | +++ linux-3.0.3/include/linux/elf.h 2011-08-23 21:47:56.000000000 -0400 | |
51829 | @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword; | |
51830 | #define PT_GNU_EH_FRAME 0x6474e550 | |
51831 | ||
51832 | #define PT_GNU_STACK (PT_LOOS + 0x474e551) | |
51833 | +#define PT_GNU_RELRO (PT_LOOS + 0x474e552) | |
51834 | + | |
51835 | +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580) | |
51836 | + | |
51837 | +/* Constants for the e_flags field */ | |
51838 | +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */ | |
51839 | +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */ | |
51840 | +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */ | |
51841 | +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */ | |
51842 | +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */ | |
51843 | +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */ | |
51844 | ||
51845 | /* | |
51846 | * Extended Numbering | |
51847 | @@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword; | |
51848 | #define DT_DEBUG 21 | |
51849 | #define DT_TEXTREL 22 | |
51850 | #define DT_JMPREL 23 | |
51851 | +#define DT_FLAGS 30 | |
51852 | + #define DF_TEXTREL 0x00000004 | |
51853 | #define DT_ENCODING 32 | |
51854 | #define OLD_DT_LOOS 0x60000000 | |
51855 | #define DT_LOOS 0x6000000d | |
51856 | @@ -252,6 +265,19 @@ typedef struct elf64_hdr { | |
51857 | #define PF_W 0x2 | |
51858 | #define PF_X 0x1 | |
51859 | ||
51860 | +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */ | |
51861 | +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */ | |
51862 | +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */ | |
51863 | +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */ | |
51864 | +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */ | |
51865 | +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */ | |
51866 | +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */ | |
51867 | +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */ | |
51868 | +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */ | |
51869 | +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */ | |
51870 | +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */ | |
51871 | +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */ | |
51872 | + | |
51873 | typedef struct elf32_phdr{ | |
51874 | Elf32_Word p_type; | |
51875 | Elf32_Off p_offset; | |
51876 | @@ -344,6 +370,8 @@ typedef struct elf64_shdr { | |
51877 | #define EI_OSABI 7 | |
51878 | #define EI_PAD 8 | |
51879 | ||
51880 | +#define EI_PAX 14 | |
51881 | + | |
51882 | #define ELFMAG0 0x7f /* EI_MAG */ | |
51883 | #define ELFMAG1 'E' | |
51884 | #define ELFMAG2 'L' | |
51885 | @@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC []; | |
51886 | #define elf_note elf32_note | |
51887 | #define elf_addr_t Elf32_Off | |
51888 | #define Elf_Half Elf32_Half | |
51889 | +#define elf_dyn Elf32_Dyn | |
51890 | ||
51891 | #else | |
51892 | ||
51893 | @@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC []; | |
51894 | #define elf_note elf64_note | |
51895 | #define elf_addr_t Elf64_Off | |
51896 | #define Elf_Half Elf64_Half | |
51897 | +#define elf_dyn Elf64_Dyn | |
51898 | ||
51899 | #endif | |
51900 | ||
51901 | diff -urNp linux-3.0.3/include/linux/firewire.h linux-3.0.3/include/linux/firewire.h | |
51902 | --- linux-3.0.3/include/linux/firewire.h 2011-07-21 22:17:23.000000000 -0400 | |
51903 | +++ linux-3.0.3/include/linux/firewire.h 2011-08-23 21:47:56.000000000 -0400 | |
51904 | @@ -428,7 +428,7 @@ struct fw_iso_context { | |
51905 | union { | |
51906 | fw_iso_callback_t sc; | |
51907 | fw_iso_mc_callback_t mc; | |
51908 | - } callback; | |
51909 | + } __no_const callback; | |
51910 | void *callback_data; | |
51911 | }; | |
51912 | ||
51913 | diff -urNp linux-3.0.3/include/linux/fscache-cache.h linux-3.0.3/include/linux/fscache-cache.h | |
51914 | --- linux-3.0.3/include/linux/fscache-cache.h 2011-07-21 22:17:23.000000000 -0400 | |
51915 | +++ linux-3.0.3/include/linux/fscache-cache.h 2011-08-23 21:47:56.000000000 -0400 | |
51916 | @@ -102,7 +102,7 @@ struct fscache_operation { | |
51917 | fscache_operation_release_t release; | |
51918 | }; | |
51919 | ||
51920 | -extern atomic_t fscache_op_debug_id; | |
51921 | +extern atomic_unchecked_t fscache_op_debug_id; | |
51922 | extern void fscache_op_work_func(struct work_struct *work); | |
51923 | ||
51924 | extern void fscache_enqueue_operation(struct fscache_operation *); | |
51925 | @@ -122,7 +122,7 @@ static inline void fscache_operation_ini | |
51926 | { | |
51927 | INIT_WORK(&op->work, fscache_op_work_func); | |
51928 | atomic_set(&op->usage, 1); | |
51929 | - op->debug_id = atomic_inc_return(&fscache_op_debug_id); | |
51930 | + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id); | |
51931 | op->processor = processor; | |
51932 | op->release = release; | |
51933 | INIT_LIST_HEAD(&op->pend_link); | |
51934 | diff -urNp linux-3.0.3/include/linux/fs.h linux-3.0.3/include/linux/fs.h | |
51935 | --- linux-3.0.3/include/linux/fs.h 2011-07-21 22:17:23.000000000 -0400 | |
51936 | +++ linux-3.0.3/include/linux/fs.h 2011-08-26 19:49:56.000000000 -0400 | |
51937 | @@ -109,6 +109,11 @@ struct inodes_stat_t { | |
51938 | /* File was opened by fanotify and shouldn't generate fanotify events */ | |
51939 | #define FMODE_NONOTIFY ((__force fmode_t)0x1000000) | |
51940 | ||
51941 | +/* Hack for grsec so as not to require read permission simply to execute | |
51942 | + * a binary | |
51943 | + */ | |
51944 | +#define FMODE_GREXEC ((__force fmode_t)0x2000000) | |
51945 | + | |
51946 | /* | |
51947 | * The below are the various read and write types that we support. Some of | |
51948 | * them include behavioral modifiers that send information down to the | |
51949 | @@ -1571,7 +1576,8 @@ struct file_operations { | |
51950 | int (*setlease)(struct file *, long, struct file_lock **); | |
51951 | long (*fallocate)(struct file *file, int mode, loff_t offset, | |
51952 | loff_t len); | |
51953 | -}; | |
51954 | +} __do_const; | |
51955 | +typedef struct file_operations __no_const file_operations_no_const; | |
51956 | ||
51957 | #define IPERM_FLAG_RCU 0x0001 | |
51958 | ||
51959 | diff -urNp linux-3.0.3/include/linux/fsnotify.h linux-3.0.3/include/linux/fsnotify.h | |
51960 | --- linux-3.0.3/include/linux/fsnotify.h 2011-07-21 22:17:23.000000000 -0400 | |
51961 | +++ linux-3.0.3/include/linux/fsnotify.h 2011-08-24 18:10:29.000000000 -0400 | |
51962 | @@ -314,7 +314,7 @@ static inline void fsnotify_change(struc | |
51963 | */ | |
51964 | static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name) | |
51965 | { | |
51966 | - return kstrdup(name, GFP_KERNEL); | |
51967 | + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL); | |
51968 | } | |
51969 | ||
51970 | /* | |
51971 | diff -urNp linux-3.0.3/include/linux/fs_struct.h linux-3.0.3/include/linux/fs_struct.h | |
51972 | --- linux-3.0.3/include/linux/fs_struct.h 2011-07-21 22:17:23.000000000 -0400 | |
51973 | +++ linux-3.0.3/include/linux/fs_struct.h 2011-08-23 21:47:56.000000000 -0400 | |
51974 | @@ -6,7 +6,7 @@ | |
51975 | #include <linux/seqlock.h> | |
51976 | ||
51977 | struct fs_struct { | |
51978 | - int users; | |
51979 | + atomic_t users; | |
51980 | spinlock_t lock; | |
51981 | seqcount_t seq; | |
51982 | int umask; | |
51983 | diff -urNp linux-3.0.3/include/linux/ftrace_event.h linux-3.0.3/include/linux/ftrace_event.h | |
51984 | --- linux-3.0.3/include/linux/ftrace_event.h 2011-07-21 22:17:23.000000000 -0400 | |
51985 | +++ linux-3.0.3/include/linux/ftrace_event.h 2011-08-23 21:47:56.000000000 -0400 | |
51986 | @@ -96,7 +96,7 @@ struct trace_event_functions { | |
51987 | trace_print_func raw; | |
51988 | trace_print_func hex; | |
51989 | trace_print_func binary; | |
51990 | -}; | |
51991 | +} __no_const; | |
51992 | ||
51993 | struct trace_event { | |
51994 | struct hlist_node node; | |
51995 | @@ -247,7 +247,7 @@ extern int trace_define_field(struct ftr | |
51996 | extern int trace_add_event_call(struct ftrace_event_call *call); | |
51997 | extern void trace_remove_event_call(struct ftrace_event_call *call); | |
51998 | ||
51999 | -#define is_signed_type(type) (((type)(-1)) < 0) | |
52000 | +#define is_signed_type(type) (((type)(-1)) < (type)1) | |
52001 | ||
52002 | int trace_set_clr_event(const char *system, const char *event, int set); | |
52003 | ||
52004 | diff -urNp linux-3.0.3/include/linux/genhd.h linux-3.0.3/include/linux/genhd.h | |
52005 | --- linux-3.0.3/include/linux/genhd.h 2011-07-21 22:17:23.000000000 -0400 | |
52006 | +++ linux-3.0.3/include/linux/genhd.h 2011-08-23 21:47:56.000000000 -0400 | |
52007 | @@ -184,7 +184,7 @@ struct gendisk { | |
52008 | struct kobject *slave_dir; | |
52009 | ||
52010 | struct timer_rand_state *random; | |
52011 | - atomic_t sync_io; /* RAID */ | |
52012 | + atomic_unchecked_t sync_io; /* RAID */ | |
52013 | struct disk_events *ev; | |
52014 | #ifdef CONFIG_BLK_DEV_INTEGRITY | |
52015 | struct blk_integrity *integrity; | |
52016 | diff -urNp linux-3.0.3/include/linux/gracl.h linux-3.0.3/include/linux/gracl.h | |
52017 | --- linux-3.0.3/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500 | |
52018 | +++ linux-3.0.3/include/linux/gracl.h 2011-08-23 21:48:14.000000000 -0400 | |
52019 | @@ -0,0 +1,317 @@ | |
52020 | +#ifndef GR_ACL_H | |
52021 | +#define GR_ACL_H | |
52022 | + | |
52023 | +#include <linux/grdefs.h> | |
52024 | +#include <linux/resource.h> | |
52025 | +#include <linux/capability.h> | |
52026 | +#include <linux/dcache.h> | |
52027 | +#include <asm/resource.h> | |
52028 | + | |
52029 | +/* Major status information */ | |
52030 | + | |
52031 | +#define GR_VERSION "grsecurity 2.2.2" | |
52032 | +#define GRSECURITY_VERSION 0x2202 | |
52033 | + | |
52034 | +enum { | |
52035 | + GR_SHUTDOWN = 0, | |
52036 | + GR_ENABLE = 1, | |
52037 | + GR_SPROLE = 2, | |
52038 | + GR_RELOAD = 3, | |
52039 | + GR_SEGVMOD = 4, | |
52040 | + GR_STATUS = 5, | |
52041 | + GR_UNSPROLE = 6, | |
52042 | + GR_PASSSET = 7, | |
52043 | + GR_SPROLEPAM = 8, | |
52044 | +}; | |
52045 | + | |
52046 | +/* Password setup definitions | |
52047 | + * kernel/grhash.c */ | |
52048 | +enum { | |
52049 | + GR_PW_LEN = 128, | |
52050 | + GR_SALT_LEN = 16, | |
52051 | + GR_SHA_LEN = 32, | |
52052 | +}; | |
52053 | + | |
52054 | +enum { | |
52055 | + GR_SPROLE_LEN = 64, | |
52056 | +}; | |
52057 | + | |
52058 | +enum { | |
52059 | + GR_NO_GLOB = 0, | |
52060 | + GR_REG_GLOB, | |
52061 | + GR_CREATE_GLOB | |
52062 | +}; | |
52063 | + | |
52064 | +#define GR_NLIMITS 32 | |
52065 | + | |
52066 | +/* Begin Data Structures */ | |
52067 | + | |
52068 | +struct sprole_pw { | |
52069 | + unsigned char *rolename; | |
52070 | + unsigned char salt[GR_SALT_LEN]; | |
52071 | + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */ | |
52072 | +}; | |
52073 | + | |
52074 | +struct name_entry { | |
52075 | + __u32 key; | |
52076 | + ino_t inode; | |
52077 | + dev_t device; | |
52078 | + char *name; | |
52079 | + __u16 len; | |
52080 | + __u8 deleted; | |
52081 | + struct name_entry *prev; | |
52082 | + struct name_entry *next; | |
52083 | +}; | |
52084 | + | |
52085 | +struct inodev_entry { | |
52086 | + struct name_entry *nentry; | |
52087 | + struct inodev_entry *prev; | |
52088 | + struct inodev_entry *next; | |
52089 | +}; | |
52090 | + | |
52091 | +struct acl_role_db { | |
52092 | + struct acl_role_label **r_hash; | |
52093 | + __u32 r_size; | |
52094 | +}; | |
52095 | + | |
52096 | +struct inodev_db { | |
52097 | + struct inodev_entry **i_hash; | |
52098 | + __u32 i_size; | |
52099 | +}; | |
52100 | + | |
52101 | +struct name_db { | |
52102 | + struct name_entry **n_hash; | |
52103 | + __u32 n_size; | |
52104 | +}; | |
52105 | + | |
52106 | +struct crash_uid { | |
52107 | + uid_t uid; | |
52108 | + unsigned long expires; | |
52109 | +}; | |
52110 | + | |
52111 | +struct gr_hash_struct { | |
52112 | + void **table; | |
52113 | + void **nametable; | |
52114 | + void *first; | |
52115 | + __u32 table_size; | |
52116 | + __u32 used_size; | |
52117 | + int type; | |
52118 | +}; | |
52119 | + | |
52120 | +/* Userspace Grsecurity ACL data structures */ | |
52121 | + | |
52122 | +struct acl_subject_label { | |
52123 | + char *filename; | |
52124 | + ino_t inode; | |
52125 | + dev_t device; | |
52126 | + __u32 mode; | |
52127 | + kernel_cap_t cap_mask; | |
52128 | + kernel_cap_t cap_lower; | |
52129 | + kernel_cap_t cap_invert_audit; | |
52130 | + | |
52131 | + struct rlimit res[GR_NLIMITS]; | |
52132 | + __u32 resmask; | |
52133 | + | |
52134 | + __u8 user_trans_type; | |
52135 | + __u8 group_trans_type; | |
52136 | + uid_t *user_transitions; | |
52137 | + gid_t *group_transitions; | |
52138 | + __u16 user_trans_num; | |
52139 | + __u16 group_trans_num; | |
52140 | + | |
52141 | + __u32 sock_families[2]; | |
52142 | + __u32 ip_proto[8]; | |
52143 | + __u32 ip_type; | |
52144 | + struct acl_ip_label **ips; | |
52145 | + __u32 ip_num; | |
52146 | + __u32 inaddr_any_override; | |
52147 | + | |
52148 | + __u32 crashes; | |
52149 | + unsigned long expires; | |
52150 | + | |
52151 | + struct acl_subject_label *parent_subject; | |
52152 | + struct gr_hash_struct *hash; | |
52153 | + struct acl_subject_label *prev; | |
52154 | + struct acl_subject_label *next; | |
52155 | + | |
52156 | + struct acl_object_label **obj_hash; | |
52157 | + __u32 obj_hash_size; | |
52158 | + __u16 pax_flags; | |
52159 | +}; | |
52160 | + | |
52161 | +struct role_allowed_ip { | |
52162 | + __u32 addr; | |
52163 | + __u32 netmask; | |
52164 | + | |
52165 | + struct role_allowed_ip *prev; | |
52166 | + struct role_allowed_ip *next; | |
52167 | +}; | |
52168 | + | |
52169 | +struct role_transition { | |
52170 | + char *rolename; | |
52171 | + | |
52172 | + struct role_transition *prev; | |
52173 | + struct role_transition *next; | |
52174 | +}; | |
52175 | + | |
52176 | +struct acl_role_label { | |
52177 | + char *rolename; | |
52178 | + uid_t uidgid; | |
52179 | + __u16 roletype; | |
52180 | + | |
52181 | + __u16 auth_attempts; | |
52182 | + unsigned long expires; | |
52183 | + | |
52184 | + struct acl_subject_label *root_label; | |
52185 | + struct gr_hash_struct *hash; | |
52186 | + | |
52187 | + struct acl_role_label *prev; | |
52188 | + struct acl_role_label *next; | |
52189 | + | |
52190 | + struct role_transition *transitions; | |
52191 | + struct role_allowed_ip *allowed_ips; | |
52192 | + uid_t *domain_children; | |
52193 | + __u16 domain_child_num; | |
52194 | + | |
52195 | + struct acl_subject_label **subj_hash; | |
52196 | + __u32 subj_hash_size; | |
52197 | +}; | |
52198 | + | |
52199 | +struct user_acl_role_db { | |
52200 | + struct acl_role_label **r_table; | |
52201 | + __u32 num_pointers; /* Number of allocations to track */ | |
52202 | + __u32 num_roles; /* Number of roles */ | |
52203 | + __u32 num_domain_children; /* Number of domain children */ | |
52204 | + __u32 num_subjects; /* Number of subjects */ | |
52205 | + __u32 num_objects; /* Number of objects */ | |
52206 | +}; | |
52207 | + | |
52208 | +struct acl_object_label { | |
52209 | + char *filename; | |
52210 | + ino_t inode; | |
52211 | + dev_t device; | |
52212 | + __u32 mode; | |
52213 | + | |
52214 | + struct acl_subject_label *nested; | |
52215 | + struct acl_object_label *globbed; | |
52216 | + | |
52217 | + /* next two structures not used */ | |
52218 | + | |
52219 | + struct acl_object_label *prev; | |
52220 | + struct acl_object_label *next; | |
52221 | +}; | |
52222 | + | |
52223 | +struct acl_ip_label { | |
52224 | + char *iface; | |
52225 | + __u32 addr; | |
52226 | + __u32 netmask; | |
52227 | + __u16 low, high; | |
52228 | + __u8 mode; | |
52229 | + __u32 type; | |
52230 | + __u32 proto[8]; | |
52231 | + | |
52232 | + /* next two structures not used */ | |
52233 | + | |
52234 | + struct acl_ip_label *prev; | |
52235 | + struct acl_ip_label *next; | |
52236 | +}; | |
52237 | + | |
52238 | +struct gr_arg { | |
52239 | + struct user_acl_role_db role_db; | |
52240 | + unsigned char pw[GR_PW_LEN]; | |
52241 | + unsigned char salt[GR_SALT_LEN]; | |
52242 | + unsigned char sum[GR_SHA_LEN]; | |
52243 | + unsigned char sp_role[GR_SPROLE_LEN]; | |
52244 | + struct sprole_pw *sprole_pws; | |
52245 | + dev_t segv_device; | |
52246 | + ino_t segv_inode; | |
52247 | + uid_t segv_uid; | |
52248 | + __u16 num_sprole_pws; | |
52249 | + __u16 mode; | |
52250 | +}; | |
52251 | + | |
52252 | +struct gr_arg_wrapper { | |
52253 | + struct gr_arg *arg; | |
52254 | + __u32 version; | |
52255 | + __u32 size; | |
52256 | +}; | |
52257 | + | |
52258 | +struct subject_map { | |
52259 | + struct acl_subject_label *user; | |
52260 | + struct acl_subject_label *kernel; | |
52261 | + struct subject_map *prev; | |
52262 | + struct subject_map *next; | |
52263 | +}; | |
52264 | + | |
52265 | +struct acl_subj_map_db { | |
52266 | + struct subject_map **s_hash; | |
52267 | + __u32 s_size; | |
52268 | +}; | |
52269 | + | |
52270 | +/* End Data Structures Section */ | |
52271 | + | |
52272 | +/* Hash functions generated by empirical testing by Brad Spengler | |
52273 | + Makes good use of the low bits of the inode. Generally 0-1 times | |
52274 | + in loop for successful match. 0-3 for unsuccessful match. | |
52275 | + Shift/add algorithm with modulus of table size and an XOR*/ | |
52276 | + | |
52277 | +static __inline__ unsigned int | |
52278 | +rhash(const uid_t uid, const __u16 type, const unsigned int sz) | |
52279 | +{ | |
52280 | + return ((((uid + type) << (16 + type)) ^ uid) % sz); | |
52281 | +} | |
52282 | + | |
52283 | + static __inline__ unsigned int | |
52284 | +shash(const struct acl_subject_label *userp, const unsigned int sz) | |
52285 | +{ | |
52286 | + return ((const unsigned long)userp % sz); | |
52287 | +} | |
52288 | + | |
52289 | +static __inline__ unsigned int | |
52290 | +fhash(const ino_t ino, const dev_t dev, const unsigned int sz) | |
52291 | +{ | |
52292 | + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz); | |
52293 | +} | |
52294 | + | |
52295 | +static __inline__ unsigned int | |
52296 | +nhash(const char *name, const __u16 len, const unsigned int sz) | |
52297 | +{ | |
52298 | + return full_name_hash((const unsigned char *)name, len) % sz; | |
52299 | +} | |
52300 | + | |
52301 | +#define FOR_EACH_ROLE_START(role) \ | |
52302 | + role = role_list; \ | |
52303 | + while (role) { | |
52304 | + | |
52305 | +#define FOR_EACH_ROLE_END(role) \ | |
52306 | + role = role->prev; \ | |
52307 | + } | |
52308 | + | |
52309 | +#define FOR_EACH_SUBJECT_START(role,subj,iter) \ | |
52310 | + subj = NULL; \ | |
52311 | + iter = 0; \ | |
52312 | + while (iter < role->subj_hash_size) { \ | |
52313 | + if (subj == NULL) \ | |
52314 | + subj = role->subj_hash[iter]; \ | |
52315 | + if (subj == NULL) { \ | |
52316 | + iter++; \ | |
52317 | + continue; \ | |
52318 | + } | |
52319 | + | |
52320 | +#define FOR_EACH_SUBJECT_END(subj,iter) \ | |
52321 | + subj = subj->next; \ | |
52322 | + if (subj == NULL) \ | |
52323 | + iter++; \ | |
52324 | + } | |
52325 | + | |
52326 | + | |
52327 | +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \ | |
52328 | + subj = role->hash->first; \ | |
52329 | + while (subj != NULL) { | |
52330 | + | |
52331 | +#define FOR_EACH_NESTED_SUBJECT_END(subj) \ | |
52332 | + subj = subj->next; \ | |
52333 | + } | |
52334 | + | |
52335 | +#endif | |
52336 | + | |
52337 | diff -urNp linux-3.0.3/include/linux/gralloc.h linux-3.0.3/include/linux/gralloc.h | |
52338 | --- linux-3.0.3/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500 | |
52339 | +++ linux-3.0.3/include/linux/gralloc.h 2011-08-23 21:48:14.000000000 -0400 | |
52340 | @@ -0,0 +1,9 @@ | |
52341 | +#ifndef __GRALLOC_H | |
52342 | +#define __GRALLOC_H | |
52343 | + | |
52344 | +void acl_free_all(void); | |
52345 | +int acl_alloc_stack_init(unsigned long size); | |
52346 | +void *acl_alloc(unsigned long len); | |
52347 | +void *acl_alloc_num(unsigned long num, unsigned long len); | |
52348 | + | |
52349 | +#endif | |
52350 | diff -urNp linux-3.0.3/include/linux/grdefs.h linux-3.0.3/include/linux/grdefs.h | |
52351 | --- linux-3.0.3/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500 | |
52352 | +++ linux-3.0.3/include/linux/grdefs.h 2011-08-23 21:48:14.000000000 -0400 | |
52353 | @@ -0,0 +1,140 @@ | |
52354 | +#ifndef GRDEFS_H | |
52355 | +#define GRDEFS_H | |
52356 | + | |
52357 | +/* Begin grsecurity status declarations */ | |
52358 | + | |
52359 | +enum { | |
52360 | + GR_READY = 0x01, | |
52361 | + GR_STATUS_INIT = 0x00 // disabled state | |
52362 | +}; | |
52363 | + | |
52364 | +/* Begin ACL declarations */ | |
52365 | + | |
52366 | +/* Role flags */ | |
52367 | + | |
52368 | +enum { | |
52369 | + GR_ROLE_USER = 0x0001, | |
52370 | + GR_ROLE_GROUP = 0x0002, | |
52371 | + GR_ROLE_DEFAULT = 0x0004, | |
52372 | + GR_ROLE_SPECIAL = 0x0008, | |
52373 | + GR_ROLE_AUTH = 0x0010, | |
52374 | + GR_ROLE_NOPW = 0x0020, | |
52375 | + GR_ROLE_GOD = 0x0040, | |
52376 | + GR_ROLE_LEARN = 0x0080, | |
52377 | + GR_ROLE_TPE = 0x0100, | |
52378 | + GR_ROLE_DOMAIN = 0x0200, | |
52379 | + GR_ROLE_PAM = 0x0400, | |
52380 | + GR_ROLE_PERSIST = 0x0800 | |
52381 | +}; | |
52382 | + | |
52383 | +/* ACL Subject and Object mode flags */ | |
52384 | +enum { | |
52385 | + GR_DELETED = 0x80000000 | |
52386 | +}; | |
52387 | + | |
52388 | +/* ACL Object-only mode flags */ | |
52389 | +enum { | |
52390 | + GR_READ = 0x00000001, | |
52391 | + GR_APPEND = 0x00000002, | |
52392 | + GR_WRITE = 0x00000004, | |
52393 | + GR_EXEC = 0x00000008, | |
52394 | + GR_FIND = 0x00000010, | |
52395 | + GR_INHERIT = 0x00000020, | |
52396 | + GR_SETID = 0x00000040, | |
52397 | + GR_CREATE = 0x00000080, | |
52398 | + GR_DELETE = 0x00000100, | |
52399 | + GR_LINK = 0x00000200, | |
52400 | + GR_AUDIT_READ = 0x00000400, | |
52401 | + GR_AUDIT_APPEND = 0x00000800, | |
52402 | + GR_AUDIT_WRITE = 0x00001000, | |
52403 | + GR_AUDIT_EXEC = 0x00002000, | |
52404 | + GR_AUDIT_FIND = 0x00004000, | |
52405 | + GR_AUDIT_INHERIT= 0x00008000, | |
52406 | + GR_AUDIT_SETID = 0x00010000, | |
52407 | + GR_AUDIT_CREATE = 0x00020000, | |
52408 | + GR_AUDIT_DELETE = 0x00040000, | |
52409 | + GR_AUDIT_LINK = 0x00080000, | |
52410 | + GR_PTRACERD = 0x00100000, | |
52411 | + GR_NOPTRACE = 0x00200000, | |
52412 | + GR_SUPPRESS = 0x00400000, | |
52413 | + GR_NOLEARN = 0x00800000, | |
52414 | + GR_INIT_TRANSFER= 0x01000000 | |
52415 | +}; | |
52416 | + | |
52417 | +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \ | |
52418 | + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \ | |
52419 | + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK) | |
52420 | + | |
52421 | +/* ACL subject-only mode flags */ | |
52422 | +enum { | |
52423 | + GR_KILL = 0x00000001, | |
52424 | + GR_VIEW = 0x00000002, | |
52425 | + GR_PROTECTED = 0x00000004, | |
52426 | + GR_LEARN = 0x00000008, | |
52427 | + GR_OVERRIDE = 0x00000010, | |
52428 | + /* just a placeholder, this mode is only used in userspace */ | |
52429 | + GR_DUMMY = 0x00000020, | |
52430 | + GR_PROTSHM = 0x00000040, | |
52431 | + GR_KILLPROC = 0x00000080, | |
52432 | + GR_KILLIPPROC = 0x00000100, | |
52433 | + /* just a placeholder, this mode is only used in userspace */ | |
52434 | + GR_NOTROJAN = 0x00000200, | |
52435 | + GR_PROTPROCFD = 0x00000400, | |
52436 | + GR_PROCACCT = 0x00000800, | |
52437 | + GR_RELAXPTRACE = 0x00001000, | |
52438 | + GR_NESTED = 0x00002000, | |
52439 | + GR_INHERITLEARN = 0x00004000, | |
52440 | + GR_PROCFIND = 0x00008000, | |
52441 | + GR_POVERRIDE = 0x00010000, | |
52442 | + GR_KERNELAUTH = 0x00020000, | |
52443 | + GR_ATSECURE = 0x00040000, | |
52444 | + GR_SHMEXEC = 0x00080000 | |
52445 | +}; | |
52446 | + | |
52447 | +enum { | |
52448 | + GR_PAX_ENABLE_SEGMEXEC = 0x0001, | |
52449 | + GR_PAX_ENABLE_PAGEEXEC = 0x0002, | |
52450 | + GR_PAX_ENABLE_MPROTECT = 0x0004, | |
52451 | + GR_PAX_ENABLE_RANDMMAP = 0x0008, | |
52452 | + GR_PAX_ENABLE_EMUTRAMP = 0x0010, | |
52453 | + GR_PAX_DISABLE_SEGMEXEC = 0x0100, | |
52454 | + GR_PAX_DISABLE_PAGEEXEC = 0x0200, | |
52455 | + GR_PAX_DISABLE_MPROTECT = 0x0400, | |
52456 | + GR_PAX_DISABLE_RANDMMAP = 0x0800, | |
52457 | + GR_PAX_DISABLE_EMUTRAMP = 0x1000, | |
52458 | +}; | |
52459 | + | |
52460 | +enum { | |
52461 | + GR_ID_USER = 0x01, | |
52462 | + GR_ID_GROUP = 0x02, | |
52463 | +}; | |
52464 | + | |
52465 | +enum { | |
52466 | + GR_ID_ALLOW = 0x01, | |
52467 | + GR_ID_DENY = 0x02, | |
52468 | +}; | |
52469 | + | |
52470 | +#define GR_CRASH_RES 31 | |
52471 | +#define GR_UIDTABLE_MAX 500 | |
52472 | + | |
52473 | +/* begin resource learning section */ | |
52474 | +enum { | |
52475 | + GR_RLIM_CPU_BUMP = 60, | |
52476 | + GR_RLIM_FSIZE_BUMP = 50000, | |
52477 | + GR_RLIM_DATA_BUMP = 10000, | |
52478 | + GR_RLIM_STACK_BUMP = 1000, | |
52479 | + GR_RLIM_CORE_BUMP = 10000, | |
52480 | + GR_RLIM_RSS_BUMP = 500000, | |
52481 | + GR_RLIM_NPROC_BUMP = 1, | |
52482 | + GR_RLIM_NOFILE_BUMP = 5, | |
52483 | + GR_RLIM_MEMLOCK_BUMP = 50000, | |
52484 | + GR_RLIM_AS_BUMP = 500000, | |
52485 | + GR_RLIM_LOCKS_BUMP = 2, | |
52486 | + GR_RLIM_SIGPENDING_BUMP = 5, | |
52487 | + GR_RLIM_MSGQUEUE_BUMP = 10000, | |
52488 | + GR_RLIM_NICE_BUMP = 1, | |
52489 | + GR_RLIM_RTPRIO_BUMP = 1, | |
52490 | + GR_RLIM_RTTIME_BUMP = 1000000 | |
52491 | +}; | |
52492 | + | |
52493 | +#endif | |
52494 | diff -urNp linux-3.0.3/include/linux/grinternal.h linux-3.0.3/include/linux/grinternal.h | |
52495 | --- linux-3.0.3/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500 | |
52496 | +++ linux-3.0.3/include/linux/grinternal.h 2011-08-23 21:48:14.000000000 -0400 | |
52497 | @@ -0,0 +1,219 @@ | |
52498 | +#ifndef __GRINTERNAL_H | |
52499 | +#define __GRINTERNAL_H | |
52500 | + | |
52501 | +#ifdef CONFIG_GRKERNSEC | |
52502 | + | |
52503 | +#include <linux/fs.h> | |
52504 | +#include <linux/mnt_namespace.h> | |
52505 | +#include <linux/nsproxy.h> | |
52506 | +#include <linux/gracl.h> | |
52507 | +#include <linux/grdefs.h> | |
52508 | +#include <linux/grmsg.h> | |
52509 | + | |
52510 | +void gr_add_learn_entry(const char *fmt, ...) | |
52511 | + __attribute__ ((format (printf, 1, 2))); | |
52512 | +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode, | |
52513 | + const struct vfsmount *mnt); | |
52514 | +__u32 gr_check_create(const struct dentry *new_dentry, | |
52515 | + const struct dentry *parent, | |
52516 | + const struct vfsmount *mnt, const __u32 mode); | |
52517 | +int gr_check_protected_task(const struct task_struct *task); | |
52518 | +__u32 to_gr_audit(const __u32 reqmode); | |
52519 | +int gr_set_acls(const int type); | |
52520 | +int gr_apply_subject_to_task(struct task_struct *task); | |
52521 | +int gr_acl_is_enabled(void); | |
52522 | +char gr_roletype_to_char(void); | |
52523 | + | |
52524 | +void gr_handle_alertkill(struct task_struct *task); | |
52525 | +char *gr_to_filename(const struct dentry *dentry, | |
52526 | + const struct vfsmount *mnt); | |
52527 | +char *gr_to_filename1(const struct dentry *dentry, | |
52528 | + const struct vfsmount *mnt); | |
52529 | +char *gr_to_filename2(const struct dentry *dentry, | |
52530 | + const struct vfsmount *mnt); | |
52531 | +char *gr_to_filename3(const struct dentry *dentry, | |
52532 | + const struct vfsmount *mnt); | |
52533 | + | |
52534 | +extern int grsec_enable_harden_ptrace; | |
52535 | +extern int grsec_enable_link; | |
52536 | +extern int grsec_enable_fifo; | |
52537 | +extern int grsec_enable_execve; | |
52538 | +extern int grsec_enable_shm; | |
52539 | +extern int grsec_enable_execlog; | |
52540 | +extern int grsec_enable_signal; | |
52541 | +extern int grsec_enable_audit_ptrace; | |
52542 | +extern int grsec_enable_forkfail; | |
52543 | +extern int grsec_enable_time; | |
52544 | +extern int grsec_enable_rofs; | |
52545 | +extern int grsec_enable_chroot_shmat; | |
52546 | +extern int grsec_enable_chroot_mount; | |
52547 | +extern int grsec_enable_chroot_double; | |
52548 | +extern int grsec_enable_chroot_pivot; | |
52549 | +extern int grsec_enable_chroot_chdir; | |
52550 | +extern int grsec_enable_chroot_chmod; | |
52551 | +extern int grsec_enable_chroot_mknod; | |
52552 | +extern int grsec_enable_chroot_fchdir; | |
52553 | +extern int grsec_enable_chroot_nice; | |
52554 | +extern int grsec_enable_chroot_execlog; | |
52555 | +extern int grsec_enable_chroot_caps; | |
52556 | +extern int grsec_enable_chroot_sysctl; | |
52557 | +extern int grsec_enable_chroot_unix; | |
52558 | +extern int grsec_enable_tpe; | |
52559 | +extern int grsec_tpe_gid; | |
52560 | +extern int grsec_enable_tpe_all; | |
52561 | +extern int grsec_enable_tpe_invert; | |
52562 | +extern int grsec_enable_socket_all; | |
52563 | +extern int grsec_socket_all_gid; | |
52564 | +extern int grsec_enable_socket_client; | |
52565 | +extern int grsec_socket_client_gid; | |
52566 | +extern int grsec_enable_socket_server; | |
52567 | +extern int grsec_socket_server_gid; | |
52568 | +extern int grsec_audit_gid; | |
52569 | +extern int grsec_enable_group; | |
52570 | +extern int grsec_enable_audit_textrel; | |
52571 | +extern int grsec_enable_log_rwxmaps; | |
52572 | +extern int grsec_enable_mount; | |
52573 | +extern int grsec_enable_chdir; | |
52574 | +extern int grsec_resource_logging; | |
52575 | +extern int grsec_enable_blackhole; | |
52576 | +extern int grsec_lastack_retries; | |
52577 | +extern int grsec_enable_brute; | |
52578 | +extern int grsec_lock; | |
52579 | + | |
52580 | +extern spinlock_t grsec_alert_lock; | |
52581 | +extern unsigned long grsec_alert_wtime; | |
52582 | +extern unsigned long grsec_alert_fyet; | |
52583 | + | |
52584 | +extern spinlock_t grsec_audit_lock; | |
52585 | + | |
52586 | +extern rwlock_t grsec_exec_file_lock; | |
52587 | + | |
52588 | +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \ | |
52589 | + gr_to_filename2((tsk)->exec_file->f_path.dentry, \ | |
52590 | + (tsk)->exec_file->f_vfsmnt) : "/") | |
52591 | + | |
52592 | +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \ | |
52593 | + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \ | |
52594 | + (tsk)->real_parent->exec_file->f_vfsmnt) : "/") | |
52595 | + | |
52596 | +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \ | |
52597 | + gr_to_filename((tsk)->exec_file->f_path.dentry, \ | |
52598 | + (tsk)->exec_file->f_vfsmnt) : "/") | |
52599 | + | |
52600 | +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \ | |
52601 | + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \ | |
52602 | + (tsk)->real_parent->exec_file->f_vfsmnt) : "/") | |
52603 | + | |
52604 | +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted) | |
52605 | + | |
52606 | +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry) | |
52607 | + | |
52608 | +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \ | |
52609 | + (task)->pid, (cred)->uid, \ | |
52610 | + (cred)->euid, (cred)->gid, (cred)->egid, \ | |
52611 | + gr_parent_task_fullpath(task), \ | |
52612 | + (task)->real_parent->comm, (task)->real_parent->pid, \ | |
52613 | + (pcred)->uid, (pcred)->euid, \ | |
52614 | + (pcred)->gid, (pcred)->egid | |
52615 | + | |
52616 | +#define GR_CHROOT_CAPS {{ \ | |
52617 | + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \ | |
52618 | + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \ | |
52619 | + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \ | |
52620 | + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \ | |
52621 | + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \ | |
52622 | + CAP_TO_MASK(CAP_IPC_OWNER) , 0 }} | |
52623 | + | |
52624 | +#define security_learn(normal_msg,args...) \ | |
52625 | +({ \ | |
52626 | + read_lock(&grsec_exec_file_lock); \ | |
52627 | + gr_add_learn_entry(normal_msg "\n", ## args); \ | |
52628 | + read_unlock(&grsec_exec_file_lock); \ | |
52629 | +}) | |
52630 | + | |
52631 | +enum { | |
52632 | + GR_DO_AUDIT, | |
52633 | + GR_DONT_AUDIT, | |
52634 | + /* used for non-audit messages that we shouldn't kill the task on */ | |
52635 | + GR_DONT_AUDIT_GOOD | |
52636 | +}; | |
52637 | + | |
52638 | +enum { | |
52639 | + GR_TTYSNIFF, | |
52640 | + GR_RBAC, | |
52641 | + GR_RBAC_STR, | |
52642 | + GR_STR_RBAC, | |
52643 | + GR_RBAC_MODE2, | |
52644 | + GR_RBAC_MODE3, | |
52645 | + GR_FILENAME, | |
52646 | + GR_SYSCTL_HIDDEN, | |
52647 | + GR_NOARGS, | |
52648 | + GR_ONE_INT, | |
52649 | + GR_ONE_INT_TWO_STR, | |
52650 | + GR_ONE_STR, | |
52651 | + GR_STR_INT, | |
52652 | + GR_TWO_STR_INT, | |
52653 | + GR_TWO_INT, | |
52654 | + GR_TWO_U64, | |
52655 | + GR_THREE_INT, | |
52656 | + GR_FIVE_INT_TWO_STR, | |
52657 | + GR_TWO_STR, | |
52658 | + GR_THREE_STR, | |
52659 | + GR_FOUR_STR, | |
52660 | + GR_STR_FILENAME, | |
52661 | + GR_FILENAME_STR, | |
52662 | + GR_FILENAME_TWO_INT, | |
52663 | + GR_FILENAME_TWO_INT_STR, | |
52664 | + GR_TEXTREL, | |
52665 | + GR_PTRACE, | |
52666 | + GR_RESOURCE, | |
52667 | + GR_CAP, | |
52668 | + GR_SIG, | |
52669 | + GR_SIG2, | |
52670 | + GR_CRASH1, | |
52671 | + GR_CRASH2, | |
52672 | + GR_PSACCT, | |
52673 | + GR_RWXMAP | |
52674 | +}; | |
52675 | + | |
52676 | +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str) | |
52677 | +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task) | |
52678 | +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt) | |
52679 | +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str) | |
52680 | +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt) | |
52681 | +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2) | |
52682 | +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3) | |
52683 | +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt) | |
52684 | +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS) | |
52685 | +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num) | |
52686 | +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2) | |
52687 | +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str) | |
52688 | +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num) | |
52689 | +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2) | |
52690 | +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2) | |
52691 | +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3) | |
52692 | +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2) | |
52693 | +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2) | |
52694 | +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num) | |
52695 | +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3) | |
52696 | +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4) | |
52697 | +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt) | |
52698 | +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str) | |
52699 | +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2) | |
52700 | +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str) | |
52701 | +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2) | |
52702 | +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task) | |
52703 | +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2) | |
52704 | +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str) | |
52705 | +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr) | |
52706 | +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num) | |
52707 | +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong) | |
52708 | +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1) | |
52709 | +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) | |
52710 | +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str) | |
52711 | + | |
52712 | +void gr_log_varargs(int audit, const char *msg, int argtypes, ...); | |
52713 | + | |
52714 | +#endif | |
52715 | + | |
52716 | +#endif | |
52717 | diff -urNp linux-3.0.3/include/linux/grmsg.h linux-3.0.3/include/linux/grmsg.h | |
52718 | --- linux-3.0.3/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500 | |
52719 | +++ linux-3.0.3/include/linux/grmsg.h 2011-08-25 17:27:26.000000000 -0400 | |
52720 | @@ -0,0 +1,107 @@ | |
52721 | +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u" | |
52722 | +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u" | |
52723 | +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by " | |
52724 | +#define GR_STOPMOD_MSG "denied modification of module state by " | |
52725 | +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by " | |
52726 | +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by " | |
52727 | +#define GR_IOPERM_MSG "denied use of ioperm() by " | |
52728 | +#define GR_IOPL_MSG "denied use of iopl() by " | |
52729 | +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by " | |
52730 | +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by " | |
52731 | +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by " | |
52732 | +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by " | |
52733 | +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by " | |
52734 | +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4" | |
52735 | +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4" | |
52736 | +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by " | |
52737 | +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by " | |
52738 | +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by " | |
52739 | +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by " | |
52740 | +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by " | |
52741 | +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by " | |
52742 | +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by " | |
52743 | +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against " | |
52744 | +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by " | |
52745 | +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by " | |
52746 | +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by " | |
52747 | +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by " | |
52748 | +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for " | |
52749 | +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by " | |
52750 | +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by " | |
52751 | +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by " | |
52752 | +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by " | |
52753 | +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by " | |
52754 | +#define GR_EXEC_ACL_MSG "%s execution of %.950s by " | |
52755 | +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by " | |
52756 | +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds" | |
52757 | +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds" | |
52758 | +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by " | |
52759 | +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by " | |
52760 | +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by " | |
52761 | +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by " | |
52762 | +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by " | |
52763 | +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by " | |
52764 | +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by " | |
52765 | +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by " | |
52766 | +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by " | |
52767 | +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by " | |
52768 | +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by " | |
52769 | +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by " | |
52770 | +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by " | |
52771 | +#define GR_INITF_ACL_MSG "init_variables() failed %s by " | |
52772 | +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader" | |
52773 | +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by " | |
52774 | +#define GR_SHUTS_ACL_MSG "shutdown auth success for " | |
52775 | +#define GR_SHUTF_ACL_MSG "shutdown auth failure for " | |
52776 | +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for " | |
52777 | +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for " | |
52778 | +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for " | |
52779 | +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for " | |
52780 | +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by " | |
52781 | +#define GR_ENABLEF_ACL_MSG "unable to load %s for " | |
52782 | +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system" | |
52783 | +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by " | |
52784 | +#define GR_RELOADF_ACL_MSG "failed reload of %s for " | |
52785 | +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for " | |
52786 | +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by " | |
52787 | +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by " | |
52788 | +#define GR_SPROLEF_ACL_MSG "special role %s failure for " | |
52789 | +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for " | |
52790 | +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by " | |
52791 | +#define GR_INVMODE_ACL_MSG "invalid mode %d by " | |
52792 | +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by " | |
52793 | +#define GR_FAILFORK_MSG "failed fork with errno %s by " | |
52794 | +#define GR_NICE_CHROOT_MSG "denied priority change by " | |
52795 | +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in " | |
52796 | +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by " | |
52797 | +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by " | |
52798 | +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by " | |
52799 | +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by " | |
52800 | +#define GR_TIME_MSG "time set by " | |
52801 | +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by " | |
52802 | +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by " | |
52803 | +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by " | |
52804 | +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by " | |
52805 | +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by " | |
52806 | +#define GR_BIND_MSG "denied bind() by " | |
52807 | +#define GR_CONNECT_MSG "denied connect() by " | |
52808 | +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by " | |
52809 | +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by " | |
52810 | +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4" | |
52811 | +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process " | |
52812 | +#define GR_CAP_ACL_MSG "use of %s denied for " | |
52813 | +#define GR_CAP_ACL_MSG2 "use of %s permitted for " | |
52814 | +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for " | |
52815 | +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for " | |
52816 | +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by " | |
52817 | +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by " | |
52818 | +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by " | |
52819 | +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by " | |
52820 | +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by " | |
52821 | +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for " | |
52822 | +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by " | |
52823 | +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by " | |
52824 | +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by " | |
52825 | +#define GR_VM86_MSG "denied use of vm86 by " | |
52826 | +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by " | |
52827 | +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by " | |
52828 | diff -urNp linux-3.0.3/include/linux/grsecurity.h linux-3.0.3/include/linux/grsecurity.h | |
52829 | --- linux-3.0.3/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500 | |
52830 | +++ linux-3.0.3/include/linux/grsecurity.h 2011-08-25 17:27:36.000000000 -0400 | |
52831 | @@ -0,0 +1,227 @@ | |
52832 | +#ifndef GR_SECURITY_H | |
52833 | +#define GR_SECURITY_H | |
52834 | +#include <linux/fs.h> | |
52835 | +#include <linux/fs_struct.h> | |
52836 | +#include <linux/binfmts.h> | |
52837 | +#include <linux/gracl.h> | |
52838 | + | |
52839 | +/* notify of brain-dead configs */ | |
52840 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
52841 | +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled." | |
52842 | +#endif | |
52843 | +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC) | |
52844 | +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled." | |
52845 | +#endif | |
52846 | +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS) | |
52847 | +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled." | |
52848 | +#endif | |
52849 | +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS) | |
52850 | +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled." | |
52851 | +#endif | |
52852 | +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP) | |
52853 | +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled." | |
52854 | +#endif | |
52855 | +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR) | |
52856 | +#error "CONFIG_PAX enabled, but no PaX options are enabled." | |
52857 | +#endif | |
52858 | + | |
52859 | +#include <linux/compat.h> | |
52860 | + | |
52861 | +struct user_arg_ptr { | |
52862 | +#ifdef CONFIG_COMPAT | |
52863 | + bool is_compat; | |
52864 | +#endif | |
52865 | + union { | |
52866 | + const char __user *const __user *native; | |
52867 | +#ifdef CONFIG_COMPAT | |
52868 | + compat_uptr_t __user *compat; | |
52869 | +#endif | |
52870 | + } ptr; | |
52871 | +}; | |
52872 | + | |
52873 | +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags); | |
52874 | +void gr_handle_brute_check(void); | |
52875 | +void gr_handle_kernel_exploit(void); | |
52876 | +int gr_process_user_ban(void); | |
52877 | + | |
52878 | +char gr_roletype_to_char(void); | |
52879 | + | |
52880 | +int gr_acl_enable_at_secure(void); | |
52881 | + | |
52882 | +int gr_check_user_change(int real, int effective, int fs); | |
52883 | +int gr_check_group_change(int real, int effective, int fs); | |
52884 | + | |
52885 | +void gr_del_task_from_ip_table(struct task_struct *p); | |
52886 | + | |
52887 | +int gr_pid_is_chrooted(struct task_struct *p); | |
52888 | +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type); | |
52889 | +int gr_handle_chroot_nice(void); | |
52890 | +int gr_handle_chroot_sysctl(const int op); | |
52891 | +int gr_handle_chroot_setpriority(struct task_struct *p, | |
52892 | + const int niceval); | |
52893 | +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt); | |
52894 | +int gr_handle_chroot_chroot(const struct dentry *dentry, | |
52895 | + const struct vfsmount *mnt); | |
52896 | +int gr_handle_chroot_caps(struct path *path); | |
52897 | +void gr_handle_chroot_chdir(struct path *path); | |
52898 | +int gr_handle_chroot_chmod(const struct dentry *dentry, | |
52899 | + const struct vfsmount *mnt, const int mode); | |
52900 | +int gr_handle_chroot_mknod(const struct dentry *dentry, | |
52901 | + const struct vfsmount *mnt, const int mode); | |
52902 | +int gr_handle_chroot_mount(const struct dentry *dentry, | |
52903 | + const struct vfsmount *mnt, | |
52904 | + const char *dev_name); | |
52905 | +int gr_handle_chroot_pivot(void); | |
52906 | +int gr_handle_chroot_unix(const pid_t pid); | |
52907 | + | |
52908 | +int gr_handle_rawio(const struct inode *inode); | |
52909 | + | |
52910 | +void gr_handle_ioperm(void); | |
52911 | +void gr_handle_iopl(void); | |
52912 | + | |
52913 | +int gr_tpe_allow(const struct file *file); | |
52914 | + | |
52915 | +void gr_set_chroot_entries(struct task_struct *task, struct path *path); | |
52916 | +void gr_clear_chroot_entries(struct task_struct *task); | |
52917 | + | |
52918 | +void gr_log_forkfail(const int retval); | |
52919 | +void gr_log_timechange(void); | |
52920 | +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t); | |
52921 | +void gr_log_chdir(const struct dentry *dentry, | |
52922 | + const struct vfsmount *mnt); | |
52923 | +void gr_log_chroot_exec(const struct dentry *dentry, | |
52924 | + const struct vfsmount *mnt); | |
52925 | +void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv); | |
52926 | +void gr_log_remount(const char *devname, const int retval); | |
52927 | +void gr_log_unmount(const char *devname, const int retval); | |
52928 | +void gr_log_mount(const char *from, const char *to, const int retval); | |
52929 | +void gr_log_textrel(struct vm_area_struct *vma); | |
52930 | +void gr_log_rwxmmap(struct file *file); | |
52931 | +void gr_log_rwxmprotect(struct file *file); | |
52932 | + | |
52933 | +int gr_handle_follow_link(const struct inode *parent, | |
52934 | + const struct inode *inode, | |
52935 | + const struct dentry *dentry, | |
52936 | + const struct vfsmount *mnt); | |
52937 | +int gr_handle_fifo(const struct dentry *dentry, | |
52938 | + const struct vfsmount *mnt, | |
52939 | + const struct dentry *dir, const int flag, | |
52940 | + const int acc_mode); | |
52941 | +int gr_handle_hardlink(const struct dentry *dentry, | |
52942 | + const struct vfsmount *mnt, | |
52943 | + struct inode *inode, | |
52944 | + const int mode, const char *to); | |
52945 | + | |
52946 | +int gr_is_capable(const int cap); | |
52947 | +int gr_is_capable_nolog(const int cap); | |
52948 | +void gr_learn_resource(const struct task_struct *task, const int limit, | |
52949 | + const unsigned long wanted, const int gt); | |
52950 | +void gr_copy_label(struct task_struct *tsk); | |
52951 | +void gr_handle_crash(struct task_struct *task, const int sig); | |
52952 | +int gr_handle_signal(const struct task_struct *p, const int sig); | |
52953 | +int gr_check_crash_uid(const uid_t uid); | |
52954 | +int gr_check_protected_task(const struct task_struct *task); | |
52955 | +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type); | |
52956 | +int gr_acl_handle_mmap(const struct file *file, | |
52957 | + const unsigned long prot); | |
52958 | +int gr_acl_handle_mprotect(const struct file *file, | |
52959 | + const unsigned long prot); | |
52960 | +int gr_check_hidden_task(const struct task_struct *tsk); | |
52961 | +__u32 gr_acl_handle_truncate(const struct dentry *dentry, | |
52962 | + const struct vfsmount *mnt); | |
52963 | +__u32 gr_acl_handle_utime(const struct dentry *dentry, | |
52964 | + const struct vfsmount *mnt); | |
52965 | +__u32 gr_acl_handle_access(const struct dentry *dentry, | |
52966 | + const struct vfsmount *mnt, const int fmode); | |
52967 | +__u32 gr_acl_handle_fchmod(const struct dentry *dentry, | |
52968 | + const struct vfsmount *mnt, mode_t mode); | |
52969 | +__u32 gr_acl_handle_chmod(const struct dentry *dentry, | |
52970 | + const struct vfsmount *mnt, mode_t mode); | |
52971 | +__u32 gr_acl_handle_chown(const struct dentry *dentry, | |
52972 | + const struct vfsmount *mnt); | |
52973 | +__u32 gr_acl_handle_setxattr(const struct dentry *dentry, | |
52974 | + const struct vfsmount *mnt); | |
52975 | +int gr_handle_ptrace(struct task_struct *task, const long request); | |
52976 | +int gr_handle_proc_ptrace(struct task_struct *task); | |
52977 | +__u32 gr_acl_handle_execve(const struct dentry *dentry, | |
52978 | + const struct vfsmount *mnt); | |
52979 | +int gr_check_crash_exec(const struct file *filp); | |
52980 | +int gr_acl_is_enabled(void); | |
52981 | +void gr_set_kernel_label(struct task_struct *task); | |
52982 | +void gr_set_role_label(struct task_struct *task, const uid_t uid, | |
52983 | + const gid_t gid); | |
52984 | +int gr_set_proc_label(const struct dentry *dentry, | |
52985 | + const struct vfsmount *mnt, | |
52986 | + const int unsafe_share); | |
52987 | +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry, | |
52988 | + const struct vfsmount *mnt); | |
52989 | +__u32 gr_acl_handle_open(const struct dentry *dentry, | |
52990 | + const struct vfsmount *mnt, const int fmode); | |
52991 | +__u32 gr_acl_handle_creat(const struct dentry *dentry, | |
52992 | + const struct dentry *p_dentry, | |
52993 | + const struct vfsmount *p_mnt, const int fmode, | |
52994 | + const int imode); | |
52995 | +void gr_handle_create(const struct dentry *dentry, | |
52996 | + const struct vfsmount *mnt); | |
52997 | +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry, | |
52998 | + const struct dentry *parent_dentry, | |
52999 | + const struct vfsmount *parent_mnt, | |
53000 | + const int mode); | |
53001 | +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry, | |
53002 | + const struct dentry *parent_dentry, | |
53003 | + const struct vfsmount *parent_mnt); | |
53004 | +__u32 gr_acl_handle_rmdir(const struct dentry *dentry, | |
53005 | + const struct vfsmount *mnt); | |
53006 | +void gr_handle_delete(const ino_t ino, const dev_t dev); | |
53007 | +__u32 gr_acl_handle_unlink(const struct dentry *dentry, | |
53008 | + const struct vfsmount *mnt); | |
53009 | +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry, | |
53010 | + const struct dentry *parent_dentry, | |
53011 | + const struct vfsmount *parent_mnt, | |
53012 | + const char *from); | |
53013 | +__u32 gr_acl_handle_link(const struct dentry *new_dentry, | |
53014 | + const struct dentry *parent_dentry, | |
53015 | + const struct vfsmount *parent_mnt, | |
53016 | + const struct dentry *old_dentry, | |
53017 | + const struct vfsmount *old_mnt, const char *to); | |
53018 | +int gr_acl_handle_rename(struct dentry *new_dentry, | |
53019 | + struct dentry *parent_dentry, | |
53020 | + const struct vfsmount *parent_mnt, | |
53021 | + struct dentry *old_dentry, | |
53022 | + struct inode *old_parent_inode, | |
53023 | + struct vfsmount *old_mnt, const char *newname); | |
53024 | +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir, | |
53025 | + struct dentry *old_dentry, | |
53026 | + struct dentry *new_dentry, | |
53027 | + struct vfsmount *mnt, const __u8 replace); | |
53028 | +__u32 gr_check_link(const struct dentry *new_dentry, | |
53029 | + const struct dentry *parent_dentry, | |
53030 | + const struct vfsmount *parent_mnt, | |
53031 | + const struct dentry *old_dentry, | |
53032 | + const struct vfsmount *old_mnt); | |
53033 | +int gr_acl_handle_filldir(const struct file *file, const char *name, | |
53034 | + const unsigned int namelen, const ino_t ino); | |
53035 | + | |
53036 | +__u32 gr_acl_handle_unix(const struct dentry *dentry, | |
53037 | + const struct vfsmount *mnt); | |
53038 | +void gr_acl_handle_exit(void); | |
53039 | +void gr_acl_handle_psacct(struct task_struct *task, const long code); | |
53040 | +int gr_acl_handle_procpidmem(const struct task_struct *task); | |
53041 | +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags); | |
53042 | +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode); | |
53043 | +void gr_audit_ptrace(struct task_struct *task); | |
53044 | +dev_t gr_get_dev_from_dentry(struct dentry *dentry); | |
53045 | + | |
53046 | +#ifdef CONFIG_GRKERNSEC | |
53047 | +void task_grsec_rbac(struct seq_file *m, struct task_struct *p); | |
53048 | +void gr_handle_vm86(void); | |
53049 | +void gr_handle_mem_readwrite(u64 from, u64 to); | |
53050 | + | |
53051 | +extern int grsec_enable_dmesg; | |
53052 | +extern int grsec_disable_privio; | |
53053 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
53054 | +extern int grsec_enable_chroot_findtask; | |
53055 | +#endif | |
53056 | +#endif | |
53057 | + | |
53058 | +#endif | |
53059 | diff -urNp linux-3.0.3/include/linux/grsock.h linux-3.0.3/include/linux/grsock.h | |
53060 | --- linux-3.0.3/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500 | |
53061 | +++ linux-3.0.3/include/linux/grsock.h 2011-08-23 21:48:14.000000000 -0400 | |
53062 | @@ -0,0 +1,19 @@ | |
53063 | +#ifndef __GRSOCK_H | |
53064 | +#define __GRSOCK_H | |
53065 | + | |
53066 | +extern void gr_attach_curr_ip(const struct sock *sk); | |
53067 | +extern int gr_handle_sock_all(const int family, const int type, | |
53068 | + const int protocol); | |
53069 | +extern int gr_handle_sock_server(const struct sockaddr *sck); | |
53070 | +extern int gr_handle_sock_server_other(const struct sock *sck); | |
53071 | +extern int gr_handle_sock_client(const struct sockaddr *sck); | |
53072 | +extern int gr_search_connect(struct socket * sock, | |
53073 | + struct sockaddr_in * addr); | |
53074 | +extern int gr_search_bind(struct socket * sock, | |
53075 | + struct sockaddr_in * addr); | |
53076 | +extern int gr_search_listen(struct socket * sock); | |
53077 | +extern int gr_search_accept(struct socket * sock); | |
53078 | +extern int gr_search_socket(const int domain, const int type, | |
53079 | + const int protocol); | |
53080 | + | |
53081 | +#endif | |
53082 | diff -urNp linux-3.0.3/include/linux/hid.h linux-3.0.3/include/linux/hid.h | |
53083 | --- linux-3.0.3/include/linux/hid.h 2011-07-21 22:17:23.000000000 -0400 | |
53084 | +++ linux-3.0.3/include/linux/hid.h 2011-08-23 21:47:56.000000000 -0400 | |
53085 | @@ -675,7 +675,7 @@ struct hid_ll_driver { | |
53086 | unsigned int code, int value); | |
53087 | ||
53088 | int (*parse)(struct hid_device *hdev); | |
53089 | -}; | |
53090 | +} __no_const; | |
53091 | ||
53092 | #define PM_HINT_FULLON 1<<5 | |
53093 | #define PM_HINT_NORMAL 1<<1 | |
53094 | diff -urNp linux-3.0.3/include/linux/highmem.h linux-3.0.3/include/linux/highmem.h | |
53095 | --- linux-3.0.3/include/linux/highmem.h 2011-07-21 22:17:23.000000000 -0400 | |
53096 | +++ linux-3.0.3/include/linux/highmem.h 2011-08-23 21:47:56.000000000 -0400 | |
53097 | @@ -185,6 +185,18 @@ static inline void clear_highpage(struct | |
53098 | kunmap_atomic(kaddr, KM_USER0); | |
53099 | } | |
53100 | ||
53101 | +static inline void sanitize_highpage(struct page *page) | |
53102 | +{ | |
53103 | + void *kaddr; | |
53104 | + unsigned long flags; | |
53105 | + | |
53106 | + local_irq_save(flags); | |
53107 | + kaddr = kmap_atomic(page, KM_CLEARPAGE); | |
53108 | + clear_page(kaddr); | |
53109 | + kunmap_atomic(kaddr, KM_CLEARPAGE); | |
53110 | + local_irq_restore(flags); | |
53111 | +} | |
53112 | + | |
53113 | static inline void zero_user_segments(struct page *page, | |
53114 | unsigned start1, unsigned end1, | |
53115 | unsigned start2, unsigned end2) | |
53116 | diff -urNp linux-3.0.3/include/linux/i2c.h linux-3.0.3/include/linux/i2c.h | |
53117 | --- linux-3.0.3/include/linux/i2c.h 2011-07-21 22:17:23.000000000 -0400 | |
53118 | +++ linux-3.0.3/include/linux/i2c.h 2011-08-23 21:47:56.000000000 -0400 | |
53119 | @@ -346,6 +346,7 @@ struct i2c_algorithm { | |
53120 | /* To determine what the adapter supports */ | |
53121 | u32 (*functionality) (struct i2c_adapter *); | |
53122 | }; | |
53123 | +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const; | |
53124 | ||
53125 | /* | |
53126 | * i2c_adapter is the structure used to identify a physical i2c bus along | |
53127 | diff -urNp linux-3.0.3/include/linux/i2o.h linux-3.0.3/include/linux/i2o.h | |
53128 | --- linux-3.0.3/include/linux/i2o.h 2011-07-21 22:17:23.000000000 -0400 | |
53129 | +++ linux-3.0.3/include/linux/i2o.h 2011-08-23 21:47:56.000000000 -0400 | |
53130 | @@ -564,7 +564,7 @@ struct i2o_controller { | |
53131 | struct i2o_device *exec; /* Executive */ | |
53132 | #if BITS_PER_LONG == 64 | |
53133 | spinlock_t context_list_lock; /* lock for context_list */ | |
53134 | - atomic_t context_list_counter; /* needed for unique contexts */ | |
53135 | + atomic_unchecked_t context_list_counter; /* needed for unique contexts */ | |
53136 | struct list_head context_list; /* list of context id's | |
53137 | and pointers */ | |
53138 | #endif | |
53139 | diff -urNp linux-3.0.3/include/linux/init.h linux-3.0.3/include/linux/init.h | |
53140 | --- linux-3.0.3/include/linux/init.h 2011-07-21 22:17:23.000000000 -0400 | |
53141 | +++ linux-3.0.3/include/linux/init.h 2011-08-23 21:47:56.000000000 -0400 | |
53142 | @@ -293,13 +293,13 @@ void __init parse_early_options(char *cm | |
53143 | ||
53144 | /* Each module must use one module_init(). */ | |
53145 | #define module_init(initfn) \ | |
53146 | - static inline initcall_t __inittest(void) \ | |
53147 | + static inline __used initcall_t __inittest(void) \ | |
53148 | { return initfn; } \ | |
53149 | int init_module(void) __attribute__((alias(#initfn))); | |
53150 | ||
53151 | /* This is only required if you want to be unloadable. */ | |
53152 | #define module_exit(exitfn) \ | |
53153 | - static inline exitcall_t __exittest(void) \ | |
53154 | + static inline __used exitcall_t __exittest(void) \ | |
53155 | { return exitfn; } \ | |
53156 | void cleanup_module(void) __attribute__((alias(#exitfn))); | |
53157 | ||
53158 | diff -urNp linux-3.0.3/include/linux/init_task.h linux-3.0.3/include/linux/init_task.h | |
53159 | --- linux-3.0.3/include/linux/init_task.h 2011-07-21 22:17:23.000000000 -0400 | |
53160 | +++ linux-3.0.3/include/linux/init_task.h 2011-08-23 21:47:56.000000000 -0400 | |
53161 | @@ -126,6 +126,12 @@ extern struct cred init_cred; | |
53162 | # define INIT_PERF_EVENTS(tsk) | |
53163 | #endif | |
53164 | ||
53165 | +#ifdef CONFIG_X86 | |
53166 | +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO, | |
53167 | +#else | |
53168 | +#define INIT_TASK_THREAD_INFO | |
53169 | +#endif | |
53170 | + | |
53171 | /* | |
53172 | * INIT_TASK is used to set up the first task table, touch at | |
53173 | * your own risk!. Base=0, limit=0x1fffff (=2MB) | |
53174 | @@ -164,6 +170,7 @@ extern struct cred init_cred; | |
53175 | RCU_INIT_POINTER(.cred, &init_cred), \ | |
53176 | .comm = "swapper", \ | |
53177 | .thread = INIT_THREAD, \ | |
53178 | + INIT_TASK_THREAD_INFO \ | |
53179 | .fs = &init_fs, \ | |
53180 | .files = &init_files, \ | |
53181 | .signal = &init_signals, \ | |
53182 | diff -urNp linux-3.0.3/include/linux/intel-iommu.h linux-3.0.3/include/linux/intel-iommu.h | |
53183 | --- linux-3.0.3/include/linux/intel-iommu.h 2011-07-21 22:17:23.000000000 -0400 | |
53184 | +++ linux-3.0.3/include/linux/intel-iommu.h 2011-08-23 21:47:56.000000000 -0400 | |
53185 | @@ -296,7 +296,7 @@ struct iommu_flush { | |
53186 | u8 fm, u64 type); | |
53187 | void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr, | |
53188 | unsigned int size_order, u64 type); | |
53189 | -}; | |
53190 | +} __no_const; | |
53191 | ||
53192 | enum { | |
53193 | SR_DMAR_FECTL_REG, | |
53194 | diff -urNp linux-3.0.3/include/linux/interrupt.h linux-3.0.3/include/linux/interrupt.h | |
53195 | --- linux-3.0.3/include/linux/interrupt.h 2011-07-21 22:17:23.000000000 -0400 | |
53196 | +++ linux-3.0.3/include/linux/interrupt.h 2011-08-23 21:47:56.000000000 -0400 | |
53197 | @@ -422,7 +422,7 @@ enum | |
53198 | /* map softirq index to softirq name. update 'softirq_to_name' in | |
53199 | * kernel/softirq.c when adding a new softirq. | |
53200 | */ | |
53201 | -extern char *softirq_to_name[NR_SOFTIRQS]; | |
53202 | +extern const char * const softirq_to_name[NR_SOFTIRQS]; | |
53203 | ||
53204 | /* softirq mask and active fields moved to irq_cpustat_t in | |
53205 | * asm/hardirq.h to get better cache usage. KAO | |
53206 | @@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS | |
53207 | ||
53208 | struct softirq_action | |
53209 | { | |
53210 | - void (*action)(struct softirq_action *); | |
53211 | + void (*action)(void); | |
53212 | }; | |
53213 | ||
53214 | asmlinkage void do_softirq(void); | |
53215 | asmlinkage void __do_softirq(void); | |
53216 | -extern void open_softirq(int nr, void (*action)(struct softirq_action *)); | |
53217 | +extern void open_softirq(int nr, void (*action)(void)); | |
53218 | extern void softirq_init(void); | |
53219 | static inline void __raise_softirq_irqoff(unsigned int nr) | |
53220 | { | |
53221 | diff -urNp linux-3.0.3/include/linux/kallsyms.h linux-3.0.3/include/linux/kallsyms.h | |
53222 | --- linux-3.0.3/include/linux/kallsyms.h 2011-07-21 22:17:23.000000000 -0400 | |
53223 | +++ linux-3.0.3/include/linux/kallsyms.h 2011-08-23 21:48:14.000000000 -0400 | |
53224 | @@ -15,7 +15,8 @@ | |
53225 | ||
53226 | struct module; | |
53227 | ||
53228 | -#ifdef CONFIG_KALLSYMS | |
53229 | +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS) | |
53230 | +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
53231 | /* Lookup the address for a symbol. Returns 0 if not found. */ | |
53232 | unsigned long kallsyms_lookup_name(const char *name); | |
53233 | ||
53234 | @@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un | |
53235 | /* Stupid that this does nothing, but I didn't create this mess. */ | |
53236 | #define __print_symbol(fmt, addr) | |
53237 | #endif /*CONFIG_KALLSYMS*/ | |
53238 | +#else /* when included by kallsyms.c, vsnprintf.c, or | |
53239 | + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */ | |
53240 | +extern void __print_symbol(const char *fmt, unsigned long address); | |
53241 | +extern int sprint_backtrace(char *buffer, unsigned long address); | |
53242 | +extern int sprint_symbol(char *buffer, unsigned long address); | |
53243 | +const char *kallsyms_lookup(unsigned long addr, | |
53244 | + unsigned long *symbolsize, | |
53245 | + unsigned long *offset, | |
53246 | + char **modname, char *namebuf); | |
53247 | +#endif | |
53248 | ||
53249 | /* This macro allows us to keep printk typechecking */ | |
53250 | static void __check_printsym_format(const char *fmt, ...) | |
53251 | diff -urNp linux-3.0.3/include/linux/kgdb.h linux-3.0.3/include/linux/kgdb.h | |
53252 | --- linux-3.0.3/include/linux/kgdb.h 2011-07-21 22:17:23.000000000 -0400 | |
53253 | +++ linux-3.0.3/include/linux/kgdb.h 2011-08-26 19:49:56.000000000 -0400 | |
53254 | @@ -53,7 +53,7 @@ extern int kgdb_connected; | |
53255 | extern int kgdb_io_module_registered; | |
53256 | ||
53257 | extern atomic_t kgdb_setting_breakpoint; | |
53258 | -extern atomic_t kgdb_cpu_doing_single_step; | |
53259 | +extern atomic_unchecked_t kgdb_cpu_doing_single_step; | |
53260 | ||
53261 | extern struct task_struct *kgdb_usethread; | |
53262 | extern struct task_struct *kgdb_contthread; | |
53263 | @@ -251,7 +251,7 @@ struct kgdb_arch { | |
53264 | void (*disable_hw_break)(struct pt_regs *regs); | |
53265 | void (*remove_all_hw_break)(void); | |
53266 | void (*correct_hw_break)(void); | |
53267 | -}; | |
53268 | +} __do_const; | |
53269 | ||
53270 | /** | |
53271 | * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB. | |
53272 | @@ -276,7 +276,7 @@ struct kgdb_io { | |
53273 | void (*pre_exception) (void); | |
53274 | void (*post_exception) (void); | |
53275 | int is_console; | |
53276 | -}; | |
53277 | +} __do_const; | |
53278 | ||
53279 | extern struct kgdb_arch arch_kgdb_ops; | |
53280 | ||
53281 | diff -urNp linux-3.0.3/include/linux/kmod.h linux-3.0.3/include/linux/kmod.h | |
53282 | --- linux-3.0.3/include/linux/kmod.h 2011-07-21 22:17:23.000000000 -0400 | |
53283 | +++ linux-3.0.3/include/linux/kmod.h 2011-08-23 21:48:14.000000000 -0400 | |
53284 | @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysc | |
53285 | * usually useless though. */ | |
53286 | extern int __request_module(bool wait, const char *name, ...) \ | |
53287 | __attribute__((format(printf, 2, 3))); | |
53288 | +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \ | |
53289 | + __attribute__((format(printf, 3, 4))); | |
53290 | #define request_module(mod...) __request_module(true, mod) | |
53291 | #define request_module_nowait(mod...) __request_module(false, mod) | |
53292 | #define try_then_request_module(x, mod...) \ | |
53293 | diff -urNp linux-3.0.3/include/linux/kvm_host.h linux-3.0.3/include/linux/kvm_host.h | |
53294 | --- linux-3.0.3/include/linux/kvm_host.h 2011-07-21 22:17:23.000000000 -0400 | |
53295 | +++ linux-3.0.3/include/linux/kvm_host.h 2011-08-23 21:47:56.000000000 -0400 | |
53296 | @@ -307,7 +307,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc | |
53297 | void vcpu_load(struct kvm_vcpu *vcpu); | |
53298 | void vcpu_put(struct kvm_vcpu *vcpu); | |
53299 | ||
53300 | -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, | |
53301 | +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align, | |
53302 | struct module *module); | |
53303 | void kvm_exit(void); | |
53304 | ||
53305 | @@ -446,7 +446,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug( | |
53306 | struct kvm_guest_debug *dbg); | |
53307 | int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run); | |
53308 | ||
53309 | -int kvm_arch_init(void *opaque); | |
53310 | +int kvm_arch_init(const void *opaque); | |
53311 | void kvm_arch_exit(void); | |
53312 | ||
53313 | int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu); | |
53314 | diff -urNp linux-3.0.3/include/linux/libata.h linux-3.0.3/include/linux/libata.h | |
53315 | --- linux-3.0.3/include/linux/libata.h 2011-07-21 22:17:23.000000000 -0400 | |
53316 | +++ linux-3.0.3/include/linux/libata.h 2011-08-26 19:49:56.000000000 -0400 | |
53317 | @@ -899,7 +899,7 @@ struct ata_port_operations { | |
53318 | * fields must be pointers. | |
53319 | */ | |
53320 | const struct ata_port_operations *inherits; | |
53321 | -}; | |
53322 | +} __do_const; | |
53323 | ||
53324 | struct ata_port_info { | |
53325 | unsigned long flags; | |
53326 | diff -urNp linux-3.0.3/include/linux/mca.h linux-3.0.3/include/linux/mca.h | |
53327 | --- linux-3.0.3/include/linux/mca.h 2011-07-21 22:17:23.000000000 -0400 | |
53328 | +++ linux-3.0.3/include/linux/mca.h 2011-08-23 21:47:56.000000000 -0400 | |
53329 | @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions { | |
53330 | int region); | |
53331 | void * (*mca_transform_memory)(struct mca_device *, | |
53332 | void *memory); | |
53333 | -}; | |
53334 | +} __no_const; | |
53335 | ||
53336 | struct mca_bus { | |
53337 | u64 default_dma_mask; | |
53338 | diff -urNp linux-3.0.3/include/linux/memory.h linux-3.0.3/include/linux/memory.h | |
53339 | --- linux-3.0.3/include/linux/memory.h 2011-07-21 22:17:23.000000000 -0400 | |
53340 | +++ linux-3.0.3/include/linux/memory.h 2011-08-23 21:47:56.000000000 -0400 | |
53341 | @@ -144,7 +144,7 @@ struct memory_accessor { | |
53342 | size_t count); | |
53343 | ssize_t (*write)(struct memory_accessor *, const char *buf, | |
53344 | off_t offset, size_t count); | |
53345 | -}; | |
53346 | +} __no_const; | |
53347 | ||
53348 | /* | |
53349 | * Kernel text modification mutex, used for code patching. Users of this lock | |
53350 | diff -urNp linux-3.0.3/include/linux/mfd/abx500.h linux-3.0.3/include/linux/mfd/abx500.h | |
53351 | --- linux-3.0.3/include/linux/mfd/abx500.h 2011-07-21 22:17:23.000000000 -0400 | |
53352 | +++ linux-3.0.3/include/linux/mfd/abx500.h 2011-08-23 21:47:56.000000000 -0400 | |
53353 | @@ -234,6 +234,7 @@ struct abx500_ops { | |
53354 | int (*event_registers_startup_state_get) (struct device *, u8 *); | |
53355 | int (*startup_irq_enabled) (struct device *, unsigned int); | |
53356 | }; | |
53357 | +typedef struct abx500_ops __no_const abx500_ops_no_const; | |
53358 | ||
53359 | int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops); | |
53360 | void abx500_remove_ops(struct device *dev); | |
53361 | diff -urNp linux-3.0.3/include/linux/mm.h linux-3.0.3/include/linux/mm.h | |
53362 | --- linux-3.0.3/include/linux/mm.h 2011-08-23 21:44:40.000000000 -0400 | |
53363 | +++ linux-3.0.3/include/linux/mm.h 2011-08-23 21:47:56.000000000 -0400 | |
53364 | @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void | |
53365 | ||
53366 | #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */ | |
53367 | #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */ | |
53368 | + | |
53369 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32) | |
53370 | +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */ | |
53371 | +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */ | |
53372 | +#else | |
53373 | #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */ | |
53374 | +#endif | |
53375 | + | |
53376 | #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */ | |
53377 | #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */ | |
53378 | ||
53379 | @@ -1009,34 +1016,6 @@ int set_page_dirty(struct page *page); | |
53380 | int set_page_dirty_lock(struct page *page); | |
53381 | int clear_page_dirty_for_io(struct page *page); | |
53382 | ||
53383 | -/* Is the vma a continuation of the stack vma above it? */ | |
53384 | -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr) | |
53385 | -{ | |
53386 | - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); | |
53387 | -} | |
53388 | - | |
53389 | -static inline int stack_guard_page_start(struct vm_area_struct *vma, | |
53390 | - unsigned long addr) | |
53391 | -{ | |
53392 | - return (vma->vm_flags & VM_GROWSDOWN) && | |
53393 | - (vma->vm_start == addr) && | |
53394 | - !vma_growsdown(vma->vm_prev, addr); | |
53395 | -} | |
53396 | - | |
53397 | -/* Is the vma a continuation of the stack vma below it? */ | |
53398 | -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr) | |
53399 | -{ | |
53400 | - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP); | |
53401 | -} | |
53402 | - | |
53403 | -static inline int stack_guard_page_end(struct vm_area_struct *vma, | |
53404 | - unsigned long addr) | |
53405 | -{ | |
53406 | - return (vma->vm_flags & VM_GROWSUP) && | |
53407 | - (vma->vm_end == addr) && | |
53408 | - !vma_growsup(vma->vm_next, addr); | |
53409 | -} | |
53410 | - | |
53411 | extern unsigned long move_page_tables(struct vm_area_struct *vma, | |
53412 | unsigned long old_addr, struct vm_area_struct *new_vma, | |
53413 | unsigned long new_addr, unsigned long len); | |
53414 | @@ -1169,6 +1148,15 @@ struct shrinker { | |
53415 | extern void register_shrinker(struct shrinker *); | |
53416 | extern void unregister_shrinker(struct shrinker *); | |
53417 | ||
53418 | +#ifdef CONFIG_MMU | |
53419 | +pgprot_t vm_get_page_prot(vm_flags_t vm_flags); | |
53420 | +#else | |
53421 | +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags) | |
53422 | +{ | |
53423 | + return __pgprot(0); | |
53424 | +} | |
53425 | +#endif | |
53426 | + | |
53427 | int vma_wants_writenotify(struct vm_area_struct *vma); | |
53428 | ||
53429 | extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr, | |
53430 | @@ -1452,6 +1440,7 @@ out: | |
53431 | } | |
53432 | ||
53433 | extern int do_munmap(struct mm_struct *, unsigned long, size_t); | |
53434 | +extern int __do_munmap(struct mm_struct *, unsigned long, size_t); | |
53435 | ||
53436 | extern unsigned long do_brk(unsigned long, unsigned long); | |
53437 | ||
53438 | @@ -1510,6 +1499,10 @@ extern struct vm_area_struct * find_vma( | |
53439 | extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr, | |
53440 | struct vm_area_struct **pprev); | |
53441 | ||
53442 | +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma); | |
53443 | +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma); | |
53444 | +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl); | |
53445 | + | |
53446 | /* Look up the first VMA which intersects the interval start_addr..end_addr-1, | |
53447 | NULL if none. Assume start_addr < end_addr. */ | |
53448 | static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr) | |
53449 | @@ -1526,15 +1519,6 @@ static inline unsigned long vma_pages(st | |
53450 | return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; | |
53451 | } | |
53452 | ||
53453 | -#ifdef CONFIG_MMU | |
53454 | -pgprot_t vm_get_page_prot(unsigned long vm_flags); | |
53455 | -#else | |
53456 | -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags) | |
53457 | -{ | |
53458 | - return __pgprot(0); | |
53459 | -} | |
53460 | -#endif | |
53461 | - | |
53462 | struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); | |
53463 | int remap_pfn_range(struct vm_area_struct *, unsigned long addr, | |
53464 | unsigned long pfn, unsigned long size, pgprot_t); | |
53465 | @@ -1647,7 +1631,7 @@ extern int unpoison_memory(unsigned long | |
53466 | extern int sysctl_memory_failure_early_kill; | |
53467 | extern int sysctl_memory_failure_recovery; | |
53468 | extern void shake_page(struct page *p, int access); | |
53469 | -extern atomic_long_t mce_bad_pages; | |
53470 | +extern atomic_long_unchecked_t mce_bad_pages; | |
53471 | extern int soft_offline_page(struct page *page, int flags); | |
53472 | ||
53473 | extern void dump_page(struct page *page); | |
53474 | @@ -1661,5 +1645,11 @@ extern void copy_user_huge_page(struct p | |
53475 | unsigned int pages_per_huge_page); | |
53476 | #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */ | |
53477 | ||
53478 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
53479 | +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot); | |
53480 | +#else | |
53481 | +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {} | |
53482 | +#endif | |
53483 | + | |
53484 | #endif /* __KERNEL__ */ | |
53485 | #endif /* _LINUX_MM_H */ | |
53486 | diff -urNp linux-3.0.3/include/linux/mm_types.h linux-3.0.3/include/linux/mm_types.h | |
53487 | --- linux-3.0.3/include/linux/mm_types.h 2011-07-21 22:17:23.000000000 -0400 | |
53488 | +++ linux-3.0.3/include/linux/mm_types.h 2011-08-23 21:47:56.000000000 -0400 | |
53489 | @@ -184,6 +184,8 @@ struct vm_area_struct { | |
53490 | #ifdef CONFIG_NUMA | |
53491 | struct mempolicy *vm_policy; /* NUMA policy for the VMA */ | |
53492 | #endif | |
53493 | + | |
53494 | + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */ | |
53495 | }; | |
53496 | ||
53497 | struct core_thread { | |
53498 | @@ -316,6 +318,24 @@ struct mm_struct { | |
53499 | #ifdef CONFIG_CPUMASK_OFFSTACK | |
53500 | struct cpumask cpumask_allocation; | |
53501 | #endif | |
53502 | + | |
53503 | +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
53504 | + unsigned long pax_flags; | |
53505 | +#endif | |
53506 | + | |
53507 | +#ifdef CONFIG_PAX_DLRESOLVE | |
53508 | + unsigned long call_dl_resolve; | |
53509 | +#endif | |
53510 | + | |
53511 | +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT) | |
53512 | + unsigned long call_syscall; | |
53513 | +#endif | |
53514 | + | |
53515 | +#ifdef CONFIG_PAX_ASLR | |
53516 | + unsigned long delta_mmap; /* randomized offset */ | |
53517 | + unsigned long delta_stack; /* randomized offset */ | |
53518 | +#endif | |
53519 | + | |
53520 | }; | |
53521 | ||
53522 | static inline void mm_init_cpumask(struct mm_struct *mm) | |
53523 | diff -urNp linux-3.0.3/include/linux/mmu_notifier.h linux-3.0.3/include/linux/mmu_notifier.h | |
53524 | --- linux-3.0.3/include/linux/mmu_notifier.h 2011-07-21 22:17:23.000000000 -0400 | |
53525 | +++ linux-3.0.3/include/linux/mmu_notifier.h 2011-08-23 21:47:56.000000000 -0400 | |
53526 | @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr | |
53527 | */ | |
53528 | #define ptep_clear_flush_notify(__vma, __address, __ptep) \ | |
53529 | ({ \ | |
53530 | - pte_t __pte; \ | |
53531 | + pte_t ___pte; \ | |
53532 | struct vm_area_struct *___vma = __vma; \ | |
53533 | unsigned long ___address = __address; \ | |
53534 | - __pte = ptep_clear_flush(___vma, ___address, __ptep); \ | |
53535 | + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \ | |
53536 | mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \ | |
53537 | - __pte; \ | |
53538 | + ___pte; \ | |
53539 | }) | |
53540 | ||
53541 | #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \ | |
53542 | diff -urNp linux-3.0.3/include/linux/mmzone.h linux-3.0.3/include/linux/mmzone.h | |
53543 | --- linux-3.0.3/include/linux/mmzone.h 2011-07-21 22:17:23.000000000 -0400 | |
53544 | +++ linux-3.0.3/include/linux/mmzone.h 2011-08-23 21:47:56.000000000 -0400 | |
53545 | @@ -350,7 +350,7 @@ struct zone { | |
53546 | unsigned long flags; /* zone flags, see below */ | |
53547 | ||
53548 | /* Zone statistics */ | |
53549 | - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
53550 | + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
53551 | ||
53552 | /* | |
53553 | * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on | |
53554 | diff -urNp linux-3.0.3/include/linux/mod_devicetable.h linux-3.0.3/include/linux/mod_devicetable.h | |
53555 | --- linux-3.0.3/include/linux/mod_devicetable.h 2011-07-21 22:17:23.000000000 -0400 | |
53556 | +++ linux-3.0.3/include/linux/mod_devicetable.h 2011-08-23 21:47:56.000000000 -0400 | |
53557 | @@ -12,7 +12,7 @@ | |
53558 | typedef unsigned long kernel_ulong_t; | |
53559 | #endif | |
53560 | ||
53561 | -#define PCI_ANY_ID (~0) | |
53562 | +#define PCI_ANY_ID ((__u16)~0) | |
53563 | ||
53564 | struct pci_device_id { | |
53565 | __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/ | |
53566 | @@ -131,7 +131,7 @@ struct usb_device_id { | |
53567 | #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100 | |
53568 | #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200 | |
53569 | ||
53570 | -#define HID_ANY_ID (~0) | |
53571 | +#define HID_ANY_ID (~0U) | |
53572 | ||
53573 | struct hid_device_id { | |
53574 | __u16 bus; | |
53575 | diff -urNp linux-3.0.3/include/linux/module.h linux-3.0.3/include/linux/module.h | |
53576 | --- linux-3.0.3/include/linux/module.h 2011-07-21 22:17:23.000000000 -0400 | |
53577 | +++ linux-3.0.3/include/linux/module.h 2011-08-23 21:47:56.000000000 -0400 | |
53578 | @@ -16,6 +16,7 @@ | |
53579 | #include <linux/kobject.h> | |
53580 | #include <linux/moduleparam.h> | |
53581 | #include <linux/tracepoint.h> | |
53582 | +#include <linux/fs.h> | |
53583 | ||
53584 | #include <linux/percpu.h> | |
53585 | #include <asm/module.h> | |
53586 | @@ -325,19 +326,16 @@ struct module | |
53587 | int (*init)(void); | |
53588 | ||
53589 | /* If this is non-NULL, vfree after init() returns */ | |
53590 | - void *module_init; | |
53591 | + void *module_init_rx, *module_init_rw; | |
53592 | ||
53593 | /* Here is the actual code + data, vfree'd on unload. */ | |
53594 | - void *module_core; | |
53595 | + void *module_core_rx, *module_core_rw; | |
53596 | ||
53597 | /* Here are the sizes of the init and core sections */ | |
53598 | - unsigned int init_size, core_size; | |
53599 | + unsigned int init_size_rw, core_size_rw; | |
53600 | ||
53601 | /* The size of the executable code in each section. */ | |
53602 | - unsigned int init_text_size, core_text_size; | |
53603 | - | |
53604 | - /* Size of RO sections of the module (text+rodata) */ | |
53605 | - unsigned int init_ro_size, core_ro_size; | |
53606 | + unsigned int init_size_rx, core_size_rx; | |
53607 | ||
53608 | /* Arch-specific module values */ | |
53609 | struct mod_arch_specific arch; | |
53610 | @@ -393,6 +391,10 @@ struct module | |
53611 | #ifdef CONFIG_EVENT_TRACING | |
53612 | struct ftrace_event_call **trace_events; | |
53613 | unsigned int num_trace_events; | |
53614 | + struct file_operations trace_id; | |
53615 | + struct file_operations trace_enable; | |
53616 | + struct file_operations trace_format; | |
53617 | + struct file_operations trace_filter; | |
53618 | #endif | |
53619 | #ifdef CONFIG_FTRACE_MCOUNT_RECORD | |
53620 | unsigned int num_ftrace_callsites; | |
53621 | @@ -443,16 +445,46 @@ bool is_module_address(unsigned long add | |
53622 | bool is_module_percpu_address(unsigned long addr); | |
53623 | bool is_module_text_address(unsigned long addr); | |
53624 | ||
53625 | +static inline int within_module_range(unsigned long addr, void *start, unsigned long size) | |
53626 | +{ | |
53627 | + | |
53628 | +#ifdef CONFIG_PAX_KERNEXEC | |
53629 | + if (ktla_ktva(addr) >= (unsigned long)start && | |
53630 | + ktla_ktva(addr) < (unsigned long)start + size) | |
53631 | + return 1; | |
53632 | +#endif | |
53633 | + | |
53634 | + return ((void *)addr >= start && (void *)addr < start + size); | |
53635 | +} | |
53636 | + | |
53637 | +static inline int within_module_core_rx(unsigned long addr, struct module *mod) | |
53638 | +{ | |
53639 | + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx); | |
53640 | +} | |
53641 | + | |
53642 | +static inline int within_module_core_rw(unsigned long addr, struct module *mod) | |
53643 | +{ | |
53644 | + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw); | |
53645 | +} | |
53646 | + | |
53647 | +static inline int within_module_init_rx(unsigned long addr, struct module *mod) | |
53648 | +{ | |
53649 | + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx); | |
53650 | +} | |
53651 | + | |
53652 | +static inline int within_module_init_rw(unsigned long addr, struct module *mod) | |
53653 | +{ | |
53654 | + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw); | |
53655 | +} | |
53656 | + | |
53657 | static inline int within_module_core(unsigned long addr, struct module *mod) | |
53658 | { | |
53659 | - return (unsigned long)mod->module_core <= addr && | |
53660 | - addr < (unsigned long)mod->module_core + mod->core_size; | |
53661 | + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod); | |
53662 | } | |
53663 | ||
53664 | static inline int within_module_init(unsigned long addr, struct module *mod) | |
53665 | { | |
53666 | - return (unsigned long)mod->module_init <= addr && | |
53667 | - addr < (unsigned long)mod->module_init + mod->init_size; | |
53668 | + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod); | |
53669 | } | |
53670 | ||
53671 | /* Search for module by name: must hold module_mutex. */ | |
53672 | diff -urNp linux-3.0.3/include/linux/moduleloader.h linux-3.0.3/include/linux/moduleloader.h | |
53673 | --- linux-3.0.3/include/linux/moduleloader.h 2011-07-21 22:17:23.000000000 -0400 | |
53674 | +++ linux-3.0.3/include/linux/moduleloader.h 2011-08-23 21:47:56.000000000 -0400 | |
53675 | @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st | |
53676 | sections. Returns NULL on failure. */ | |
53677 | void *module_alloc(unsigned long size); | |
53678 | ||
53679 | +#ifdef CONFIG_PAX_KERNEXEC | |
53680 | +void *module_alloc_exec(unsigned long size); | |
53681 | +#else | |
53682 | +#define module_alloc_exec(x) module_alloc(x) | |
53683 | +#endif | |
53684 | + | |
53685 | /* Free memory returned from module_alloc. */ | |
53686 | void module_free(struct module *mod, void *module_region); | |
53687 | ||
53688 | +#ifdef CONFIG_PAX_KERNEXEC | |
53689 | +void module_free_exec(struct module *mod, void *module_region); | |
53690 | +#else | |
53691 | +#define module_free_exec(x, y) module_free((x), (y)) | |
53692 | +#endif | |
53693 | + | |
53694 | /* Apply the given relocation to the (simplified) ELF. Return -error | |
53695 | or 0. */ | |
53696 | int apply_relocate(Elf_Shdr *sechdrs, | |
53697 | diff -urNp linux-3.0.3/include/linux/moduleparam.h linux-3.0.3/include/linux/moduleparam.h | |
53698 | --- linux-3.0.3/include/linux/moduleparam.h 2011-07-21 22:17:23.000000000 -0400 | |
53699 | +++ linux-3.0.3/include/linux/moduleparam.h 2011-08-23 21:47:56.000000000 -0400 | |
53700 | @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock | |
53701 | * @len is usually just sizeof(string). | |
53702 | */ | |
53703 | #define module_param_string(name, string, len, perm) \ | |
53704 | - static const struct kparam_string __param_string_##name \ | |
53705 | + static const struct kparam_string __param_string_##name __used \ | |
53706 | = { len, string }; \ | |
53707 | __module_param_call(MODULE_PARAM_PREFIX, name, \ | |
53708 | ¶m_ops_string, \ | |
53709 | @@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe | |
53710 | * module_param_named() for why this might be necessary. | |
53711 | */ | |
53712 | #define module_param_array_named(name, array, type, nump, perm) \ | |
53713 | - static const struct kparam_array __param_arr_##name \ | |
53714 | + static const struct kparam_array __param_arr_##name __used \ | |
53715 | = { .max = ARRAY_SIZE(array), .num = nump, \ | |
53716 | .ops = ¶m_ops_##type, \ | |
53717 | .elemsize = sizeof(array[0]), .elem = array }; \ | |
53718 | diff -urNp linux-3.0.3/include/linux/namei.h linux-3.0.3/include/linux/namei.h | |
53719 | --- linux-3.0.3/include/linux/namei.h 2011-07-21 22:17:23.000000000 -0400 | |
53720 | +++ linux-3.0.3/include/linux/namei.h 2011-08-23 21:47:56.000000000 -0400 | |
53721 | @@ -24,7 +24,7 @@ struct nameidata { | |
53722 | unsigned seq; | |
53723 | int last_type; | |
53724 | unsigned depth; | |
53725 | - char *saved_names[MAX_NESTED_LINKS + 1]; | |
53726 | + const char *saved_names[MAX_NESTED_LINKS + 1]; | |
53727 | ||
53728 | /* Intent data */ | |
53729 | union { | |
53730 | @@ -91,12 +91,12 @@ extern int follow_up(struct path *); | |
53731 | extern struct dentry *lock_rename(struct dentry *, struct dentry *); | |
53732 | extern void unlock_rename(struct dentry *, struct dentry *); | |
53733 | ||
53734 | -static inline void nd_set_link(struct nameidata *nd, char *path) | |
53735 | +static inline void nd_set_link(struct nameidata *nd, const char *path) | |
53736 | { | |
53737 | nd->saved_names[nd->depth] = path; | |
53738 | } | |
53739 | ||
53740 | -static inline char *nd_get_link(struct nameidata *nd) | |
53741 | +static inline const char *nd_get_link(const struct nameidata *nd) | |
53742 | { | |
53743 | return nd->saved_names[nd->depth]; | |
53744 | } | |
53745 | diff -urNp linux-3.0.3/include/linux/netdevice.h linux-3.0.3/include/linux/netdevice.h | |
53746 | --- linux-3.0.3/include/linux/netdevice.h 2011-08-23 21:44:40.000000000 -0400 | |
53747 | +++ linux-3.0.3/include/linux/netdevice.h 2011-08-23 21:47:56.000000000 -0400 | |
53748 | @@ -979,6 +979,7 @@ struct net_device_ops { | |
53749 | int (*ndo_set_features)(struct net_device *dev, | |
53750 | u32 features); | |
53751 | }; | |
53752 | +typedef struct net_device_ops __no_const net_device_ops_no_const; | |
53753 | ||
53754 | /* | |
53755 | * The DEVICE structure. | |
53756 | diff -urNp linux-3.0.3/include/linux/netfilter/xt_gradm.h linux-3.0.3/include/linux/netfilter/xt_gradm.h | |
53757 | --- linux-3.0.3/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500 | |
53758 | +++ linux-3.0.3/include/linux/netfilter/xt_gradm.h 2011-08-23 21:48:14.000000000 -0400 | |
53759 | @@ -0,0 +1,9 @@ | |
53760 | +#ifndef _LINUX_NETFILTER_XT_GRADM_H | |
53761 | +#define _LINUX_NETFILTER_XT_GRADM_H 1 | |
53762 | + | |
53763 | +struct xt_gradm_mtinfo { | |
53764 | + __u16 flags; | |
53765 | + __u16 invflags; | |
53766 | +}; | |
53767 | + | |
53768 | +#endif | |
53769 | diff -urNp linux-3.0.3/include/linux/oprofile.h linux-3.0.3/include/linux/oprofile.h | |
53770 | --- linux-3.0.3/include/linux/oprofile.h 2011-07-21 22:17:23.000000000 -0400 | |
53771 | +++ linux-3.0.3/include/linux/oprofile.h 2011-08-23 21:47:56.000000000 -0400 | |
53772 | @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super | |
53773 | int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root, | |
53774 | char const * name, ulong * val); | |
53775 | ||
53776 | -/** Create a file for read-only access to an atomic_t. */ | |
53777 | +/** Create a file for read-only access to an atomic_unchecked_t. */ | |
53778 | int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root, | |
53779 | - char const * name, atomic_t * val); | |
53780 | + char const * name, atomic_unchecked_t * val); | |
53781 | ||
53782 | /** create a directory */ | |
53783 | struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root, | |
53784 | diff -urNp linux-3.0.3/include/linux/padata.h linux-3.0.3/include/linux/padata.h | |
53785 | --- linux-3.0.3/include/linux/padata.h 2011-07-21 22:17:23.000000000 -0400 | |
53786 | +++ linux-3.0.3/include/linux/padata.h 2011-08-23 21:47:56.000000000 -0400 | |
53787 | @@ -129,7 +129,7 @@ struct parallel_data { | |
53788 | struct padata_instance *pinst; | |
53789 | struct padata_parallel_queue __percpu *pqueue; | |
53790 | struct padata_serial_queue __percpu *squeue; | |
53791 | - atomic_t seq_nr; | |
53792 | + atomic_unchecked_t seq_nr; | |
53793 | atomic_t reorder_objects; | |
53794 | atomic_t refcnt; | |
53795 | unsigned int max_seq_nr; | |
53796 | diff -urNp linux-3.0.3/include/linux/perf_event.h linux-3.0.3/include/linux/perf_event.h | |
53797 | --- linux-3.0.3/include/linux/perf_event.h 2011-07-21 22:17:23.000000000 -0400 | |
53798 | +++ linux-3.0.3/include/linux/perf_event.h 2011-08-23 21:47:56.000000000 -0400 | |
53799 | @@ -761,8 +761,8 @@ struct perf_event { | |
53800 | ||
53801 | enum perf_event_active_state state; | |
53802 | unsigned int attach_state; | |
53803 | - local64_t count; | |
53804 | - atomic64_t child_count; | |
53805 | + local64_t count; /* PaX: fix it one day */ | |
53806 | + atomic64_unchecked_t child_count; | |
53807 | ||
53808 | /* | |
53809 | * These are the total time in nanoseconds that the event | |
53810 | @@ -813,8 +813,8 @@ struct perf_event { | |
53811 | * These accumulate total time (in nanoseconds) that children | |
53812 | * events have been enabled and running, respectively. | |
53813 | */ | |
53814 | - atomic64_t child_total_time_enabled; | |
53815 | - atomic64_t child_total_time_running; | |
53816 | + atomic64_unchecked_t child_total_time_enabled; | |
53817 | + atomic64_unchecked_t child_total_time_running; | |
53818 | ||
53819 | /* | |
53820 | * Protect attach/detach and child_list: | |
53821 | diff -urNp linux-3.0.3/include/linux/pipe_fs_i.h linux-3.0.3/include/linux/pipe_fs_i.h | |
53822 | --- linux-3.0.3/include/linux/pipe_fs_i.h 2011-07-21 22:17:23.000000000 -0400 | |
53823 | +++ linux-3.0.3/include/linux/pipe_fs_i.h 2011-08-23 21:47:56.000000000 -0400 | |
53824 | @@ -46,9 +46,9 @@ struct pipe_buffer { | |
53825 | struct pipe_inode_info { | |
53826 | wait_queue_head_t wait; | |
53827 | unsigned int nrbufs, curbuf, buffers; | |
53828 | - unsigned int readers; | |
53829 | - unsigned int writers; | |
53830 | - unsigned int waiting_writers; | |
53831 | + atomic_t readers; | |
53832 | + atomic_t writers; | |
53833 | + atomic_t waiting_writers; | |
53834 | unsigned int r_counter; | |
53835 | unsigned int w_counter; | |
53836 | struct page *tmp_page; | |
53837 | diff -urNp linux-3.0.3/include/linux/pm_runtime.h linux-3.0.3/include/linux/pm_runtime.h | |
53838 | --- linux-3.0.3/include/linux/pm_runtime.h 2011-07-21 22:17:23.000000000 -0400 | |
53839 | +++ linux-3.0.3/include/linux/pm_runtime.h 2011-08-23 21:47:56.000000000 -0400 | |
53840 | @@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_ | |
53841 | ||
53842 | static inline void pm_runtime_mark_last_busy(struct device *dev) | |
53843 | { | |
53844 | - ACCESS_ONCE(dev->power.last_busy) = jiffies; | |
53845 | + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies; | |
53846 | } | |
53847 | ||
53848 | #else /* !CONFIG_PM_RUNTIME */ | |
53849 | diff -urNp linux-3.0.3/include/linux/poison.h linux-3.0.3/include/linux/poison.h | |
53850 | --- linux-3.0.3/include/linux/poison.h 2011-07-21 22:17:23.000000000 -0400 | |
53851 | +++ linux-3.0.3/include/linux/poison.h 2011-08-23 21:47:56.000000000 -0400 | |
53852 | @@ -19,8 +19,8 @@ | |
53853 | * under normal circumstances, used to verify that nobody uses | |
53854 | * non-initialized list entries. | |
53855 | */ | |
53856 | -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA) | |
53857 | -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA) | |
53858 | +#define LIST_POISON1 ((void *) (long)0xFFFFFF01) | |
53859 | +#define LIST_POISON2 ((void *) (long)0xFFFFFF02) | |
53860 | ||
53861 | /********** include/linux/timer.h **********/ | |
53862 | /* | |
53863 | diff -urNp linux-3.0.3/include/linux/preempt.h linux-3.0.3/include/linux/preempt.h | |
53864 | --- linux-3.0.3/include/linux/preempt.h 2011-07-21 22:17:23.000000000 -0400 | |
53865 | +++ linux-3.0.3/include/linux/preempt.h 2011-08-23 21:47:56.000000000 -0400 | |
53866 | @@ -115,7 +115,7 @@ struct preempt_ops { | |
53867 | void (*sched_in)(struct preempt_notifier *notifier, int cpu); | |
53868 | void (*sched_out)(struct preempt_notifier *notifier, | |
53869 | struct task_struct *next); | |
53870 | -}; | |
53871 | +} __no_const; | |
53872 | ||
53873 | /** | |
53874 | * preempt_notifier - key for installing preemption notifiers | |
53875 | diff -urNp linux-3.0.3/include/linux/proc_fs.h linux-3.0.3/include/linux/proc_fs.h | |
53876 | --- linux-3.0.3/include/linux/proc_fs.h 2011-07-21 22:17:23.000000000 -0400 | |
53877 | +++ linux-3.0.3/include/linux/proc_fs.h 2011-08-23 21:48:14.000000000 -0400 | |
53878 | @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro | |
53879 | return proc_create_data(name, mode, parent, proc_fops, NULL); | |
53880 | } | |
53881 | ||
53882 | +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode, | |
53883 | + struct proc_dir_entry *parent, const struct file_operations *proc_fops) | |
53884 | +{ | |
53885 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
53886 | + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL); | |
53887 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
53888 | + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL); | |
53889 | +#else | |
53890 | + return proc_create_data(name, mode, parent, proc_fops, NULL); | |
53891 | +#endif | |
53892 | +} | |
53893 | + | |
53894 | + | |
53895 | static inline struct proc_dir_entry *create_proc_read_entry(const char *name, | |
53896 | mode_t mode, struct proc_dir_entry *base, | |
53897 | read_proc_t *read_proc, void * data) | |
53898 | @@ -258,7 +271,7 @@ union proc_op { | |
53899 | int (*proc_show)(struct seq_file *m, | |
53900 | struct pid_namespace *ns, struct pid *pid, | |
53901 | struct task_struct *task); | |
53902 | -}; | |
53903 | +} __no_const; | |
53904 | ||
53905 | struct ctl_table_header; | |
53906 | struct ctl_table; | |
53907 | diff -urNp linux-3.0.3/include/linux/ptrace.h linux-3.0.3/include/linux/ptrace.h | |
53908 | --- linux-3.0.3/include/linux/ptrace.h 2011-07-21 22:17:23.000000000 -0400 | |
53909 | +++ linux-3.0.3/include/linux/ptrace.h 2011-08-23 21:48:14.000000000 -0400 | |
53910 | @@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_ | |
53911 | extern void exit_ptrace(struct task_struct *tracer); | |
53912 | #define PTRACE_MODE_READ 1 | |
53913 | #define PTRACE_MODE_ATTACH 2 | |
53914 | -/* Returns 0 on success, -errno on denial. */ | |
53915 | -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode); | |
53916 | /* Returns true on success, false on denial. */ | |
53917 | extern bool ptrace_may_access(struct task_struct *task, unsigned int mode); | |
53918 | +/* Returns true on success, false on denial. */ | |
53919 | +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode); | |
53920 | ||
53921 | static inline int ptrace_reparented(struct task_struct *child) | |
53922 | { | |
53923 | diff -urNp linux-3.0.3/include/linux/random.h linux-3.0.3/include/linux/random.h | |
53924 | --- linux-3.0.3/include/linux/random.h 2011-08-23 21:44:40.000000000 -0400 | |
53925 | +++ linux-3.0.3/include/linux/random.h 2011-08-23 21:47:56.000000000 -0400 | |
53926 | @@ -69,12 +69,17 @@ void srandom32(u32 seed); | |
53927 | ||
53928 | u32 prandom32(struct rnd_state *); | |
53929 | ||
53930 | +static inline unsigned long pax_get_random_long(void) | |
53931 | +{ | |
53932 | + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0); | |
53933 | +} | |
53934 | + | |
53935 | /* | |
53936 | * Handle minimum values for seeds | |
53937 | */ | |
53938 | static inline u32 __seed(u32 x, u32 m) | |
53939 | { | |
53940 | - return (x < m) ? x + m : x; | |
53941 | + return (x <= m) ? x + m + 1 : x; | |
53942 | } | |
53943 | ||
53944 | /** | |
53945 | diff -urNp linux-3.0.3/include/linux/reboot.h linux-3.0.3/include/linux/reboot.h | |
53946 | --- linux-3.0.3/include/linux/reboot.h 2011-07-21 22:17:23.000000000 -0400 | |
53947 | +++ linux-3.0.3/include/linux/reboot.h 2011-08-23 21:47:56.000000000 -0400 | |
53948 | @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st | |
53949 | * Architecture-specific implementations of sys_reboot commands. | |
53950 | */ | |
53951 | ||
53952 | -extern void machine_restart(char *cmd); | |
53953 | -extern void machine_halt(void); | |
53954 | -extern void machine_power_off(void); | |
53955 | +extern void machine_restart(char *cmd) __noreturn; | |
53956 | +extern void machine_halt(void) __noreturn; | |
53957 | +extern void machine_power_off(void) __noreturn; | |
53958 | ||
53959 | extern void machine_shutdown(void); | |
53960 | struct pt_regs; | |
53961 | @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc | |
53962 | */ | |
53963 | ||
53964 | extern void kernel_restart_prepare(char *cmd); | |
53965 | -extern void kernel_restart(char *cmd); | |
53966 | -extern void kernel_halt(void); | |
53967 | -extern void kernel_power_off(void); | |
53968 | +extern void kernel_restart(char *cmd) __noreturn; | |
53969 | +extern void kernel_halt(void) __noreturn; | |
53970 | +extern void kernel_power_off(void) __noreturn; | |
53971 | ||
53972 | extern int C_A_D; /* for sysctl */ | |
53973 | void ctrl_alt_del(void); | |
53974 | @@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force); | |
53975 | * Emergency restart, callable from an interrupt handler. | |
53976 | */ | |
53977 | ||
53978 | -extern void emergency_restart(void); | |
53979 | +extern void emergency_restart(void) __noreturn; | |
53980 | #include <asm/emergency-restart.h> | |
53981 | ||
53982 | #endif | |
53983 | diff -urNp linux-3.0.3/include/linux/reiserfs_fs.h linux-3.0.3/include/linux/reiserfs_fs.h | |
53984 | --- linux-3.0.3/include/linux/reiserfs_fs.h 2011-07-21 22:17:23.000000000 -0400 | |
53985 | +++ linux-3.0.3/include/linux/reiserfs_fs.h 2011-08-23 21:47:56.000000000 -0400 | |
53986 | @@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset | |
53987 | #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */ | |
53988 | ||
53989 | #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter) | |
53990 | -#define get_generation(s) atomic_read (&fs_generation(s)) | |
53991 | +#define get_generation(s) atomic_read_unchecked (&fs_generation(s)) | |
53992 | #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen) | |
53993 | #define __fs_changed(gen,s) (gen != get_generation (s)) | |
53994 | #define fs_changed(gen,s) \ | |
53995 | diff -urNp linux-3.0.3/include/linux/reiserfs_fs_sb.h linux-3.0.3/include/linux/reiserfs_fs_sb.h | |
53996 | --- linux-3.0.3/include/linux/reiserfs_fs_sb.h 2011-07-21 22:17:23.000000000 -0400 | |
53997 | +++ linux-3.0.3/include/linux/reiserfs_fs_sb.h 2011-08-23 21:47:56.000000000 -0400 | |
53998 | @@ -386,7 +386,7 @@ struct reiserfs_sb_info { | |
53999 | /* Comment? -Hans */ | |
54000 | wait_queue_head_t s_wait; | |
54001 | /* To be obsoleted soon by per buffer seals.. -Hans */ | |
54002 | - atomic_t s_generation_counter; // increased by one every time the | |
54003 | + atomic_unchecked_t s_generation_counter; // increased by one every time the | |
54004 | // tree gets re-balanced | |
54005 | unsigned long s_properties; /* File system properties. Currently holds | |
54006 | on-disk FS format */ | |
54007 | diff -urNp linux-3.0.3/include/linux/relay.h linux-3.0.3/include/linux/relay.h | |
54008 | --- linux-3.0.3/include/linux/relay.h 2011-07-21 22:17:23.000000000 -0400 | |
54009 | +++ linux-3.0.3/include/linux/relay.h 2011-08-23 21:47:56.000000000 -0400 | |
54010 | @@ -159,7 +159,7 @@ struct rchan_callbacks | |
54011 | * The callback should return 0 if successful, negative if not. | |
54012 | */ | |
54013 | int (*remove_buf_file)(struct dentry *dentry); | |
54014 | -}; | |
54015 | +} __no_const; | |
54016 | ||
54017 | /* | |
54018 | * CONFIG_RELAY kernel API, kernel/relay.c | |
54019 | diff -urNp linux-3.0.3/include/linux/rfkill.h linux-3.0.3/include/linux/rfkill.h | |
54020 | --- linux-3.0.3/include/linux/rfkill.h 2011-07-21 22:17:23.000000000 -0400 | |
54021 | +++ linux-3.0.3/include/linux/rfkill.h 2011-08-23 21:47:56.000000000 -0400 | |
54022 | @@ -147,6 +147,7 @@ struct rfkill_ops { | |
54023 | void (*query)(struct rfkill *rfkill, void *data); | |
54024 | int (*set_block)(void *data, bool blocked); | |
54025 | }; | |
54026 | +typedef struct rfkill_ops __no_const rfkill_ops_no_const; | |
54027 | ||
54028 | #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE) | |
54029 | /** | |
54030 | diff -urNp linux-3.0.3/include/linux/rmap.h linux-3.0.3/include/linux/rmap.h | |
54031 | --- linux-3.0.3/include/linux/rmap.h 2011-07-21 22:17:23.000000000 -0400 | |
54032 | +++ linux-3.0.3/include/linux/rmap.h 2011-08-23 21:47:56.000000000 -0400 | |
54033 | @@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc | |
54034 | void anon_vma_init(void); /* create anon_vma_cachep */ | |
54035 | int anon_vma_prepare(struct vm_area_struct *); | |
54036 | void unlink_anon_vmas(struct vm_area_struct *); | |
54037 | -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *); | |
54038 | -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *); | |
54039 | +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *); | |
54040 | +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *); | |
54041 | void __anon_vma_link(struct vm_area_struct *); | |
54042 | ||
54043 | static inline void anon_vma_merge(struct vm_area_struct *vma, | |
54044 | diff -urNp linux-3.0.3/include/linux/sched.h linux-3.0.3/include/linux/sched.h | |
54045 | --- linux-3.0.3/include/linux/sched.h 2011-07-21 22:17:23.000000000 -0400 | |
54046 | +++ linux-3.0.3/include/linux/sched.h 2011-08-25 17:22:27.000000000 -0400 | |
54047 | @@ -100,6 +100,7 @@ struct bio_list; | |
54048 | struct fs_struct; | |
54049 | struct perf_event_context; | |
54050 | struct blk_plug; | |
54051 | +struct linux_binprm; | |
54052 | ||
54053 | /* | |
54054 | * List of flags we want to share for kernel threads, | |
54055 | @@ -380,10 +381,13 @@ struct user_namespace; | |
54056 | #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN) | |
54057 | ||
54058 | extern int sysctl_max_map_count; | |
54059 | +extern unsigned long sysctl_heap_stack_gap; | |
54060 | ||
54061 | #include <linux/aio.h> | |
54062 | ||
54063 | #ifdef CONFIG_MMU | |
54064 | +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len); | |
54065 | +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len); | |
54066 | extern void arch_pick_mmap_layout(struct mm_struct *mm); | |
54067 | extern unsigned long | |
54068 | arch_get_unmapped_area(struct file *, unsigned long, unsigned long, | |
54069 | @@ -629,6 +633,17 @@ struct signal_struct { | |
54070 | #ifdef CONFIG_TASKSTATS | |
54071 | struct taskstats *stats; | |
54072 | #endif | |
54073 | + | |
54074 | +#ifdef CONFIG_GRKERNSEC | |
54075 | + u32 curr_ip; | |
54076 | + u32 saved_ip; | |
54077 | + u32 gr_saddr; | |
54078 | + u32 gr_daddr; | |
54079 | + u16 gr_sport; | |
54080 | + u16 gr_dport; | |
54081 | + u8 used_accept:1; | |
54082 | +#endif | |
54083 | + | |
54084 | #ifdef CONFIG_AUDIT | |
54085 | unsigned audit_tty; | |
54086 | struct tty_audit_buf *tty_audit_buf; | |
54087 | @@ -710,6 +725,11 @@ struct user_struct { | |
54088 | struct key *session_keyring; /* UID's default session keyring */ | |
54089 | #endif | |
54090 | ||
54091 | +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) | |
54092 | + unsigned int banned; | |
54093 | + unsigned long ban_expires; | |
54094 | +#endif | |
54095 | + | |
54096 | /* Hash table maintenance information */ | |
54097 | struct hlist_node uidhash_node; | |
54098 | uid_t uid; | |
54099 | @@ -1340,8 +1360,8 @@ struct task_struct { | |
54100 | struct list_head thread_group; | |
54101 | ||
54102 | struct completion *vfork_done; /* for vfork() */ | |
54103 | - int __user *set_child_tid; /* CLONE_CHILD_SETTID */ | |
54104 | - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */ | |
54105 | + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */ | |
54106 | + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */ | |
54107 | ||
54108 | cputime_t utime, stime, utimescaled, stimescaled; | |
54109 | cputime_t gtime; | |
54110 | @@ -1357,13 +1377,6 @@ struct task_struct { | |
54111 | struct task_cputime cputime_expires; | |
54112 | struct list_head cpu_timers[3]; | |
54113 | ||
54114 | -/* process credentials */ | |
54115 | - const struct cred __rcu *real_cred; /* objective and real subjective task | |
54116 | - * credentials (COW) */ | |
54117 | - const struct cred __rcu *cred; /* effective (overridable) subjective task | |
54118 | - * credentials (COW) */ | |
54119 | - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */ | |
54120 | - | |
54121 | char comm[TASK_COMM_LEN]; /* executable name excluding path | |
54122 | - access with [gs]et_task_comm (which lock | |
54123 | it with task_lock()) | |
54124 | @@ -1380,8 +1393,16 @@ struct task_struct { | |
54125 | #endif | |
54126 | /* CPU-specific state of this task */ | |
54127 | struct thread_struct thread; | |
54128 | +/* thread_info moved to task_struct */ | |
54129 | +#ifdef CONFIG_X86 | |
54130 | + struct thread_info tinfo; | |
54131 | +#endif | |
54132 | /* filesystem information */ | |
54133 | struct fs_struct *fs; | |
54134 | + | |
54135 | + const struct cred __rcu *cred; /* effective (overridable) subjective task | |
54136 | + * credentials (COW) */ | |
54137 | + | |
54138 | /* open file information */ | |
54139 | struct files_struct *files; | |
54140 | /* namespaces */ | |
54141 | @@ -1428,6 +1449,11 @@ struct task_struct { | |
54142 | struct rt_mutex_waiter *pi_blocked_on; | |
54143 | #endif | |
54144 | ||
54145 | +/* process credentials */ | |
54146 | + const struct cred __rcu *real_cred; /* objective and real subjective task | |
54147 | + * credentials (COW) */ | |
54148 | + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */ | |
54149 | + | |
54150 | #ifdef CONFIG_DEBUG_MUTEXES | |
54151 | /* mutex deadlock detection */ | |
54152 | struct mutex_waiter *blocked_on; | |
54153 | @@ -1538,6 +1564,21 @@ struct task_struct { | |
54154 | unsigned long default_timer_slack_ns; | |
54155 | ||
54156 | struct list_head *scm_work_list; | |
54157 | + | |
54158 | +#ifdef CONFIG_GRKERNSEC | |
54159 | + /* grsecurity */ | |
54160 | + struct dentry *gr_chroot_dentry; | |
54161 | + struct acl_subject_label *acl; | |
54162 | + struct acl_role_label *role; | |
54163 | + struct file *exec_file; | |
54164 | + u16 acl_role_id; | |
54165 | + /* is this the task that authenticated to the special role */ | |
54166 | + u8 acl_sp_role; | |
54167 | + u8 is_writable; | |
54168 | + u8 brute; | |
54169 | + u8 gr_is_chrooted; | |
54170 | +#endif | |
54171 | + | |
54172 | #ifdef CONFIG_FUNCTION_GRAPH_TRACER | |
54173 | /* Index of current stored address in ret_stack */ | |
54174 | int curr_ret_stack; | |
54175 | @@ -1572,6 +1613,57 @@ struct task_struct { | |
54176 | #endif | |
54177 | }; | |
54178 | ||
54179 | +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */ | |
54180 | +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */ | |
54181 | +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */ | |
54182 | +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */ | |
54183 | +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */ | |
54184 | +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */ | |
54185 | + | |
54186 | +#ifdef CONFIG_PAX_SOFTMODE | |
54187 | +extern int pax_softmode; | |
54188 | +#endif | |
54189 | + | |
54190 | +extern int pax_check_flags(unsigned long *); | |
54191 | + | |
54192 | +/* if tsk != current then task_lock must be held on it */ | |
54193 | +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) | |
54194 | +static inline unsigned long pax_get_flags(struct task_struct *tsk) | |
54195 | +{ | |
54196 | + if (likely(tsk->mm)) | |
54197 | + return tsk->mm->pax_flags; | |
54198 | + else | |
54199 | + return 0UL; | |
54200 | +} | |
54201 | + | |
54202 | +/* if tsk != current then task_lock must be held on it */ | |
54203 | +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags) | |
54204 | +{ | |
54205 | + if (likely(tsk->mm)) { | |
54206 | + tsk->mm->pax_flags = flags; | |
54207 | + return 0; | |
54208 | + } | |
54209 | + return -EINVAL; | |
54210 | +} | |
54211 | +#endif | |
54212 | + | |
54213 | +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS | |
54214 | +extern void pax_set_initial_flags(struct linux_binprm *bprm); | |
54215 | +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS) | |
54216 | +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm); | |
54217 | +#endif | |
54218 | + | |
54219 | +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp); | |
54220 | +extern void pax_report_insns(void *pc, void *sp); | |
54221 | +extern void pax_report_refcount_overflow(struct pt_regs *regs); | |
54222 | +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET; | |
54223 | + | |
54224 | +#ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
54225 | +extern void pax_track_stack(void); | |
54226 | +#else | |
54227 | +static inline void pax_track_stack(void) {} | |
54228 | +#endif | |
54229 | + | |
54230 | /* Future-safe accessor for struct task_struct's cpus_allowed. */ | |
54231 | #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed) | |
54232 | ||
54233 | @@ -1768,6 +1860,7 @@ extern void thread_group_times(struct ta | |
54234 | #define PF_DUMPCORE 0x00000200 /* dumped core */ | |
54235 | #define PF_SIGNALED 0x00000400 /* killed by a signal */ | |
54236 | #define PF_MEMALLOC 0x00000800 /* Allocating memory */ | |
54237 | +#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */ | |
54238 | #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */ | |
54239 | #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */ | |
54240 | #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */ | |
54241 | @@ -2056,7 +2149,9 @@ void yield(void); | |
54242 | extern struct exec_domain default_exec_domain; | |
54243 | ||
54244 | union thread_union { | |
54245 | +#ifndef CONFIG_X86 | |
54246 | struct thread_info thread_info; | |
54247 | +#endif | |
54248 | unsigned long stack[THREAD_SIZE/sizeof(long)]; | |
54249 | }; | |
54250 | ||
54251 | @@ -2089,6 +2184,7 @@ extern struct pid_namespace init_pid_ns; | |
54252 | */ | |
54253 | ||
54254 | extern struct task_struct *find_task_by_vpid(pid_t nr); | |
54255 | +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr); | |
54256 | extern struct task_struct *find_task_by_pid_ns(pid_t nr, | |
54257 | struct pid_namespace *ns); | |
54258 | ||
54259 | @@ -2225,7 +2321,7 @@ extern void __cleanup_sighand(struct sig | |
54260 | extern void exit_itimers(struct signal_struct *); | |
54261 | extern void flush_itimer_signals(void); | |
54262 | ||
54263 | -extern NORET_TYPE void do_group_exit(int); | |
54264 | +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET; | |
54265 | ||
54266 | extern void daemonize(const char *, ...); | |
54267 | extern int allow_signal(int); | |
54268 | @@ -2393,13 +2489,17 @@ static inline unsigned long *end_of_stac | |
54269 | ||
54270 | #endif | |
54271 | ||
54272 | -static inline int object_is_on_stack(void *obj) | |
54273 | +static inline int object_starts_on_stack(void *obj) | |
54274 | { | |
54275 | - void *stack = task_stack_page(current); | |
54276 | + const void *stack = task_stack_page(current); | |
54277 | ||
54278 | return (obj >= stack) && (obj < (stack + THREAD_SIZE)); | |
54279 | } | |
54280 | ||
54281 | +#ifdef CONFIG_PAX_USERCOPY | |
54282 | +extern int object_is_on_stack(const void *obj, unsigned long len); | |
54283 | +#endif | |
54284 | + | |
54285 | extern void thread_info_cache_init(void); | |
54286 | ||
54287 | #ifdef CONFIG_DEBUG_STACK_USAGE | |
54288 | diff -urNp linux-3.0.3/include/linux/screen_info.h linux-3.0.3/include/linux/screen_info.h | |
54289 | --- linux-3.0.3/include/linux/screen_info.h 2011-07-21 22:17:23.000000000 -0400 | |
54290 | +++ linux-3.0.3/include/linux/screen_info.h 2011-08-23 21:47:56.000000000 -0400 | |
54291 | @@ -43,7 +43,8 @@ struct screen_info { | |
54292 | __u16 pages; /* 0x32 */ | |
54293 | __u16 vesa_attributes; /* 0x34 */ | |
54294 | __u32 capabilities; /* 0x36 */ | |
54295 | - __u8 _reserved[6]; /* 0x3a */ | |
54296 | + __u16 vesapm_size; /* 0x3a */ | |
54297 | + __u8 _reserved[4]; /* 0x3c */ | |
54298 | } __attribute__((packed)); | |
54299 | ||
54300 | #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */ | |
54301 | diff -urNp linux-3.0.3/include/linux/security.h linux-3.0.3/include/linux/security.h | |
54302 | --- linux-3.0.3/include/linux/security.h 2011-07-21 22:17:23.000000000 -0400 | |
54303 | +++ linux-3.0.3/include/linux/security.h 2011-08-23 21:48:14.000000000 -0400 | |
54304 | @@ -36,6 +36,7 @@ | |
54305 | #include <linux/key.h> | |
54306 | #include <linux/xfrm.h> | |
54307 | #include <linux/slab.h> | |
54308 | +#include <linux/grsecurity.h> | |
54309 | #include <net/flow.h> | |
54310 | ||
54311 | /* Maximum number of letters for an LSM name string */ | |
54312 | diff -urNp linux-3.0.3/include/linux/seq_file.h linux-3.0.3/include/linux/seq_file.h | |
54313 | --- linux-3.0.3/include/linux/seq_file.h 2011-07-21 22:17:23.000000000 -0400 | |
54314 | +++ linux-3.0.3/include/linux/seq_file.h 2011-08-23 21:47:56.000000000 -0400 | |
54315 | @@ -32,6 +32,7 @@ struct seq_operations { | |
54316 | void * (*next) (struct seq_file *m, void *v, loff_t *pos); | |
54317 | int (*show) (struct seq_file *m, void *v); | |
54318 | }; | |
54319 | +typedef struct seq_operations __no_const seq_operations_no_const; | |
54320 | ||
54321 | #define SEQ_SKIP 1 | |
54322 | ||
54323 | diff -urNp linux-3.0.3/include/linux/shmem_fs.h linux-3.0.3/include/linux/shmem_fs.h | |
54324 | --- linux-3.0.3/include/linux/shmem_fs.h 2011-07-21 22:17:23.000000000 -0400 | |
54325 | +++ linux-3.0.3/include/linux/shmem_fs.h 2011-08-23 21:47:56.000000000 -0400 | |
54326 | @@ -10,7 +10,7 @@ | |
54327 | ||
54328 | #define SHMEM_NR_DIRECT 16 | |
54329 | ||
54330 | -#define SHMEM_SYMLINK_INLINE_LEN (SHMEM_NR_DIRECT * sizeof(swp_entry_t)) | |
54331 | +#define SHMEM_SYMLINK_INLINE_LEN 64 | |
54332 | ||
54333 | struct shmem_inode_info { | |
54334 | spinlock_t lock; | |
54335 | diff -urNp linux-3.0.3/include/linux/shm.h linux-3.0.3/include/linux/shm.h | |
54336 | --- linux-3.0.3/include/linux/shm.h 2011-07-21 22:17:23.000000000 -0400 | |
54337 | +++ linux-3.0.3/include/linux/shm.h 2011-08-23 21:48:14.000000000 -0400 | |
54338 | @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke | |
54339 | pid_t shm_cprid; | |
54340 | pid_t shm_lprid; | |
54341 | struct user_struct *mlock_user; | |
54342 | +#ifdef CONFIG_GRKERNSEC | |
54343 | + time_t shm_createtime; | |
54344 | + pid_t shm_lapid; | |
54345 | +#endif | |
54346 | }; | |
54347 | ||
54348 | /* shm_mode upper byte flags */ | |
54349 | diff -urNp linux-3.0.3/include/linux/skbuff.h linux-3.0.3/include/linux/skbuff.h | |
54350 | --- linux-3.0.3/include/linux/skbuff.h 2011-07-21 22:17:23.000000000 -0400 | |
54351 | +++ linux-3.0.3/include/linux/skbuff.h 2011-08-23 21:47:56.000000000 -0400 | |
54352 | @@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp | |
54353 | */ | |
54354 | static inline int skb_queue_empty(const struct sk_buff_head *list) | |
54355 | { | |
54356 | - return list->next == (struct sk_buff *)list; | |
54357 | + return list->next == (const struct sk_buff *)list; | |
54358 | } | |
54359 | ||
54360 | /** | |
54361 | @@ -605,7 +605,7 @@ static inline int skb_queue_empty(const | |
54362 | static inline bool skb_queue_is_last(const struct sk_buff_head *list, | |
54363 | const struct sk_buff *skb) | |
54364 | { | |
54365 | - return skb->next == (struct sk_buff *)list; | |
54366 | + return skb->next == (const struct sk_buff *)list; | |
54367 | } | |
54368 | ||
54369 | /** | |
54370 | @@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con | |
54371 | static inline bool skb_queue_is_first(const struct sk_buff_head *list, | |
54372 | const struct sk_buff *skb) | |
54373 | { | |
54374 | - return skb->prev == (struct sk_buff *)list; | |
54375 | + return skb->prev == (const struct sk_buff *)list; | |
54376 | } | |
54377 | ||
54378 | /** | |
54379 | @@ -1440,7 +1440,7 @@ static inline int pskb_network_may_pull( | |
54380 | * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8) | |
54381 | */ | |
54382 | #ifndef NET_SKB_PAD | |
54383 | -#define NET_SKB_PAD max(32, L1_CACHE_BYTES) | |
54384 | +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES) | |
54385 | #endif | |
54386 | ||
54387 | extern int ___pskb_trim(struct sk_buff *skb, unsigned int len); | |
54388 | diff -urNp linux-3.0.3/include/linux/slab_def.h linux-3.0.3/include/linux/slab_def.h | |
54389 | --- linux-3.0.3/include/linux/slab_def.h 2011-07-21 22:17:23.000000000 -0400 | |
54390 | +++ linux-3.0.3/include/linux/slab_def.h 2011-08-23 21:47:56.000000000 -0400 | |
54391 | @@ -96,10 +96,10 @@ struct kmem_cache { | |
54392 | unsigned long node_allocs; | |
54393 | unsigned long node_frees; | |
54394 | unsigned long node_overflow; | |
54395 | - atomic_t allochit; | |
54396 | - atomic_t allocmiss; | |
54397 | - atomic_t freehit; | |
54398 | - atomic_t freemiss; | |
54399 | + atomic_unchecked_t allochit; | |
54400 | + atomic_unchecked_t allocmiss; | |
54401 | + atomic_unchecked_t freehit; | |
54402 | + atomic_unchecked_t freemiss; | |
54403 | ||
54404 | /* | |
54405 | * If debugging is enabled, then the allocator can add additional | |
54406 | diff -urNp linux-3.0.3/include/linux/slab.h linux-3.0.3/include/linux/slab.h | |
54407 | --- linux-3.0.3/include/linux/slab.h 2011-07-21 22:17:23.000000000 -0400 | |
54408 | +++ linux-3.0.3/include/linux/slab.h 2011-08-23 21:47:56.000000000 -0400 | |
54409 | @@ -11,12 +11,20 @@ | |
54410 | ||
54411 | #include <linux/gfp.h> | |
54412 | #include <linux/types.h> | |
54413 | +#include <linux/err.h> | |
54414 | ||
54415 | /* | |
54416 | * Flags to pass to kmem_cache_create(). | |
54417 | * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set. | |
54418 | */ | |
54419 | #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */ | |
54420 | + | |
54421 | +#ifdef CONFIG_PAX_USERCOPY | |
54422 | +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */ | |
54423 | +#else | |
54424 | +#define SLAB_USERCOPY 0x00000000UL | |
54425 | +#endif | |
54426 | + | |
54427 | #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */ | |
54428 | #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */ | |
54429 | #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */ | |
54430 | @@ -87,10 +95,13 @@ | |
54431 | * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can. | |
54432 | * Both make kfree a no-op. | |
54433 | */ | |
54434 | -#define ZERO_SIZE_PTR ((void *)16) | |
54435 | +#define ZERO_SIZE_PTR \ | |
54436 | +({ \ | |
54437 | + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\ | |
54438 | + (void *)(-MAX_ERRNO-1L); \ | |
54439 | +}) | |
54440 | ||
54441 | -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \ | |
54442 | - (unsigned long)ZERO_SIZE_PTR) | |
54443 | +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1) | |
54444 | ||
54445 | /* | |
54446 | * struct kmem_cache related prototypes | |
54447 | @@ -141,6 +152,7 @@ void * __must_check krealloc(const void | |
54448 | void kfree(const void *); | |
54449 | void kzfree(const void *); | |
54450 | size_t ksize(const void *); | |
54451 | +void check_object_size(const void *ptr, unsigned long n, bool to); | |
54452 | ||
54453 | /* | |
54454 | * Allocator specific definitions. These are mainly used to establish optimized | |
54455 | @@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t | |
54456 | ||
54457 | void __init kmem_cache_init_late(void); | |
54458 | ||
54459 | +#define kmalloc(x, y) \ | |
54460 | +({ \ | |
54461 | + void *___retval; \ | |
54462 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54463 | + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \ | |
54464 | + ___retval = NULL; \ | |
54465 | + else \ | |
54466 | + ___retval = kmalloc((size_t)___x, (y)); \ | |
54467 | + ___retval; \ | |
54468 | +}) | |
54469 | + | |
54470 | +#define kmalloc_node(x, y, z) \ | |
54471 | +({ \ | |
54472 | + void *___retval; \ | |
54473 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54474 | + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\ | |
54475 | + ___retval = NULL; \ | |
54476 | + else \ | |
54477 | + ___retval = kmalloc_node((size_t)___x, (y), (z));\ | |
54478 | + ___retval; \ | |
54479 | +}) | |
54480 | + | |
54481 | +#define kzalloc(x, y) \ | |
54482 | +({ \ | |
54483 | + void *___retval; \ | |
54484 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54485 | + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \ | |
54486 | + ___retval = NULL; \ | |
54487 | + else \ | |
54488 | + ___retval = kzalloc((size_t)___x, (y)); \ | |
54489 | + ___retval; \ | |
54490 | +}) | |
54491 | + | |
54492 | +#define __krealloc(x, y, z) \ | |
54493 | +({ \ | |
54494 | + void *___retval; \ | |
54495 | + intoverflow_t ___y = (intoverflow_t)y; \ | |
54496 | + if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\ | |
54497 | + ___retval = NULL; \ | |
54498 | + else \ | |
54499 | + ___retval = __krealloc((x), (size_t)___y, (z)); \ | |
54500 | + ___retval; \ | |
54501 | +}) | |
54502 | + | |
54503 | +#define krealloc(x, y, z) \ | |
54504 | +({ \ | |
54505 | + void *___retval; \ | |
54506 | + intoverflow_t ___y = (intoverflow_t)y; \ | |
54507 | + if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \ | |
54508 | + ___retval = NULL; \ | |
54509 | + else \ | |
54510 | + ___retval = krealloc((x), (size_t)___y, (z)); \ | |
54511 | + ___retval; \ | |
54512 | +}) | |
54513 | + | |
54514 | #endif /* _LINUX_SLAB_H */ | |
54515 | diff -urNp linux-3.0.3/include/linux/slub_def.h linux-3.0.3/include/linux/slub_def.h | |
54516 | --- linux-3.0.3/include/linux/slub_def.h 2011-07-21 22:17:23.000000000 -0400 | |
54517 | +++ linux-3.0.3/include/linux/slub_def.h 2011-08-23 21:47:56.000000000 -0400 | |
54518 | @@ -82,7 +82,7 @@ struct kmem_cache { | |
54519 | struct kmem_cache_order_objects max; | |
54520 | struct kmem_cache_order_objects min; | |
54521 | gfp_t allocflags; /* gfp flags to use on each alloc */ | |
54522 | - int refcount; /* Refcount for slab cache destroy */ | |
54523 | + atomic_t refcount; /* Refcount for slab cache destroy */ | |
54524 | void (*ctor)(void *); | |
54525 | int inuse; /* Offset to metadata */ | |
54526 | int align; /* Alignment */ | |
54527 | @@ -218,7 +218,7 @@ static __always_inline struct kmem_cache | |
54528 | } | |
54529 | ||
54530 | void *kmem_cache_alloc(struct kmem_cache *, gfp_t); | |
54531 | -void *__kmalloc(size_t size, gfp_t flags); | |
54532 | +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1); | |
54533 | ||
54534 | static __always_inline void * | |
54535 | kmalloc_order(size_t size, gfp_t flags, unsigned int order) | |
54536 | diff -urNp linux-3.0.3/include/linux/sonet.h linux-3.0.3/include/linux/sonet.h | |
54537 | --- linux-3.0.3/include/linux/sonet.h 2011-07-21 22:17:23.000000000 -0400 | |
54538 | +++ linux-3.0.3/include/linux/sonet.h 2011-08-23 21:47:56.000000000 -0400 | |
54539 | @@ -61,7 +61,7 @@ struct sonet_stats { | |
54540 | #include <asm/atomic.h> | |
54541 | ||
54542 | struct k_sonet_stats { | |
54543 | -#define __HANDLE_ITEM(i) atomic_t i | |
54544 | +#define __HANDLE_ITEM(i) atomic_unchecked_t i | |
54545 | __SONET_ITEMS | |
54546 | #undef __HANDLE_ITEM | |
54547 | }; | |
54548 | diff -urNp linux-3.0.3/include/linux/sunrpc/clnt.h linux-3.0.3/include/linux/sunrpc/clnt.h | |
54549 | --- linux-3.0.3/include/linux/sunrpc/clnt.h 2011-07-21 22:17:23.000000000 -0400 | |
54550 | +++ linux-3.0.3/include/linux/sunrpc/clnt.h 2011-08-23 21:47:56.000000000 -0400 | |
54551 | @@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por | |
54552 | { | |
54553 | switch (sap->sa_family) { | |
54554 | case AF_INET: | |
54555 | - return ntohs(((struct sockaddr_in *)sap)->sin_port); | |
54556 | + return ntohs(((const struct sockaddr_in *)sap)->sin_port); | |
54557 | case AF_INET6: | |
54558 | - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port); | |
54559 | + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port); | |
54560 | } | |
54561 | return 0; | |
54562 | } | |
54563 | @@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const | |
54564 | static inline bool __rpc_copy_addr4(struct sockaddr *dst, | |
54565 | const struct sockaddr *src) | |
54566 | { | |
54567 | - const struct sockaddr_in *ssin = (struct sockaddr_in *) src; | |
54568 | + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src; | |
54569 | struct sockaddr_in *dsin = (struct sockaddr_in *) dst; | |
54570 | ||
54571 | dsin->sin_family = ssin->sin_family; | |
54572 | @@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const | |
54573 | if (sa->sa_family != AF_INET6) | |
54574 | return 0; | |
54575 | ||
54576 | - return ((struct sockaddr_in6 *) sa)->sin6_scope_id; | |
54577 | + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id; | |
54578 | } | |
54579 | ||
54580 | #endif /* __KERNEL__ */ | |
54581 | diff -urNp linux-3.0.3/include/linux/sunrpc/svc_rdma.h linux-3.0.3/include/linux/sunrpc/svc_rdma.h | |
54582 | --- linux-3.0.3/include/linux/sunrpc/svc_rdma.h 2011-07-21 22:17:23.000000000 -0400 | |
54583 | +++ linux-3.0.3/include/linux/sunrpc/svc_rdma.h 2011-08-23 21:47:56.000000000 -0400 | |
54584 | @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord; | |
54585 | extern unsigned int svcrdma_max_requests; | |
54586 | extern unsigned int svcrdma_max_req_size; | |
54587 | ||
54588 | -extern atomic_t rdma_stat_recv; | |
54589 | -extern atomic_t rdma_stat_read; | |
54590 | -extern atomic_t rdma_stat_write; | |
54591 | -extern atomic_t rdma_stat_sq_starve; | |
54592 | -extern atomic_t rdma_stat_rq_starve; | |
54593 | -extern atomic_t rdma_stat_rq_poll; | |
54594 | -extern atomic_t rdma_stat_rq_prod; | |
54595 | -extern atomic_t rdma_stat_sq_poll; | |
54596 | -extern atomic_t rdma_stat_sq_prod; | |
54597 | +extern atomic_unchecked_t rdma_stat_recv; | |
54598 | +extern atomic_unchecked_t rdma_stat_read; | |
54599 | +extern atomic_unchecked_t rdma_stat_write; | |
54600 | +extern atomic_unchecked_t rdma_stat_sq_starve; | |
54601 | +extern atomic_unchecked_t rdma_stat_rq_starve; | |
54602 | +extern atomic_unchecked_t rdma_stat_rq_poll; | |
54603 | +extern atomic_unchecked_t rdma_stat_rq_prod; | |
54604 | +extern atomic_unchecked_t rdma_stat_sq_poll; | |
54605 | +extern atomic_unchecked_t rdma_stat_sq_prod; | |
54606 | ||
54607 | #define RPCRDMA_VERSION 1 | |
54608 | ||
54609 | diff -urNp linux-3.0.3/include/linux/sysctl.h linux-3.0.3/include/linux/sysctl.h | |
54610 | --- linux-3.0.3/include/linux/sysctl.h 2011-07-21 22:17:23.000000000 -0400 | |
54611 | +++ linux-3.0.3/include/linux/sysctl.h 2011-08-23 21:48:14.000000000 -0400 | |
54612 | @@ -155,7 +155,11 @@ enum | |
54613 | KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */ | |
54614 | }; | |
54615 | ||
54616 | - | |
54617 | +#ifdef CONFIG_PAX_SOFTMODE | |
54618 | +enum { | |
54619 | + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */ | |
54620 | +}; | |
54621 | +#endif | |
54622 | ||
54623 | /* CTL_VM names: */ | |
54624 | enum | |
54625 | @@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab | |
54626 | ||
54627 | extern int proc_dostring(struct ctl_table *, int, | |
54628 | void __user *, size_t *, loff_t *); | |
54629 | +extern int proc_dostring_modpriv(struct ctl_table *, int, | |
54630 | + void __user *, size_t *, loff_t *); | |
54631 | extern int proc_dointvec(struct ctl_table *, int, | |
54632 | void __user *, size_t *, loff_t *); | |
54633 | extern int proc_dointvec_minmax(struct ctl_table *, int, | |
54634 | diff -urNp linux-3.0.3/include/linux/tty_ldisc.h linux-3.0.3/include/linux/tty_ldisc.h | |
54635 | --- linux-3.0.3/include/linux/tty_ldisc.h 2011-07-21 22:17:23.000000000 -0400 | |
54636 | +++ linux-3.0.3/include/linux/tty_ldisc.h 2011-08-23 21:47:56.000000000 -0400 | |
54637 | @@ -148,7 +148,7 @@ struct tty_ldisc_ops { | |
54638 | ||
54639 | struct module *owner; | |
54640 | ||
54641 | - int refcount; | |
54642 | + atomic_t refcount; | |
54643 | }; | |
54644 | ||
54645 | struct tty_ldisc { | |
54646 | diff -urNp linux-3.0.3/include/linux/types.h linux-3.0.3/include/linux/types.h | |
54647 | --- linux-3.0.3/include/linux/types.h 2011-07-21 22:17:23.000000000 -0400 | |
54648 | +++ linux-3.0.3/include/linux/types.h 2011-08-23 21:47:56.000000000 -0400 | |
54649 | @@ -213,10 +213,26 @@ typedef struct { | |
54650 | int counter; | |
54651 | } atomic_t; | |
54652 | ||
54653 | +#ifdef CONFIG_PAX_REFCOUNT | |
54654 | +typedef struct { | |
54655 | + int counter; | |
54656 | +} atomic_unchecked_t; | |
54657 | +#else | |
54658 | +typedef atomic_t atomic_unchecked_t; | |
54659 | +#endif | |
54660 | + | |
54661 | #ifdef CONFIG_64BIT | |
54662 | typedef struct { | |
54663 | long counter; | |
54664 | } atomic64_t; | |
54665 | + | |
54666 | +#ifdef CONFIG_PAX_REFCOUNT | |
54667 | +typedef struct { | |
54668 | + long counter; | |
54669 | +} atomic64_unchecked_t; | |
54670 | +#else | |
54671 | +typedef atomic64_t atomic64_unchecked_t; | |
54672 | +#endif | |
54673 | #endif | |
54674 | ||
54675 | struct list_head { | |
54676 | diff -urNp linux-3.0.3/include/linux/uaccess.h linux-3.0.3/include/linux/uaccess.h | |
54677 | --- linux-3.0.3/include/linux/uaccess.h 2011-07-21 22:17:23.000000000 -0400 | |
54678 | +++ linux-3.0.3/include/linux/uaccess.h 2011-08-23 21:47:56.000000000 -0400 | |
54679 | @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_ | |
54680 | long ret; \ | |
54681 | mm_segment_t old_fs = get_fs(); \ | |
54682 | \ | |
54683 | - set_fs(KERNEL_DS); \ | |
54684 | pagefault_disable(); \ | |
54685 | + set_fs(KERNEL_DS); \ | |
54686 | ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ | |
54687 | - pagefault_enable(); \ | |
54688 | set_fs(old_fs); \ | |
54689 | + pagefault_enable(); \ | |
54690 | ret; \ | |
54691 | }) | |
54692 | ||
54693 | diff -urNp linux-3.0.3/include/linux/unaligned/access_ok.h linux-3.0.3/include/linux/unaligned/access_ok.h | |
54694 | --- linux-3.0.3/include/linux/unaligned/access_ok.h 2011-07-21 22:17:23.000000000 -0400 | |
54695 | +++ linux-3.0.3/include/linux/unaligned/access_ok.h 2011-08-23 21:47:56.000000000 -0400 | |
54696 | @@ -6,32 +6,32 @@ | |
54697 | ||
54698 | static inline u16 get_unaligned_le16(const void *p) | |
54699 | { | |
54700 | - return le16_to_cpup((__le16 *)p); | |
54701 | + return le16_to_cpup((const __le16 *)p); | |
54702 | } | |
54703 | ||
54704 | static inline u32 get_unaligned_le32(const void *p) | |
54705 | { | |
54706 | - return le32_to_cpup((__le32 *)p); | |
54707 | + return le32_to_cpup((const __le32 *)p); | |
54708 | } | |
54709 | ||
54710 | static inline u64 get_unaligned_le64(const void *p) | |
54711 | { | |
54712 | - return le64_to_cpup((__le64 *)p); | |
54713 | + return le64_to_cpup((const __le64 *)p); | |
54714 | } | |
54715 | ||
54716 | static inline u16 get_unaligned_be16(const void *p) | |
54717 | { | |
54718 | - return be16_to_cpup((__be16 *)p); | |
54719 | + return be16_to_cpup((const __be16 *)p); | |
54720 | } | |
54721 | ||
54722 | static inline u32 get_unaligned_be32(const void *p) | |
54723 | { | |
54724 | - return be32_to_cpup((__be32 *)p); | |
54725 | + return be32_to_cpup((const __be32 *)p); | |
54726 | } | |
54727 | ||
54728 | static inline u64 get_unaligned_be64(const void *p) | |
54729 | { | |
54730 | - return be64_to_cpup((__be64 *)p); | |
54731 | + return be64_to_cpup((const __be64 *)p); | |
54732 | } | |
54733 | ||
54734 | static inline void put_unaligned_le16(u16 val, void *p) | |
54735 | diff -urNp linux-3.0.3/include/linux/vmalloc.h linux-3.0.3/include/linux/vmalloc.h | |
54736 | --- linux-3.0.3/include/linux/vmalloc.h 2011-07-21 22:17:23.000000000 -0400 | |
54737 | +++ linux-3.0.3/include/linux/vmalloc.h 2011-08-23 21:47:56.000000000 -0400 | |
54738 | @@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining | |
54739 | #define VM_MAP 0x00000004 /* vmap()ed pages */ | |
54740 | #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */ | |
54741 | #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */ | |
54742 | + | |
54743 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC) | |
54744 | +#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */ | |
54745 | +#endif | |
54746 | + | |
54747 | /* bits [20..32] reserved for arch specific ioremap internals */ | |
54748 | ||
54749 | /* | |
54750 | @@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm | |
54751 | # endif | |
54752 | #endif | |
54753 | ||
54754 | +#define vmalloc(x) \ | |
54755 | +({ \ | |
54756 | + void *___retval; \ | |
54757 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54758 | + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \ | |
54759 | + ___retval = NULL; \ | |
54760 | + else \ | |
54761 | + ___retval = vmalloc((unsigned long)___x); \ | |
54762 | + ___retval; \ | |
54763 | +}) | |
54764 | + | |
54765 | +#define vzalloc(x) \ | |
54766 | +({ \ | |
54767 | + void *___retval; \ | |
54768 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54769 | + if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \ | |
54770 | + ___retval = NULL; \ | |
54771 | + else \ | |
54772 | + ___retval = vzalloc((unsigned long)___x); \ | |
54773 | + ___retval; \ | |
54774 | +}) | |
54775 | + | |
54776 | +#define __vmalloc(x, y, z) \ | |
54777 | +({ \ | |
54778 | + void *___retval; \ | |
54779 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54780 | + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\ | |
54781 | + ___retval = NULL; \ | |
54782 | + else \ | |
54783 | + ___retval = __vmalloc((unsigned long)___x, (y), (z));\ | |
54784 | + ___retval; \ | |
54785 | +}) | |
54786 | + | |
54787 | +#define vmalloc_user(x) \ | |
54788 | +({ \ | |
54789 | + void *___retval; \ | |
54790 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54791 | + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\ | |
54792 | + ___retval = NULL; \ | |
54793 | + else \ | |
54794 | + ___retval = vmalloc_user((unsigned long)___x); \ | |
54795 | + ___retval; \ | |
54796 | +}) | |
54797 | + | |
54798 | +#define vmalloc_exec(x) \ | |
54799 | +({ \ | |
54800 | + void *___retval; \ | |
54801 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54802 | + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\ | |
54803 | + ___retval = NULL; \ | |
54804 | + else \ | |
54805 | + ___retval = vmalloc_exec((unsigned long)___x); \ | |
54806 | + ___retval; \ | |
54807 | +}) | |
54808 | + | |
54809 | +#define vmalloc_node(x, y) \ | |
54810 | +({ \ | |
54811 | + void *___retval; \ | |
54812 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54813 | + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\ | |
54814 | + ___retval = NULL; \ | |
54815 | + else \ | |
54816 | + ___retval = vmalloc_node((unsigned long)___x, (y));\ | |
54817 | + ___retval; \ | |
54818 | +}) | |
54819 | + | |
54820 | +#define vzalloc_node(x, y) \ | |
54821 | +({ \ | |
54822 | + void *___retval; \ | |
54823 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54824 | + if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\ | |
54825 | + ___retval = NULL; \ | |
54826 | + else \ | |
54827 | + ___retval = vzalloc_node((unsigned long)___x, (y));\ | |
54828 | + ___retval; \ | |
54829 | +}) | |
54830 | + | |
54831 | +#define vmalloc_32(x) \ | |
54832 | +({ \ | |
54833 | + void *___retval; \ | |
54834 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54835 | + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\ | |
54836 | + ___retval = NULL; \ | |
54837 | + else \ | |
54838 | + ___retval = vmalloc_32((unsigned long)___x); \ | |
54839 | + ___retval; \ | |
54840 | +}) | |
54841 | + | |
54842 | +#define vmalloc_32_user(x) \ | |
54843 | +({ \ | |
54844 | +void *___retval; \ | |
54845 | + intoverflow_t ___x = (intoverflow_t)x; \ | |
54846 | + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\ | |
54847 | + ___retval = NULL; \ | |
54848 | + else \ | |
54849 | + ___retval = vmalloc_32_user((unsigned long)___x);\ | |
54850 | + ___retval; \ | |
54851 | +}) | |
54852 | + | |
54853 | #endif /* _LINUX_VMALLOC_H */ | |
54854 | diff -urNp linux-3.0.3/include/linux/vmstat.h linux-3.0.3/include/linux/vmstat.h | |
54855 | --- linux-3.0.3/include/linux/vmstat.h 2011-07-21 22:17:23.000000000 -0400 | |
54856 | +++ linux-3.0.3/include/linux/vmstat.h 2011-08-23 21:47:56.000000000 -0400 | |
54857 | @@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(in | |
54858 | /* | |
54859 | * Zone based page accounting with per cpu differentials. | |
54860 | */ | |
54861 | -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
54862 | +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
54863 | ||
54864 | static inline void zone_page_state_add(long x, struct zone *zone, | |
54865 | enum zone_stat_item item) | |
54866 | { | |
54867 | - atomic_long_add(x, &zone->vm_stat[item]); | |
54868 | - atomic_long_add(x, &vm_stat[item]); | |
54869 | + atomic_long_add_unchecked(x, &zone->vm_stat[item]); | |
54870 | + atomic_long_add_unchecked(x, &vm_stat[item]); | |
54871 | } | |
54872 | ||
54873 | static inline unsigned long global_page_state(enum zone_stat_item item) | |
54874 | { | |
54875 | - long x = atomic_long_read(&vm_stat[item]); | |
54876 | + long x = atomic_long_read_unchecked(&vm_stat[item]); | |
54877 | #ifdef CONFIG_SMP | |
54878 | if (x < 0) | |
54879 | x = 0; | |
54880 | @@ -109,7 +109,7 @@ static inline unsigned long global_page_ | |
54881 | static inline unsigned long zone_page_state(struct zone *zone, | |
54882 | enum zone_stat_item item) | |
54883 | { | |
54884 | - long x = atomic_long_read(&zone->vm_stat[item]); | |
54885 | + long x = atomic_long_read_unchecked(&zone->vm_stat[item]); | |
54886 | #ifdef CONFIG_SMP | |
54887 | if (x < 0) | |
54888 | x = 0; | |
54889 | @@ -126,7 +126,7 @@ static inline unsigned long zone_page_st | |
54890 | static inline unsigned long zone_page_state_snapshot(struct zone *zone, | |
54891 | enum zone_stat_item item) | |
54892 | { | |
54893 | - long x = atomic_long_read(&zone->vm_stat[item]); | |
54894 | + long x = atomic_long_read_unchecked(&zone->vm_stat[item]); | |
54895 | ||
54896 | #ifdef CONFIG_SMP | |
54897 | int cpu; | |
54898 | @@ -221,8 +221,8 @@ static inline void __mod_zone_page_state | |
54899 | ||
54900 | static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item) | |
54901 | { | |
54902 | - atomic_long_inc(&zone->vm_stat[item]); | |
54903 | - atomic_long_inc(&vm_stat[item]); | |
54904 | + atomic_long_inc_unchecked(&zone->vm_stat[item]); | |
54905 | + atomic_long_inc_unchecked(&vm_stat[item]); | |
54906 | } | |
54907 | ||
54908 | static inline void __inc_zone_page_state(struct page *page, | |
54909 | @@ -233,8 +233,8 @@ static inline void __inc_zone_page_state | |
54910 | ||
54911 | static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item) | |
54912 | { | |
54913 | - atomic_long_dec(&zone->vm_stat[item]); | |
54914 | - atomic_long_dec(&vm_stat[item]); | |
54915 | + atomic_long_dec_unchecked(&zone->vm_stat[item]); | |
54916 | + atomic_long_dec_unchecked(&vm_stat[item]); | |
54917 | } | |
54918 | ||
54919 | static inline void __dec_zone_page_state(struct page *page, | |
54920 | diff -urNp linux-3.0.3/include/media/saa7146_vv.h linux-3.0.3/include/media/saa7146_vv.h | |
54921 | --- linux-3.0.3/include/media/saa7146_vv.h 2011-07-21 22:17:23.000000000 -0400 | |
54922 | +++ linux-3.0.3/include/media/saa7146_vv.h 2011-08-24 18:26:09.000000000 -0400 | |
54923 | @@ -163,7 +163,7 @@ struct saa7146_ext_vv | |
54924 | int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *); | |
54925 | ||
54926 | /* the extension can override this */ | |
54927 | - struct v4l2_ioctl_ops ops; | |
54928 | + v4l2_ioctl_ops_no_const ops; | |
54929 | /* pointer to the saa7146 core ops */ | |
54930 | const struct v4l2_ioctl_ops *core_ops; | |
54931 | ||
54932 | diff -urNp linux-3.0.3/include/media/v4l2-ioctl.h linux-3.0.3/include/media/v4l2-ioctl.h | |
54933 | --- linux-3.0.3/include/media/v4l2-ioctl.h 2011-07-21 22:17:23.000000000 -0400 | |
54934 | +++ linux-3.0.3/include/media/v4l2-ioctl.h 2011-08-24 18:25:45.000000000 -0400 | |
54935 | @@ -272,6 +272,7 @@ struct v4l2_ioctl_ops { | |
54936 | long (*vidioc_default) (struct file *file, void *fh, | |
54937 | bool valid_prio, int cmd, void *arg); | |
54938 | }; | |
54939 | +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const; | |
54940 | ||
54941 | ||
54942 | /* v4l debugging and diagnostics */ | |
54943 | diff -urNp linux-3.0.3/include/net/caif/cfctrl.h linux-3.0.3/include/net/caif/cfctrl.h | |
54944 | --- linux-3.0.3/include/net/caif/cfctrl.h 2011-07-21 22:17:23.000000000 -0400 | |
54945 | +++ linux-3.0.3/include/net/caif/cfctrl.h 2011-08-23 21:47:56.000000000 -0400 | |
54946 | @@ -52,7 +52,7 @@ struct cfctrl_rsp { | |
54947 | void (*radioset_rsp)(void); | |
54948 | void (*reject_rsp)(struct cflayer *layer, u8 linkid, | |
54949 | struct cflayer *client_layer); | |
54950 | -}; | |
54951 | +} __no_const; | |
54952 | ||
54953 | /* Link Setup Parameters for CAIF-Links. */ | |
54954 | struct cfctrl_link_param { | |
54955 | @@ -101,8 +101,8 @@ struct cfctrl_request_info { | |
54956 | struct cfctrl { | |
54957 | struct cfsrvl serv; | |
54958 | struct cfctrl_rsp res; | |
54959 | - atomic_t req_seq_no; | |
54960 | - atomic_t rsp_seq_no; | |
54961 | + atomic_unchecked_t req_seq_no; | |
54962 | + atomic_unchecked_t rsp_seq_no; | |
54963 | struct list_head list; | |
54964 | /* Protects from simultaneous access to first_req list */ | |
54965 | spinlock_t info_list_lock; | |
54966 | diff -urNp linux-3.0.3/include/net/flow.h linux-3.0.3/include/net/flow.h | |
54967 | --- linux-3.0.3/include/net/flow.h 2011-07-21 22:17:23.000000000 -0400 | |
54968 | +++ linux-3.0.3/include/net/flow.h 2011-08-23 21:47:56.000000000 -0400 | |
54969 | @@ -188,6 +188,6 @@ extern struct flow_cache_object *flow_ca | |
54970 | u8 dir, flow_resolve_t resolver, void *ctx); | |
54971 | ||
54972 | extern void flow_cache_flush(void); | |
54973 | -extern atomic_t flow_cache_genid; | |
54974 | +extern atomic_unchecked_t flow_cache_genid; | |
54975 | ||
54976 | #endif | |
54977 | diff -urNp linux-3.0.3/include/net/inetpeer.h linux-3.0.3/include/net/inetpeer.h | |
54978 | --- linux-3.0.3/include/net/inetpeer.h 2011-07-21 22:17:23.000000000 -0400 | |
54979 | +++ linux-3.0.3/include/net/inetpeer.h 2011-08-23 21:47:56.000000000 -0400 | |
54980 | @@ -43,8 +43,8 @@ struct inet_peer { | |
54981 | */ | |
54982 | union { | |
54983 | struct { | |
54984 | - atomic_t rid; /* Frag reception counter */ | |
54985 | - atomic_t ip_id_count; /* IP ID for the next packet */ | |
54986 | + atomic_unchecked_t rid; /* Frag reception counter */ | |
54987 | + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */ | |
54988 | __u32 tcp_ts; | |
54989 | __u32 tcp_ts_stamp; | |
54990 | u32 metrics[RTAX_MAX]; | |
54991 | @@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in | |
54992 | { | |
54993 | more++; | |
54994 | inet_peer_refcheck(p); | |
54995 | - return atomic_add_return(more, &p->ip_id_count) - more; | |
54996 | + return atomic_add_return_unchecked(more, &p->ip_id_count) - more; | |
54997 | } | |
54998 | ||
54999 | #endif /* _NET_INETPEER_H */ | |
55000 | diff -urNp linux-3.0.3/include/net/ip_fib.h linux-3.0.3/include/net/ip_fib.h | |
55001 | --- linux-3.0.3/include/net/ip_fib.h 2011-07-21 22:17:23.000000000 -0400 | |
55002 | +++ linux-3.0.3/include/net/ip_fib.h 2011-08-23 21:47:56.000000000 -0400 | |
55003 | @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s | |
55004 | ||
55005 | #define FIB_RES_SADDR(net, res) \ | |
55006 | ((FIB_RES_NH(res).nh_saddr_genid == \ | |
55007 | - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \ | |
55008 | + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \ | |
55009 | FIB_RES_NH(res).nh_saddr : \ | |
55010 | fib_info_update_nh_saddr((net), &FIB_RES_NH(res))) | |
55011 | #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw) | |
55012 | diff -urNp linux-3.0.3/include/net/ip_vs.h linux-3.0.3/include/net/ip_vs.h | |
55013 | --- linux-3.0.3/include/net/ip_vs.h 2011-07-21 22:17:23.000000000 -0400 | |
55014 | +++ linux-3.0.3/include/net/ip_vs.h 2011-08-23 21:47:56.000000000 -0400 | |
55015 | @@ -509,7 +509,7 @@ struct ip_vs_conn { | |
55016 | struct ip_vs_conn *control; /* Master control connection */ | |
55017 | atomic_t n_control; /* Number of controlled ones */ | |
55018 | struct ip_vs_dest *dest; /* real server */ | |
55019 | - atomic_t in_pkts; /* incoming packet counter */ | |
55020 | + atomic_unchecked_t in_pkts; /* incoming packet counter */ | |
55021 | ||
55022 | /* packet transmitter for different forwarding methods. If it | |
55023 | mangles the packet, it must return NF_DROP or better NF_STOLEN, | |
55024 | @@ -647,7 +647,7 @@ struct ip_vs_dest { | |
55025 | __be16 port; /* port number of the server */ | |
55026 | union nf_inet_addr addr; /* IP address of the server */ | |
55027 | volatile unsigned flags; /* dest status flags */ | |
55028 | - atomic_t conn_flags; /* flags to copy to conn */ | |
55029 | + atomic_unchecked_t conn_flags; /* flags to copy to conn */ | |
55030 | atomic_t weight; /* server weight */ | |
55031 | ||
55032 | atomic_t refcnt; /* reference counter */ | |
55033 | diff -urNp linux-3.0.3/include/net/irda/ircomm_core.h linux-3.0.3/include/net/irda/ircomm_core.h | |
55034 | --- linux-3.0.3/include/net/irda/ircomm_core.h 2011-07-21 22:17:23.000000000 -0400 | |
55035 | +++ linux-3.0.3/include/net/irda/ircomm_core.h 2011-08-23 21:47:56.000000000 -0400 | |
55036 | @@ -51,7 +51,7 @@ typedef struct { | |
55037 | int (*connect_response)(struct ircomm_cb *, struct sk_buff *); | |
55038 | int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *, | |
55039 | struct ircomm_info *); | |
55040 | -} call_t; | |
55041 | +} __no_const call_t; | |
55042 | ||
55043 | struct ircomm_cb { | |
55044 | irda_queue_t queue; | |
55045 | diff -urNp linux-3.0.3/include/net/irda/ircomm_tty.h linux-3.0.3/include/net/irda/ircomm_tty.h | |
55046 | --- linux-3.0.3/include/net/irda/ircomm_tty.h 2011-07-21 22:17:23.000000000 -0400 | |
55047 | +++ linux-3.0.3/include/net/irda/ircomm_tty.h 2011-08-23 21:47:56.000000000 -0400 | |
55048 | @@ -35,6 +35,7 @@ | |
55049 | #include <linux/termios.h> | |
55050 | #include <linux/timer.h> | |
55051 | #include <linux/tty.h> /* struct tty_struct */ | |
55052 | +#include <asm/local.h> | |
55053 | ||
55054 | #include <net/irda/irias_object.h> | |
55055 | #include <net/irda/ircomm_core.h> | |
55056 | @@ -105,8 +106,8 @@ struct ircomm_tty_cb { | |
55057 | unsigned short close_delay; | |
55058 | unsigned short closing_wait; /* time to wait before closing */ | |
55059 | ||
55060 | - int open_count; | |
55061 | - int blocked_open; /* # of blocked opens */ | |
55062 | + local_t open_count; | |
55063 | + local_t blocked_open; /* # of blocked opens */ | |
55064 | ||
55065 | /* Protect concurent access to : | |
55066 | * o self->open_count | |
55067 | diff -urNp linux-3.0.3/include/net/iucv/af_iucv.h linux-3.0.3/include/net/iucv/af_iucv.h | |
55068 | --- linux-3.0.3/include/net/iucv/af_iucv.h 2011-07-21 22:17:23.000000000 -0400 | |
55069 | +++ linux-3.0.3/include/net/iucv/af_iucv.h 2011-08-23 21:47:56.000000000 -0400 | |
55070 | @@ -87,7 +87,7 @@ struct iucv_sock { | |
55071 | struct iucv_sock_list { | |
55072 | struct hlist_head head; | |
55073 | rwlock_t lock; | |
55074 | - atomic_t autobind_name; | |
55075 | + atomic_unchecked_t autobind_name; | |
55076 | }; | |
55077 | ||
55078 | unsigned int iucv_sock_poll(struct file *file, struct socket *sock, | |
55079 | diff -urNp linux-3.0.3/include/net/lapb.h linux-3.0.3/include/net/lapb.h | |
55080 | --- linux-3.0.3/include/net/lapb.h 2011-07-21 22:17:23.000000000 -0400 | |
55081 | +++ linux-3.0.3/include/net/lapb.h 2011-08-23 21:47:56.000000000 -0400 | |
55082 | @@ -95,7 +95,7 @@ struct lapb_cb { | |
55083 | struct sk_buff_head write_queue; | |
55084 | struct sk_buff_head ack_queue; | |
55085 | unsigned char window; | |
55086 | - struct lapb_register_struct callbacks; | |
55087 | + struct lapb_register_struct *callbacks; | |
55088 | ||
55089 | /* FRMR control information */ | |
55090 | struct lapb_frame frmr_data; | |
55091 | diff -urNp linux-3.0.3/include/net/neighbour.h linux-3.0.3/include/net/neighbour.h | |
55092 | --- linux-3.0.3/include/net/neighbour.h 2011-07-21 22:17:23.000000000 -0400 | |
55093 | +++ linux-3.0.3/include/net/neighbour.h 2011-08-26 19:49:56.000000000 -0400 | |
55094 | @@ -117,14 +117,14 @@ struct neighbour { | |
55095 | }; | |
55096 | ||
55097 | struct neigh_ops { | |
55098 | - int family; | |
55099 | + const int family; | |
55100 | void (*solicit)(struct neighbour *, struct sk_buff*); | |
55101 | void (*error_report)(struct neighbour *, struct sk_buff*); | |
55102 | int (*output)(struct sk_buff*); | |
55103 | int (*connected_output)(struct sk_buff*); | |
55104 | int (*hh_output)(struct sk_buff*); | |
55105 | int (*queue_xmit)(struct sk_buff*); | |
55106 | -}; | |
55107 | +} __do_const; | |
55108 | ||
55109 | struct pneigh_entry { | |
55110 | struct pneigh_entry *next; | |
55111 | diff -urNp linux-3.0.3/include/net/netlink.h linux-3.0.3/include/net/netlink.h | |
55112 | --- linux-3.0.3/include/net/netlink.h 2011-07-21 22:17:23.000000000 -0400 | |
55113 | +++ linux-3.0.3/include/net/netlink.h 2011-08-23 21:47:56.000000000 -0400 | |
55114 | @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct | |
55115 | static inline void nlmsg_trim(struct sk_buff *skb, const void *mark) | |
55116 | { | |
55117 | if (mark) | |
55118 | - skb_trim(skb, (unsigned char *) mark - skb->data); | |
55119 | + skb_trim(skb, (const unsigned char *) mark - skb->data); | |
55120 | } | |
55121 | ||
55122 | /** | |
55123 | diff -urNp linux-3.0.3/include/net/netns/ipv4.h linux-3.0.3/include/net/netns/ipv4.h | |
55124 | --- linux-3.0.3/include/net/netns/ipv4.h 2011-07-21 22:17:23.000000000 -0400 | |
55125 | +++ linux-3.0.3/include/net/netns/ipv4.h 2011-08-23 21:47:56.000000000 -0400 | |
55126 | @@ -56,8 +56,8 @@ struct netns_ipv4 { | |
55127 | ||
55128 | unsigned int sysctl_ping_group_range[2]; | |
55129 | ||
55130 | - atomic_t rt_genid; | |
55131 | - atomic_t dev_addr_genid; | |
55132 | + atomic_unchecked_t rt_genid; | |
55133 | + atomic_unchecked_t dev_addr_genid; | |
55134 | ||
55135 | #ifdef CONFIG_IP_MROUTE | |
55136 | #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES | |
55137 | diff -urNp linux-3.0.3/include/net/sctp/sctp.h linux-3.0.3/include/net/sctp/sctp.h | |
55138 | --- linux-3.0.3/include/net/sctp/sctp.h 2011-07-21 22:17:23.000000000 -0400 | |
55139 | +++ linux-3.0.3/include/net/sctp/sctp.h 2011-08-23 21:47:56.000000000 -0400 | |
55140 | @@ -315,9 +315,9 @@ do { \ | |
55141 | ||
55142 | #else /* SCTP_DEBUG */ | |
55143 | ||
55144 | -#define SCTP_DEBUG_PRINTK(whatever...) | |
55145 | -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) | |
55146 | -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) | |
55147 | +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0) | |
55148 | +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0) | |
55149 | +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0) | |
55150 | #define SCTP_ENABLE_DEBUG | |
55151 | #define SCTP_DISABLE_DEBUG | |
55152 | #define SCTP_ASSERT(expr, str, func) | |
55153 | diff -urNp linux-3.0.3/include/net/sock.h linux-3.0.3/include/net/sock.h | |
55154 | --- linux-3.0.3/include/net/sock.h 2011-07-21 22:17:23.000000000 -0400 | |
55155 | +++ linux-3.0.3/include/net/sock.h 2011-08-23 21:47:56.000000000 -0400 | |
55156 | @@ -277,7 +277,7 @@ struct sock { | |
55157 | #ifdef CONFIG_RPS | |
55158 | __u32 sk_rxhash; | |
55159 | #endif | |
55160 | - atomic_t sk_drops; | |
55161 | + atomic_unchecked_t sk_drops; | |
55162 | int sk_rcvbuf; | |
55163 | ||
55164 | struct sk_filter __rcu *sk_filter; | |
55165 | @@ -1390,7 +1390,7 @@ static inline void sk_nocaps_add(struct | |
55166 | } | |
55167 | ||
55168 | static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb, | |
55169 | - char __user *from, char *to, | |
55170 | + char __user *from, unsigned char *to, | |
55171 | int copy, int offset) | |
55172 | { | |
55173 | if (skb->ip_summed == CHECKSUM_NONE) { | |
55174 | diff -urNp linux-3.0.3/include/net/tcp.h linux-3.0.3/include/net/tcp.h | |
55175 | --- linux-3.0.3/include/net/tcp.h 2011-07-21 22:17:23.000000000 -0400 | |
55176 | +++ linux-3.0.3/include/net/tcp.h 2011-08-23 21:47:56.000000000 -0400 | |
55177 | @@ -1374,8 +1374,8 @@ enum tcp_seq_states { | |
55178 | struct tcp_seq_afinfo { | |
55179 | char *name; | |
55180 | sa_family_t family; | |
55181 | - struct file_operations seq_fops; | |
55182 | - struct seq_operations seq_ops; | |
55183 | + file_operations_no_const seq_fops; | |
55184 | + seq_operations_no_const seq_ops; | |
55185 | }; | |
55186 | ||
55187 | struct tcp_iter_state { | |
55188 | diff -urNp linux-3.0.3/include/net/udp.h linux-3.0.3/include/net/udp.h | |
55189 | --- linux-3.0.3/include/net/udp.h 2011-07-21 22:17:23.000000000 -0400 | |
55190 | +++ linux-3.0.3/include/net/udp.h 2011-08-23 21:47:56.000000000 -0400 | |
55191 | @@ -234,8 +234,8 @@ struct udp_seq_afinfo { | |
55192 | char *name; | |
55193 | sa_family_t family; | |
55194 | struct udp_table *udp_table; | |
55195 | - struct file_operations seq_fops; | |
55196 | - struct seq_operations seq_ops; | |
55197 | + file_operations_no_const seq_fops; | |
55198 | + seq_operations_no_const seq_ops; | |
55199 | }; | |
55200 | ||
55201 | struct udp_iter_state { | |
55202 | diff -urNp linux-3.0.3/include/net/xfrm.h linux-3.0.3/include/net/xfrm.h | |
55203 | --- linux-3.0.3/include/net/xfrm.h 2011-07-21 22:17:23.000000000 -0400 | |
55204 | +++ linux-3.0.3/include/net/xfrm.h 2011-08-23 21:47:56.000000000 -0400 | |
55205 | @@ -505,7 +505,7 @@ struct xfrm_policy { | |
55206 | struct timer_list timer; | |
55207 | ||
55208 | struct flow_cache_object flo; | |
55209 | - atomic_t genid; | |
55210 | + atomic_unchecked_t genid; | |
55211 | u32 priority; | |
55212 | u32 index; | |
55213 | struct xfrm_mark mark; | |
55214 | diff -urNp linux-3.0.3/include/rdma/iw_cm.h linux-3.0.3/include/rdma/iw_cm.h | |
55215 | --- linux-3.0.3/include/rdma/iw_cm.h 2011-07-21 22:17:23.000000000 -0400 | |
55216 | +++ linux-3.0.3/include/rdma/iw_cm.h 2011-08-23 21:47:56.000000000 -0400 | |
55217 | @@ -120,7 +120,7 @@ struct iw_cm_verbs { | |
55218 | int backlog); | |
55219 | ||
55220 | int (*destroy_listen)(struct iw_cm_id *cm_id); | |
55221 | -}; | |
55222 | +} __no_const; | |
55223 | ||
55224 | /** | |
55225 | * iw_create_cm_id - Create an IW CM identifier. | |
55226 | diff -urNp linux-3.0.3/include/scsi/libfc.h linux-3.0.3/include/scsi/libfc.h | |
55227 | --- linux-3.0.3/include/scsi/libfc.h 2011-07-21 22:17:23.000000000 -0400 | |
55228 | +++ linux-3.0.3/include/scsi/libfc.h 2011-08-23 21:47:56.000000000 -0400 | |
55229 | @@ -750,6 +750,7 @@ struct libfc_function_template { | |
55230 | */ | |
55231 | void (*disc_stop_final) (struct fc_lport *); | |
55232 | }; | |
55233 | +typedef struct libfc_function_template __no_const libfc_function_template_no_const; | |
55234 | ||
55235 | /** | |
55236 | * struct fc_disc - Discovery context | |
55237 | @@ -853,7 +854,7 @@ struct fc_lport { | |
55238 | struct fc_vport *vport; | |
55239 | ||
55240 | /* Operational Information */ | |
55241 | - struct libfc_function_template tt; | |
55242 | + libfc_function_template_no_const tt; | |
55243 | u8 link_up; | |
55244 | u8 qfull; | |
55245 | enum fc_lport_state state; | |
55246 | diff -urNp linux-3.0.3/include/scsi/scsi_device.h linux-3.0.3/include/scsi/scsi_device.h | |
55247 | --- linux-3.0.3/include/scsi/scsi_device.h 2011-07-21 22:17:23.000000000 -0400 | |
55248 | +++ linux-3.0.3/include/scsi/scsi_device.h 2011-08-23 21:47:56.000000000 -0400 | |
55249 | @@ -161,9 +161,9 @@ struct scsi_device { | |
55250 | unsigned int max_device_blocked; /* what device_blocked counts down from */ | |
55251 | #define SCSI_DEFAULT_DEVICE_BLOCKED 3 | |
55252 | ||
55253 | - atomic_t iorequest_cnt; | |
55254 | - atomic_t iodone_cnt; | |
55255 | - atomic_t ioerr_cnt; | |
55256 | + atomic_unchecked_t iorequest_cnt; | |
55257 | + atomic_unchecked_t iodone_cnt; | |
55258 | + atomic_unchecked_t ioerr_cnt; | |
55259 | ||
55260 | struct device sdev_gendev, | |
55261 | sdev_dev; | |
55262 | diff -urNp linux-3.0.3/include/scsi/scsi_transport_fc.h linux-3.0.3/include/scsi/scsi_transport_fc.h | |
55263 | --- linux-3.0.3/include/scsi/scsi_transport_fc.h 2011-07-21 22:17:23.000000000 -0400 | |
55264 | +++ linux-3.0.3/include/scsi/scsi_transport_fc.h 2011-08-26 19:49:56.000000000 -0400 | |
55265 | @@ -711,7 +711,7 @@ struct fc_function_template { | |
55266 | unsigned long show_host_system_hostname:1; | |
55267 | ||
55268 | unsigned long disable_target_scan:1; | |
55269 | -}; | |
55270 | +} __do_const; | |
55271 | ||
55272 | ||
55273 | /** | |
55274 | diff -urNp linux-3.0.3/include/sound/ak4xxx-adda.h linux-3.0.3/include/sound/ak4xxx-adda.h | |
55275 | --- linux-3.0.3/include/sound/ak4xxx-adda.h 2011-07-21 22:17:23.000000000 -0400 | |
55276 | +++ linux-3.0.3/include/sound/ak4xxx-adda.h 2011-08-23 21:47:56.000000000 -0400 | |
55277 | @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops { | |
55278 | void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg, | |
55279 | unsigned char val); | |
55280 | void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate); | |
55281 | -}; | |
55282 | +} __no_const; | |
55283 | ||
55284 | #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */ | |
55285 | ||
55286 | diff -urNp linux-3.0.3/include/sound/hwdep.h linux-3.0.3/include/sound/hwdep.h | |
55287 | --- linux-3.0.3/include/sound/hwdep.h 2011-07-21 22:17:23.000000000 -0400 | |
55288 | +++ linux-3.0.3/include/sound/hwdep.h 2011-08-23 21:47:56.000000000 -0400 | |
55289 | @@ -49,7 +49,7 @@ struct snd_hwdep_ops { | |
55290 | struct snd_hwdep_dsp_status *status); | |
55291 | int (*dsp_load)(struct snd_hwdep *hw, | |
55292 | struct snd_hwdep_dsp_image *image); | |
55293 | -}; | |
55294 | +} __no_const; | |
55295 | ||
55296 | struct snd_hwdep { | |
55297 | struct snd_card *card; | |
55298 | diff -urNp linux-3.0.3/include/sound/info.h linux-3.0.3/include/sound/info.h | |
55299 | --- linux-3.0.3/include/sound/info.h 2011-07-21 22:17:23.000000000 -0400 | |
55300 | +++ linux-3.0.3/include/sound/info.h 2011-08-23 21:47:56.000000000 -0400 | |
55301 | @@ -44,7 +44,7 @@ struct snd_info_entry_text { | |
55302 | struct snd_info_buffer *buffer); | |
55303 | void (*write)(struct snd_info_entry *entry, | |
55304 | struct snd_info_buffer *buffer); | |
55305 | -}; | |
55306 | +} __no_const; | |
55307 | ||
55308 | struct snd_info_entry_ops { | |
55309 | int (*open)(struct snd_info_entry *entry, | |
55310 | diff -urNp linux-3.0.3/include/sound/pcm.h linux-3.0.3/include/sound/pcm.h | |
55311 | --- linux-3.0.3/include/sound/pcm.h 2011-07-21 22:17:23.000000000 -0400 | |
55312 | +++ linux-3.0.3/include/sound/pcm.h 2011-08-23 21:47:56.000000000 -0400 | |
55313 | @@ -81,6 +81,7 @@ struct snd_pcm_ops { | |
55314 | int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma); | |
55315 | int (*ack)(struct snd_pcm_substream *substream); | |
55316 | }; | |
55317 | +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const; | |
55318 | ||
55319 | /* | |
55320 | * | |
55321 | diff -urNp linux-3.0.3/include/sound/sb16_csp.h linux-3.0.3/include/sound/sb16_csp.h | |
55322 | --- linux-3.0.3/include/sound/sb16_csp.h 2011-07-21 22:17:23.000000000 -0400 | |
55323 | +++ linux-3.0.3/include/sound/sb16_csp.h 2011-08-23 21:47:56.000000000 -0400 | |
55324 | @@ -146,7 +146,7 @@ struct snd_sb_csp_ops { | |
55325 | int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels); | |
55326 | int (*csp_stop) (struct snd_sb_csp * p); | |
55327 | int (*csp_qsound_transfer) (struct snd_sb_csp * p); | |
55328 | -}; | |
55329 | +} __no_const; | |
55330 | ||
55331 | /* | |
55332 | * CSP private data | |
55333 | diff -urNp linux-3.0.3/include/sound/soc.h linux-3.0.3/include/sound/soc.h | |
55334 | --- linux-3.0.3/include/sound/soc.h 2011-07-21 22:17:23.000000000 -0400 | |
55335 | +++ linux-3.0.3/include/sound/soc.h 2011-08-26 19:49:56.000000000 -0400 | |
55336 | @@ -636,7 +636,7 @@ struct snd_soc_platform_driver { | |
55337 | ||
55338 | /* platform stream ops */ | |
55339 | struct snd_pcm_ops *ops; | |
55340 | -}; | |
55341 | +} __do_const; | |
55342 | ||
55343 | struct snd_soc_platform { | |
55344 | const char *name; | |
55345 | diff -urNp linux-3.0.3/include/sound/ymfpci.h linux-3.0.3/include/sound/ymfpci.h | |
55346 | --- linux-3.0.3/include/sound/ymfpci.h 2011-07-21 22:17:23.000000000 -0400 | |
55347 | +++ linux-3.0.3/include/sound/ymfpci.h 2011-08-23 21:47:56.000000000 -0400 | |
55348 | @@ -358,7 +358,7 @@ struct snd_ymfpci { | |
55349 | spinlock_t reg_lock; | |
55350 | spinlock_t voice_lock; | |
55351 | wait_queue_head_t interrupt_sleep; | |
55352 | - atomic_t interrupt_sleep_count; | |
55353 | + atomic_unchecked_t interrupt_sleep_count; | |
55354 | struct snd_info_entry *proc_entry; | |
55355 | const struct firmware *dsp_microcode; | |
55356 | const struct firmware *controller_microcode; | |
55357 | diff -urNp linux-3.0.3/include/target/target_core_base.h linux-3.0.3/include/target/target_core_base.h | |
55358 | --- linux-3.0.3/include/target/target_core_base.h 2011-07-21 22:17:23.000000000 -0400 | |
55359 | +++ linux-3.0.3/include/target/target_core_base.h 2011-08-23 21:47:56.000000000 -0400 | |
55360 | @@ -364,7 +364,7 @@ struct t10_reservation_ops { | |
55361 | int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32); | |
55362 | int (*t10_pr_register)(struct se_cmd *); | |
55363 | int (*t10_pr_clear)(struct se_cmd *); | |
55364 | -}; | |
55365 | +} __no_const; | |
55366 | ||
55367 | struct t10_reservation_template { | |
55368 | /* Reservation effects all target ports */ | |
55369 | @@ -432,8 +432,8 @@ struct se_transport_task { | |
55370 | atomic_t t_task_cdbs_left; | |
55371 | atomic_t t_task_cdbs_ex_left; | |
55372 | atomic_t t_task_cdbs_timeout_left; | |
55373 | - atomic_t t_task_cdbs_sent; | |
55374 | - atomic_t t_transport_aborted; | |
55375 | + atomic_unchecked_t t_task_cdbs_sent; | |
55376 | + atomic_unchecked_t t_transport_aborted; | |
55377 | atomic_t t_transport_active; | |
55378 | atomic_t t_transport_complete; | |
55379 | atomic_t t_transport_queue_active; | |
55380 | @@ -774,7 +774,7 @@ struct se_device { | |
55381 | atomic_t active_cmds; | |
55382 | atomic_t simple_cmds; | |
55383 | atomic_t depth_left; | |
55384 | - atomic_t dev_ordered_id; | |
55385 | + atomic_unchecked_t dev_ordered_id; | |
55386 | atomic_t dev_tur_active; | |
55387 | atomic_t execute_tasks; | |
55388 | atomic_t dev_status_thr_count; | |
55389 | diff -urNp linux-3.0.3/include/trace/events/irq.h linux-3.0.3/include/trace/events/irq.h | |
55390 | --- linux-3.0.3/include/trace/events/irq.h 2011-07-21 22:17:23.000000000 -0400 | |
55391 | +++ linux-3.0.3/include/trace/events/irq.h 2011-08-23 21:47:56.000000000 -0400 | |
55392 | @@ -36,7 +36,7 @@ struct softirq_action; | |
55393 | */ | |
55394 | TRACE_EVENT(irq_handler_entry, | |
55395 | ||
55396 | - TP_PROTO(int irq, struct irqaction *action), | |
55397 | + TP_PROTO(int irq, const struct irqaction *action), | |
55398 | ||
55399 | TP_ARGS(irq, action), | |
55400 | ||
55401 | @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry, | |
55402 | */ | |
55403 | TRACE_EVENT(irq_handler_exit, | |
55404 | ||
55405 | - TP_PROTO(int irq, struct irqaction *action, int ret), | |
55406 | + TP_PROTO(int irq, const struct irqaction *action, int ret), | |
55407 | ||
55408 | TP_ARGS(irq, action, ret), | |
55409 | ||
55410 | diff -urNp linux-3.0.3/include/video/udlfb.h linux-3.0.3/include/video/udlfb.h | |
55411 | --- linux-3.0.3/include/video/udlfb.h 2011-07-21 22:17:23.000000000 -0400 | |
55412 | +++ linux-3.0.3/include/video/udlfb.h 2011-08-23 21:47:56.000000000 -0400 | |
55413 | @@ -51,10 +51,10 @@ struct dlfb_data { | |
55414 | int base8; | |
55415 | u32 pseudo_palette[256]; | |
55416 | /* blit-only rendering path metrics, exposed through sysfs */ | |
55417 | - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */ | |
55418 | - atomic_t bytes_identical; /* saved effort with backbuffer comparison */ | |
55419 | - atomic_t bytes_sent; /* to usb, after compression including overhead */ | |
55420 | - atomic_t cpu_kcycles_used; /* transpired during pixel processing */ | |
55421 | + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */ | |
55422 | + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */ | |
55423 | + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */ | |
55424 | + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */ | |
55425 | }; | |
55426 | ||
55427 | #define NR_USB_REQUEST_I2C_SUB_IO 0x02 | |
55428 | diff -urNp linux-3.0.3/include/video/uvesafb.h linux-3.0.3/include/video/uvesafb.h | |
55429 | --- linux-3.0.3/include/video/uvesafb.h 2011-07-21 22:17:23.000000000 -0400 | |
55430 | +++ linux-3.0.3/include/video/uvesafb.h 2011-08-23 21:47:56.000000000 -0400 | |
55431 | @@ -177,6 +177,7 @@ struct uvesafb_par { | |
55432 | u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */ | |
55433 | u8 pmi_setpal; /* PMI for palette changes */ | |
55434 | u16 *pmi_base; /* protected mode interface location */ | |
55435 | + u8 *pmi_code; /* protected mode code location */ | |
55436 | void *pmi_start; | |
55437 | void *pmi_pal; | |
55438 | u8 *vbe_state_orig; /* | |
55439 | diff -urNp linux-3.0.3/init/do_mounts.c linux-3.0.3/init/do_mounts.c | |
55440 | --- linux-3.0.3/init/do_mounts.c 2011-07-21 22:17:23.000000000 -0400 | |
55441 | +++ linux-3.0.3/init/do_mounts.c 2011-08-23 21:47:56.000000000 -0400 | |
55442 | @@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa | |
55443 | ||
55444 | static int __init do_mount_root(char *name, char *fs, int flags, void *data) | |
55445 | { | |
55446 | - int err = sys_mount(name, "/root", fs, flags, data); | |
55447 | + int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data); | |
55448 | if (err) | |
55449 | return err; | |
55450 | ||
55451 | @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ... | |
55452 | va_start(args, fmt); | |
55453 | vsprintf(buf, fmt, args); | |
55454 | va_end(args); | |
55455 | - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0); | |
55456 | + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0); | |
55457 | if (fd >= 0) { | |
55458 | sys_ioctl(fd, FDEJECT, 0); | |
55459 | sys_close(fd); | |
55460 | } | |
55461 | printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf); | |
55462 | - fd = sys_open("/dev/console", O_RDWR, 0); | |
55463 | + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0); | |
55464 | if (fd >= 0) { | |
55465 | sys_ioctl(fd, TCGETS, (long)&termios); | |
55466 | termios.c_lflag &= ~ICANON; | |
55467 | sys_ioctl(fd, TCSETSF, (long)&termios); | |
55468 | - sys_read(fd, &c, 1); | |
55469 | + sys_read(fd, (char __user *)&c, 1); | |
55470 | termios.c_lflag |= ICANON; | |
55471 | sys_ioctl(fd, TCSETSF, (long)&termios); | |
55472 | sys_close(fd); | |
55473 | @@ -488,6 +488,6 @@ void __init prepare_namespace(void) | |
55474 | mount_root(); | |
55475 | out: | |
55476 | devtmpfs_mount("dev"); | |
55477 | - sys_mount(".", "/", NULL, MS_MOVE, NULL); | |
55478 | + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL); | |
55479 | sys_chroot((const char __user __force *)"."); | |
55480 | } | |
55481 | diff -urNp linux-3.0.3/init/do_mounts.h linux-3.0.3/init/do_mounts.h | |
55482 | --- linux-3.0.3/init/do_mounts.h 2011-07-21 22:17:23.000000000 -0400 | |
55483 | +++ linux-3.0.3/init/do_mounts.h 2011-08-23 21:47:56.000000000 -0400 | |
55484 | @@ -15,15 +15,15 @@ extern int root_mountflags; | |
55485 | ||
55486 | static inline int create_dev(char *name, dev_t dev) | |
55487 | { | |
55488 | - sys_unlink(name); | |
55489 | - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev)); | |
55490 | + sys_unlink((__force char __user *)name); | |
55491 | + return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev)); | |
55492 | } | |
55493 | ||
55494 | #if BITS_PER_LONG == 32 | |
55495 | static inline u32 bstat(char *name) | |
55496 | { | |
55497 | struct stat64 stat; | |
55498 | - if (sys_stat64(name, &stat) != 0) | |
55499 | + if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0) | |
55500 | return 0; | |
55501 | if (!S_ISBLK(stat.st_mode)) | |
55502 | return 0; | |
55503 | diff -urNp linux-3.0.3/init/do_mounts_initrd.c linux-3.0.3/init/do_mounts_initrd.c | |
55504 | --- linux-3.0.3/init/do_mounts_initrd.c 2011-07-21 22:17:23.000000000 -0400 | |
55505 | +++ linux-3.0.3/init/do_mounts_initrd.c 2011-08-23 21:47:56.000000000 -0400 | |
55506 | @@ -44,13 +44,13 @@ static void __init handle_initrd(void) | |
55507 | create_dev("/dev/root.old", Root_RAM0); | |
55508 | /* mount initrd on rootfs' /root */ | |
55509 | mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY); | |
55510 | - sys_mkdir("/old", 0700); | |
55511 | - root_fd = sys_open("/", 0, 0); | |
55512 | - old_fd = sys_open("/old", 0, 0); | |
55513 | + sys_mkdir((__force const char __user *)"/old", 0700); | |
55514 | + root_fd = sys_open((__force const char __user *)"/", 0, 0); | |
55515 | + old_fd = sys_open((__force const char __user *)"/old", 0, 0); | |
55516 | /* move initrd over / and chdir/chroot in initrd root */ | |
55517 | - sys_chdir("/root"); | |
55518 | - sys_mount(".", "/", NULL, MS_MOVE, NULL); | |
55519 | - sys_chroot("."); | |
55520 | + sys_chdir((__force const char __user *)"/root"); | |
55521 | + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL); | |
55522 | + sys_chroot((__force const char __user *)"."); | |
55523 | ||
55524 | /* | |
55525 | * In case that a resume from disk is carried out by linuxrc or one of | |
55526 | @@ -67,15 +67,15 @@ static void __init handle_initrd(void) | |
55527 | ||
55528 | /* move initrd to rootfs' /old */ | |
55529 | sys_fchdir(old_fd); | |
55530 | - sys_mount("/", ".", NULL, MS_MOVE, NULL); | |
55531 | + sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL); | |
55532 | /* switch root and cwd back to / of rootfs */ | |
55533 | sys_fchdir(root_fd); | |
55534 | - sys_chroot("."); | |
55535 | + sys_chroot((__force const char __user *)"."); | |
55536 | sys_close(old_fd); | |
55537 | sys_close(root_fd); | |
55538 | ||
55539 | if (new_decode_dev(real_root_dev) == Root_RAM0) { | |
55540 | - sys_chdir("/old"); | |
55541 | + sys_chdir((__force const char __user *)"/old"); | |
55542 | return; | |
55543 | } | |
55544 | ||
55545 | @@ -83,17 +83,17 @@ static void __init handle_initrd(void) | |
55546 | mount_root(); | |
55547 | ||
55548 | printk(KERN_NOTICE "Trying to move old root to /initrd ... "); | |
55549 | - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL); | |
55550 | + error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL); | |
55551 | if (!error) | |
55552 | printk("okay\n"); | |
55553 | else { | |
55554 | - int fd = sys_open("/dev/root.old", O_RDWR, 0); | |
55555 | + int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0); | |
55556 | if (error == -ENOENT) | |
55557 | printk("/initrd does not exist. Ignored.\n"); | |
55558 | else | |
55559 | printk("failed\n"); | |
55560 | printk(KERN_NOTICE "Unmounting old root\n"); | |
55561 | - sys_umount("/old", MNT_DETACH); | |
55562 | + sys_umount((__force char __user *)"/old", MNT_DETACH); | |
55563 | printk(KERN_NOTICE "Trying to free ramdisk memory ... "); | |
55564 | if (fd < 0) { | |
55565 | error = fd; | |
55566 | @@ -116,11 +116,11 @@ int __init initrd_load(void) | |
55567 | * mounted in the normal path. | |
55568 | */ | |
55569 | if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) { | |
55570 | - sys_unlink("/initrd.image"); | |
55571 | + sys_unlink((__force const char __user *)"/initrd.image"); | |
55572 | handle_initrd(); | |
55573 | return 1; | |
55574 | } | |
55575 | } | |
55576 | - sys_unlink("/initrd.image"); | |
55577 | + sys_unlink((__force const char __user *)"/initrd.image"); | |
55578 | return 0; | |
55579 | } | |
55580 | diff -urNp linux-3.0.3/init/do_mounts_md.c linux-3.0.3/init/do_mounts_md.c | |
55581 | --- linux-3.0.3/init/do_mounts_md.c 2011-07-21 22:17:23.000000000 -0400 | |
55582 | +++ linux-3.0.3/init/do_mounts_md.c 2011-08-23 21:47:56.000000000 -0400 | |
55583 | @@ -170,7 +170,7 @@ static void __init md_setup_drive(void) | |
55584 | partitioned ? "_d" : "", minor, | |
55585 | md_setup_args[ent].device_names); | |
55586 | ||
55587 | - fd = sys_open(name, 0, 0); | |
55588 | + fd = sys_open((__force char __user *)name, 0, 0); | |
55589 | if (fd < 0) { | |
55590 | printk(KERN_ERR "md: open failed - cannot start " | |
55591 | "array %s\n", name); | |
55592 | @@ -233,7 +233,7 @@ static void __init md_setup_drive(void) | |
55593 | * array without it | |
55594 | */ | |
55595 | sys_close(fd); | |
55596 | - fd = sys_open(name, 0, 0); | |
55597 | + fd = sys_open((__force char __user *)name, 0, 0); | |
55598 | sys_ioctl(fd, BLKRRPART, 0); | |
55599 | } | |
55600 | sys_close(fd); | |
55601 | diff -urNp linux-3.0.3/init/initramfs.c linux-3.0.3/init/initramfs.c | |
55602 | --- linux-3.0.3/init/initramfs.c 2011-07-21 22:17:23.000000000 -0400 | |
55603 | +++ linux-3.0.3/init/initramfs.c 2011-08-23 21:47:56.000000000 -0400 | |
55604 | @@ -74,7 +74,7 @@ static void __init free_hash(void) | |
55605 | } | |
55606 | } | |
55607 | ||
55608 | -static long __init do_utime(char __user *filename, time_t mtime) | |
55609 | +static long __init do_utime(__force char __user *filename, time_t mtime) | |
55610 | { | |
55611 | struct timespec t[2]; | |
55612 | ||
55613 | @@ -109,7 +109,7 @@ static void __init dir_utime(void) | |
55614 | struct dir_entry *de, *tmp; | |
55615 | list_for_each_entry_safe(de, tmp, &dir_list, list) { | |
55616 | list_del(&de->list); | |
55617 | - do_utime(de->name, de->mtime); | |
55618 | + do_utime((__force char __user *)de->name, de->mtime); | |
55619 | kfree(de->name); | |
55620 | kfree(de); | |
55621 | } | |
55622 | @@ -271,7 +271,7 @@ static int __init maybe_link(void) | |
55623 | if (nlink >= 2) { | |
55624 | char *old = find_link(major, minor, ino, mode, collected); | |
55625 | if (old) | |
55626 | - return (sys_link(old, collected) < 0) ? -1 : 1; | |
55627 | + return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1; | |
55628 | } | |
55629 | return 0; | |
55630 | } | |
55631 | @@ -280,11 +280,11 @@ static void __init clean_path(char *path | |
55632 | { | |
55633 | struct stat st; | |
55634 | ||
55635 | - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) { | |
55636 | + if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) { | |
55637 | if (S_ISDIR(st.st_mode)) | |
55638 | - sys_rmdir(path); | |
55639 | + sys_rmdir((__force char __user *)path); | |
55640 | else | |
55641 | - sys_unlink(path); | |
55642 | + sys_unlink((__force char __user *)path); | |
55643 | } | |
55644 | } | |
55645 | ||
55646 | @@ -305,7 +305,7 @@ static int __init do_name(void) | |
55647 | int openflags = O_WRONLY|O_CREAT; | |
55648 | if (ml != 1) | |
55649 | openflags |= O_TRUNC; | |
55650 | - wfd = sys_open(collected, openflags, mode); | |
55651 | + wfd = sys_open((__force char __user *)collected, openflags, mode); | |
55652 | ||
55653 | if (wfd >= 0) { | |
55654 | sys_fchown(wfd, uid, gid); | |
55655 | @@ -317,17 +317,17 @@ static int __init do_name(void) | |
55656 | } | |
55657 | } | |
55658 | } else if (S_ISDIR(mode)) { | |
55659 | - sys_mkdir(collected, mode); | |
55660 | - sys_chown(collected, uid, gid); | |
55661 | - sys_chmod(collected, mode); | |
55662 | + sys_mkdir((__force char __user *)collected, mode); | |
55663 | + sys_chown((__force char __user *)collected, uid, gid); | |
55664 | + sys_chmod((__force char __user *)collected, mode); | |
55665 | dir_add(collected, mtime); | |
55666 | } else if (S_ISBLK(mode) || S_ISCHR(mode) || | |
55667 | S_ISFIFO(mode) || S_ISSOCK(mode)) { | |
55668 | if (maybe_link() == 0) { | |
55669 | - sys_mknod(collected, mode, rdev); | |
55670 | - sys_chown(collected, uid, gid); | |
55671 | - sys_chmod(collected, mode); | |
55672 | - do_utime(collected, mtime); | |
55673 | + sys_mknod((__force char __user *)collected, mode, rdev); | |
55674 | + sys_chown((__force char __user *)collected, uid, gid); | |
55675 | + sys_chmod((__force char __user *)collected, mode); | |
55676 | + do_utime((__force char __user *)collected, mtime); | |
55677 | } | |
55678 | } | |
55679 | return 0; | |
55680 | @@ -336,15 +336,15 @@ static int __init do_name(void) | |
55681 | static int __init do_copy(void) | |
55682 | { | |
55683 | if (count >= body_len) { | |
55684 | - sys_write(wfd, victim, body_len); | |
55685 | + sys_write(wfd, (__force char __user *)victim, body_len); | |
55686 | sys_close(wfd); | |
55687 | - do_utime(vcollected, mtime); | |
55688 | + do_utime((__force char __user *)vcollected, mtime); | |
55689 | kfree(vcollected); | |
55690 | eat(body_len); | |
55691 | state = SkipIt; | |
55692 | return 0; | |
55693 | } else { | |
55694 | - sys_write(wfd, victim, count); | |
55695 | + sys_write(wfd, (__force char __user *)victim, count); | |
55696 | body_len -= count; | |
55697 | eat(count); | |
55698 | return 1; | |
55699 | @@ -355,9 +355,9 @@ static int __init do_symlink(void) | |
55700 | { | |
55701 | collected[N_ALIGN(name_len) + body_len] = '\0'; | |
55702 | clean_path(collected, 0); | |
55703 | - sys_symlink(collected + N_ALIGN(name_len), collected); | |
55704 | - sys_lchown(collected, uid, gid); | |
55705 | - do_utime(collected, mtime); | |
55706 | + sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected); | |
55707 | + sys_lchown((__force char __user *)collected, uid, gid); | |
55708 | + do_utime((__force char __user *)collected, mtime); | |
55709 | state = SkipIt; | |
55710 | next_state = Reset; | |
55711 | return 0; | |
55712 | diff -urNp linux-3.0.3/init/Kconfig linux-3.0.3/init/Kconfig | |
55713 | --- linux-3.0.3/init/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
55714 | +++ linux-3.0.3/init/Kconfig 2011-08-23 21:47:56.000000000 -0400 | |
55715 | @@ -1195,7 +1195,7 @@ config SLUB_DEBUG | |
55716 | ||
55717 | config COMPAT_BRK | |
55718 | bool "Disable heap randomization" | |
55719 | - default y | |
55720 | + default n | |
55721 | help | |
55722 | Randomizing heap placement makes heap exploits harder, but it | |
55723 | also breaks ancient binaries (including anything libc5 based). | |
55724 | diff -urNp linux-3.0.3/init/main.c linux-3.0.3/init/main.c | |
55725 | --- linux-3.0.3/init/main.c 2011-07-21 22:17:23.000000000 -0400 | |
55726 | +++ linux-3.0.3/init/main.c 2011-08-23 21:48:14.000000000 -0400 | |
55727 | @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) | |
55728 | extern void tc_init(void); | |
55729 | #endif | |
55730 | ||
55731 | +extern void grsecurity_init(void); | |
55732 | + | |
55733 | /* | |
55734 | * Debug helper: via this flag we know that we are in 'early bootup code' | |
55735 | * where only the boot processor is running with IRQ disabled. This means | |
55736 | @@ -149,6 +151,49 @@ static int __init set_reset_devices(char | |
55737 | ||
55738 | __setup("reset_devices", set_reset_devices); | |
55739 | ||
55740 | +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
55741 | +extern char pax_enter_kernel_user[]; | |
55742 | +extern char pax_exit_kernel_user[]; | |
55743 | +extern pgdval_t clone_pgd_mask; | |
55744 | +#endif | |
55745 | + | |
55746 | +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF) | |
55747 | +static int __init setup_pax_nouderef(char *str) | |
55748 | +{ | |
55749 | +#ifdef CONFIG_X86_32 | |
55750 | + unsigned int cpu; | |
55751 | + struct desc_struct *gdt; | |
55752 | + | |
55753 | + for (cpu = 0; cpu < NR_CPUS; cpu++) { | |
55754 | + gdt = get_cpu_gdt_table(cpu); | |
55755 | + gdt[GDT_ENTRY_KERNEL_DS].type = 3; | |
55756 | + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf; | |
55757 | + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf; | |
55758 | + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf; | |
55759 | + } | |
55760 | + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory"); | |
55761 | +#else | |
55762 | + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1); | |
55763 | + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1); | |
55764 | + clone_pgd_mask = ~(pgdval_t)0UL; | |
55765 | +#endif | |
55766 | + | |
55767 | + return 0; | |
55768 | +} | |
55769 | +early_param("pax_nouderef", setup_pax_nouderef); | |
55770 | +#endif | |
55771 | + | |
55772 | +#ifdef CONFIG_PAX_SOFTMODE | |
55773 | +int pax_softmode; | |
55774 | + | |
55775 | +static int __init setup_pax_softmode(char *str) | |
55776 | +{ | |
55777 | + get_option(&str, &pax_softmode); | |
55778 | + return 1; | |
55779 | +} | |
55780 | +__setup("pax_softmode=", setup_pax_softmode); | |
55781 | +#endif | |
55782 | + | |
55783 | static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; | |
55784 | const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; | |
55785 | static const char *panic_later, *panic_param; | |
55786 | @@ -667,6 +712,7 @@ int __init_or_module do_one_initcall(ini | |
55787 | { | |
55788 | int count = preempt_count(); | |
55789 | int ret; | |
55790 | + const char *msg1 = "", *msg2 = ""; | |
55791 | ||
55792 | if (initcall_debug) | |
55793 | ret = do_one_initcall_debug(fn); | |
55794 | @@ -679,15 +725,15 @@ int __init_or_module do_one_initcall(ini | |
55795 | sprintf(msgbuf, "error code %d ", ret); | |
55796 | ||
55797 | if (preempt_count() != count) { | |
55798 | - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf)); | |
55799 | + msg1 = " preemption imbalance"; | |
55800 | preempt_count() = count; | |
55801 | } | |
55802 | if (irqs_disabled()) { | |
55803 | - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf)); | |
55804 | + msg2 = " disabled interrupts"; | |
55805 | local_irq_enable(); | |
55806 | } | |
55807 | - if (msgbuf[0]) { | |
55808 | - printk("initcall %pF returned with %s\n", fn, msgbuf); | |
55809 | + if (msgbuf[0] || *msg1 || *msg2) { | |
55810 | + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2); | |
55811 | } | |
55812 | ||
55813 | return ret; | |
55814 | @@ -805,7 +851,7 @@ static int __init kernel_init(void * unu | |
55815 | do_basic_setup(); | |
55816 | ||
55817 | /* Open the /dev/console on the rootfs, this should never fail */ | |
55818 | - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0) | |
55819 | + if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0) | |
55820 | printk(KERN_WARNING "Warning: unable to open an initial console.\n"); | |
55821 | ||
55822 | (void) sys_dup(0); | |
55823 | @@ -818,11 +864,13 @@ static int __init kernel_init(void * unu | |
55824 | if (!ramdisk_execute_command) | |
55825 | ramdisk_execute_command = "/init"; | |
55826 | ||
55827 | - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) { | |
55828 | + if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) { | |
55829 | ramdisk_execute_command = NULL; | |
55830 | prepare_namespace(); | |
55831 | } | |
55832 | ||
55833 | + grsecurity_init(); | |
55834 | + | |
55835 | /* | |
55836 | * Ok, we have completed the initial bootup, and | |
55837 | * we're essentially up and running. Get rid of the | |
55838 | diff -urNp linux-3.0.3/ipc/mqueue.c linux-3.0.3/ipc/mqueue.c | |
55839 | --- linux-3.0.3/ipc/mqueue.c 2011-07-21 22:17:23.000000000 -0400 | |
55840 | +++ linux-3.0.3/ipc/mqueue.c 2011-08-23 21:48:14.000000000 -0400 | |
55841 | @@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st | |
55842 | mq_bytes = (mq_msg_tblsz + | |
55843 | (info->attr.mq_maxmsg * info->attr.mq_msgsize)); | |
55844 | ||
55845 | + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1); | |
55846 | spin_lock(&mq_lock); | |
55847 | if (u->mq_bytes + mq_bytes < u->mq_bytes || | |
55848 | u->mq_bytes + mq_bytes > | |
55849 | diff -urNp linux-3.0.3/ipc/msg.c linux-3.0.3/ipc/msg.c | |
55850 | --- linux-3.0.3/ipc/msg.c 2011-07-21 22:17:23.000000000 -0400 | |
55851 | +++ linux-3.0.3/ipc/msg.c 2011-08-23 21:47:56.000000000 -0400 | |
55852 | @@ -309,18 +309,19 @@ static inline int msg_security(struct ke | |
55853 | return security_msg_queue_associate(msq, msgflg); | |
55854 | } | |
55855 | ||
55856 | +static struct ipc_ops msg_ops = { | |
55857 | + .getnew = newque, | |
55858 | + .associate = msg_security, | |
55859 | + .more_checks = NULL | |
55860 | +}; | |
55861 | + | |
55862 | SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg) | |
55863 | { | |
55864 | struct ipc_namespace *ns; | |
55865 | - struct ipc_ops msg_ops; | |
55866 | struct ipc_params msg_params; | |
55867 | ||
55868 | ns = current->nsproxy->ipc_ns; | |
55869 | ||
55870 | - msg_ops.getnew = newque; | |
55871 | - msg_ops.associate = msg_security; | |
55872 | - msg_ops.more_checks = NULL; | |
55873 | - | |
55874 | msg_params.key = key; | |
55875 | msg_params.flg = msgflg; | |
55876 | ||
55877 | diff -urNp linux-3.0.3/ipc/sem.c linux-3.0.3/ipc/sem.c | |
55878 | --- linux-3.0.3/ipc/sem.c 2011-08-23 21:44:40.000000000 -0400 | |
55879 | +++ linux-3.0.3/ipc/sem.c 2011-08-23 21:48:14.000000000 -0400 | |
55880 | @@ -318,10 +318,15 @@ static inline int sem_more_checks(struct | |
55881 | return 0; | |
55882 | } | |
55883 | ||
55884 | +static struct ipc_ops sem_ops = { | |
55885 | + .getnew = newary, | |
55886 | + .associate = sem_security, | |
55887 | + .more_checks = sem_more_checks | |
55888 | +}; | |
55889 | + | |
55890 | SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg) | |
55891 | { | |
55892 | struct ipc_namespace *ns; | |
55893 | - struct ipc_ops sem_ops; | |
55894 | struct ipc_params sem_params; | |
55895 | ||
55896 | ns = current->nsproxy->ipc_ns; | |
55897 | @@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, | |
55898 | if (nsems < 0 || nsems > ns->sc_semmsl) | |
55899 | return -EINVAL; | |
55900 | ||
55901 | - sem_ops.getnew = newary; | |
55902 | - sem_ops.associate = sem_security; | |
55903 | - sem_ops.more_checks = sem_more_checks; | |
55904 | - | |
55905 | sem_params.key = key; | |
55906 | sem_params.flg = semflg; | |
55907 | sem_params.u.nsems = nsems; | |
55908 | @@ -854,6 +855,8 @@ static int semctl_main(struct ipc_namesp | |
55909 | int nsems; | |
55910 | struct list_head tasks; | |
55911 | ||
55912 | + pax_track_stack(); | |
55913 | + | |
55914 | sma = sem_lock_check(ns, semid); | |
55915 | if (IS_ERR(sma)) | |
55916 | return PTR_ERR(sma); | |
55917 | @@ -1301,6 +1304,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, | |
55918 | struct ipc_namespace *ns; | |
55919 | struct list_head tasks; | |
55920 | ||
55921 | + pax_track_stack(); | |
55922 | + | |
55923 | ns = current->nsproxy->ipc_ns; | |
55924 | ||
55925 | if (nsops < 1 || semid < 0) | |
55926 | diff -urNp linux-3.0.3/ipc/shm.c linux-3.0.3/ipc/shm.c | |
55927 | --- linux-3.0.3/ipc/shm.c 2011-07-21 22:17:23.000000000 -0400 | |
55928 | +++ linux-3.0.3/ipc/shm.c 2011-08-23 21:48:14.000000000 -0400 | |
55929 | @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name | |
55930 | static int sysvipc_shm_proc_show(struct seq_file *s, void *it); | |
55931 | #endif | |
55932 | ||
55933 | +#ifdef CONFIG_GRKERNSEC | |
55934 | +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid, | |
55935 | + const time_t shm_createtime, const uid_t cuid, | |
55936 | + const int shmid); | |
55937 | +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid, | |
55938 | + const time_t shm_createtime); | |
55939 | +#endif | |
55940 | + | |
55941 | void shm_init_ns(struct ipc_namespace *ns) | |
55942 | { | |
55943 | ns->shm_ctlmax = SHMMAX; | |
55944 | @@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace * | |
55945 | shp->shm_lprid = 0; | |
55946 | shp->shm_atim = shp->shm_dtim = 0; | |
55947 | shp->shm_ctim = get_seconds(); | |
55948 | +#ifdef CONFIG_GRKERNSEC | |
55949 | + { | |
55950 | + struct timespec timeval; | |
55951 | + do_posix_clock_monotonic_gettime(&timeval); | |
55952 | + | |
55953 | + shp->shm_createtime = timeval.tv_sec; | |
55954 | + } | |
55955 | +#endif | |
55956 | shp->shm_segsz = size; | |
55957 | shp->shm_nattch = 0; | |
55958 | shp->shm_file = file; | |
55959 | @@ -451,18 +467,19 @@ static inline int shm_more_checks(struct | |
55960 | return 0; | |
55961 | } | |
55962 | ||
55963 | +static struct ipc_ops shm_ops = { | |
55964 | + .getnew = newseg, | |
55965 | + .associate = shm_security, | |
55966 | + .more_checks = shm_more_checks | |
55967 | +}; | |
55968 | + | |
55969 | SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg) | |
55970 | { | |
55971 | struct ipc_namespace *ns; | |
55972 | - struct ipc_ops shm_ops; | |
55973 | struct ipc_params shm_params; | |
55974 | ||
55975 | ns = current->nsproxy->ipc_ns; | |
55976 | ||
55977 | - shm_ops.getnew = newseg; | |
55978 | - shm_ops.associate = shm_security; | |
55979 | - shm_ops.more_checks = shm_more_checks; | |
55980 | - | |
55981 | shm_params.key = key; | |
55982 | shm_params.flg = shmflg; | |
55983 | shm_params.u.size = size; | |
55984 | @@ -762,8 +779,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, | |
55985 | case SHM_LOCK: | |
55986 | case SHM_UNLOCK: | |
55987 | { | |
55988 | - struct file *uninitialized_var(shm_file); | |
55989 | - | |
55990 | lru_add_drain_all(); /* drain pagevecs to lru lists */ | |
55991 | ||
55992 | shp = shm_lock_check(ns, shmid); | |
55993 | @@ -896,9 +911,21 @@ long do_shmat(int shmid, char __user *sh | |
55994 | if (err) | |
55995 | goto out_unlock; | |
55996 | ||
55997 | +#ifdef CONFIG_GRKERNSEC | |
55998 | + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime, | |
55999 | + shp->shm_perm.cuid, shmid) || | |
56000 | + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) { | |
56001 | + err = -EACCES; | |
56002 | + goto out_unlock; | |
56003 | + } | |
56004 | +#endif | |
56005 | + | |
56006 | path = shp->shm_file->f_path; | |
56007 | path_get(&path); | |
56008 | shp->shm_nattch++; | |
56009 | +#ifdef CONFIG_GRKERNSEC | |
56010 | + shp->shm_lapid = current->pid; | |
56011 | +#endif | |
56012 | size = i_size_read(path.dentry->d_inode); | |
56013 | shm_unlock(shp); | |
56014 | ||
56015 | diff -urNp linux-3.0.3/kernel/acct.c linux-3.0.3/kernel/acct.c | |
56016 | --- linux-3.0.3/kernel/acct.c 2011-07-21 22:17:23.000000000 -0400 | |
56017 | +++ linux-3.0.3/kernel/acct.c 2011-08-23 21:47:56.000000000 -0400 | |
56018 | @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a | |
56019 | */ | |
56020 | flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur; | |
56021 | current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; | |
56022 | - file->f_op->write(file, (char *)&ac, | |
56023 | + file->f_op->write(file, (__force char __user *)&ac, | |
56024 | sizeof(acct_t), &file->f_pos); | |
56025 | current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; | |
56026 | set_fs(fs); | |
56027 | diff -urNp linux-3.0.3/kernel/audit.c linux-3.0.3/kernel/audit.c | |
56028 | --- linux-3.0.3/kernel/audit.c 2011-07-21 22:17:23.000000000 -0400 | |
56029 | +++ linux-3.0.3/kernel/audit.c 2011-08-23 21:47:56.000000000 -0400 | |
56030 | @@ -112,7 +112,7 @@ u32 audit_sig_sid = 0; | |
56031 | 3) suppressed due to audit_rate_limit | |
56032 | 4) suppressed due to audit_backlog_limit | |
56033 | */ | |
56034 | -static atomic_t audit_lost = ATOMIC_INIT(0); | |
56035 | +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0); | |
56036 | ||
56037 | /* The netlink socket. */ | |
56038 | static struct sock *audit_sock; | |
56039 | @@ -234,7 +234,7 @@ void audit_log_lost(const char *message) | |
56040 | unsigned long now; | |
56041 | int print; | |
56042 | ||
56043 | - atomic_inc(&audit_lost); | |
56044 | + atomic_inc_unchecked(&audit_lost); | |
56045 | ||
56046 | print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); | |
56047 | ||
56048 | @@ -253,7 +253,7 @@ void audit_log_lost(const char *message) | |
56049 | printk(KERN_WARNING | |
56050 | "audit: audit_lost=%d audit_rate_limit=%d " | |
56051 | "audit_backlog_limit=%d\n", | |
56052 | - atomic_read(&audit_lost), | |
56053 | + atomic_read_unchecked(&audit_lost), | |
56054 | audit_rate_limit, | |
56055 | audit_backlog_limit); | |
56056 | audit_panic(message); | |
56057 | @@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b | |
56058 | status_set.pid = audit_pid; | |
56059 | status_set.rate_limit = audit_rate_limit; | |
56060 | status_set.backlog_limit = audit_backlog_limit; | |
56061 | - status_set.lost = atomic_read(&audit_lost); | |
56062 | + status_set.lost = atomic_read_unchecked(&audit_lost); | |
56063 | status_set.backlog = skb_queue_len(&audit_skb_queue); | |
56064 | audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, | |
56065 | &status_set, sizeof(status_set)); | |
56066 | diff -urNp linux-3.0.3/kernel/auditsc.c linux-3.0.3/kernel/auditsc.c | |
56067 | --- linux-3.0.3/kernel/auditsc.c 2011-07-21 22:17:23.000000000 -0400 | |
56068 | +++ linux-3.0.3/kernel/auditsc.c 2011-08-23 21:47:56.000000000 -0400 | |
56069 | @@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_conte | |
56070 | } | |
56071 | ||
56072 | /* global counter which is incremented every time something logs in */ | |
56073 | -static atomic_t session_id = ATOMIC_INIT(0); | |
56074 | +static atomic_unchecked_t session_id = ATOMIC_INIT(0); | |
56075 | ||
56076 | /** | |
56077 | * audit_set_loginuid - set a task's audit_context loginuid | |
56078 | @@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT | |
56079 | */ | |
56080 | int audit_set_loginuid(struct task_struct *task, uid_t loginuid) | |
56081 | { | |
56082 | - unsigned int sessionid = atomic_inc_return(&session_id); | |
56083 | + unsigned int sessionid = atomic_inc_return_unchecked(&session_id); | |
56084 | struct audit_context *context = task->audit_context; | |
56085 | ||
56086 | if (context && context->in_syscall) { | |
56087 | diff -urNp linux-3.0.3/kernel/capability.c linux-3.0.3/kernel/capability.c | |
56088 | --- linux-3.0.3/kernel/capability.c 2011-07-21 22:17:23.000000000 -0400 | |
56089 | +++ linux-3.0.3/kernel/capability.c 2011-08-23 21:48:14.000000000 -0400 | |
56090 | @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_ | |
56091 | * before modification is attempted and the application | |
56092 | * fails. | |
56093 | */ | |
56094 | + if (tocopy > ARRAY_SIZE(kdata)) | |
56095 | + return -EFAULT; | |
56096 | + | |
56097 | if (copy_to_user(dataptr, kdata, tocopy | |
56098 | * sizeof(struct __user_cap_data_struct))) { | |
56099 | return -EFAULT; | |
56100 | @@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *n | |
56101 | BUG(); | |
56102 | } | |
56103 | ||
56104 | - if (security_capable(ns, current_cred(), cap) == 0) { | |
56105 | + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) { | |
56106 | current->flags |= PF_SUPERPRIV; | |
56107 | return true; | |
56108 | } | |
56109 | @@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *n | |
56110 | } | |
56111 | EXPORT_SYMBOL(ns_capable); | |
56112 | ||
56113 | +bool ns_capable_nolog(struct user_namespace *ns, int cap) | |
56114 | +{ | |
56115 | + if (unlikely(!cap_valid(cap))) { | |
56116 | + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap); | |
56117 | + BUG(); | |
56118 | + } | |
56119 | + | |
56120 | + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) { | |
56121 | + current->flags |= PF_SUPERPRIV; | |
56122 | + return true; | |
56123 | + } | |
56124 | + return false; | |
56125 | +} | |
56126 | +EXPORT_SYMBOL(ns_capable_nolog); | |
56127 | + | |
56128 | +bool capable_nolog(int cap) | |
56129 | +{ | |
56130 | + return ns_capable_nolog(&init_user_ns, cap); | |
56131 | +} | |
56132 | +EXPORT_SYMBOL(capable_nolog); | |
56133 | + | |
56134 | /** | |
56135 | * task_ns_capable - Determine whether current task has a superior | |
56136 | * capability targeted at a specific task's user namespace. | |
56137 | @@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct | |
56138 | } | |
56139 | EXPORT_SYMBOL(task_ns_capable); | |
56140 | ||
56141 | +bool task_ns_capable_nolog(struct task_struct *t, int cap) | |
56142 | +{ | |
56143 | + return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap); | |
56144 | +} | |
56145 | +EXPORT_SYMBOL(task_ns_capable_nolog); | |
56146 | + | |
56147 | /** | |
56148 | * nsown_capable - Check superior capability to one's own user_ns | |
56149 | * @cap: The capability in question | |
56150 | diff -urNp linux-3.0.3/kernel/cgroup.c linux-3.0.3/kernel/cgroup.c | |
56151 | --- linux-3.0.3/kernel/cgroup.c 2011-07-21 22:17:23.000000000 -0400 | |
56152 | +++ linux-3.0.3/kernel/cgroup.c 2011-08-23 21:48:14.000000000 -0400 | |
56153 | @@ -593,6 +593,8 @@ static struct css_set *find_css_set( | |
56154 | struct hlist_head *hhead; | |
56155 | struct cg_cgroup_link *link; | |
56156 | ||
56157 | + pax_track_stack(); | |
56158 | + | |
56159 | /* First see if we already have a cgroup group that matches | |
56160 | * the desired set */ | |
56161 | read_lock(&css_set_lock); | |
56162 | diff -urNp linux-3.0.3/kernel/compat.c linux-3.0.3/kernel/compat.c | |
56163 | --- linux-3.0.3/kernel/compat.c 2011-07-21 22:17:23.000000000 -0400 | |
56164 | +++ linux-3.0.3/kernel/compat.c 2011-08-23 21:48:14.000000000 -0400 | |
56165 | @@ -13,6 +13,7 @@ | |
56166 | ||
56167 | #include <linux/linkage.h> | |
56168 | #include <linux/compat.h> | |
56169 | +#include <linux/module.h> | |
56170 | #include <linux/errno.h> | |
56171 | #include <linux/time.h> | |
56172 | #include <linux/signal.h> | |
56173 | diff -urNp linux-3.0.3/kernel/configs.c linux-3.0.3/kernel/configs.c | |
56174 | --- linux-3.0.3/kernel/configs.c 2011-07-21 22:17:23.000000000 -0400 | |
56175 | +++ linux-3.0.3/kernel/configs.c 2011-08-23 21:48:14.000000000 -0400 | |
56176 | @@ -74,8 +74,19 @@ static int __init ikconfig_init(void) | |
56177 | struct proc_dir_entry *entry; | |
56178 | ||
56179 | /* create the current config file */ | |
56180 | +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM) | |
56181 | +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM) | |
56182 | + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL, | |
56183 | + &ikconfig_file_ops); | |
56184 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
56185 | + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL, | |
56186 | + &ikconfig_file_ops); | |
56187 | +#endif | |
56188 | +#else | |
56189 | entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL, | |
56190 | &ikconfig_file_ops); | |
56191 | +#endif | |
56192 | + | |
56193 | if (!entry) | |
56194 | return -ENOMEM; | |
56195 | ||
56196 | diff -urNp linux-3.0.3/kernel/cred.c linux-3.0.3/kernel/cred.c | |
56197 | --- linux-3.0.3/kernel/cred.c 2011-07-21 22:17:23.000000000 -0400 | |
56198 | +++ linux-3.0.3/kernel/cred.c 2011-08-25 17:23:03.000000000 -0400 | |
56199 | @@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head | |
56200 | */ | |
56201 | void __put_cred(struct cred *cred) | |
56202 | { | |
56203 | + pax_track_stack(); | |
56204 | + | |
56205 | kdebug("__put_cred(%p{%d,%d})", cred, | |
56206 | atomic_read(&cred->usage), | |
56207 | read_cred_subscribers(cred)); | |
56208 | @@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk) | |
56209 | { | |
56210 | struct cred *cred; | |
56211 | ||
56212 | + pax_track_stack(); | |
56213 | + | |
56214 | kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred, | |
56215 | atomic_read(&tsk->cred->usage), | |
56216 | read_cred_subscribers(tsk->cred)); | |
56217 | @@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct | |
56218 | { | |
56219 | const struct cred *cred; | |
56220 | ||
56221 | + pax_track_stack(); | |
56222 | + | |
56223 | rcu_read_lock(); | |
56224 | ||
56225 | do { | |
56226 | @@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void) | |
56227 | { | |
56228 | struct cred *new; | |
56229 | ||
56230 | + pax_track_stack(); | |
56231 | + | |
56232 | new = kmem_cache_zalloc(cred_jar, GFP_KERNEL); | |
56233 | if (!new) | |
56234 | return NULL; | |
56235 | @@ -287,6 +295,8 @@ struct cred *prepare_creds(void) | |
56236 | const struct cred *old; | |
56237 | struct cred *new; | |
56238 | ||
56239 | + pax_track_stack(); | |
56240 | + | |
56241 | validate_process_creds(); | |
56242 | ||
56243 | new = kmem_cache_alloc(cred_jar, GFP_KERNEL); | |
56244 | @@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void) | |
56245 | struct thread_group_cred *tgcred = NULL; | |
56246 | struct cred *new; | |
56247 | ||
56248 | + pax_track_stack(); | |
56249 | + | |
56250 | #ifdef CONFIG_KEYS | |
56251 | tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL); | |
56252 | if (!tgcred) | |
56253 | @@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un | |
56254 | struct cred *new; | |
56255 | int ret; | |
56256 | ||
56257 | + pax_track_stack(); | |
56258 | + | |
56259 | if ( | |
56260 | #ifdef CONFIG_KEYS | |
56261 | !p->cred->thread_keyring && | |
56262 | @@ -475,6 +489,8 @@ int commit_creds(struct cred *new) | |
56263 | struct task_struct *task = current; | |
56264 | const struct cred *old = task->real_cred; | |
56265 | ||
56266 | + pax_track_stack(); | |
56267 | + | |
56268 | kdebug("commit_creds(%p{%d,%d})", new, | |
56269 | atomic_read(&new->usage), | |
56270 | read_cred_subscribers(new)); | |
56271 | @@ -489,6 +505,8 @@ int commit_creds(struct cred *new) | |
56272 | ||
56273 | get_cred(new); /* we will require a ref for the subj creds too */ | |
56274 | ||
56275 | + gr_set_role_label(task, new->uid, new->gid); | |
56276 | + | |
56277 | /* dumpability changes */ | |
56278 | if (old->euid != new->euid || | |
56279 | old->egid != new->egid || | |
56280 | @@ -508,10 +526,8 @@ int commit_creds(struct cred *new) | |
56281 | key_fsgid_changed(task); | |
56282 | ||
56283 | /* do it | |
56284 | - * - What if a process setreuid()'s and this brings the | |
56285 | - * new uid over his NPROC rlimit? We can check this now | |
56286 | - * cheaply with the new uid cache, so if it matters | |
56287 | - * we should be checking for it. -DaveM | |
56288 | + * RLIMIT_NPROC limits on user->processes have already been checked | |
56289 | + * in set_user(). | |
56290 | */ | |
56291 | alter_cred_subscribers(new, 2); | |
56292 | if (new->user != old->user) | |
56293 | @@ -551,6 +567,8 @@ EXPORT_SYMBOL(commit_creds); | |
56294 | */ | |
56295 | void abort_creds(struct cred *new) | |
56296 | { | |
56297 | + pax_track_stack(); | |
56298 | + | |
56299 | kdebug("abort_creds(%p{%d,%d})", new, | |
56300 | atomic_read(&new->usage), | |
56301 | read_cred_subscribers(new)); | |
56302 | @@ -574,6 +592,8 @@ const struct cred *override_creds(const | |
56303 | { | |
56304 | const struct cred *old = current->cred; | |
56305 | ||
56306 | + pax_track_stack(); | |
56307 | + | |
56308 | kdebug("override_creds(%p{%d,%d})", new, | |
56309 | atomic_read(&new->usage), | |
56310 | read_cred_subscribers(new)); | |
56311 | @@ -603,6 +623,8 @@ void revert_creds(const struct cred *old | |
56312 | { | |
56313 | const struct cred *override = current->cred; | |
56314 | ||
56315 | + pax_track_stack(); | |
56316 | + | |
56317 | kdebug("revert_creds(%p{%d,%d})", old, | |
56318 | atomic_read(&old->usage), | |
56319 | read_cred_subscribers(old)); | |
56320 | @@ -649,6 +671,8 @@ struct cred *prepare_kernel_cred(struct | |
56321 | const struct cred *old; | |
56322 | struct cred *new; | |
56323 | ||
56324 | + pax_track_stack(); | |
56325 | + | |
56326 | new = kmem_cache_alloc(cred_jar, GFP_KERNEL); | |
56327 | if (!new) | |
56328 | return NULL; | |
56329 | @@ -703,6 +727,8 @@ EXPORT_SYMBOL(prepare_kernel_cred); | |
56330 | */ | |
56331 | int set_security_override(struct cred *new, u32 secid) | |
56332 | { | |
56333 | + pax_track_stack(); | |
56334 | + | |
56335 | return security_kernel_act_as(new, secid); | |
56336 | } | |
56337 | EXPORT_SYMBOL(set_security_override); | |
56338 | @@ -722,6 +748,8 @@ int set_security_override_from_ctx(struc | |
56339 | u32 secid; | |
56340 | int ret; | |
56341 | ||
56342 | + pax_track_stack(); | |
56343 | + | |
56344 | ret = security_secctx_to_secid(secctx, strlen(secctx), &secid); | |
56345 | if (ret < 0) | |
56346 | return ret; | |
56347 | diff -urNp linux-3.0.3/kernel/debug/debug_core.c linux-3.0.3/kernel/debug/debug_core.c | |
56348 | --- linux-3.0.3/kernel/debug/debug_core.c 2011-07-21 22:17:23.000000000 -0400 | |
56349 | +++ linux-3.0.3/kernel/debug/debug_core.c 2011-08-23 21:47:56.000000000 -0400 | |
56350 | @@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc | |
56351 | */ | |
56352 | static atomic_t masters_in_kgdb; | |
56353 | static atomic_t slaves_in_kgdb; | |
56354 | -static atomic_t kgdb_break_tasklet_var; | |
56355 | +static atomic_unchecked_t kgdb_break_tasklet_var; | |
56356 | atomic_t kgdb_setting_breakpoint; | |
56357 | ||
56358 | struct task_struct *kgdb_usethread; | |
56359 | @@ -129,7 +129,7 @@ int kgdb_single_step; | |
56360 | static pid_t kgdb_sstep_pid; | |
56361 | ||
56362 | /* to keep track of the CPU which is doing the single stepping*/ | |
56363 | -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1); | |
56364 | +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1); | |
56365 | ||
56366 | /* | |
56367 | * If you are debugging a problem where roundup (the collection of | |
56368 | @@ -542,7 +542,7 @@ return_normal: | |
56369 | * kernel will only try for the value of sstep_tries before | |
56370 | * giving up and continuing on. | |
56371 | */ | |
56372 | - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 && | |
56373 | + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 && | |
56374 | (kgdb_info[cpu].task && | |
56375 | kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) { | |
56376 | atomic_set(&kgdb_active, -1); | |
56377 | @@ -636,8 +636,8 @@ cpu_master_loop: | |
56378 | } | |
56379 | ||
56380 | kgdb_restore: | |
56381 | - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) { | |
56382 | - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step); | |
56383 | + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) { | |
56384 | + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step); | |
56385 | if (kgdb_info[sstep_cpu].task) | |
56386 | kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid; | |
56387 | else | |
56388 | @@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo | |
56389 | static void kgdb_tasklet_bpt(unsigned long ing) | |
56390 | { | |
56391 | kgdb_breakpoint(); | |
56392 | - atomic_set(&kgdb_break_tasklet_var, 0); | |
56393 | + atomic_set_unchecked(&kgdb_break_tasklet_var, 0); | |
56394 | } | |
56395 | ||
56396 | static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0); | |
56397 | ||
56398 | void kgdb_schedule_breakpoint(void) | |
56399 | { | |
56400 | - if (atomic_read(&kgdb_break_tasklet_var) || | |
56401 | + if (atomic_read_unchecked(&kgdb_break_tasklet_var) || | |
56402 | atomic_read(&kgdb_active) != -1 || | |
56403 | atomic_read(&kgdb_setting_breakpoint)) | |
56404 | return; | |
56405 | - atomic_inc(&kgdb_break_tasklet_var); | |
56406 | + atomic_inc_unchecked(&kgdb_break_tasklet_var); | |
56407 | tasklet_schedule(&kgdb_tasklet_breakpoint); | |
56408 | } | |
56409 | EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint); | |
56410 | diff -urNp linux-3.0.3/kernel/debug/kdb/kdb_main.c linux-3.0.3/kernel/debug/kdb/kdb_main.c | |
56411 | --- linux-3.0.3/kernel/debug/kdb/kdb_main.c 2011-07-21 22:17:23.000000000 -0400 | |
56412 | +++ linux-3.0.3/kernel/debug/kdb/kdb_main.c 2011-08-23 21:47:56.000000000 -0400 | |
56413 | @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha | |
56414 | list_for_each_entry(mod, kdb_modules, list) { | |
56415 | ||
56416 | kdb_printf("%-20s%8u 0x%p ", mod->name, | |
56417 | - mod->core_size, (void *)mod); | |
56418 | + mod->core_size_rx + mod->core_size_rw, (void *)mod); | |
56419 | #ifdef CONFIG_MODULE_UNLOAD | |
56420 | kdb_printf("%4d ", module_refcount(mod)); | |
56421 | #endif | |
56422 | @@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha | |
56423 | kdb_printf(" (Loading)"); | |
56424 | else | |
56425 | kdb_printf(" (Live)"); | |
56426 | - kdb_printf(" 0x%p", mod->module_core); | |
56427 | + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw); | |
56428 | ||
56429 | #ifdef CONFIG_MODULE_UNLOAD | |
56430 | { | |
56431 | diff -urNp linux-3.0.3/kernel/events/core.c linux-3.0.3/kernel/events/core.c | |
56432 | --- linux-3.0.3/kernel/events/core.c 2011-08-23 21:44:40.000000000 -0400 | |
56433 | +++ linux-3.0.3/kernel/events/core.c 2011-08-23 21:47:56.000000000 -0400 | |
56434 | @@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_ | |
56435 | return 0; | |
56436 | } | |
56437 | ||
56438 | -static atomic64_t perf_event_id; | |
56439 | +static atomic64_unchecked_t perf_event_id; | |
56440 | ||
56441 | static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx, | |
56442 | enum event_type_t event_type); | |
56443 | @@ -2488,7 +2488,7 @@ static void __perf_event_read(void *info | |
56444 | ||
56445 | static inline u64 perf_event_count(struct perf_event *event) | |
56446 | { | |
56447 | - return local64_read(&event->count) + atomic64_read(&event->child_count); | |
56448 | + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count); | |
56449 | } | |
56450 | ||
56451 | static u64 perf_event_read(struct perf_event *event) | |
56452 | @@ -3023,9 +3023,9 @@ u64 perf_event_read_value(struct perf_ev | |
56453 | mutex_lock(&event->child_mutex); | |
56454 | total += perf_event_read(event); | |
56455 | *enabled += event->total_time_enabled + | |
56456 | - atomic64_read(&event->child_total_time_enabled); | |
56457 | + atomic64_read_unchecked(&event->child_total_time_enabled); | |
56458 | *running += event->total_time_running + | |
56459 | - atomic64_read(&event->child_total_time_running); | |
56460 | + atomic64_read_unchecked(&event->child_total_time_running); | |
56461 | ||
56462 | list_for_each_entry(child, &event->child_list, child_list) { | |
56463 | total += perf_event_read(child); | |
56464 | @@ -3388,10 +3388,10 @@ void perf_event_update_userpage(struct p | |
56465 | userpg->offset -= local64_read(&event->hw.prev_count); | |
56466 | ||
56467 | userpg->time_enabled = event->total_time_enabled + | |
56468 | - atomic64_read(&event->child_total_time_enabled); | |
56469 | + atomic64_read_unchecked(&event->child_total_time_enabled); | |
56470 | ||
56471 | userpg->time_running = event->total_time_running + | |
56472 | - atomic64_read(&event->child_total_time_running); | |
56473 | + atomic64_read_unchecked(&event->child_total_time_running); | |
56474 | ||
56475 | barrier(); | |
56476 | ++userpg->lock; | |
56477 | @@ -4188,11 +4188,11 @@ static void perf_output_read_one(struct | |
56478 | values[n++] = perf_event_count(event); | |
56479 | if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { | |
56480 | values[n++] = enabled + | |
56481 | - atomic64_read(&event->child_total_time_enabled); | |
56482 | + atomic64_read_unchecked(&event->child_total_time_enabled); | |
56483 | } | |
56484 | if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) { | |
56485 | values[n++] = running + | |
56486 | - atomic64_read(&event->child_total_time_running); | |
56487 | + atomic64_read_unchecked(&event->child_total_time_running); | |
56488 | } | |
56489 | if (read_format & PERF_FORMAT_ID) | |
56490 | values[n++] = primary_event_id(event); | |
56491 | @@ -6190,7 +6190,7 @@ perf_event_alloc(struct perf_event_attr | |
56492 | event->parent = parent_event; | |
56493 | ||
56494 | event->ns = get_pid_ns(current->nsproxy->pid_ns); | |
56495 | - event->id = atomic64_inc_return(&perf_event_id); | |
56496 | + event->id = atomic64_inc_return_unchecked(&perf_event_id); | |
56497 | ||
56498 | event->state = PERF_EVENT_STATE_INACTIVE; | |
56499 | ||
56500 | @@ -6713,10 +6713,10 @@ static void sync_child_event(struct perf | |
56501 | /* | |
56502 | * Add back the child's count to the parent's count: | |
56503 | */ | |
56504 | - atomic64_add(child_val, &parent_event->child_count); | |
56505 | - atomic64_add(child_event->total_time_enabled, | |
56506 | + atomic64_add_unchecked(child_val, &parent_event->child_count); | |
56507 | + atomic64_add_unchecked(child_event->total_time_enabled, | |
56508 | &parent_event->child_total_time_enabled); | |
56509 | - atomic64_add(child_event->total_time_running, | |
56510 | + atomic64_add_unchecked(child_event->total_time_running, | |
56511 | &parent_event->child_total_time_running); | |
56512 | ||
56513 | /* | |
56514 | diff -urNp linux-3.0.3/kernel/exit.c linux-3.0.3/kernel/exit.c | |
56515 | --- linux-3.0.3/kernel/exit.c 2011-07-21 22:17:23.000000000 -0400 | |
56516 | +++ linux-3.0.3/kernel/exit.c 2011-08-23 21:48:14.000000000 -0400 | |
56517 | @@ -57,6 +57,10 @@ | |
56518 | #include <asm/pgtable.h> | |
56519 | #include <asm/mmu_context.h> | |
56520 | ||
56521 | +#ifdef CONFIG_GRKERNSEC | |
56522 | +extern rwlock_t grsec_exec_file_lock; | |
56523 | +#endif | |
56524 | + | |
56525 | static void exit_mm(struct task_struct * tsk); | |
56526 | ||
56527 | static void __unhash_process(struct task_struct *p, bool group_dead) | |
56528 | @@ -169,6 +173,10 @@ void release_task(struct task_struct * p | |
56529 | struct task_struct *leader; | |
56530 | int zap_leader; | |
56531 | repeat: | |
56532 | +#ifdef CONFIG_NET | |
56533 | + gr_del_task_from_ip_table(p); | |
56534 | +#endif | |
56535 | + | |
56536 | tracehook_prepare_release_task(p); | |
56537 | /* don't need to get the RCU readlock here - the process is dead and | |
56538 | * can't be modifying its own credentials. But shut RCU-lockdep up */ | |
56539 | @@ -338,11 +346,22 @@ static void reparent_to_kthreadd(void) | |
56540 | { | |
56541 | write_lock_irq(&tasklist_lock); | |
56542 | ||
56543 | +#ifdef CONFIG_GRKERNSEC | |
56544 | + write_lock(&grsec_exec_file_lock); | |
56545 | + if (current->exec_file) { | |
56546 | + fput(current->exec_file); | |
56547 | + current->exec_file = NULL; | |
56548 | + } | |
56549 | + write_unlock(&grsec_exec_file_lock); | |
56550 | +#endif | |
56551 | + | |
56552 | ptrace_unlink(current); | |
56553 | /* Reparent to init */ | |
56554 | current->real_parent = current->parent = kthreadd_task; | |
56555 | list_move_tail(¤t->sibling, ¤t->real_parent->children); | |
56556 | ||
56557 | + gr_set_kernel_label(current); | |
56558 | + | |
56559 | /* Set the exit signal to SIGCHLD so we signal init on exit */ | |
56560 | current->exit_signal = SIGCHLD; | |
56561 | ||
56562 | @@ -394,7 +413,7 @@ int allow_signal(int sig) | |
56563 | * know it'll be handled, so that they don't get converted to | |
56564 | * SIGKILL or just silently dropped. | |
56565 | */ | |
56566 | - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2; | |
56567 | + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2; | |
56568 | recalc_sigpending(); | |
56569 | spin_unlock_irq(¤t->sighand->siglock); | |
56570 | return 0; | |
56571 | @@ -430,6 +449,17 @@ void daemonize(const char *name, ...) | |
56572 | vsnprintf(current->comm, sizeof(current->comm), name, args); | |
56573 | va_end(args); | |
56574 | ||
56575 | +#ifdef CONFIG_GRKERNSEC | |
56576 | + write_lock(&grsec_exec_file_lock); | |
56577 | + if (current->exec_file) { | |
56578 | + fput(current->exec_file); | |
56579 | + current->exec_file = NULL; | |
56580 | + } | |
56581 | + write_unlock(&grsec_exec_file_lock); | |
56582 | +#endif | |
56583 | + | |
56584 | + gr_set_kernel_label(current); | |
56585 | + | |
56586 | /* | |
56587 | * If we were started as result of loading a module, close all of the | |
56588 | * user space pages. We don't need them, and if we didn't close them | |
56589 | @@ -904,15 +934,8 @@ NORET_TYPE void do_exit(long code) | |
56590 | struct task_struct *tsk = current; | |
56591 | int group_dead; | |
56592 | ||
56593 | - profile_task_exit(tsk); | |
56594 | - | |
56595 | - WARN_ON(atomic_read(&tsk->fs_excl)); | |
56596 | - WARN_ON(blk_needs_flush_plug(tsk)); | |
56597 | - | |
56598 | if (unlikely(in_interrupt())) | |
56599 | panic("Aiee, killing interrupt handler!"); | |
56600 | - if (unlikely(!tsk->pid)) | |
56601 | - panic("Attempted to kill the idle task!"); | |
56602 | ||
56603 | /* | |
56604 | * If do_exit is called because this processes oopsed, it's possible | |
56605 | @@ -923,6 +946,14 @@ NORET_TYPE void do_exit(long code) | |
56606 | */ | |
56607 | set_fs(USER_DS); | |
56608 | ||
56609 | + profile_task_exit(tsk); | |
56610 | + | |
56611 | + WARN_ON(atomic_read(&tsk->fs_excl)); | |
56612 | + WARN_ON(blk_needs_flush_plug(tsk)); | |
56613 | + | |
56614 | + if (unlikely(!tsk->pid)) | |
56615 | + panic("Attempted to kill the idle task!"); | |
56616 | + | |
56617 | tracehook_report_exit(&code); | |
56618 | ||
56619 | validate_creds_for_do_exit(tsk); | |
56620 | @@ -983,6 +1014,9 @@ NORET_TYPE void do_exit(long code) | |
56621 | tsk->exit_code = code; | |
56622 | taskstats_exit(tsk, group_dead); | |
56623 | ||
56624 | + gr_acl_handle_psacct(tsk, code); | |
56625 | + gr_acl_handle_exit(); | |
56626 | + | |
56627 | exit_mm(tsk); | |
56628 | ||
56629 | if (group_dead) | |
56630 | diff -urNp linux-3.0.3/kernel/fork.c linux-3.0.3/kernel/fork.c | |
56631 | --- linux-3.0.3/kernel/fork.c 2011-07-21 22:17:23.000000000 -0400 | |
56632 | +++ linux-3.0.3/kernel/fork.c 2011-08-25 17:23:36.000000000 -0400 | |
56633 | @@ -286,7 +286,7 @@ static struct task_struct *dup_task_stru | |
56634 | *stackend = STACK_END_MAGIC; /* for overflow detection */ | |
56635 | ||
56636 | #ifdef CONFIG_CC_STACKPROTECTOR | |
56637 | - tsk->stack_canary = get_random_int(); | |
56638 | + tsk->stack_canary = pax_get_random_long(); | |
56639 | #endif | |
56640 | ||
56641 | /* One for us, one for whoever does the "release_task()" (usually parent) */ | |
56642 | @@ -308,13 +308,77 @@ out: | |
56643 | } | |
56644 | ||
56645 | #ifdef CONFIG_MMU | |
56646 | +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt) | |
56647 | +{ | |
56648 | + struct vm_area_struct *tmp; | |
56649 | + unsigned long charge; | |
56650 | + struct mempolicy *pol; | |
56651 | + struct file *file; | |
56652 | + | |
56653 | + charge = 0; | |
56654 | + if (mpnt->vm_flags & VM_ACCOUNT) { | |
56655 | + unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; | |
56656 | + if (security_vm_enough_memory(len)) | |
56657 | + goto fail_nomem; | |
56658 | + charge = len; | |
56659 | + } | |
56660 | + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); | |
56661 | + if (!tmp) | |
56662 | + goto fail_nomem; | |
56663 | + *tmp = *mpnt; | |
56664 | + tmp->vm_mm = mm; | |
56665 | + INIT_LIST_HEAD(&tmp->anon_vma_chain); | |
56666 | + pol = mpol_dup(vma_policy(mpnt)); | |
56667 | + if (IS_ERR(pol)) | |
56668 | + goto fail_nomem_policy; | |
56669 | + vma_set_policy(tmp, pol); | |
56670 | + if (anon_vma_fork(tmp, mpnt)) | |
56671 | + goto fail_nomem_anon_vma_fork; | |
56672 | + tmp->vm_flags &= ~VM_LOCKED; | |
56673 | + tmp->vm_next = tmp->vm_prev = NULL; | |
56674 | + tmp->vm_mirror = NULL; | |
56675 | + file = tmp->vm_file; | |
56676 | + if (file) { | |
56677 | + struct inode *inode = file->f_path.dentry->d_inode; | |
56678 | + struct address_space *mapping = file->f_mapping; | |
56679 | + | |
56680 | + get_file(file); | |
56681 | + if (tmp->vm_flags & VM_DENYWRITE) | |
56682 | + atomic_dec(&inode->i_writecount); | |
56683 | + mutex_lock(&mapping->i_mmap_mutex); | |
56684 | + if (tmp->vm_flags & VM_SHARED) | |
56685 | + mapping->i_mmap_writable++; | |
56686 | + flush_dcache_mmap_lock(mapping); | |
56687 | + /* insert tmp into the share list, just after mpnt */ | |
56688 | + vma_prio_tree_add(tmp, mpnt); | |
56689 | + flush_dcache_mmap_unlock(mapping); | |
56690 | + mutex_unlock(&mapping->i_mmap_mutex); | |
56691 | + } | |
56692 | + | |
56693 | + /* | |
56694 | + * Clear hugetlb-related page reserves for children. This only | |
56695 | + * affects MAP_PRIVATE mappings. Faults generated by the child | |
56696 | + * are not guaranteed to succeed, even if read-only | |
56697 | + */ | |
56698 | + if (is_vm_hugetlb_page(tmp)) | |
56699 | + reset_vma_resv_huge_pages(tmp); | |
56700 | + | |
56701 | + return tmp; | |
56702 | + | |
56703 | +fail_nomem_anon_vma_fork: | |
56704 | + mpol_put(pol); | |
56705 | +fail_nomem_policy: | |
56706 | + kmem_cache_free(vm_area_cachep, tmp); | |
56707 | +fail_nomem: | |
56708 | + vm_unacct_memory(charge); | |
56709 | + return NULL; | |
56710 | +} | |
56711 | + | |
56712 | static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) | |
56713 | { | |
56714 | struct vm_area_struct *mpnt, *tmp, *prev, **pprev; | |
56715 | struct rb_node **rb_link, *rb_parent; | |
56716 | int retval; | |
56717 | - unsigned long charge; | |
56718 | - struct mempolicy *pol; | |
56719 | ||
56720 | down_write(&oldmm->mmap_sem); | |
56721 | flush_cache_dup_mm(oldmm); | |
56722 | @@ -326,8 +390,8 @@ static int dup_mmap(struct mm_struct *mm | |
56723 | mm->locked_vm = 0; | |
56724 | mm->mmap = NULL; | |
56725 | mm->mmap_cache = NULL; | |
56726 | - mm->free_area_cache = oldmm->mmap_base; | |
56727 | - mm->cached_hole_size = ~0UL; | |
56728 | + mm->free_area_cache = oldmm->free_area_cache; | |
56729 | + mm->cached_hole_size = oldmm->cached_hole_size; | |
56730 | mm->map_count = 0; | |
56731 | cpumask_clear(mm_cpumask(mm)); | |
56732 | mm->mm_rb = RB_ROOT; | |
56733 | @@ -343,8 +407,6 @@ static int dup_mmap(struct mm_struct *mm | |
56734 | ||
56735 | prev = NULL; | |
56736 | for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) { | |
56737 | - struct file *file; | |
56738 | - | |
56739 | if (mpnt->vm_flags & VM_DONTCOPY) { | |
56740 | long pages = vma_pages(mpnt); | |
56741 | mm->total_vm -= pages; | |
56742 | @@ -352,55 +414,13 @@ static int dup_mmap(struct mm_struct *mm | |
56743 | -pages); | |
56744 | continue; | |
56745 | } | |
56746 | - charge = 0; | |
56747 | - if (mpnt->vm_flags & VM_ACCOUNT) { | |
56748 | - unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; | |
56749 | - if (security_vm_enough_memory(len)) | |
56750 | - goto fail_nomem; | |
56751 | - charge = len; | |
56752 | - } | |
56753 | - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); | |
56754 | - if (!tmp) | |
56755 | - goto fail_nomem; | |
56756 | - *tmp = *mpnt; | |
56757 | - INIT_LIST_HEAD(&tmp->anon_vma_chain); | |
56758 | - pol = mpol_dup(vma_policy(mpnt)); | |
56759 | - retval = PTR_ERR(pol); | |
56760 | - if (IS_ERR(pol)) | |
56761 | - goto fail_nomem_policy; | |
56762 | - vma_set_policy(tmp, pol); | |
56763 | - tmp->vm_mm = mm; | |
56764 | - if (anon_vma_fork(tmp, mpnt)) | |
56765 | - goto fail_nomem_anon_vma_fork; | |
56766 | - tmp->vm_flags &= ~VM_LOCKED; | |
56767 | - tmp->vm_next = tmp->vm_prev = NULL; | |
56768 | - file = tmp->vm_file; | |
56769 | - if (file) { | |
56770 | - struct inode *inode = file->f_path.dentry->d_inode; | |
56771 | - struct address_space *mapping = file->f_mapping; | |
56772 | - | |
56773 | - get_file(file); | |
56774 | - if (tmp->vm_flags & VM_DENYWRITE) | |
56775 | - atomic_dec(&inode->i_writecount); | |
56776 | - mutex_lock(&mapping->i_mmap_mutex); | |
56777 | - if (tmp->vm_flags & VM_SHARED) | |
56778 | - mapping->i_mmap_writable++; | |
56779 | - flush_dcache_mmap_lock(mapping); | |
56780 | - /* insert tmp into the share list, just after mpnt */ | |
56781 | - vma_prio_tree_add(tmp, mpnt); | |
56782 | - flush_dcache_mmap_unlock(mapping); | |
56783 | - mutex_unlock(&mapping->i_mmap_mutex); | |
56784 | + tmp = dup_vma(mm, mpnt); | |
56785 | + if (!tmp) { | |
56786 | + retval = -ENOMEM; | |
56787 | + goto out; | |
56788 | } | |
56789 | ||
56790 | /* | |
56791 | - * Clear hugetlb-related page reserves for children. This only | |
56792 | - * affects MAP_PRIVATE mappings. Faults generated by the child | |
56793 | - * are not guaranteed to succeed, even if read-only | |
56794 | - */ | |
56795 | - if (is_vm_hugetlb_page(tmp)) | |
56796 | - reset_vma_resv_huge_pages(tmp); | |
56797 | - | |
56798 | - /* | |
56799 | * Link in the new vma and copy the page table entries. | |
56800 | */ | |
56801 | *pprev = tmp; | |
56802 | @@ -421,6 +441,31 @@ static int dup_mmap(struct mm_struct *mm | |
56803 | if (retval) | |
56804 | goto out; | |
56805 | } | |
56806 | + | |
56807 | +#ifdef CONFIG_PAX_SEGMEXEC | |
56808 | + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) { | |
56809 | + struct vm_area_struct *mpnt_m; | |
56810 | + | |
56811 | + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) { | |
56812 | + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm); | |
56813 | + | |
56814 | + if (!mpnt->vm_mirror) | |
56815 | + continue; | |
56816 | + | |
56817 | + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) { | |
56818 | + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt); | |
56819 | + mpnt->vm_mirror = mpnt_m; | |
56820 | + } else { | |
56821 | + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm); | |
56822 | + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror; | |
56823 | + mpnt_m->vm_mirror->vm_mirror = mpnt_m; | |
56824 | + mpnt->vm_mirror->vm_mirror = mpnt; | |
56825 | + } | |
56826 | + } | |
56827 | + BUG_ON(mpnt_m); | |
56828 | + } | |
56829 | +#endif | |
56830 | + | |
56831 | /* a new mm has just been created */ | |
56832 | arch_dup_mmap(oldmm, mm); | |
56833 | retval = 0; | |
56834 | @@ -429,14 +474,6 @@ out: | |
56835 | flush_tlb_mm(oldmm); | |
56836 | up_write(&oldmm->mmap_sem); | |
56837 | return retval; | |
56838 | -fail_nomem_anon_vma_fork: | |
56839 | - mpol_put(pol); | |
56840 | -fail_nomem_policy: | |
56841 | - kmem_cache_free(vm_area_cachep, tmp); | |
56842 | -fail_nomem: | |
56843 | - retval = -ENOMEM; | |
56844 | - vm_unacct_memory(charge); | |
56845 | - goto out; | |
56846 | } | |
56847 | ||
56848 | static inline int mm_alloc_pgd(struct mm_struct * mm) | |
56849 | @@ -836,13 +873,14 @@ static int copy_fs(unsigned long clone_f | |
56850 | spin_unlock(&fs->lock); | |
56851 | return -EAGAIN; | |
56852 | } | |
56853 | - fs->users++; | |
56854 | + atomic_inc(&fs->users); | |
56855 | spin_unlock(&fs->lock); | |
56856 | return 0; | |
56857 | } | |
56858 | tsk->fs = copy_fs_struct(fs); | |
56859 | if (!tsk->fs) | |
56860 | return -ENOMEM; | |
56861 | + gr_set_chroot_entries(tsk, &tsk->fs->root); | |
56862 | return 0; | |
56863 | } | |
56864 | ||
56865 | @@ -1104,12 +1142,16 @@ static struct task_struct *copy_process( | |
56866 | DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); | |
56867 | #endif | |
56868 | retval = -EAGAIN; | |
56869 | + | |
56870 | + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0); | |
56871 | + | |
56872 | if (atomic_read(&p->real_cred->user->processes) >= | |
56873 | task_rlimit(p, RLIMIT_NPROC)) { | |
56874 | - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && | |
56875 | - p->real_cred->user != INIT_USER) | |
56876 | + if (p->real_cred->user != INIT_USER && | |
56877 | + !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) | |
56878 | goto bad_fork_free; | |
56879 | } | |
56880 | + current->flags &= ~PF_NPROC_EXCEEDED; | |
56881 | ||
56882 | retval = copy_creds(p, clone_flags); | |
56883 | if (retval < 0) | |
56884 | @@ -1250,6 +1292,8 @@ static struct task_struct *copy_process( | |
56885 | if (clone_flags & CLONE_THREAD) | |
56886 | p->tgid = current->tgid; | |
56887 | ||
56888 | + gr_copy_label(p); | |
56889 | + | |
56890 | p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; | |
56891 | /* | |
56892 | * Clear TID on mm_release()? | |
56893 | @@ -1414,6 +1458,8 @@ bad_fork_cleanup_count: | |
56894 | bad_fork_free: | |
56895 | free_task(p); | |
56896 | fork_out: | |
56897 | + gr_log_forkfail(retval); | |
56898 | + | |
56899 | return ERR_PTR(retval); | |
56900 | } | |
56901 | ||
56902 | @@ -1502,6 +1548,8 @@ long do_fork(unsigned long clone_flags, | |
56903 | if (clone_flags & CLONE_PARENT_SETTID) | |
56904 | put_user(nr, parent_tidptr); | |
56905 | ||
56906 | + gr_handle_brute_check(); | |
56907 | + | |
56908 | if (clone_flags & CLONE_VFORK) { | |
56909 | p->vfork_done = &vfork; | |
56910 | init_completion(&vfork); | |
56911 | @@ -1610,7 +1658,7 @@ static int unshare_fs(unsigned long unsh | |
56912 | return 0; | |
56913 | ||
56914 | /* don't need lock here; in the worst case we'll do useless copy */ | |
56915 | - if (fs->users == 1) | |
56916 | + if (atomic_read(&fs->users) == 1) | |
56917 | return 0; | |
56918 | ||
56919 | *new_fsp = copy_fs_struct(fs); | |
56920 | @@ -1697,7 +1745,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, | |
56921 | fs = current->fs; | |
56922 | spin_lock(&fs->lock); | |
56923 | current->fs = new_fs; | |
56924 | - if (--fs->users) | |
56925 | + gr_set_chroot_entries(current, ¤t->fs->root); | |
56926 | + if (atomic_dec_return(&fs->users)) | |
56927 | new_fs = NULL; | |
56928 | else | |
56929 | new_fs = fs; | |
56930 | diff -urNp linux-3.0.3/kernel/futex.c linux-3.0.3/kernel/futex.c | |
56931 | --- linux-3.0.3/kernel/futex.c 2011-08-23 21:44:40.000000000 -0400 | |
56932 | +++ linux-3.0.3/kernel/futex.c 2011-08-23 21:48:14.000000000 -0400 | |
56933 | @@ -54,6 +54,7 @@ | |
56934 | #include <linux/mount.h> | |
56935 | #include <linux/pagemap.h> | |
56936 | #include <linux/syscalls.h> | |
56937 | +#include <linux/ptrace.h> | |
56938 | #include <linux/signal.h> | |
56939 | #include <linux/module.h> | |
56940 | #include <linux/magic.h> | |
56941 | @@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fsh | |
56942 | struct page *page, *page_head; | |
56943 | int err, ro = 0; | |
56944 | ||
56945 | +#ifdef CONFIG_PAX_SEGMEXEC | |
56946 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE) | |
56947 | + return -EFAULT; | |
56948 | +#endif | |
56949 | + | |
56950 | /* | |
56951 | * The futex address must be "naturally" aligned. | |
56952 | */ | |
56953 | @@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr, | |
56954 | struct futex_q q = futex_q_init; | |
56955 | int ret; | |
56956 | ||
56957 | + pax_track_stack(); | |
56958 | + | |
56959 | if (!bitset) | |
56960 | return -EINVAL; | |
56961 | q.bitset = bitset; | |
56962 | @@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __u | |
56963 | struct futex_q q = futex_q_init; | |
56964 | int res, ret; | |
56965 | ||
56966 | + pax_track_stack(); | |
56967 | + | |
56968 | if (!bitset) | |
56969 | return -EINVAL; | |
56970 | ||
56971 | @@ -2431,7 +2441,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi | |
56972 | { | |
56973 | struct robust_list_head __user *head; | |
56974 | unsigned long ret; | |
56975 | +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP | |
56976 | const struct cred *cred = current_cred(), *pcred; | |
56977 | +#endif | |
56978 | ||
56979 | if (!futex_cmpxchg_enabled) | |
56980 | return -ENOSYS; | |
56981 | @@ -2447,6 +2459,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi | |
56982 | if (!p) | |
56983 | goto err_unlock; | |
56984 | ret = -EPERM; | |
56985 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
56986 | + if (!ptrace_may_access(p, PTRACE_MODE_READ)) | |
56987 | + goto err_unlock; | |
56988 | +#else | |
56989 | pcred = __task_cred(p); | |
56990 | /* If victim is in different user_ns, then uids are not | |
56991 | comparable, so we must have CAP_SYS_PTRACE */ | |
56992 | @@ -2461,6 +2477,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi | |
56993 | !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE)) | |
56994 | goto err_unlock; | |
56995 | ok: | |
56996 | +#endif | |
56997 | head = p->robust_list; | |
56998 | rcu_read_unlock(); | |
56999 | } | |
57000 | @@ -2712,6 +2729,7 @@ static int __init futex_init(void) | |
57001 | { | |
57002 | u32 curval; | |
57003 | int i; | |
57004 | + mm_segment_t oldfs; | |
57005 | ||
57006 | /* | |
57007 | * This will fail and we want it. Some arch implementations do | |
57008 | @@ -2723,8 +2741,11 @@ static int __init futex_init(void) | |
57009 | * implementation, the non-functional ones will return | |
57010 | * -ENOSYS. | |
57011 | */ | |
57012 | + oldfs = get_fs(); | |
57013 | + set_fs(USER_DS); | |
57014 | if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT) | |
57015 | futex_cmpxchg_enabled = 1; | |
57016 | + set_fs(oldfs); | |
57017 | ||
57018 | for (i = 0; i < ARRAY_SIZE(futex_queues); i++) { | |
57019 | plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock); | |
57020 | diff -urNp linux-3.0.3/kernel/futex_compat.c linux-3.0.3/kernel/futex_compat.c | |
57021 | --- linux-3.0.3/kernel/futex_compat.c 2011-07-21 22:17:23.000000000 -0400 | |
57022 | +++ linux-3.0.3/kernel/futex_compat.c 2011-08-23 21:48:14.000000000 -0400 | |
57023 | @@ -10,6 +10,7 @@ | |
57024 | #include <linux/compat.h> | |
57025 | #include <linux/nsproxy.h> | |
57026 | #include <linux/futex.h> | |
57027 | +#include <linux/ptrace.h> | |
57028 | ||
57029 | #include <asm/uaccess.h> | |
57030 | ||
57031 | @@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp | |
57032 | { | |
57033 | struct compat_robust_list_head __user *head; | |
57034 | unsigned long ret; | |
57035 | - const struct cred *cred = current_cred(), *pcred; | |
57036 | +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP | |
57037 | + const struct cred *cred = current_cred(); | |
57038 | + const struct cred *pcred; | |
57039 | +#endif | |
57040 | ||
57041 | if (!futex_cmpxchg_enabled) | |
57042 | return -ENOSYS; | |
57043 | @@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp | |
57044 | if (!p) | |
57045 | goto err_unlock; | |
57046 | ret = -EPERM; | |
57047 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
57048 | + if (!ptrace_may_access(p, PTRACE_MODE_READ)) | |
57049 | + goto err_unlock; | |
57050 | +#else | |
57051 | pcred = __task_cred(p); | |
57052 | /* If victim is in different user_ns, then uids are not | |
57053 | comparable, so we must have CAP_SYS_PTRACE */ | |
57054 | @@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp | |
57055 | !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE)) | |
57056 | goto err_unlock; | |
57057 | ok: | |
57058 | +#endif | |
57059 | head = p->compat_robust_list; | |
57060 | rcu_read_unlock(); | |
57061 | } | |
57062 | diff -urNp linux-3.0.3/kernel/gcov/base.c linux-3.0.3/kernel/gcov/base.c | |
57063 | --- linux-3.0.3/kernel/gcov/base.c 2011-07-21 22:17:23.000000000 -0400 | |
57064 | +++ linux-3.0.3/kernel/gcov/base.c 2011-08-23 21:47:56.000000000 -0400 | |
57065 | @@ -102,11 +102,6 @@ void gcov_enable_events(void) | |
57066 | } | |
57067 | ||
57068 | #ifdef CONFIG_MODULES | |
57069 | -static inline int within(void *addr, void *start, unsigned long size) | |
57070 | -{ | |
57071 | - return ((addr >= start) && (addr < start + size)); | |
57072 | -} | |
57073 | - | |
57074 | /* Update list and generate events when modules are unloaded. */ | |
57075 | static int gcov_module_notifier(struct notifier_block *nb, unsigned long event, | |
57076 | void *data) | |
57077 | @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n | |
57078 | prev = NULL; | |
57079 | /* Remove entries located in module from linked list. */ | |
57080 | for (info = gcov_info_head; info; info = info->next) { | |
57081 | - if (within(info, mod->module_core, mod->core_size)) { | |
57082 | + if (within_module_core_rw((unsigned long)info, mod)) { | |
57083 | if (prev) | |
57084 | prev->next = info->next; | |
57085 | else | |
57086 | diff -urNp linux-3.0.3/kernel/hrtimer.c linux-3.0.3/kernel/hrtimer.c | |
57087 | --- linux-3.0.3/kernel/hrtimer.c 2011-07-21 22:17:23.000000000 -0400 | |
57088 | +++ linux-3.0.3/kernel/hrtimer.c 2011-08-23 21:47:56.000000000 -0400 | |
57089 | @@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void) | |
57090 | local_irq_restore(flags); | |
57091 | } | |
57092 | ||
57093 | -static void run_hrtimer_softirq(struct softirq_action *h) | |
57094 | +static void run_hrtimer_softirq(void) | |
57095 | { | |
57096 | hrtimer_peek_ahead_timers(); | |
57097 | } | |
57098 | diff -urNp linux-3.0.3/kernel/jump_label.c linux-3.0.3/kernel/jump_label.c | |
57099 | --- linux-3.0.3/kernel/jump_label.c 2011-07-21 22:17:23.000000000 -0400 | |
57100 | +++ linux-3.0.3/kernel/jump_label.c 2011-08-23 21:47:56.000000000 -0400 | |
57101 | @@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entr | |
57102 | ||
57103 | size = (((unsigned long)stop - (unsigned long)start) | |
57104 | / sizeof(struct jump_entry)); | |
57105 | + pax_open_kernel(); | |
57106 | sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL); | |
57107 | + pax_close_kernel(); | |
57108 | } | |
57109 | ||
57110 | static void jump_label_update(struct jump_label_key *key, int enable); | |
57111 | @@ -297,10 +299,12 @@ static void jump_label_invalidate_module | |
57112 | struct jump_entry *iter_stop = iter_start + mod->num_jump_entries; | |
57113 | struct jump_entry *iter; | |
57114 | ||
57115 | + pax_open_kernel(); | |
57116 | for (iter = iter_start; iter < iter_stop; iter++) { | |
57117 | if (within_module_init(iter->code, mod)) | |
57118 | iter->code = 0; | |
57119 | } | |
57120 | + pax_close_kernel(); | |
57121 | } | |
57122 | ||
57123 | static int | |
57124 | diff -urNp linux-3.0.3/kernel/kallsyms.c linux-3.0.3/kernel/kallsyms.c | |
57125 | --- linux-3.0.3/kernel/kallsyms.c 2011-07-21 22:17:23.000000000 -0400 | |
57126 | +++ linux-3.0.3/kernel/kallsyms.c 2011-08-23 21:48:14.000000000 -0400 | |
57127 | @@ -11,6 +11,9 @@ | |
57128 | * Changed the compression method from stem compression to "table lookup" | |
57129 | * compression (see scripts/kallsyms.c for a more complete description) | |
57130 | */ | |
57131 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
57132 | +#define __INCLUDED_BY_HIDESYM 1 | |
57133 | +#endif | |
57134 | #include <linux/kallsyms.h> | |
57135 | #include <linux/module.h> | |
57136 | #include <linux/init.h> | |
57137 | @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark | |
57138 | ||
57139 | static inline int is_kernel_inittext(unsigned long addr) | |
57140 | { | |
57141 | + if (system_state != SYSTEM_BOOTING) | |
57142 | + return 0; | |
57143 | + | |
57144 | if (addr >= (unsigned long)_sinittext | |
57145 | && addr <= (unsigned long)_einittext) | |
57146 | return 1; | |
57147 | return 0; | |
57148 | } | |
57149 | ||
57150 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
57151 | +#ifdef CONFIG_MODULES | |
57152 | +static inline int is_module_text(unsigned long addr) | |
57153 | +{ | |
57154 | + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END) | |
57155 | + return 1; | |
57156 | + | |
57157 | + addr = ktla_ktva(addr); | |
57158 | + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END; | |
57159 | +} | |
57160 | +#else | |
57161 | +static inline int is_module_text(unsigned long addr) | |
57162 | +{ | |
57163 | + return 0; | |
57164 | +} | |
57165 | +#endif | |
57166 | +#endif | |
57167 | + | |
57168 | static inline int is_kernel_text(unsigned long addr) | |
57169 | { | |
57170 | if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) || | |
57171 | @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne | |
57172 | ||
57173 | static inline int is_kernel(unsigned long addr) | |
57174 | { | |
57175 | + | |
57176 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
57177 | + if (is_kernel_text(addr) || is_kernel_inittext(addr)) | |
57178 | + return 1; | |
57179 | + | |
57180 | + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end) | |
57181 | +#else | |
57182 | if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end) | |
57183 | +#endif | |
57184 | + | |
57185 | return 1; | |
57186 | return in_gate_area_no_mm(addr); | |
57187 | } | |
57188 | ||
57189 | static int is_ksym_addr(unsigned long addr) | |
57190 | { | |
57191 | + | |
57192 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
57193 | + if (is_module_text(addr)) | |
57194 | + return 0; | |
57195 | +#endif | |
57196 | + | |
57197 | if (all_var) | |
57198 | return is_kernel(addr); | |
57199 | ||
57200 | @@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st | |
57201 | ||
57202 | static void reset_iter(struct kallsym_iter *iter, loff_t new_pos) | |
57203 | { | |
57204 | - iter->name[0] = '\0'; | |
57205 | iter->nameoff = get_symbol_offset(new_pos); | |
57206 | iter->pos = new_pos; | |
57207 | } | |
57208 | @@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo | |
57209 | { | |
57210 | struct kallsym_iter *iter = m->private; | |
57211 | ||
57212 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
57213 | + if (current_uid()) | |
57214 | + return 0; | |
57215 | +#endif | |
57216 | + | |
57217 | /* Some debugging symbols have no name. Ignore them. */ | |
57218 | if (!iter->name[0]) | |
57219 | return 0; | |
57220 | @@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i | |
57221 | struct kallsym_iter *iter; | |
57222 | int ret; | |
57223 | ||
57224 | - iter = kmalloc(sizeof(*iter), GFP_KERNEL); | |
57225 | + iter = kzalloc(sizeof(*iter), GFP_KERNEL); | |
57226 | if (!iter) | |
57227 | return -ENOMEM; | |
57228 | reset_iter(iter, 0); | |
57229 | diff -urNp linux-3.0.3/kernel/kmod.c linux-3.0.3/kernel/kmod.c | |
57230 | --- linux-3.0.3/kernel/kmod.c 2011-07-21 22:17:23.000000000 -0400 | |
57231 | +++ linux-3.0.3/kernel/kmod.c 2011-08-23 21:48:14.000000000 -0400 | |
57232 | @@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb | |
57233 | * If module auto-loading support is disabled then this function | |
57234 | * becomes a no-operation. | |
57235 | */ | |
57236 | -int __request_module(bool wait, const char *fmt, ...) | |
57237 | +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap) | |
57238 | { | |
57239 | - va_list args; | |
57240 | char module_name[MODULE_NAME_LEN]; | |
57241 | unsigned int max_modprobes; | |
57242 | int ret; | |
57243 | - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL }; | |
57244 | + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL }; | |
57245 | static char *envp[] = { "HOME=/", | |
57246 | "TERM=linux", | |
57247 | "PATH=/sbin:/usr/sbin:/bin:/usr/bin", | |
57248 | @@ -88,9 +87,7 @@ int __request_module(bool wait, const ch | |
57249 | #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */ | |
57250 | static int kmod_loop_msg; | |
57251 | ||
57252 | - va_start(args, fmt); | |
57253 | - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); | |
57254 | - va_end(args); | |
57255 | + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap); | |
57256 | if (ret >= MODULE_NAME_LEN) | |
57257 | return -ENAMETOOLONG; | |
57258 | ||
57259 | @@ -98,6 +95,20 @@ int __request_module(bool wait, const ch | |
57260 | if (ret) | |
57261 | return ret; | |
57262 | ||
57263 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57264 | + if (!current_uid()) { | |
57265 | + /* hack to workaround consolekit/udisks stupidity */ | |
57266 | + read_lock(&tasklist_lock); | |
57267 | + if (!strcmp(current->comm, "mount") && | |
57268 | + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) { | |
57269 | + read_unlock(&tasklist_lock); | |
57270 | + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name); | |
57271 | + return -EPERM; | |
57272 | + } | |
57273 | + read_unlock(&tasklist_lock); | |
57274 | + } | |
57275 | +#endif | |
57276 | + | |
57277 | /* If modprobe needs a service that is in a module, we get a recursive | |
57278 | * loop. Limit the number of running kmod threads to max_threads/2 or | |
57279 | * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method | |
57280 | @@ -131,6 +142,47 @@ int __request_module(bool wait, const ch | |
57281 | atomic_dec(&kmod_concurrent); | |
57282 | return ret; | |
57283 | } | |
57284 | + | |
57285 | +int ___request_module(bool wait, char *module_param, const char *fmt, ...) | |
57286 | +{ | |
57287 | + va_list args; | |
57288 | + int ret; | |
57289 | + | |
57290 | + va_start(args, fmt); | |
57291 | + ret = ____request_module(wait, module_param, fmt, args); | |
57292 | + va_end(args); | |
57293 | + | |
57294 | + return ret; | |
57295 | +} | |
57296 | + | |
57297 | +int __request_module(bool wait, const char *fmt, ...) | |
57298 | +{ | |
57299 | + va_list args; | |
57300 | + int ret; | |
57301 | + | |
57302 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57303 | + if (current_uid()) { | |
57304 | + char module_param[MODULE_NAME_LEN]; | |
57305 | + | |
57306 | + memset(module_param, 0, sizeof(module_param)); | |
57307 | + | |
57308 | + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid()); | |
57309 | + | |
57310 | + va_start(args, fmt); | |
57311 | + ret = ____request_module(wait, module_param, fmt, args); | |
57312 | + va_end(args); | |
57313 | + | |
57314 | + return ret; | |
57315 | + } | |
57316 | +#endif | |
57317 | + | |
57318 | + va_start(args, fmt); | |
57319 | + ret = ____request_module(wait, NULL, fmt, args); | |
57320 | + va_end(args); | |
57321 | + | |
57322 | + return ret; | |
57323 | +} | |
57324 | + | |
57325 | EXPORT_SYMBOL(__request_module); | |
57326 | #endif /* CONFIG_MODULES */ | |
57327 | ||
57328 | diff -urNp linux-3.0.3/kernel/kprobes.c linux-3.0.3/kernel/kprobes.c | |
57329 | --- linux-3.0.3/kernel/kprobes.c 2011-07-21 22:17:23.000000000 -0400 | |
57330 | +++ linux-3.0.3/kernel/kprobes.c 2011-08-23 21:47:56.000000000 -0400 | |
57331 | @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_ | |
57332 | * kernel image and loaded module images reside. This is required | |
57333 | * so x86_64 can correctly handle the %rip-relative fixups. | |
57334 | */ | |
57335 | - kip->insns = module_alloc(PAGE_SIZE); | |
57336 | + kip->insns = module_alloc_exec(PAGE_SIZE); | |
57337 | if (!kip->insns) { | |
57338 | kfree(kip); | |
57339 | return NULL; | |
57340 | @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st | |
57341 | */ | |
57342 | if (!list_is_singular(&kip->list)) { | |
57343 | list_del(&kip->list); | |
57344 | - module_free(NULL, kip->insns); | |
57345 | + module_free_exec(NULL, kip->insns); | |
57346 | kfree(kip); | |
57347 | } | |
57348 | return 1; | |
57349 | @@ -1936,7 +1936,7 @@ static int __init init_kprobes(void) | |
57350 | { | |
57351 | int i, err = 0; | |
57352 | unsigned long offset = 0, size = 0; | |
57353 | - char *modname, namebuf[128]; | |
57354 | + char *modname, namebuf[KSYM_NAME_LEN]; | |
57355 | const char *symbol_name; | |
57356 | void *addr; | |
57357 | struct kprobe_blackpoint *kb; | |
57358 | @@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st | |
57359 | const char *sym = NULL; | |
57360 | unsigned int i = *(loff_t *) v; | |
57361 | unsigned long offset = 0; | |
57362 | - char *modname, namebuf[128]; | |
57363 | + char *modname, namebuf[KSYM_NAME_LEN]; | |
57364 | ||
57365 | head = &kprobe_table[i]; | |
57366 | preempt_disable(); | |
57367 | diff -urNp linux-3.0.3/kernel/lockdep.c linux-3.0.3/kernel/lockdep.c | |
57368 | --- linux-3.0.3/kernel/lockdep.c 2011-07-21 22:17:23.000000000 -0400 | |
57369 | +++ linux-3.0.3/kernel/lockdep.c 2011-08-23 21:47:56.000000000 -0400 | |
57370 | @@ -583,6 +583,10 @@ static int static_obj(void *obj) | |
57371 | end = (unsigned long) &_end, | |
57372 | addr = (unsigned long) obj; | |
57373 | ||
57374 | +#ifdef CONFIG_PAX_KERNEXEC | |
57375 | + start = ktla_ktva(start); | |
57376 | +#endif | |
57377 | + | |
57378 | /* | |
57379 | * static variable? | |
57380 | */ | |
57381 | @@ -718,6 +722,7 @@ register_lock_class(struct lockdep_map * | |
57382 | if (!static_obj(lock->key)) { | |
57383 | debug_locks_off(); | |
57384 | printk("INFO: trying to register non-static key.\n"); | |
57385 | + printk("lock:%pS key:%pS.\n", lock, lock->key); | |
57386 | printk("the code is fine but needs lockdep annotation.\n"); | |
57387 | printk("turning off the locking correctness validator.\n"); | |
57388 | dump_stack(); | |
57389 | @@ -2936,7 +2941,7 @@ static int __lock_acquire(struct lockdep | |
57390 | if (!class) | |
57391 | return 0; | |
57392 | } | |
57393 | - atomic_inc((atomic_t *)&class->ops); | |
57394 | + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops); | |
57395 | if (very_verbose(class)) { | |
57396 | printk("\nacquire class [%p] %s", class->key, class->name); | |
57397 | if (class->name_version > 1) | |
57398 | diff -urNp linux-3.0.3/kernel/lockdep_proc.c linux-3.0.3/kernel/lockdep_proc.c | |
57399 | --- linux-3.0.3/kernel/lockdep_proc.c 2011-07-21 22:17:23.000000000 -0400 | |
57400 | +++ linux-3.0.3/kernel/lockdep_proc.c 2011-08-23 21:47:56.000000000 -0400 | |
57401 | @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v | |
57402 | ||
57403 | static void print_name(struct seq_file *m, struct lock_class *class) | |
57404 | { | |
57405 | - char str[128]; | |
57406 | + char str[KSYM_NAME_LEN]; | |
57407 | const char *name = class->name; | |
57408 | ||
57409 | if (!name) { | |
57410 | diff -urNp linux-3.0.3/kernel/module.c linux-3.0.3/kernel/module.c | |
57411 | --- linux-3.0.3/kernel/module.c 2011-07-21 22:17:23.000000000 -0400 | |
57412 | +++ linux-3.0.3/kernel/module.c 2011-08-23 21:48:14.000000000 -0400 | |
57413 | @@ -58,6 +58,7 @@ | |
57414 | #include <linux/jump_label.h> | |
57415 | #include <linux/pfn.h> | |
57416 | #include <linux/bsearch.h> | |
57417 | +#include <linux/grsecurity.h> | |
57418 | ||
57419 | #define CREATE_TRACE_POINTS | |
57420 | #include <trace/events/module.h> | |
57421 | @@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not | |
57422 | ||
57423 | /* Bounds of module allocation, for speeding __module_address. | |
57424 | * Protected by module_mutex. */ | |
57425 | -static unsigned long module_addr_min = -1UL, module_addr_max = 0; | |
57426 | +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0; | |
57427 | +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0; | |
57428 | ||
57429 | int register_module_notifier(struct notifier_block * nb) | |
57430 | { | |
57431 | @@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(cons | |
57432 | return true; | |
57433 | ||
57434 | list_for_each_entry_rcu(mod, &modules, list) { | |
57435 | - struct symsearch arr[] = { | |
57436 | + struct symsearch modarr[] = { | |
57437 | { mod->syms, mod->syms + mod->num_syms, mod->crcs, | |
57438 | NOT_GPL_ONLY, false }, | |
57439 | { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms, | |
57440 | @@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(cons | |
57441 | #endif | |
57442 | }; | |
57443 | ||
57444 | - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data)) | |
57445 | + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data)) | |
57446 | return true; | |
57447 | } | |
57448 | return false; | |
57449 | @@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu( | |
57450 | static int percpu_modalloc(struct module *mod, | |
57451 | unsigned long size, unsigned long align) | |
57452 | { | |
57453 | - if (align > PAGE_SIZE) { | |
57454 | + if (align-1 >= PAGE_SIZE) { | |
57455 | printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n", | |
57456 | mod->name, align, PAGE_SIZE); | |
57457 | align = PAGE_SIZE; | |
57458 | @@ -1166,7 +1168,7 @@ resolve_symbol_wait(struct module *mod, | |
57459 | */ | |
57460 | #ifdef CONFIG_SYSFS | |
57461 | ||
57462 | -#ifdef CONFIG_KALLSYMS | |
57463 | +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM) | |
57464 | static inline bool sect_empty(const Elf_Shdr *sect) | |
57465 | { | |
57466 | return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0; | |
57467 | @@ -1632,21 +1634,21 @@ static void set_section_ro_nx(void *base | |
57468 | ||
57469 | static void unset_module_core_ro_nx(struct module *mod) | |
57470 | { | |
57471 | - set_page_attributes(mod->module_core + mod->core_text_size, | |
57472 | - mod->module_core + mod->core_size, | |
57473 | + set_page_attributes(mod->module_core_rw, | |
57474 | + mod->module_core_rw + mod->core_size_rw, | |
57475 | set_memory_x); | |
57476 | - set_page_attributes(mod->module_core, | |
57477 | - mod->module_core + mod->core_ro_size, | |
57478 | + set_page_attributes(mod->module_core_rx, | |
57479 | + mod->module_core_rx + mod->core_size_rx, | |
57480 | set_memory_rw); | |
57481 | } | |
57482 | ||
57483 | static void unset_module_init_ro_nx(struct module *mod) | |
57484 | { | |
57485 | - set_page_attributes(mod->module_init + mod->init_text_size, | |
57486 | - mod->module_init + mod->init_size, | |
57487 | + set_page_attributes(mod->module_init_rw, | |
57488 | + mod->module_init_rw + mod->init_size_rw, | |
57489 | set_memory_x); | |
57490 | - set_page_attributes(mod->module_init, | |
57491 | - mod->module_init + mod->init_ro_size, | |
57492 | + set_page_attributes(mod->module_init_rx, | |
57493 | + mod->module_init_rx + mod->init_size_rx, | |
57494 | set_memory_rw); | |
57495 | } | |
57496 | ||
57497 | @@ -1657,14 +1659,14 @@ void set_all_modules_text_rw(void) | |
57498 | ||
57499 | mutex_lock(&module_mutex); | |
57500 | list_for_each_entry_rcu(mod, &modules, list) { | |
57501 | - if ((mod->module_core) && (mod->core_text_size)) { | |
57502 | - set_page_attributes(mod->module_core, | |
57503 | - mod->module_core + mod->core_text_size, | |
57504 | + if ((mod->module_core_rx) && (mod->core_size_rx)) { | |
57505 | + set_page_attributes(mod->module_core_rx, | |
57506 | + mod->module_core_rx + mod->core_size_rx, | |
57507 | set_memory_rw); | |
57508 | } | |
57509 | - if ((mod->module_init) && (mod->init_text_size)) { | |
57510 | - set_page_attributes(mod->module_init, | |
57511 | - mod->module_init + mod->init_text_size, | |
57512 | + if ((mod->module_init_rx) && (mod->init_size_rx)) { | |
57513 | + set_page_attributes(mod->module_init_rx, | |
57514 | + mod->module_init_rx + mod->init_size_rx, | |
57515 | set_memory_rw); | |
57516 | } | |
57517 | } | |
57518 | @@ -1678,14 +1680,14 @@ void set_all_modules_text_ro(void) | |
57519 | ||
57520 | mutex_lock(&module_mutex); | |
57521 | list_for_each_entry_rcu(mod, &modules, list) { | |
57522 | - if ((mod->module_core) && (mod->core_text_size)) { | |
57523 | - set_page_attributes(mod->module_core, | |
57524 | - mod->module_core + mod->core_text_size, | |
57525 | + if ((mod->module_core_rx) && (mod->core_size_rx)) { | |
57526 | + set_page_attributes(mod->module_core_rx, | |
57527 | + mod->module_core_rx + mod->core_size_rx, | |
57528 | set_memory_ro); | |
57529 | } | |
57530 | - if ((mod->module_init) && (mod->init_text_size)) { | |
57531 | - set_page_attributes(mod->module_init, | |
57532 | - mod->module_init + mod->init_text_size, | |
57533 | + if ((mod->module_init_rx) && (mod->init_size_rx)) { | |
57534 | + set_page_attributes(mod->module_init_rx, | |
57535 | + mod->module_init_rx + mod->init_size_rx, | |
57536 | set_memory_ro); | |
57537 | } | |
57538 | } | |
57539 | @@ -1722,16 +1724,19 @@ static void free_module(struct module *m | |
57540 | ||
57541 | /* This may be NULL, but that's OK */ | |
57542 | unset_module_init_ro_nx(mod); | |
57543 | - module_free(mod, mod->module_init); | |
57544 | + module_free(mod, mod->module_init_rw); | |
57545 | + module_free_exec(mod, mod->module_init_rx); | |
57546 | kfree(mod->args); | |
57547 | percpu_modfree(mod); | |
57548 | ||
57549 | /* Free lock-classes: */ | |
57550 | - lockdep_free_key_range(mod->module_core, mod->core_size); | |
57551 | + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx); | |
57552 | + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw); | |
57553 | ||
57554 | /* Finally, free the core (containing the module structure) */ | |
57555 | unset_module_core_ro_nx(mod); | |
57556 | - module_free(mod, mod->module_core); | |
57557 | + module_free_exec(mod, mod->module_core_rx); | |
57558 | + module_free(mod, mod->module_core_rw); | |
57559 | ||
57560 | #ifdef CONFIG_MPU | |
57561 | update_protections(current->mm); | |
57562 | @@ -1800,10 +1805,31 @@ static int simplify_symbols(struct modul | |
57563 | unsigned int i; | |
57564 | int ret = 0; | |
57565 | const struct kernel_symbol *ksym; | |
57566 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57567 | + int is_fs_load = 0; | |
57568 | + int register_filesystem_found = 0; | |
57569 | + char *p; | |
57570 | + | |
57571 | + p = strstr(mod->args, "grsec_modharden_fs"); | |
57572 | + if (p) { | |
57573 | + char *endptr = p + strlen("grsec_modharden_fs"); | |
57574 | + /* copy \0 as well */ | |
57575 | + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1); | |
57576 | + is_fs_load = 1; | |
57577 | + } | |
57578 | +#endif | |
57579 | ||
57580 | for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { | |
57581 | const char *name = info->strtab + sym[i].st_name; | |
57582 | ||
57583 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57584 | + /* it's a real shame this will never get ripped and copied | |
57585 | + upstream! ;( | |
57586 | + */ | |
57587 | + if (is_fs_load && !strcmp(name, "register_filesystem")) | |
57588 | + register_filesystem_found = 1; | |
57589 | +#endif | |
57590 | + | |
57591 | switch (sym[i].st_shndx) { | |
57592 | case SHN_COMMON: | |
57593 | /* We compiled with -fno-common. These are not | |
57594 | @@ -1824,7 +1850,9 @@ static int simplify_symbols(struct modul | |
57595 | ksym = resolve_symbol_wait(mod, info, name); | |
57596 | /* Ok if resolved. */ | |
57597 | if (ksym && !IS_ERR(ksym)) { | |
57598 | + pax_open_kernel(); | |
57599 | sym[i].st_value = ksym->value; | |
57600 | + pax_close_kernel(); | |
57601 | break; | |
57602 | } | |
57603 | ||
57604 | @@ -1843,11 +1871,20 @@ static int simplify_symbols(struct modul | |
57605 | secbase = (unsigned long)mod_percpu(mod); | |
57606 | else | |
57607 | secbase = info->sechdrs[sym[i].st_shndx].sh_addr; | |
57608 | + pax_open_kernel(); | |
57609 | sym[i].st_value += secbase; | |
57610 | + pax_close_kernel(); | |
57611 | break; | |
57612 | } | |
57613 | } | |
57614 | ||
57615 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57616 | + if (is_fs_load && !register_filesystem_found) { | |
57617 | + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name); | |
57618 | + ret = -EPERM; | |
57619 | + } | |
57620 | +#endif | |
57621 | + | |
57622 | return ret; | |
57623 | } | |
57624 | ||
57625 | @@ -1931,22 +1968,12 @@ static void layout_sections(struct modul | |
57626 | || s->sh_entsize != ~0UL | |
57627 | || strstarts(sname, ".init")) | |
57628 | continue; | |
57629 | - s->sh_entsize = get_offset(mod, &mod->core_size, s, i); | |
57630 | + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC)) | |
57631 | + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i); | |
57632 | + else | |
57633 | + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i); | |
57634 | DEBUGP("\t%s\n", name); | |
57635 | } | |
57636 | - switch (m) { | |
57637 | - case 0: /* executable */ | |
57638 | - mod->core_size = debug_align(mod->core_size); | |
57639 | - mod->core_text_size = mod->core_size; | |
57640 | - break; | |
57641 | - case 1: /* RO: text and ro-data */ | |
57642 | - mod->core_size = debug_align(mod->core_size); | |
57643 | - mod->core_ro_size = mod->core_size; | |
57644 | - break; | |
57645 | - case 3: /* whole core */ | |
57646 | - mod->core_size = debug_align(mod->core_size); | |
57647 | - break; | |
57648 | - } | |
57649 | } | |
57650 | ||
57651 | DEBUGP("Init section allocation order:\n"); | |
57652 | @@ -1960,23 +1987,13 @@ static void layout_sections(struct modul | |
57653 | || s->sh_entsize != ~0UL | |
57654 | || !strstarts(sname, ".init")) | |
57655 | continue; | |
57656 | - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i) | |
57657 | - | INIT_OFFSET_MASK); | |
57658 | + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC)) | |
57659 | + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i); | |
57660 | + else | |
57661 | + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i); | |
57662 | + s->sh_entsize |= INIT_OFFSET_MASK; | |
57663 | DEBUGP("\t%s\n", sname); | |
57664 | } | |
57665 | - switch (m) { | |
57666 | - case 0: /* executable */ | |
57667 | - mod->init_size = debug_align(mod->init_size); | |
57668 | - mod->init_text_size = mod->init_size; | |
57669 | - break; | |
57670 | - case 1: /* RO: text and ro-data */ | |
57671 | - mod->init_size = debug_align(mod->init_size); | |
57672 | - mod->init_ro_size = mod->init_size; | |
57673 | - break; | |
57674 | - case 3: /* whole init */ | |
57675 | - mod->init_size = debug_align(mod->init_size); | |
57676 | - break; | |
57677 | - } | |
57678 | } | |
57679 | } | |
57680 | ||
57681 | @@ -2141,7 +2158,7 @@ static void layout_symtab(struct module | |
57682 | ||
57683 | /* Put symbol section at end of init part of module. */ | |
57684 | symsect->sh_flags |= SHF_ALLOC; | |
57685 | - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect, | |
57686 | + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect, | |
57687 | info->index.sym) | INIT_OFFSET_MASK; | |
57688 | DEBUGP("\t%s\n", info->secstrings + symsect->sh_name); | |
57689 | ||
57690 | @@ -2158,19 +2175,19 @@ static void layout_symtab(struct module | |
57691 | } | |
57692 | ||
57693 | /* Append room for core symbols at end of core part. */ | |
57694 | - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1); | |
57695 | - mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym); | |
57696 | + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1); | |
57697 | + mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym); | |
57698 | ||
57699 | /* Put string table section at end of init part of module. */ | |
57700 | strsect->sh_flags |= SHF_ALLOC; | |
57701 | - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect, | |
57702 | + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect, | |
57703 | info->index.str) | INIT_OFFSET_MASK; | |
57704 | DEBUGP("\t%s\n", info->secstrings + strsect->sh_name); | |
57705 | ||
57706 | /* Append room for core symbols' strings at end of core part. */ | |
57707 | - info->stroffs = mod->core_size; | |
57708 | + info->stroffs = mod->core_size_rx; | |
57709 | __set_bit(0, info->strmap); | |
57710 | - mod->core_size += bitmap_weight(info->strmap, strsect->sh_size); | |
57711 | + mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size); | |
57712 | } | |
57713 | ||
57714 | static void add_kallsyms(struct module *mod, const struct load_info *info) | |
57715 | @@ -2186,11 +2203,13 @@ static void add_kallsyms(struct module * | |
57716 | /* Make sure we get permanent strtab: don't use info->strtab. */ | |
57717 | mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; | |
57718 | ||
57719 | + pax_open_kernel(); | |
57720 | + | |
57721 | /* Set types up while we still have access to sections. */ | |
57722 | for (i = 0; i < mod->num_symtab; i++) | |
57723 | mod->symtab[i].st_info = elf_type(&mod->symtab[i], info); | |
57724 | ||
57725 | - mod->core_symtab = dst = mod->module_core + info->symoffs; | |
57726 | + mod->core_symtab = dst = mod->module_core_rx + info->symoffs; | |
57727 | src = mod->symtab; | |
57728 | *dst = *src; | |
57729 | for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) { | |
57730 | @@ -2203,10 +2222,12 @@ static void add_kallsyms(struct module * | |
57731 | } | |
57732 | mod->core_num_syms = ndst; | |
57733 | ||
57734 | - mod->core_strtab = s = mod->module_core + info->stroffs; | |
57735 | + mod->core_strtab = s = mod->module_core_rx + info->stroffs; | |
57736 | for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i) | |
57737 | if (test_bit(i, info->strmap)) | |
57738 | *++s = mod->strtab[i]; | |
57739 | + | |
57740 | + pax_close_kernel(); | |
57741 | } | |
57742 | #else | |
57743 | static inline void layout_symtab(struct module *mod, struct load_info *info) | |
57744 | @@ -2235,17 +2256,33 @@ static void dynamic_debug_remove(struct | |
57745 | ddebug_remove_module(debug->modname); | |
57746 | } | |
57747 | ||
57748 | -static void *module_alloc_update_bounds(unsigned long size) | |
57749 | +static void *module_alloc_update_bounds_rw(unsigned long size) | |
57750 | { | |
57751 | void *ret = module_alloc(size); | |
57752 | ||
57753 | if (ret) { | |
57754 | mutex_lock(&module_mutex); | |
57755 | /* Update module bounds. */ | |
57756 | - if ((unsigned long)ret < module_addr_min) | |
57757 | - module_addr_min = (unsigned long)ret; | |
57758 | - if ((unsigned long)ret + size > module_addr_max) | |
57759 | - module_addr_max = (unsigned long)ret + size; | |
57760 | + if ((unsigned long)ret < module_addr_min_rw) | |
57761 | + module_addr_min_rw = (unsigned long)ret; | |
57762 | + if ((unsigned long)ret + size > module_addr_max_rw) | |
57763 | + module_addr_max_rw = (unsigned long)ret + size; | |
57764 | + mutex_unlock(&module_mutex); | |
57765 | + } | |
57766 | + return ret; | |
57767 | +} | |
57768 | + | |
57769 | +static void *module_alloc_update_bounds_rx(unsigned long size) | |
57770 | +{ | |
57771 | + void *ret = module_alloc_exec(size); | |
57772 | + | |
57773 | + if (ret) { | |
57774 | + mutex_lock(&module_mutex); | |
57775 | + /* Update module bounds. */ | |
57776 | + if ((unsigned long)ret < module_addr_min_rx) | |
57777 | + module_addr_min_rx = (unsigned long)ret; | |
57778 | + if ((unsigned long)ret + size > module_addr_max_rx) | |
57779 | + module_addr_max_rx = (unsigned long)ret + size; | |
57780 | mutex_unlock(&module_mutex); | |
57781 | } | |
57782 | return ret; | |
57783 | @@ -2538,7 +2575,7 @@ static int move_module(struct module *mo | |
57784 | void *ptr; | |
57785 | ||
57786 | /* Do the allocs. */ | |
57787 | - ptr = module_alloc_update_bounds(mod->core_size); | |
57788 | + ptr = module_alloc_update_bounds_rw(mod->core_size_rw); | |
57789 | /* | |
57790 | * The pointer to this block is stored in the module structure | |
57791 | * which is inside the block. Just mark it as not being a | |
57792 | @@ -2548,23 +2585,50 @@ static int move_module(struct module *mo | |
57793 | if (!ptr) | |
57794 | return -ENOMEM; | |
57795 | ||
57796 | - memset(ptr, 0, mod->core_size); | |
57797 | - mod->module_core = ptr; | |
57798 | + memset(ptr, 0, mod->core_size_rw); | |
57799 | + mod->module_core_rw = ptr; | |
57800 | ||
57801 | - ptr = module_alloc_update_bounds(mod->init_size); | |
57802 | + ptr = module_alloc_update_bounds_rw(mod->init_size_rw); | |
57803 | /* | |
57804 | * The pointer to this block is stored in the module structure | |
57805 | * which is inside the block. This block doesn't need to be | |
57806 | * scanned as it contains data and code that will be freed | |
57807 | * after the module is initialized. | |
57808 | */ | |
57809 | - kmemleak_ignore(ptr); | |
57810 | - if (!ptr && mod->init_size) { | |
57811 | - module_free(mod, mod->module_core); | |
57812 | + kmemleak_not_leak(ptr); | |
57813 | + if (!ptr && mod->init_size_rw) { | |
57814 | + module_free(mod, mod->module_core_rw); | |
57815 | return -ENOMEM; | |
57816 | } | |
57817 | - memset(ptr, 0, mod->init_size); | |
57818 | - mod->module_init = ptr; | |
57819 | + memset(ptr, 0, mod->init_size_rw); | |
57820 | + mod->module_init_rw = ptr; | |
57821 | + | |
57822 | + ptr = module_alloc_update_bounds_rx(mod->core_size_rx); | |
57823 | + kmemleak_not_leak(ptr); | |
57824 | + if (!ptr) { | |
57825 | + module_free(mod, mod->module_init_rw); | |
57826 | + module_free(mod, mod->module_core_rw); | |
57827 | + return -ENOMEM; | |
57828 | + } | |
57829 | + | |
57830 | + pax_open_kernel(); | |
57831 | + memset(ptr, 0, mod->core_size_rx); | |
57832 | + pax_close_kernel(); | |
57833 | + mod->module_core_rx = ptr; | |
57834 | + | |
57835 | + ptr = module_alloc_update_bounds_rx(mod->init_size_rx); | |
57836 | + kmemleak_not_leak(ptr); | |
57837 | + if (!ptr && mod->init_size_rx) { | |
57838 | + module_free_exec(mod, mod->module_core_rx); | |
57839 | + module_free(mod, mod->module_init_rw); | |
57840 | + module_free(mod, mod->module_core_rw); | |
57841 | + return -ENOMEM; | |
57842 | + } | |
57843 | + | |
57844 | + pax_open_kernel(); | |
57845 | + memset(ptr, 0, mod->init_size_rx); | |
57846 | + pax_close_kernel(); | |
57847 | + mod->module_init_rx = ptr; | |
57848 | ||
57849 | /* Transfer each section which specifies SHF_ALLOC */ | |
57850 | DEBUGP("final section addresses:\n"); | |
57851 | @@ -2575,16 +2639,45 @@ static int move_module(struct module *mo | |
57852 | if (!(shdr->sh_flags & SHF_ALLOC)) | |
57853 | continue; | |
57854 | ||
57855 | - if (shdr->sh_entsize & INIT_OFFSET_MASK) | |
57856 | - dest = mod->module_init | |
57857 | - + (shdr->sh_entsize & ~INIT_OFFSET_MASK); | |
57858 | - else | |
57859 | - dest = mod->module_core + shdr->sh_entsize; | |
57860 | + if (shdr->sh_entsize & INIT_OFFSET_MASK) { | |
57861 | + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC)) | |
57862 | + dest = mod->module_init_rw | |
57863 | + + (shdr->sh_entsize & ~INIT_OFFSET_MASK); | |
57864 | + else | |
57865 | + dest = mod->module_init_rx | |
57866 | + + (shdr->sh_entsize & ~INIT_OFFSET_MASK); | |
57867 | + } else { | |
57868 | + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC)) | |
57869 | + dest = mod->module_core_rw + shdr->sh_entsize; | |
57870 | + else | |
57871 | + dest = mod->module_core_rx + shdr->sh_entsize; | |
57872 | + } | |
57873 | + | |
57874 | + if (shdr->sh_type != SHT_NOBITS) { | |
57875 | + | |
57876 | +#ifdef CONFIG_PAX_KERNEXEC | |
57877 | +#ifdef CONFIG_X86_64 | |
57878 | + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR)) | |
57879 | + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT); | |
57880 | +#endif | |
57881 | + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) { | |
57882 | + pax_open_kernel(); | |
57883 | + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size); | |
57884 | + pax_close_kernel(); | |
57885 | + } else | |
57886 | +#endif | |
57887 | ||
57888 | - if (shdr->sh_type != SHT_NOBITS) | |
57889 | memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size); | |
57890 | + } | |
57891 | /* Update sh_addr to point to copy in image. */ | |
57892 | - shdr->sh_addr = (unsigned long)dest; | |
57893 | + | |
57894 | +#ifdef CONFIG_PAX_KERNEXEC | |
57895 | + if (shdr->sh_flags & SHF_EXECINSTR) | |
57896 | + shdr->sh_addr = ktva_ktla((unsigned long)dest); | |
57897 | + else | |
57898 | +#endif | |
57899 | + | |
57900 | + shdr->sh_addr = (unsigned long)dest; | |
57901 | DEBUGP("\t0x%lx %s\n", | |
57902 | shdr->sh_addr, info->secstrings + shdr->sh_name); | |
57903 | } | |
57904 | @@ -2635,12 +2728,12 @@ static void flush_module_icache(const st | |
57905 | * Do it before processing of module parameters, so the module | |
57906 | * can provide parameter accessor functions of its own. | |
57907 | */ | |
57908 | - if (mod->module_init) | |
57909 | - flush_icache_range((unsigned long)mod->module_init, | |
57910 | - (unsigned long)mod->module_init | |
57911 | - + mod->init_size); | |
57912 | - flush_icache_range((unsigned long)mod->module_core, | |
57913 | - (unsigned long)mod->module_core + mod->core_size); | |
57914 | + if (mod->module_init_rx) | |
57915 | + flush_icache_range((unsigned long)mod->module_init_rx, | |
57916 | + (unsigned long)mod->module_init_rx | |
57917 | + + mod->init_size_rx); | |
57918 | + flush_icache_range((unsigned long)mod->module_core_rx, | |
57919 | + (unsigned long)mod->module_core_rx + mod->core_size_rx); | |
57920 | ||
57921 | set_fs(old_fs); | |
57922 | } | |
57923 | @@ -2712,8 +2805,10 @@ static void module_deallocate(struct mod | |
57924 | { | |
57925 | kfree(info->strmap); | |
57926 | percpu_modfree(mod); | |
57927 | - module_free(mod, mod->module_init); | |
57928 | - module_free(mod, mod->module_core); | |
57929 | + module_free_exec(mod, mod->module_init_rx); | |
57930 | + module_free_exec(mod, mod->module_core_rx); | |
57931 | + module_free(mod, mod->module_init_rw); | |
57932 | + module_free(mod, mod->module_core_rw); | |
57933 | } | |
57934 | ||
57935 | static int post_relocation(struct module *mod, const struct load_info *info) | |
57936 | @@ -2770,9 +2865,38 @@ static struct module *load_module(void _ | |
57937 | if (err) | |
57938 | goto free_unload; | |
57939 | ||
57940 | + /* Now copy in args */ | |
57941 | + mod->args = strndup_user(uargs, ~0UL >> 1); | |
57942 | + if (IS_ERR(mod->args)) { | |
57943 | + err = PTR_ERR(mod->args); | |
57944 | + goto free_unload; | |
57945 | + } | |
57946 | + | |
57947 | /* Set up MODINFO_ATTR fields */ | |
57948 | setup_modinfo(mod, &info); | |
57949 | ||
57950 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
57951 | + { | |
57952 | + char *p, *p2; | |
57953 | + | |
57954 | + if (strstr(mod->args, "grsec_modharden_netdev")) { | |
57955 | + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name); | |
57956 | + err = -EPERM; | |
57957 | + goto free_modinfo; | |
57958 | + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) { | |
57959 | + p += strlen("grsec_modharden_normal"); | |
57960 | + p2 = strstr(p, "_"); | |
57961 | + if (p2) { | |
57962 | + *p2 = '\0'; | |
57963 | + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p); | |
57964 | + *p2 = '_'; | |
57965 | + } | |
57966 | + err = -EPERM; | |
57967 | + goto free_modinfo; | |
57968 | + } | |
57969 | + } | |
57970 | +#endif | |
57971 | + | |
57972 | /* Fix up syms, so that st_value is a pointer to location. */ | |
57973 | err = simplify_symbols(mod, &info); | |
57974 | if (err < 0) | |
57975 | @@ -2788,13 +2912,6 @@ static struct module *load_module(void _ | |
57976 | ||
57977 | flush_module_icache(mod); | |
57978 | ||
57979 | - /* Now copy in args */ | |
57980 | - mod->args = strndup_user(uargs, ~0UL >> 1); | |
57981 | - if (IS_ERR(mod->args)) { | |
57982 | - err = PTR_ERR(mod->args); | |
57983 | - goto free_arch_cleanup; | |
57984 | - } | |
57985 | - | |
57986 | /* Mark state as coming so strong_try_module_get() ignores us. */ | |
57987 | mod->state = MODULE_STATE_COMING; | |
57988 | ||
57989 | @@ -2854,11 +2971,10 @@ static struct module *load_module(void _ | |
57990 | unlock: | |
57991 | mutex_unlock(&module_mutex); | |
57992 | synchronize_sched(); | |
57993 | - kfree(mod->args); | |
57994 | - free_arch_cleanup: | |
57995 | module_arch_cleanup(mod); | |
57996 | free_modinfo: | |
57997 | free_modinfo(mod); | |
57998 | + kfree(mod->args); | |
57999 | free_unload: | |
58000 | module_unload_free(mod); | |
58001 | free_module: | |
58002 | @@ -2899,16 +3015,16 @@ SYSCALL_DEFINE3(init_module, void __user | |
58003 | MODULE_STATE_COMING, mod); | |
58004 | ||
58005 | /* Set RO and NX regions for core */ | |
58006 | - set_section_ro_nx(mod->module_core, | |
58007 | - mod->core_text_size, | |
58008 | - mod->core_ro_size, | |
58009 | - mod->core_size); | |
58010 | + set_section_ro_nx(mod->module_core_rx, | |
58011 | + mod->core_size_rx, | |
58012 | + mod->core_size_rx, | |
58013 | + mod->core_size_rx); | |
58014 | ||
58015 | /* Set RO and NX regions for init */ | |
58016 | - set_section_ro_nx(mod->module_init, | |
58017 | - mod->init_text_size, | |
58018 | - mod->init_ro_size, | |
58019 | - mod->init_size); | |
58020 | + set_section_ro_nx(mod->module_init_rx, | |
58021 | + mod->init_size_rx, | |
58022 | + mod->init_size_rx, | |
58023 | + mod->init_size_rx); | |
58024 | ||
58025 | do_mod_ctors(mod); | |
58026 | /* Start the module */ | |
58027 | @@ -2954,11 +3070,12 @@ SYSCALL_DEFINE3(init_module, void __user | |
58028 | mod->strtab = mod->core_strtab; | |
58029 | #endif | |
58030 | unset_module_init_ro_nx(mod); | |
58031 | - module_free(mod, mod->module_init); | |
58032 | - mod->module_init = NULL; | |
58033 | - mod->init_size = 0; | |
58034 | - mod->init_ro_size = 0; | |
58035 | - mod->init_text_size = 0; | |
58036 | + module_free(mod, mod->module_init_rw); | |
58037 | + module_free_exec(mod, mod->module_init_rx); | |
58038 | + mod->module_init_rw = NULL; | |
58039 | + mod->module_init_rx = NULL; | |
58040 | + mod->init_size_rw = 0; | |
58041 | + mod->init_size_rx = 0; | |
58042 | mutex_unlock(&module_mutex); | |
58043 | ||
58044 | return 0; | |
58045 | @@ -2989,10 +3106,16 @@ static const char *get_ksymbol(struct mo | |
58046 | unsigned long nextval; | |
58047 | ||
58048 | /* At worse, next value is at end of module */ | |
58049 | - if (within_module_init(addr, mod)) | |
58050 | - nextval = (unsigned long)mod->module_init+mod->init_text_size; | |
58051 | + if (within_module_init_rx(addr, mod)) | |
58052 | + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx; | |
58053 | + else if (within_module_init_rw(addr, mod)) | |
58054 | + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw; | |
58055 | + else if (within_module_core_rx(addr, mod)) | |
58056 | + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx; | |
58057 | + else if (within_module_core_rw(addr, mod)) | |
58058 | + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw; | |
58059 | else | |
58060 | - nextval = (unsigned long)mod->module_core+mod->core_text_size; | |
58061 | + return NULL; | |
58062 | ||
58063 | /* Scan for closest preceding symbol, and next symbol. (ELF | |
58064 | starts real symbols at 1). */ | |
58065 | @@ -3238,7 +3361,7 @@ static int m_show(struct seq_file *m, vo | |
58066 | char buf[8]; | |
58067 | ||
58068 | seq_printf(m, "%s %u", | |
58069 | - mod->name, mod->init_size + mod->core_size); | |
58070 | + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw); | |
58071 | print_unload_info(m, mod); | |
58072 | ||
58073 | /* Informative for users. */ | |
58074 | @@ -3247,7 +3370,7 @@ static int m_show(struct seq_file *m, vo | |
58075 | mod->state == MODULE_STATE_COMING ? "Loading": | |
58076 | "Live"); | |
58077 | /* Used by oprofile and other similar tools. */ | |
58078 | - seq_printf(m, " 0x%pK", mod->module_core); | |
58079 | + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw); | |
58080 | ||
58081 | /* Taints info */ | |
58082 | if (mod->taints) | |
58083 | @@ -3283,7 +3406,17 @@ static const struct file_operations proc | |
58084 | ||
58085 | static int __init proc_modules_init(void) | |
58086 | { | |
58087 | +#ifndef CONFIG_GRKERNSEC_HIDESYM | |
58088 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
58089 | + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations); | |
58090 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
58091 | + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations); | |
58092 | +#else | |
58093 | proc_create("modules", 0, NULL, &proc_modules_operations); | |
58094 | +#endif | |
58095 | +#else | |
58096 | + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations); | |
58097 | +#endif | |
58098 | return 0; | |
58099 | } | |
58100 | module_init(proc_modules_init); | |
58101 | @@ -3342,12 +3475,12 @@ struct module *__module_address(unsigned | |
58102 | { | |
58103 | struct module *mod; | |
58104 | ||
58105 | - if (addr < module_addr_min || addr > module_addr_max) | |
58106 | + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) && | |
58107 | + (addr < module_addr_min_rw || addr > module_addr_max_rw)) | |
58108 | return NULL; | |
58109 | ||
58110 | list_for_each_entry_rcu(mod, &modules, list) | |
58111 | - if (within_module_core(addr, mod) | |
58112 | - || within_module_init(addr, mod)) | |
58113 | + if (within_module_init(addr, mod) || within_module_core(addr, mod)) | |
58114 | return mod; | |
58115 | return NULL; | |
58116 | } | |
58117 | @@ -3381,11 +3514,20 @@ bool is_module_text_address(unsigned lon | |
58118 | */ | |
58119 | struct module *__module_text_address(unsigned long addr) | |
58120 | { | |
58121 | - struct module *mod = __module_address(addr); | |
58122 | + struct module *mod; | |
58123 | + | |
58124 | +#ifdef CONFIG_X86_32 | |
58125 | + addr = ktla_ktva(addr); | |
58126 | +#endif | |
58127 | + | |
58128 | + if (addr < module_addr_min_rx || addr > module_addr_max_rx) | |
58129 | + return NULL; | |
58130 | + | |
58131 | + mod = __module_address(addr); | |
58132 | + | |
58133 | if (mod) { | |
58134 | /* Make sure it's within the text section. */ | |
58135 | - if (!within(addr, mod->module_init, mod->init_text_size) | |
58136 | - && !within(addr, mod->module_core, mod->core_text_size)) | |
58137 | + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod)) | |
58138 | mod = NULL; | |
58139 | } | |
58140 | return mod; | |
58141 | diff -urNp linux-3.0.3/kernel/mutex.c linux-3.0.3/kernel/mutex.c | |
58142 | --- linux-3.0.3/kernel/mutex.c 2011-07-21 22:17:23.000000000 -0400 | |
58143 | +++ linux-3.0.3/kernel/mutex.c 2011-08-23 21:47:56.000000000 -0400 | |
58144 | @@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, | |
58145 | spin_lock_mutex(&lock->wait_lock, flags); | |
58146 | ||
58147 | debug_mutex_lock_common(lock, &waiter); | |
58148 | - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task)); | |
58149 | + debug_mutex_add_waiter(lock, &waiter, task); | |
58150 | ||
58151 | /* add waiting tasks to the end of the waitqueue (FIFO): */ | |
58152 | list_add_tail(&waiter.list, &lock->wait_list); | |
58153 | @@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, | |
58154 | * TASK_UNINTERRUPTIBLE case.) | |
58155 | */ | |
58156 | if (unlikely(signal_pending_state(state, task))) { | |
58157 | - mutex_remove_waiter(lock, &waiter, | |
58158 | - task_thread_info(task)); | |
58159 | + mutex_remove_waiter(lock, &waiter, task); | |
58160 | mutex_release(&lock->dep_map, 1, ip); | |
58161 | spin_unlock_mutex(&lock->wait_lock, flags); | |
58162 | ||
58163 | @@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock, | |
58164 | done: | |
58165 | lock_acquired(&lock->dep_map, ip); | |
58166 | /* got the lock - rejoice! */ | |
58167 | - mutex_remove_waiter(lock, &waiter, current_thread_info()); | |
58168 | + mutex_remove_waiter(lock, &waiter, task); | |
58169 | mutex_set_owner(lock); | |
58170 | ||
58171 | /* set it to 0 if there are no waiters left: */ | |
58172 | diff -urNp linux-3.0.3/kernel/mutex-debug.c linux-3.0.3/kernel/mutex-debug.c | |
58173 | --- linux-3.0.3/kernel/mutex-debug.c 2011-07-21 22:17:23.000000000 -0400 | |
58174 | +++ linux-3.0.3/kernel/mutex-debug.c 2011-08-23 21:47:56.000000000 -0400 | |
58175 | @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute | |
58176 | } | |
58177 | ||
58178 | void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, | |
58179 | - struct thread_info *ti) | |
58180 | + struct task_struct *task) | |
58181 | { | |
58182 | SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock)); | |
58183 | ||
58184 | /* Mark the current thread as blocked on the lock: */ | |
58185 | - ti->task->blocked_on = waiter; | |
58186 | + task->blocked_on = waiter; | |
58187 | } | |
58188 | ||
58189 | void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, | |
58190 | - struct thread_info *ti) | |
58191 | + struct task_struct *task) | |
58192 | { | |
58193 | DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list)); | |
58194 | - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task); | |
58195 | - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter); | |
58196 | - ti->task->blocked_on = NULL; | |
58197 | + DEBUG_LOCKS_WARN_ON(waiter->task != task); | |
58198 | + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter); | |
58199 | + task->blocked_on = NULL; | |
58200 | ||
58201 | list_del_init(&waiter->list); | |
58202 | waiter->task = NULL; | |
58203 | diff -urNp linux-3.0.3/kernel/mutex-debug.h linux-3.0.3/kernel/mutex-debug.h | |
58204 | --- linux-3.0.3/kernel/mutex-debug.h 2011-07-21 22:17:23.000000000 -0400 | |
58205 | +++ linux-3.0.3/kernel/mutex-debug.h 2011-08-23 21:47:56.000000000 -0400 | |
58206 | @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(stru | |
58207 | extern void debug_mutex_free_waiter(struct mutex_waiter *waiter); | |
58208 | extern void debug_mutex_add_waiter(struct mutex *lock, | |
58209 | struct mutex_waiter *waiter, | |
58210 | - struct thread_info *ti); | |
58211 | + struct task_struct *task); | |
58212 | extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, | |
58213 | - struct thread_info *ti); | |
58214 | + struct task_struct *task); | |
58215 | extern void debug_mutex_unlock(struct mutex *lock); | |
58216 | extern void debug_mutex_init(struct mutex *lock, const char *name, | |
58217 | struct lock_class_key *key); | |
58218 | diff -urNp linux-3.0.3/kernel/padata.c linux-3.0.3/kernel/padata.c | |
58219 | --- linux-3.0.3/kernel/padata.c 2011-07-21 22:17:23.000000000 -0400 | |
58220 | +++ linux-3.0.3/kernel/padata.c 2011-08-23 21:47:56.000000000 -0400 | |
58221 | @@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins | |
58222 | padata->pd = pd; | |
58223 | padata->cb_cpu = cb_cpu; | |
58224 | ||
58225 | - if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr)) | |
58226 | - atomic_set(&pd->seq_nr, -1); | |
58227 | + if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr)) | |
58228 | + atomic_set_unchecked(&pd->seq_nr, -1); | |
58229 | ||
58230 | - padata->seq_nr = atomic_inc_return(&pd->seq_nr); | |
58231 | + padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr); | |
58232 | ||
58233 | target_cpu = padata_cpu_hash(padata); | |
58234 | queue = per_cpu_ptr(pd->pqueue, target_cpu); | |
58235 | @@ -444,7 +444,7 @@ static struct parallel_data *padata_allo | |
58236 | padata_init_pqueues(pd); | |
58237 | padata_init_squeues(pd); | |
58238 | setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd); | |
58239 | - atomic_set(&pd->seq_nr, -1); | |
58240 | + atomic_set_unchecked(&pd->seq_nr, -1); | |
58241 | atomic_set(&pd->reorder_objects, 0); | |
58242 | atomic_set(&pd->refcnt, 0); | |
58243 | pd->pinst = pinst; | |
58244 | diff -urNp linux-3.0.3/kernel/panic.c linux-3.0.3/kernel/panic.c | |
58245 | --- linux-3.0.3/kernel/panic.c 2011-07-21 22:17:23.000000000 -0400 | |
58246 | +++ linux-3.0.3/kernel/panic.c 2011-08-23 21:48:14.000000000 -0400 | |
58247 | @@ -369,7 +369,7 @@ static void warn_slowpath_common(const c | |
58248 | const char *board; | |
58249 | ||
58250 | printk(KERN_WARNING "------------[ cut here ]------------\n"); | |
58251 | - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller); | |
58252 | + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller); | |
58253 | board = dmi_get_system_info(DMI_PRODUCT_NAME); | |
58254 | if (board) | |
58255 | printk(KERN_WARNING "Hardware name: %s\n", board); | |
58256 | @@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null); | |
58257 | */ | |
58258 | void __stack_chk_fail(void) | |
58259 | { | |
58260 | - panic("stack-protector: Kernel stack is corrupted in: %p\n", | |
58261 | + dump_stack(); | |
58262 | + panic("stack-protector: Kernel stack is corrupted in: %pA\n", | |
58263 | __builtin_return_address(0)); | |
58264 | } | |
58265 | EXPORT_SYMBOL(__stack_chk_fail); | |
58266 | diff -urNp linux-3.0.3/kernel/pid.c linux-3.0.3/kernel/pid.c | |
58267 | --- linux-3.0.3/kernel/pid.c 2011-07-21 22:17:23.000000000 -0400 | |
58268 | +++ linux-3.0.3/kernel/pid.c 2011-08-23 21:48:14.000000000 -0400 | |
58269 | @@ -33,6 +33,7 @@ | |
58270 | #include <linux/rculist.h> | |
58271 | #include <linux/bootmem.h> | |
58272 | #include <linux/hash.h> | |
58273 | +#include <linux/security.h> | |
58274 | #include <linux/pid_namespace.h> | |
58275 | #include <linux/init_task.h> | |
58276 | #include <linux/syscalls.h> | |
58277 | @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT | |
58278 | ||
58279 | int pid_max = PID_MAX_DEFAULT; | |
58280 | ||
58281 | -#define RESERVED_PIDS 300 | |
58282 | +#define RESERVED_PIDS 500 | |
58283 | ||
58284 | int pid_max_min = RESERVED_PIDS + 1; | |
58285 | int pid_max_max = PID_MAX_LIMIT; | |
58286 | @@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task); | |
58287 | */ | |
58288 | struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns) | |
58289 | { | |
58290 | + struct task_struct *task; | |
58291 | + | |
58292 | rcu_lockdep_assert(rcu_read_lock_held()); | |
58293 | - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID); | |
58294 | + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID); | |
58295 | + | |
58296 | + if (gr_pid_is_chrooted(task)) | |
58297 | + return NULL; | |
58298 | + | |
58299 | + return task; | |
58300 | } | |
58301 | ||
58302 | struct task_struct *find_task_by_vpid(pid_t vnr) | |
58303 | @@ -428,6 +436,12 @@ struct task_struct *find_task_by_vpid(pi | |
58304 | return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns); | |
58305 | } | |
58306 | ||
58307 | +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr) | |
58308 | +{ | |
58309 | + rcu_lockdep_assert(rcu_read_lock_held()); | |
58310 | + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID); | |
58311 | +} | |
58312 | + | |
58313 | struct pid *get_task_pid(struct task_struct *task, enum pid_type type) | |
58314 | { | |
58315 | struct pid *pid; | |
58316 | diff -urNp linux-3.0.3/kernel/posix-cpu-timers.c linux-3.0.3/kernel/posix-cpu-timers.c | |
58317 | --- linux-3.0.3/kernel/posix-cpu-timers.c 2011-07-21 22:17:23.000000000 -0400 | |
58318 | +++ linux-3.0.3/kernel/posix-cpu-timers.c 2011-08-23 21:48:14.000000000 -0400 | |
58319 | @@ -6,6 +6,7 @@ | |
58320 | #include <linux/posix-timers.h> | |
58321 | #include <linux/errno.h> | |
58322 | #include <linux/math64.h> | |
58323 | +#include <linux/security.h> | |
58324 | #include <asm/uaccess.h> | |
58325 | #include <linux/kernel_stat.h> | |
58326 | #include <trace/events/timer.h> | |
58327 | @@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = { | |
58328 | ||
58329 | static __init int init_posix_cpu_timers(void) | |
58330 | { | |
58331 | - struct k_clock process = { | |
58332 | + static struct k_clock process = { | |
58333 | .clock_getres = process_cpu_clock_getres, | |
58334 | .clock_get = process_cpu_clock_get, | |
58335 | .timer_create = process_cpu_timer_create, | |
58336 | .nsleep = process_cpu_nsleep, | |
58337 | .nsleep_restart = process_cpu_nsleep_restart, | |
58338 | }; | |
58339 | - struct k_clock thread = { | |
58340 | + static struct k_clock thread = { | |
58341 | .clock_getres = thread_cpu_clock_getres, | |
58342 | .clock_get = thread_cpu_clock_get, | |
58343 | .timer_create = thread_cpu_timer_create, | |
58344 | diff -urNp linux-3.0.3/kernel/posix-timers.c linux-3.0.3/kernel/posix-timers.c | |
58345 | --- linux-3.0.3/kernel/posix-timers.c 2011-07-21 22:17:23.000000000 -0400 | |
58346 | +++ linux-3.0.3/kernel/posix-timers.c 2011-08-23 21:48:14.000000000 -0400 | |
58347 | @@ -43,6 +43,7 @@ | |
58348 | #include <linux/idr.h> | |
58349 | #include <linux/posix-clock.h> | |
58350 | #include <linux/posix-timers.h> | |
58351 | +#include <linux/grsecurity.h> | |
58352 | #include <linux/syscalls.h> | |
58353 | #include <linux/wait.h> | |
58354 | #include <linux/workqueue.h> | |
58355 | @@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock); | |
58356 | * which we beg off on and pass to do_sys_settimeofday(). | |
58357 | */ | |
58358 | ||
58359 | -static struct k_clock posix_clocks[MAX_CLOCKS]; | |
58360 | +static struct k_clock *posix_clocks[MAX_CLOCKS]; | |
58361 | ||
58362 | /* | |
58363 | * These ones are defined below. | |
58364 | @@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc | |
58365 | */ | |
58366 | static __init int init_posix_timers(void) | |
58367 | { | |
58368 | - struct k_clock clock_realtime = { | |
58369 | + static struct k_clock clock_realtime = { | |
58370 | .clock_getres = hrtimer_get_res, | |
58371 | .clock_get = posix_clock_realtime_get, | |
58372 | .clock_set = posix_clock_realtime_set, | |
58373 | @@ -239,7 +240,7 @@ static __init int init_posix_timers(void | |
58374 | .timer_get = common_timer_get, | |
58375 | .timer_del = common_timer_del, | |
58376 | }; | |
58377 | - struct k_clock clock_monotonic = { | |
58378 | + static struct k_clock clock_monotonic = { | |
58379 | .clock_getres = hrtimer_get_res, | |
58380 | .clock_get = posix_ktime_get_ts, | |
58381 | .nsleep = common_nsleep, | |
58382 | @@ -249,19 +250,19 @@ static __init int init_posix_timers(void | |
58383 | .timer_get = common_timer_get, | |
58384 | .timer_del = common_timer_del, | |
58385 | }; | |
58386 | - struct k_clock clock_monotonic_raw = { | |
58387 | + static struct k_clock clock_monotonic_raw = { | |
58388 | .clock_getres = hrtimer_get_res, | |
58389 | .clock_get = posix_get_monotonic_raw, | |
58390 | }; | |
58391 | - struct k_clock clock_realtime_coarse = { | |
58392 | + static struct k_clock clock_realtime_coarse = { | |
58393 | .clock_getres = posix_get_coarse_res, | |
58394 | .clock_get = posix_get_realtime_coarse, | |
58395 | }; | |
58396 | - struct k_clock clock_monotonic_coarse = { | |
58397 | + static struct k_clock clock_monotonic_coarse = { | |
58398 | .clock_getres = posix_get_coarse_res, | |
58399 | .clock_get = posix_get_monotonic_coarse, | |
58400 | }; | |
58401 | - struct k_clock clock_boottime = { | |
58402 | + static struct k_clock clock_boottime = { | |
58403 | .clock_getres = hrtimer_get_res, | |
58404 | .clock_get = posix_get_boottime, | |
58405 | .nsleep = common_nsleep, | |
58406 | @@ -272,6 +273,8 @@ static __init int init_posix_timers(void | |
58407 | .timer_del = common_timer_del, | |
58408 | }; | |
58409 | ||
58410 | + pax_track_stack(); | |
58411 | + | |
58412 | posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime); | |
58413 | posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic); | |
58414 | posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw); | |
58415 | @@ -473,7 +476,7 @@ void posix_timers_register_clock(const c | |
58416 | return; | |
58417 | } | |
58418 | ||
58419 | - posix_clocks[clock_id] = *new_clock; | |
58420 | + posix_clocks[clock_id] = new_clock; | |
58421 | } | |
58422 | EXPORT_SYMBOL_GPL(posix_timers_register_clock); | |
58423 | ||
58424 | @@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock | |
58425 | return (id & CLOCKFD_MASK) == CLOCKFD ? | |
58426 | &clock_posix_dynamic : &clock_posix_cpu; | |
58427 | ||
58428 | - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres) | |
58429 | + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres) | |
58430 | return NULL; | |
58431 | - return &posix_clocks[id]; | |
58432 | + return posix_clocks[id]; | |
58433 | } | |
58434 | ||
58435 | static int common_timer_create(struct k_itimer *new_timer) | |
58436 | @@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clo | |
58437 | if (copy_from_user(&new_tp, tp, sizeof (*tp))) | |
58438 | return -EFAULT; | |
58439 | ||
58440 | + /* only the CLOCK_REALTIME clock can be set, all other clocks | |
58441 | + have their clock_set fptr set to a nosettime dummy function | |
58442 | + CLOCK_REALTIME has a NULL clock_set fptr which causes it to | |
58443 | + call common_clock_set, which calls do_sys_settimeofday, which | |
58444 | + we hook | |
58445 | + */ | |
58446 | + | |
58447 | return kc->clock_set(which_clock, &new_tp); | |
58448 | } | |
58449 | ||
58450 | diff -urNp linux-3.0.3/kernel/power/poweroff.c linux-3.0.3/kernel/power/poweroff.c | |
58451 | --- linux-3.0.3/kernel/power/poweroff.c 2011-07-21 22:17:23.000000000 -0400 | |
58452 | +++ linux-3.0.3/kernel/power/poweroff.c 2011-08-23 21:47:56.000000000 -0400 | |
58453 | @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof | |
58454 | .enable_mask = SYSRQ_ENABLE_BOOT, | |
58455 | }; | |
58456 | ||
58457 | -static int pm_sysrq_init(void) | |
58458 | +static int __init pm_sysrq_init(void) | |
58459 | { | |
58460 | register_sysrq_key('o', &sysrq_poweroff_op); | |
58461 | return 0; | |
58462 | diff -urNp linux-3.0.3/kernel/power/process.c linux-3.0.3/kernel/power/process.c | |
58463 | --- linux-3.0.3/kernel/power/process.c 2011-07-21 22:17:23.000000000 -0400 | |
58464 | +++ linux-3.0.3/kernel/power/process.c 2011-08-23 21:47:56.000000000 -0400 | |
58465 | @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_ | |
58466 | u64 elapsed_csecs64; | |
58467 | unsigned int elapsed_csecs; | |
58468 | bool wakeup = false; | |
58469 | + bool timedout = false; | |
58470 | ||
58471 | do_gettimeofday(&start); | |
58472 | ||
58473 | @@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_ | |
58474 | ||
58475 | while (true) { | |
58476 | todo = 0; | |
58477 | + if (time_after(jiffies, end_time)) | |
58478 | + timedout = true; | |
58479 | read_lock(&tasklist_lock); | |
58480 | do_each_thread(g, p) { | |
58481 | if (frozen(p) || !freezable(p)) | |
58482 | @@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_ | |
58483 | * try_to_stop() after schedule() in ptrace/signal | |
58484 | * stop sees TIF_FREEZE. | |
58485 | */ | |
58486 | - if (!task_is_stopped_or_traced(p) && | |
58487 | - !freezer_should_skip(p)) | |
58488 | + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) { | |
58489 | todo++; | |
58490 | + if (timedout) { | |
58491 | + printk(KERN_ERR "Task refusing to freeze:\n"); | |
58492 | + sched_show_task(p); | |
58493 | + } | |
58494 | + } | |
58495 | } while_each_thread(g, p); | |
58496 | read_unlock(&tasklist_lock); | |
58497 | ||
58498 | @@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_ | |
58499 | todo += wq_busy; | |
58500 | } | |
58501 | ||
58502 | - if (!todo || time_after(jiffies, end_time)) | |
58503 | + if (!todo || timedout) | |
58504 | break; | |
58505 | ||
58506 | if (pm_wakeup_pending()) { | |
58507 | diff -urNp linux-3.0.3/kernel/printk.c linux-3.0.3/kernel/printk.c | |
58508 | --- linux-3.0.3/kernel/printk.c 2011-07-21 22:17:23.000000000 -0400 | |
58509 | +++ linux-3.0.3/kernel/printk.c 2011-08-23 21:48:14.000000000 -0400 | |
58510 | @@ -313,12 +313,17 @@ static int check_syslog_permissions(int | |
58511 | if (from_file && type != SYSLOG_ACTION_OPEN) | |
58512 | return 0; | |
58513 | ||
58514 | +#ifdef CONFIG_GRKERNSEC_DMESG | |
58515 | + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN)) | |
58516 | + return -EPERM; | |
58517 | +#endif | |
58518 | + | |
58519 | if (syslog_action_restricted(type)) { | |
58520 | if (capable(CAP_SYSLOG)) | |
58521 | return 0; | |
58522 | /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */ | |
58523 | if (capable(CAP_SYS_ADMIN)) { | |
58524 | - WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN " | |
58525 | + printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN " | |
58526 | "but no CAP_SYSLOG (deprecated).\n"); | |
58527 | return 0; | |
58528 | } | |
58529 | diff -urNp linux-3.0.3/kernel/profile.c linux-3.0.3/kernel/profile.c | |
58530 | --- linux-3.0.3/kernel/profile.c 2011-07-21 22:17:23.000000000 -0400 | |
58531 | +++ linux-3.0.3/kernel/profile.c 2011-08-23 21:47:56.000000000 -0400 | |
58532 | @@ -39,7 +39,7 @@ struct profile_hit { | |
58533 | /* Oprofile timer tick hook */ | |
58534 | static int (*timer_hook)(struct pt_regs *) __read_mostly; | |
58535 | ||
58536 | -static atomic_t *prof_buffer; | |
58537 | +static atomic_unchecked_t *prof_buffer; | |
58538 | static unsigned long prof_len, prof_shift; | |
58539 | ||
58540 | int prof_on __read_mostly; | |
58541 | @@ -281,7 +281,7 @@ static void profile_flip_buffers(void) | |
58542 | hits[i].pc = 0; | |
58543 | continue; | |
58544 | } | |
58545 | - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]); | |
58546 | + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]); | |
58547 | hits[i].hits = hits[i].pc = 0; | |
58548 | } | |
58549 | } | |
58550 | @@ -342,9 +342,9 @@ static void do_profile_hits(int type, vo | |
58551 | * Add the current hit(s) and flush the write-queue out | |
58552 | * to the global buffer: | |
58553 | */ | |
58554 | - atomic_add(nr_hits, &prof_buffer[pc]); | |
58555 | + atomic_add_unchecked(nr_hits, &prof_buffer[pc]); | |
58556 | for (i = 0; i < NR_PROFILE_HIT; ++i) { | |
58557 | - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]); | |
58558 | + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]); | |
58559 | hits[i].pc = hits[i].hits = 0; | |
58560 | } | |
58561 | out: | |
58562 | @@ -419,7 +419,7 @@ static void do_profile_hits(int type, vo | |
58563 | { | |
58564 | unsigned long pc; | |
58565 | pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift; | |
58566 | - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]); | |
58567 | + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]); | |
58568 | } | |
58569 | #endif /* !CONFIG_SMP */ | |
58570 | ||
58571 | @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u | |
58572 | return -EFAULT; | |
58573 | buf++; p++; count--; read++; | |
58574 | } | |
58575 | - pnt = (char *)prof_buffer + p - sizeof(atomic_t); | |
58576 | + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t); | |
58577 | if (copy_to_user(buf, (void *)pnt, count)) | |
58578 | return -EFAULT; | |
58579 | read += count; | |
58580 | @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file | |
58581 | } | |
58582 | #endif | |
58583 | profile_discard_flip_buffers(); | |
58584 | - memset(prof_buffer, 0, prof_len * sizeof(atomic_t)); | |
58585 | + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t)); | |
58586 | return count; | |
58587 | } | |
58588 | ||
58589 | diff -urNp linux-3.0.3/kernel/ptrace.c linux-3.0.3/kernel/ptrace.c | |
58590 | --- linux-3.0.3/kernel/ptrace.c 2011-07-21 22:17:23.000000000 -0400 | |
58591 | +++ linux-3.0.3/kernel/ptrace.c 2011-08-23 21:48:14.000000000 -0400 | |
58592 | @@ -132,7 +132,8 @@ int ptrace_check_attach(struct task_stru | |
58593 | return ret; | |
58594 | } | |
58595 | ||
58596 | -int __ptrace_may_access(struct task_struct *task, unsigned int mode) | |
58597 | +static int __ptrace_may_access(struct task_struct *task, unsigned int mode, | |
58598 | + unsigned int log) | |
58599 | { | |
58600 | const struct cred *cred = current_cred(), *tcred; | |
58601 | ||
58602 | @@ -158,7 +159,8 @@ int __ptrace_may_access(struct task_stru | |
58603 | cred->gid == tcred->sgid && | |
58604 | cred->gid == tcred->gid)) | |
58605 | goto ok; | |
58606 | - if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)) | |
58607 | + if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) || | |
58608 | + (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))) | |
58609 | goto ok; | |
58610 | rcu_read_unlock(); | |
58611 | return -EPERM; | |
58612 | @@ -167,7 +169,9 @@ ok: | |
58613 | smp_rmb(); | |
58614 | if (task->mm) | |
58615 | dumpable = get_dumpable(task->mm); | |
58616 | - if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE)) | |
58617 | + if (!dumpable && | |
58618 | + ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) || | |
58619 | + (log && !task_ns_capable(task, CAP_SYS_PTRACE)))) | |
58620 | return -EPERM; | |
58621 | ||
58622 | return security_ptrace_access_check(task, mode); | |
58623 | @@ -177,7 +181,16 @@ bool ptrace_may_access(struct task_struc | |
58624 | { | |
58625 | int err; | |
58626 | task_lock(task); | |
58627 | - err = __ptrace_may_access(task, mode); | |
58628 | + err = __ptrace_may_access(task, mode, 0); | |
58629 | + task_unlock(task); | |
58630 | + return !err; | |
58631 | +} | |
58632 | + | |
58633 | +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode) | |
58634 | +{ | |
58635 | + int err; | |
58636 | + task_lock(task); | |
58637 | + err = __ptrace_may_access(task, mode, 1); | |
58638 | task_unlock(task); | |
58639 | return !err; | |
58640 | } | |
58641 | @@ -205,7 +218,7 @@ static int ptrace_attach(struct task_str | |
58642 | goto out; | |
58643 | ||
58644 | task_lock(task); | |
58645 | - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH); | |
58646 | + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1); | |
58647 | task_unlock(task); | |
58648 | if (retval) | |
58649 | goto unlock_creds; | |
58650 | @@ -218,7 +231,7 @@ static int ptrace_attach(struct task_str | |
58651 | goto unlock_tasklist; | |
58652 | ||
58653 | task->ptrace = PT_PTRACED; | |
58654 | - if (task_ns_capable(task, CAP_SYS_PTRACE)) | |
58655 | + if (task_ns_capable_nolog(task, CAP_SYS_PTRACE)) | |
58656 | task->ptrace |= PT_PTRACE_CAP; | |
58657 | ||
58658 | __ptrace_link(task, current); | |
58659 | @@ -406,6 +419,8 @@ int ptrace_readdata(struct task_struct * | |
58660 | { | |
58661 | int copied = 0; | |
58662 | ||
58663 | + pax_track_stack(); | |
58664 | + | |
58665 | while (len > 0) { | |
58666 | char buf[128]; | |
58667 | int this_len, retval; | |
58668 | @@ -417,7 +432,7 @@ int ptrace_readdata(struct task_struct * | |
58669 | break; | |
58670 | return -EIO; | |
58671 | } | |
58672 | - if (copy_to_user(dst, buf, retval)) | |
58673 | + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval)) | |
58674 | return -EFAULT; | |
58675 | copied += retval; | |
58676 | src += retval; | |
58677 | @@ -431,6 +446,8 @@ int ptrace_writedata(struct task_struct | |
58678 | { | |
58679 | int copied = 0; | |
58680 | ||
58681 | + pax_track_stack(); | |
58682 | + | |
58683 | while (len > 0) { | |
58684 | char buf[128]; | |
58685 | int this_len, retval; | |
58686 | @@ -613,9 +630,11 @@ int ptrace_request(struct task_struct *c | |
58687 | { | |
58688 | int ret = -EIO; | |
58689 | siginfo_t siginfo; | |
58690 | - void __user *datavp = (void __user *) data; | |
58691 | + void __user *datavp = (__force void __user *) data; | |
58692 | unsigned long __user *datalp = datavp; | |
58693 | ||
58694 | + pax_track_stack(); | |
58695 | + | |
58696 | switch (request) { | |
58697 | case PTRACE_PEEKTEXT: | |
58698 | case PTRACE_PEEKDATA: | |
58699 | @@ -761,14 +780,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l | |
58700 | goto out; | |
58701 | } | |
58702 | ||
58703 | + if (gr_handle_ptrace(child, request)) { | |
58704 | + ret = -EPERM; | |
58705 | + goto out_put_task_struct; | |
58706 | + } | |
58707 | + | |
58708 | if (request == PTRACE_ATTACH) { | |
58709 | ret = ptrace_attach(child); | |
58710 | /* | |
58711 | * Some architectures need to do book-keeping after | |
58712 | * a ptrace attach. | |
58713 | */ | |
58714 | - if (!ret) | |
58715 | + if (!ret) { | |
58716 | arch_ptrace_attach(child); | |
58717 | + gr_audit_ptrace(child); | |
58718 | + } | |
58719 | goto out_put_task_struct; | |
58720 | } | |
58721 | ||
58722 | @@ -793,7 +819,7 @@ int generic_ptrace_peekdata(struct task_ | |
58723 | copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0); | |
58724 | if (copied != sizeof(tmp)) | |
58725 | return -EIO; | |
58726 | - return put_user(tmp, (unsigned long __user *)data); | |
58727 | + return put_user(tmp, (__force unsigned long __user *)data); | |
58728 | } | |
58729 | ||
58730 | int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, | |
58731 | @@ -816,6 +842,8 @@ int compat_ptrace_request(struct task_st | |
58732 | siginfo_t siginfo; | |
58733 | int ret; | |
58734 | ||
58735 | + pax_track_stack(); | |
58736 | + | |
58737 | switch (request) { | |
58738 | case PTRACE_PEEKTEXT: | |
58739 | case PTRACE_PEEKDATA: | |
58740 | @@ -903,14 +931,21 @@ asmlinkage long compat_sys_ptrace(compat | |
58741 | goto out; | |
58742 | } | |
58743 | ||
58744 | + if (gr_handle_ptrace(child, request)) { | |
58745 | + ret = -EPERM; | |
58746 | + goto out_put_task_struct; | |
58747 | + } | |
58748 | + | |
58749 | if (request == PTRACE_ATTACH) { | |
58750 | ret = ptrace_attach(child); | |
58751 | /* | |
58752 | * Some architectures need to do book-keeping after | |
58753 | * a ptrace attach. | |
58754 | */ | |
58755 | - if (!ret) | |
58756 | + if (!ret) { | |
58757 | arch_ptrace_attach(child); | |
58758 | + gr_audit_ptrace(child); | |
58759 | + } | |
58760 | goto out_put_task_struct; | |
58761 | } | |
58762 | ||
58763 | diff -urNp linux-3.0.3/kernel/rcutorture.c linux-3.0.3/kernel/rcutorture.c | |
58764 | --- linux-3.0.3/kernel/rcutorture.c 2011-07-21 22:17:23.000000000 -0400 | |
58765 | +++ linux-3.0.3/kernel/rcutorture.c 2011-08-23 21:47:56.000000000 -0400 | |
58766 | @@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_ | |
58767 | { 0 }; | |
58768 | static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) = | |
58769 | { 0 }; | |
58770 | -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1]; | |
58771 | -static atomic_t n_rcu_torture_alloc; | |
58772 | -static atomic_t n_rcu_torture_alloc_fail; | |
58773 | -static atomic_t n_rcu_torture_free; | |
58774 | -static atomic_t n_rcu_torture_mberror; | |
58775 | -static atomic_t n_rcu_torture_error; | |
58776 | +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1]; | |
58777 | +static atomic_unchecked_t n_rcu_torture_alloc; | |
58778 | +static atomic_unchecked_t n_rcu_torture_alloc_fail; | |
58779 | +static atomic_unchecked_t n_rcu_torture_free; | |
58780 | +static atomic_unchecked_t n_rcu_torture_mberror; | |
58781 | +static atomic_unchecked_t n_rcu_torture_error; | |
58782 | static long n_rcu_torture_boost_ktrerror; | |
58783 | static long n_rcu_torture_boost_rterror; | |
58784 | static long n_rcu_torture_boost_failure; | |
58785 | @@ -223,11 +223,11 @@ rcu_torture_alloc(void) | |
58786 | ||
58787 | spin_lock_bh(&rcu_torture_lock); | |
58788 | if (list_empty(&rcu_torture_freelist)) { | |
58789 | - atomic_inc(&n_rcu_torture_alloc_fail); | |
58790 | + atomic_inc_unchecked(&n_rcu_torture_alloc_fail); | |
58791 | spin_unlock_bh(&rcu_torture_lock); | |
58792 | return NULL; | |
58793 | } | |
58794 | - atomic_inc(&n_rcu_torture_alloc); | |
58795 | + atomic_inc_unchecked(&n_rcu_torture_alloc); | |
58796 | p = rcu_torture_freelist.next; | |
58797 | list_del_init(p); | |
58798 | spin_unlock_bh(&rcu_torture_lock); | |
58799 | @@ -240,7 +240,7 @@ rcu_torture_alloc(void) | |
58800 | static void | |
58801 | rcu_torture_free(struct rcu_torture *p) | |
58802 | { | |
58803 | - atomic_inc(&n_rcu_torture_free); | |
58804 | + atomic_inc_unchecked(&n_rcu_torture_free); | |
58805 | spin_lock_bh(&rcu_torture_lock); | |
58806 | list_add_tail(&p->rtort_free, &rcu_torture_freelist); | |
58807 | spin_unlock_bh(&rcu_torture_lock); | |
58808 | @@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p) | |
58809 | i = rp->rtort_pipe_count; | |
58810 | if (i > RCU_TORTURE_PIPE_LEN) | |
58811 | i = RCU_TORTURE_PIPE_LEN; | |
58812 | - atomic_inc(&rcu_torture_wcount[i]); | |
58813 | + atomic_inc_unchecked(&rcu_torture_wcount[i]); | |
58814 | if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) { | |
58815 | rp->rtort_mbtest = 0; | |
58816 | rcu_torture_free(rp); | |
58817 | @@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_fr | |
58818 | i = rp->rtort_pipe_count; | |
58819 | if (i > RCU_TORTURE_PIPE_LEN) | |
58820 | i = RCU_TORTURE_PIPE_LEN; | |
58821 | - atomic_inc(&rcu_torture_wcount[i]); | |
58822 | + atomic_inc_unchecked(&rcu_torture_wcount[i]); | |
58823 | if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) { | |
58824 | rp->rtort_mbtest = 0; | |
58825 | list_del(&rp->rtort_free); | |
58826 | @@ -882,7 +882,7 @@ rcu_torture_writer(void *arg) | |
58827 | i = old_rp->rtort_pipe_count; | |
58828 | if (i > RCU_TORTURE_PIPE_LEN) | |
58829 | i = RCU_TORTURE_PIPE_LEN; | |
58830 | - atomic_inc(&rcu_torture_wcount[i]); | |
58831 | + atomic_inc_unchecked(&rcu_torture_wcount[i]); | |
58832 | old_rp->rtort_pipe_count++; | |
58833 | cur_ops->deferred_free(old_rp); | |
58834 | } | |
58835 | @@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l | |
58836 | return; | |
58837 | } | |
58838 | if (p->rtort_mbtest == 0) | |
58839 | - atomic_inc(&n_rcu_torture_mberror); | |
58840 | + atomic_inc_unchecked(&n_rcu_torture_mberror); | |
58841 | spin_lock(&rand_lock); | |
58842 | cur_ops->read_delay(&rand); | |
58843 | n_rcu_torture_timers++; | |
58844 | @@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg) | |
58845 | continue; | |
58846 | } | |
58847 | if (p->rtort_mbtest == 0) | |
58848 | - atomic_inc(&n_rcu_torture_mberror); | |
58849 | + atomic_inc_unchecked(&n_rcu_torture_mberror); | |
58850 | cur_ops->read_delay(&rand); | |
58851 | preempt_disable(); | |
58852 | pipe_count = p->rtort_pipe_count; | |
58853 | @@ -1072,16 +1072,16 @@ rcu_torture_printk(char *page) | |
58854 | rcu_torture_current, | |
58855 | rcu_torture_current_version, | |
58856 | list_empty(&rcu_torture_freelist), | |
58857 | - atomic_read(&n_rcu_torture_alloc), | |
58858 | - atomic_read(&n_rcu_torture_alloc_fail), | |
58859 | - atomic_read(&n_rcu_torture_free), | |
58860 | - atomic_read(&n_rcu_torture_mberror), | |
58861 | + atomic_read_unchecked(&n_rcu_torture_alloc), | |
58862 | + atomic_read_unchecked(&n_rcu_torture_alloc_fail), | |
58863 | + atomic_read_unchecked(&n_rcu_torture_free), | |
58864 | + atomic_read_unchecked(&n_rcu_torture_mberror), | |
58865 | n_rcu_torture_boost_ktrerror, | |
58866 | n_rcu_torture_boost_rterror, | |
58867 | n_rcu_torture_boost_failure, | |
58868 | n_rcu_torture_boosts, | |
58869 | n_rcu_torture_timers); | |
58870 | - if (atomic_read(&n_rcu_torture_mberror) != 0 || | |
58871 | + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 || | |
58872 | n_rcu_torture_boost_ktrerror != 0 || | |
58873 | n_rcu_torture_boost_rterror != 0 || | |
58874 | n_rcu_torture_boost_failure != 0) | |
58875 | @@ -1089,7 +1089,7 @@ rcu_torture_printk(char *page) | |
58876 | cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG); | |
58877 | if (i > 1) { | |
58878 | cnt += sprintf(&page[cnt], "!!! "); | |
58879 | - atomic_inc(&n_rcu_torture_error); | |
58880 | + atomic_inc_unchecked(&n_rcu_torture_error); | |
58881 | WARN_ON_ONCE(1); | |
58882 | } | |
58883 | cnt += sprintf(&page[cnt], "Reader Pipe: "); | |
58884 | @@ -1103,7 +1103,7 @@ rcu_torture_printk(char *page) | |
58885 | cnt += sprintf(&page[cnt], "Free-Block Circulation: "); | |
58886 | for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) { | |
58887 | cnt += sprintf(&page[cnt], " %d", | |
58888 | - atomic_read(&rcu_torture_wcount[i])); | |
58889 | + atomic_read_unchecked(&rcu_torture_wcount[i])); | |
58890 | } | |
58891 | cnt += sprintf(&page[cnt], "\n"); | |
58892 | if (cur_ops->stats) | |
58893 | @@ -1412,7 +1412,7 @@ rcu_torture_cleanup(void) | |
58894 | ||
58895 | if (cur_ops->cleanup) | |
58896 | cur_ops->cleanup(); | |
58897 | - if (atomic_read(&n_rcu_torture_error)) | |
58898 | + if (atomic_read_unchecked(&n_rcu_torture_error)) | |
58899 | rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE"); | |
58900 | else | |
58901 | rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS"); | |
58902 | @@ -1476,17 +1476,17 @@ rcu_torture_init(void) | |
58903 | ||
58904 | rcu_torture_current = NULL; | |
58905 | rcu_torture_current_version = 0; | |
58906 | - atomic_set(&n_rcu_torture_alloc, 0); | |
58907 | - atomic_set(&n_rcu_torture_alloc_fail, 0); | |
58908 | - atomic_set(&n_rcu_torture_free, 0); | |
58909 | - atomic_set(&n_rcu_torture_mberror, 0); | |
58910 | - atomic_set(&n_rcu_torture_error, 0); | |
58911 | + atomic_set_unchecked(&n_rcu_torture_alloc, 0); | |
58912 | + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0); | |
58913 | + atomic_set_unchecked(&n_rcu_torture_free, 0); | |
58914 | + atomic_set_unchecked(&n_rcu_torture_mberror, 0); | |
58915 | + atomic_set_unchecked(&n_rcu_torture_error, 0); | |
58916 | n_rcu_torture_boost_ktrerror = 0; | |
58917 | n_rcu_torture_boost_rterror = 0; | |
58918 | n_rcu_torture_boost_failure = 0; | |
58919 | n_rcu_torture_boosts = 0; | |
58920 | for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) | |
58921 | - atomic_set(&rcu_torture_wcount[i], 0); | |
58922 | + atomic_set_unchecked(&rcu_torture_wcount[i], 0); | |
58923 | for_each_possible_cpu(cpu) { | |
58924 | for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) { | |
58925 | per_cpu(rcu_torture_count, cpu)[i] = 0; | |
58926 | diff -urNp linux-3.0.3/kernel/rcutree.c linux-3.0.3/kernel/rcutree.c | |
58927 | --- linux-3.0.3/kernel/rcutree.c 2011-07-21 22:17:23.000000000 -0400 | |
58928 | +++ linux-3.0.3/kernel/rcutree.c 2011-08-23 21:47:56.000000000 -0400 | |
58929 | @@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state | |
58930 | /* | |
58931 | * Do softirq processing for the current CPU. | |
58932 | */ | |
58933 | -static void rcu_process_callbacks(struct softirq_action *unused) | |
58934 | +static void rcu_process_callbacks(void) | |
58935 | { | |
58936 | __rcu_process_callbacks(&rcu_sched_state, | |
58937 | &__get_cpu_var(rcu_sched_data)); | |
58938 | diff -urNp linux-3.0.3/kernel/rcutree_plugin.h linux-3.0.3/kernel/rcutree_plugin.h | |
58939 | --- linux-3.0.3/kernel/rcutree_plugin.h 2011-07-21 22:17:23.000000000 -0400 | |
58940 | +++ linux-3.0.3/kernel/rcutree_plugin.h 2011-08-23 21:47:56.000000000 -0400 | |
58941 | @@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void) | |
58942 | ||
58943 | /* Clean up and exit. */ | |
58944 | smp_mb(); /* ensure expedited GP seen before counter increment. */ | |
58945 | - ACCESS_ONCE(sync_rcu_preempt_exp_count)++; | |
58946 | + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++; | |
58947 | unlock_mb_ret: | |
58948 | mutex_unlock(&sync_rcu_preempt_exp_mutex); | |
58949 | mb_ret: | |
58950 | @@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe | |
58951 | ||
58952 | #else /* #ifndef CONFIG_SMP */ | |
58953 | ||
58954 | -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0); | |
58955 | -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0); | |
58956 | +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0); | |
58957 | +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0); | |
58958 | ||
58959 | static int synchronize_sched_expedited_cpu_stop(void *data) | |
58960 | { | |
58961 | @@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void) | |
58962 | int firstsnap, s, snap, trycount = 0; | |
58963 | ||
58964 | /* Note that atomic_inc_return() implies full memory barrier. */ | |
58965 | - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started); | |
58966 | + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started); | |
58967 | get_online_cpus(); | |
58968 | ||
58969 | /* | |
58970 | @@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void) | |
58971 | } | |
58972 | ||
58973 | /* Check to see if someone else did our work for us. */ | |
58974 | - s = atomic_read(&sync_sched_expedited_done); | |
58975 | + s = atomic_read_unchecked(&sync_sched_expedited_done); | |
58976 | if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) { | |
58977 | smp_mb(); /* ensure test happens before caller kfree */ | |
58978 | return; | |
58979 | @@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void) | |
58980 | * grace period works for us. | |
58981 | */ | |
58982 | get_online_cpus(); | |
58983 | - snap = atomic_read(&sync_sched_expedited_started) - 1; | |
58984 | + snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1; | |
58985 | smp_mb(); /* ensure read is before try_stop_cpus(). */ | |
58986 | } | |
58987 | ||
58988 | @@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void) | |
58989 | * than we did beat us to the punch. | |
58990 | */ | |
58991 | do { | |
58992 | - s = atomic_read(&sync_sched_expedited_done); | |
58993 | + s = atomic_read_unchecked(&sync_sched_expedited_done); | |
58994 | if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) { | |
58995 | smp_mb(); /* ensure test happens before caller kfree */ | |
58996 | break; | |
58997 | } | |
58998 | - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s); | |
58999 | + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s); | |
59000 | ||
59001 | put_online_cpus(); | |
59002 | } | |
59003 | diff -urNp linux-3.0.3/kernel/relay.c linux-3.0.3/kernel/relay.c | |
59004 | --- linux-3.0.3/kernel/relay.c 2011-07-21 22:17:23.000000000 -0400 | |
59005 | +++ linux-3.0.3/kernel/relay.c 2011-08-23 21:48:14.000000000 -0400 | |
59006 | @@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc | |
59007 | }; | |
59008 | ssize_t ret; | |
59009 | ||
59010 | + pax_track_stack(); | |
59011 | + | |
59012 | if (rbuf->subbufs_produced == rbuf->subbufs_consumed) | |
59013 | return 0; | |
59014 | if (splice_grow_spd(pipe, &spd)) | |
59015 | diff -urNp linux-3.0.3/kernel/resource.c linux-3.0.3/kernel/resource.c | |
59016 | --- linux-3.0.3/kernel/resource.c 2011-07-21 22:17:23.000000000 -0400 | |
59017 | +++ linux-3.0.3/kernel/resource.c 2011-08-23 21:48:14.000000000 -0400 | |
59018 | @@ -141,8 +141,18 @@ static const struct file_operations proc | |
59019 | ||
59020 | static int __init ioresources_init(void) | |
59021 | { | |
59022 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
59023 | +#ifdef CONFIG_GRKERNSEC_PROC_USER | |
59024 | + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations); | |
59025 | + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations); | |
59026 | +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) | |
59027 | + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations); | |
59028 | + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations); | |
59029 | +#endif | |
59030 | +#else | |
59031 | proc_create("ioports", 0, NULL, &proc_ioports_operations); | |
59032 | proc_create("iomem", 0, NULL, &proc_iomem_operations); | |
59033 | +#endif | |
59034 | return 0; | |
59035 | } | |
59036 | __initcall(ioresources_init); | |
59037 | diff -urNp linux-3.0.3/kernel/rtmutex-tester.c linux-3.0.3/kernel/rtmutex-tester.c | |
59038 | --- linux-3.0.3/kernel/rtmutex-tester.c 2011-07-21 22:17:23.000000000 -0400 | |
59039 | +++ linux-3.0.3/kernel/rtmutex-tester.c 2011-08-23 21:47:56.000000000 -0400 | |
59040 | @@ -20,7 +20,7 @@ | |
59041 | #define MAX_RT_TEST_MUTEXES 8 | |
59042 | ||
59043 | static spinlock_t rttest_lock; | |
59044 | -static atomic_t rttest_event; | |
59045 | +static atomic_unchecked_t rttest_event; | |
59046 | ||
59047 | struct test_thread_data { | |
59048 | int opcode; | |
59049 | @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_ | |
59050 | ||
59051 | case RTTEST_LOCKCONT: | |
59052 | td->mutexes[td->opdata] = 1; | |
59053 | - td->event = atomic_add_return(1, &rttest_event); | |
59054 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59055 | return 0; | |
59056 | ||
59057 | case RTTEST_RESET: | |
59058 | @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_ | |
59059 | return 0; | |
59060 | ||
59061 | case RTTEST_RESETEVENT: | |
59062 | - atomic_set(&rttest_event, 0); | |
59063 | + atomic_set_unchecked(&rttest_event, 0); | |
59064 | return 0; | |
59065 | ||
59066 | default: | |
59067 | @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_ | |
59068 | return ret; | |
59069 | ||
59070 | td->mutexes[id] = 1; | |
59071 | - td->event = atomic_add_return(1, &rttest_event); | |
59072 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59073 | rt_mutex_lock(&mutexes[id]); | |
59074 | - td->event = atomic_add_return(1, &rttest_event); | |
59075 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59076 | td->mutexes[id] = 4; | |
59077 | return 0; | |
59078 | ||
59079 | @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_ | |
59080 | return ret; | |
59081 | ||
59082 | td->mutexes[id] = 1; | |
59083 | - td->event = atomic_add_return(1, &rttest_event); | |
59084 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59085 | ret = rt_mutex_lock_interruptible(&mutexes[id], 0); | |
59086 | - td->event = atomic_add_return(1, &rttest_event); | |
59087 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59088 | td->mutexes[id] = ret ? 0 : 4; | |
59089 | return ret ? -EINTR : 0; | |
59090 | ||
59091 | @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_ | |
59092 | if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4) | |
59093 | return ret; | |
59094 | ||
59095 | - td->event = atomic_add_return(1, &rttest_event); | |
59096 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59097 | rt_mutex_unlock(&mutexes[id]); | |
59098 | - td->event = atomic_add_return(1, &rttest_event); | |
59099 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59100 | td->mutexes[id] = 0; | |
59101 | return 0; | |
59102 | ||
59103 | @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu | |
59104 | break; | |
59105 | ||
59106 | td->mutexes[dat] = 2; | |
59107 | - td->event = atomic_add_return(1, &rttest_event); | |
59108 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59109 | break; | |
59110 | ||
59111 | default: | |
59112 | @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu | |
59113 | return; | |
59114 | ||
59115 | td->mutexes[dat] = 3; | |
59116 | - td->event = atomic_add_return(1, &rttest_event); | |
59117 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59118 | break; | |
59119 | ||
59120 | case RTTEST_LOCKNOWAIT: | |
59121 | @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu | |
59122 | return; | |
59123 | ||
59124 | td->mutexes[dat] = 1; | |
59125 | - td->event = atomic_add_return(1, &rttest_event); | |
59126 | + td->event = atomic_add_return_unchecked(1, &rttest_event); | |
59127 | return; | |
59128 | ||
59129 | default: | |
59130 | diff -urNp linux-3.0.3/kernel/sched_autogroup.c linux-3.0.3/kernel/sched_autogroup.c | |
59131 | --- linux-3.0.3/kernel/sched_autogroup.c 2011-07-21 22:17:23.000000000 -0400 | |
59132 | +++ linux-3.0.3/kernel/sched_autogroup.c 2011-08-23 21:47:56.000000000 -0400 | |
59133 | @@ -7,7 +7,7 @@ | |
59134 | ||
59135 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; | |
59136 | static struct autogroup autogroup_default; | |
59137 | -static atomic_t autogroup_seq_nr; | |
59138 | +static atomic_unchecked_t autogroup_seq_nr; | |
59139 | ||
59140 | static void __init autogroup_init(struct task_struct *init_task) | |
59141 | { | |
59142 | @@ -78,7 +78,7 @@ static inline struct autogroup *autogrou | |
59143 | ||
59144 | kref_init(&ag->kref); | |
59145 | init_rwsem(&ag->lock); | |
59146 | - ag->id = atomic_inc_return(&autogroup_seq_nr); | |
59147 | + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr); | |
59148 | ag->tg = tg; | |
59149 | #ifdef CONFIG_RT_GROUP_SCHED | |
59150 | /* | |
59151 | diff -urNp linux-3.0.3/kernel/sched.c linux-3.0.3/kernel/sched.c | |
59152 | --- linux-3.0.3/kernel/sched.c 2011-07-21 22:17:23.000000000 -0400 | |
59153 | +++ linux-3.0.3/kernel/sched.c 2011-08-23 21:48:14.000000000 -0400 | |
59154 | @@ -4251,6 +4251,8 @@ asmlinkage void __sched schedule(void) | |
59155 | struct rq *rq; | |
59156 | int cpu; | |
59157 | ||
59158 | + pax_track_stack(); | |
59159 | + | |
59160 | need_resched: | |
59161 | preempt_disable(); | |
59162 | cpu = smp_processor_id(); | |
59163 | @@ -4934,6 +4936,8 @@ int can_nice(const struct task_struct *p | |
59164 | /* convert nice value [19,-20] to rlimit style value [1,40] */ | |
59165 | int nice_rlim = 20 - nice; | |
59166 | ||
59167 | + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1); | |
59168 | + | |
59169 | return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) || | |
59170 | capable(CAP_SYS_NICE)); | |
59171 | } | |
59172 | @@ -4967,7 +4971,8 @@ SYSCALL_DEFINE1(nice, int, increment) | |
59173 | if (nice > 19) | |
59174 | nice = 19; | |
59175 | ||
59176 | - if (increment < 0 && !can_nice(current, nice)) | |
59177 | + if (increment < 0 && (!can_nice(current, nice) || | |
59178 | + gr_handle_chroot_nice())) | |
59179 | return -EPERM; | |
59180 | ||
59181 | retval = security_task_setnice(current, nice); | |
59182 | @@ -5111,6 +5116,7 @@ recheck: | |
59183 | unsigned long rlim_rtprio = | |
59184 | task_rlimit(p, RLIMIT_RTPRIO); | |
59185 | ||
59186 | + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1); | |
59187 | /* can't set/change the rt policy */ | |
59188 | if (policy != p->policy && !rlim_rtprio) | |
59189 | return -EPERM; | |
59190 | diff -urNp linux-3.0.3/kernel/sched_fair.c linux-3.0.3/kernel/sched_fair.c | |
59191 | --- linux-3.0.3/kernel/sched_fair.c 2011-07-21 22:17:23.000000000 -0400 | |
59192 | +++ linux-3.0.3/kernel/sched_fair.c 2011-08-23 21:47:56.000000000 -0400 | |
59193 | @@ -4050,7 +4050,7 @@ static void nohz_idle_balance(int this_c | |
59194 | * run_rebalance_domains is triggered when needed from the scheduler tick. | |
59195 | * Also triggered for nohz idle balancing (with nohz_balancing_kick set). | |
59196 | */ | |
59197 | -static void run_rebalance_domains(struct softirq_action *h) | |
59198 | +static void run_rebalance_domains(void) | |
59199 | { | |
59200 | int this_cpu = smp_processor_id(); | |
59201 | struct rq *this_rq = cpu_rq(this_cpu); | |
59202 | diff -urNp linux-3.0.3/kernel/signal.c linux-3.0.3/kernel/signal.c | |
59203 | --- linux-3.0.3/kernel/signal.c 2011-07-21 22:17:23.000000000 -0400 | |
59204 | +++ linux-3.0.3/kernel/signal.c 2011-08-23 21:48:14.000000000 -0400 | |
59205 | @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache | |
59206 | ||
59207 | int print_fatal_signals __read_mostly; | |
59208 | ||
59209 | -static void __user *sig_handler(struct task_struct *t, int sig) | |
59210 | +static __sighandler_t sig_handler(struct task_struct *t, int sig) | |
59211 | { | |
59212 | return t->sighand->action[sig - 1].sa.sa_handler; | |
59213 | } | |
59214 | ||
59215 | -static int sig_handler_ignored(void __user *handler, int sig) | |
59216 | +static int sig_handler_ignored(__sighandler_t handler, int sig) | |
59217 | { | |
59218 | /* Is it explicitly or implicitly ignored? */ | |
59219 | return handler == SIG_IGN || | |
59220 | @@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us | |
59221 | static int sig_task_ignored(struct task_struct *t, int sig, | |
59222 | int from_ancestor_ns) | |
59223 | { | |
59224 | - void __user *handler; | |
59225 | + __sighandler_t handler; | |
59226 | ||
59227 | handler = sig_handler(t, sig); | |
59228 | ||
59229 | @@ -320,6 +320,9 @@ __sigqueue_alloc(int sig, struct task_st | |
59230 | atomic_inc(&user->sigpending); | |
59231 | rcu_read_unlock(); | |
59232 | ||
59233 | + if (!override_rlimit) | |
59234 | + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1); | |
59235 | + | |
59236 | if (override_rlimit || | |
59237 | atomic_read(&user->sigpending) <= | |
59238 | task_rlimit(t, RLIMIT_SIGPENDING)) { | |
59239 | @@ -444,7 +447,7 @@ flush_signal_handlers(struct task_struct | |
59240 | ||
59241 | int unhandled_signal(struct task_struct *tsk, int sig) | |
59242 | { | |
59243 | - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler; | |
59244 | + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler; | |
59245 | if (is_global_init(tsk)) | |
59246 | return 1; | |
59247 | if (handler != SIG_IGN && handler != SIG_DFL) | |
59248 | @@ -770,6 +773,13 @@ static int check_kill_permission(int sig | |
59249 | } | |
59250 | } | |
59251 | ||
59252 | + /* allow glibc communication via tgkill to other threads in our | |
59253 | + thread group */ | |
59254 | + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL || | |
59255 | + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid) | |
59256 | + && gr_handle_signal(t, sig)) | |
59257 | + return -EPERM; | |
59258 | + | |
59259 | return security_task_kill(t, info, sig, 0); | |
59260 | } | |
59261 | ||
59262 | @@ -1092,7 +1102,7 @@ __group_send_sig_info(int sig, struct si | |
59263 | return send_signal(sig, info, p, 1); | |
59264 | } | |
59265 | ||
59266 | -static int | |
59267 | +int | |
59268 | specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t) | |
59269 | { | |
59270 | return send_signal(sig, info, t, 0); | |
59271 | @@ -1129,6 +1139,7 @@ force_sig_info(int sig, struct siginfo * | |
59272 | unsigned long int flags; | |
59273 | int ret, blocked, ignored; | |
59274 | struct k_sigaction *action; | |
59275 | + int is_unhandled = 0; | |
59276 | ||
59277 | spin_lock_irqsave(&t->sighand->siglock, flags); | |
59278 | action = &t->sighand->action[sig-1]; | |
59279 | @@ -1143,9 +1154,18 @@ force_sig_info(int sig, struct siginfo * | |
59280 | } | |
59281 | if (action->sa.sa_handler == SIG_DFL) | |
59282 | t->signal->flags &= ~SIGNAL_UNKILLABLE; | |
59283 | + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL) | |
59284 | + is_unhandled = 1; | |
59285 | ret = specific_send_sig_info(sig, info, t); | |
59286 | spin_unlock_irqrestore(&t->sighand->siglock, flags); | |
59287 | ||
59288 | + /* only deal with unhandled signals, java etc trigger SIGSEGV during | |
59289 | + normal operation */ | |
59290 | + if (is_unhandled) { | |
59291 | + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t); | |
59292 | + gr_handle_crash(t, sig); | |
59293 | + } | |
59294 | + | |
59295 | return ret; | |
59296 | } | |
59297 | ||
59298 | @@ -1212,8 +1232,11 @@ int group_send_sig_info(int sig, struct | |
59299 | ret = check_kill_permission(sig, info, p); | |
59300 | rcu_read_unlock(); | |
59301 | ||
59302 | - if (!ret && sig) | |
59303 | + if (!ret && sig) { | |
59304 | ret = do_send_sig_info(sig, info, p, true); | |
59305 | + if (!ret) | |
59306 | + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p); | |
59307 | + } | |
59308 | ||
59309 | return ret; | |
59310 | } | |
59311 | @@ -1839,6 +1862,8 @@ void ptrace_notify(int exit_code) | |
59312 | { | |
59313 | siginfo_t info; | |
59314 | ||
59315 | + pax_track_stack(); | |
59316 | + | |
59317 | BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP); | |
59318 | ||
59319 | memset(&info, 0, sizeof info); | |
59320 | @@ -2639,7 +2664,15 @@ do_send_specific(pid_t tgid, pid_t pid, | |
59321 | int error = -ESRCH; | |
59322 | ||
59323 | rcu_read_lock(); | |
59324 | - p = find_task_by_vpid(pid); | |
59325 | +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK | |
59326 | + /* allow glibc communication via tgkill to other threads in our | |
59327 | + thread group */ | |
59328 | + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL && | |
59329 | + sig == (SIGRTMIN+1) && tgid == info->si_pid) | |
59330 | + p = find_task_by_vpid_unrestricted(pid); | |
59331 | + else | |
59332 | +#endif | |
59333 | + p = find_task_by_vpid(pid); | |
59334 | if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) { | |
59335 | error = check_kill_permission(sig, info, p); | |
59336 | /* | |
59337 | diff -urNp linux-3.0.3/kernel/smp.c linux-3.0.3/kernel/smp.c | |
59338 | --- linux-3.0.3/kernel/smp.c 2011-07-21 22:17:23.000000000 -0400 | |
59339 | +++ linux-3.0.3/kernel/smp.c 2011-08-23 21:47:56.000000000 -0400 | |
59340 | @@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t fu | |
59341 | } | |
59342 | EXPORT_SYMBOL(smp_call_function); | |
59343 | ||
59344 | -void ipi_call_lock(void) | |
59345 | +void ipi_call_lock(void) __acquires(call_function.lock) | |
59346 | { | |
59347 | raw_spin_lock(&call_function.lock); | |
59348 | } | |
59349 | ||
59350 | -void ipi_call_unlock(void) | |
59351 | +void ipi_call_unlock(void) __releases(call_function.lock) | |
59352 | { | |
59353 | raw_spin_unlock(&call_function.lock); | |
59354 | } | |
59355 | ||
59356 | -void ipi_call_lock_irq(void) | |
59357 | +void ipi_call_lock_irq(void) __acquires(call_function.lock) | |
59358 | { | |
59359 | raw_spin_lock_irq(&call_function.lock); | |
59360 | } | |
59361 | ||
59362 | -void ipi_call_unlock_irq(void) | |
59363 | +void ipi_call_unlock_irq(void) __releases(call_function.lock) | |
59364 | { | |
59365 | raw_spin_unlock_irq(&call_function.lock); | |
59366 | } | |
59367 | diff -urNp linux-3.0.3/kernel/softirq.c linux-3.0.3/kernel/softirq.c | |
59368 | --- linux-3.0.3/kernel/softirq.c 2011-07-21 22:17:23.000000000 -0400 | |
59369 | +++ linux-3.0.3/kernel/softirq.c 2011-08-23 21:47:56.000000000 -0400 | |
59370 | @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec | |
59371 | ||
59372 | DEFINE_PER_CPU(struct task_struct *, ksoftirqd); | |
59373 | ||
59374 | -char *softirq_to_name[NR_SOFTIRQS] = { | |
59375 | +const char * const softirq_to_name[NR_SOFTIRQS] = { | |
59376 | "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL", | |
59377 | "TASKLET", "SCHED", "HRTIMER", "RCU" | |
59378 | }; | |
59379 | @@ -235,7 +235,7 @@ restart: | |
59380 | kstat_incr_softirqs_this_cpu(vec_nr); | |
59381 | ||
59382 | trace_softirq_entry(vec_nr); | |
59383 | - h->action(h); | |
59384 | + h->action(); | |
59385 | trace_softirq_exit(vec_nr); | |
59386 | if (unlikely(prev_count != preempt_count())) { | |
59387 | printk(KERN_ERR "huh, entered softirq %u %s %p" | |
59388 | @@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr) | |
59389 | local_irq_restore(flags); | |
59390 | } | |
59391 | ||
59392 | -void open_softirq(int nr, void (*action)(struct softirq_action *)) | |
59393 | +void open_softirq(int nr, void (*action)(void)) | |
59394 | { | |
59395 | - softirq_vec[nr].action = action; | |
59396 | + pax_open_kernel(); | |
59397 | + *(void **)&softirq_vec[nr].action = action; | |
59398 | + pax_close_kernel(); | |
59399 | } | |
59400 | ||
59401 | /* | |
59402 | @@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct | |
59403 | ||
59404 | EXPORT_SYMBOL(__tasklet_hi_schedule_first); | |
59405 | ||
59406 | -static void tasklet_action(struct softirq_action *a) | |
59407 | +static void tasklet_action(void) | |
59408 | { | |
59409 | struct tasklet_struct *list; | |
59410 | ||
59411 | @@ -476,7 +478,7 @@ static void tasklet_action(struct softir | |
59412 | } | |
59413 | } | |
59414 | ||
59415 | -static void tasklet_hi_action(struct softirq_action *a) | |
59416 | +static void tasklet_hi_action(void) | |
59417 | { | |
59418 | struct tasklet_struct *list; | |
59419 | ||
59420 | diff -urNp linux-3.0.3/kernel/sys.c linux-3.0.3/kernel/sys.c | |
59421 | --- linux-3.0.3/kernel/sys.c 2011-07-21 22:17:23.000000000 -0400 | |
59422 | +++ linux-3.0.3/kernel/sys.c 2011-08-25 17:24:58.000000000 -0400 | |
59423 | @@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru | |
59424 | error = -EACCES; | |
59425 | goto out; | |
59426 | } | |
59427 | + | |
59428 | + if (gr_handle_chroot_setpriority(p, niceval)) { | |
59429 | + error = -EACCES; | |
59430 | + goto out; | |
59431 | + } | |
59432 | + | |
59433 | no_nice = security_task_setnice(p, niceval); | |
59434 | if (no_nice) { | |
59435 | error = no_nice; | |
59436 | @@ -537,6 +543,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g | |
59437 | goto error; | |
59438 | } | |
59439 | ||
59440 | + if (gr_check_group_change(new->gid, new->egid, -1)) | |
59441 | + goto error; | |
59442 | + | |
59443 | if (rgid != (gid_t) -1 || | |
59444 | (egid != (gid_t) -1 && egid != old->gid)) | |
59445 | new->sgid = new->egid; | |
59446 | @@ -566,6 +575,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid) | |
59447 | old = current_cred(); | |
59448 | ||
59449 | retval = -EPERM; | |
59450 | + | |
59451 | + if (gr_check_group_change(gid, gid, gid)) | |
59452 | + goto error; | |
59453 | + | |
59454 | if (nsown_capable(CAP_SETGID)) | |
59455 | new->gid = new->egid = new->sgid = new->fsgid = gid; | |
59456 | else if (gid == old->gid || gid == old->sgid) | |
59457 | @@ -591,11 +604,18 @@ static int set_user(struct cred *new) | |
59458 | if (!new_user) | |
59459 | return -EAGAIN; | |
59460 | ||
59461 | + /* | |
59462 | + * We don't fail in case of NPROC limit excess here because too many | |
59463 | + * poorly written programs don't check set*uid() return code, assuming | |
59464 | + * it never fails if called by root. We may still enforce NPROC limit | |
59465 | + * for programs doing set*uid()+execve() by harmlessly deferring the | |
59466 | + * failure to the execve() stage. | |
59467 | + */ | |
59468 | if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) && | |
59469 | - new_user != INIT_USER) { | |
59470 | - free_uid(new_user); | |
59471 | - return -EAGAIN; | |
59472 | - } | |
59473 | + new_user != INIT_USER) | |
59474 | + current->flags |= PF_NPROC_EXCEEDED; | |
59475 | + else | |
59476 | + current->flags &= ~PF_NPROC_EXCEEDED; | |
59477 | ||
59478 | free_uid(new->user); | |
59479 | new->user = new_user; | |
59480 | @@ -646,6 +666,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u | |
59481 | goto error; | |
59482 | } | |
59483 | ||
59484 | + if (gr_check_user_change(new->uid, new->euid, -1)) | |
59485 | + goto error; | |
59486 | + | |
59487 | if (new->uid != old->uid) { | |
59488 | retval = set_user(new); | |
59489 | if (retval < 0) | |
59490 | @@ -690,6 +713,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid) | |
59491 | old = current_cred(); | |
59492 | ||
59493 | retval = -EPERM; | |
59494 | + | |
59495 | + if (gr_check_crash_uid(uid)) | |
59496 | + goto error; | |
59497 | + if (gr_check_user_change(uid, uid, uid)) | |
59498 | + goto error; | |
59499 | + | |
59500 | if (nsown_capable(CAP_SETUID)) { | |
59501 | new->suid = new->uid = uid; | |
59502 | if (uid != old->uid) { | |
59503 | @@ -744,6 +773,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, | |
59504 | goto error; | |
59505 | } | |
59506 | ||
59507 | + if (gr_check_user_change(ruid, euid, -1)) | |
59508 | + goto error; | |
59509 | + | |
59510 | if (ruid != (uid_t) -1) { | |
59511 | new->uid = ruid; | |
59512 | if (ruid != old->uid) { | |
59513 | @@ -808,6 +840,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, | |
59514 | goto error; | |
59515 | } | |
59516 | ||
59517 | + if (gr_check_group_change(rgid, egid, -1)) | |
59518 | + goto error; | |
59519 | + | |
59520 | if (rgid != (gid_t) -1) | |
59521 | new->gid = rgid; | |
59522 | if (egid != (gid_t) -1) | |
59523 | @@ -854,6 +889,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) | |
59524 | old = current_cred(); | |
59525 | old_fsuid = old->fsuid; | |
59526 | ||
59527 | + if (gr_check_user_change(-1, -1, uid)) | |
59528 | + goto error; | |
59529 | + | |
59530 | if (uid == old->uid || uid == old->euid || | |
59531 | uid == old->suid || uid == old->fsuid || | |
59532 | nsown_capable(CAP_SETUID)) { | |
59533 | @@ -864,6 +902,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) | |
59534 | } | |
59535 | } | |
59536 | ||
59537 | +error: | |
59538 | abort_creds(new); | |
59539 | return old_fsuid; | |
59540 | ||
59541 | @@ -890,12 +929,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid) | |
59542 | if (gid == old->gid || gid == old->egid || | |
59543 | gid == old->sgid || gid == old->fsgid || | |
59544 | nsown_capable(CAP_SETGID)) { | |
59545 | + if (gr_check_group_change(-1, -1, gid)) | |
59546 | + goto error; | |
59547 | + | |
59548 | if (gid != old_fsgid) { | |
59549 | new->fsgid = gid; | |
59550 | goto change_okay; | |
59551 | } | |
59552 | } | |
59553 | ||
59554 | +error: | |
59555 | abort_creds(new); | |
59556 | return old_fsgid; | |
59557 | ||
59558 | @@ -1642,7 +1685,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi | |
59559 | error = get_dumpable(me->mm); | |
59560 | break; | |
59561 | case PR_SET_DUMPABLE: | |
59562 | - if (arg2 < 0 || arg2 > 1) { | |
59563 | + if (arg2 > 1) { | |
59564 | error = -EINVAL; | |
59565 | break; | |
59566 | } | |
59567 | diff -urNp linux-3.0.3/kernel/sysctl.c linux-3.0.3/kernel/sysctl.c | |
59568 | --- linux-3.0.3/kernel/sysctl.c 2011-07-21 22:17:23.000000000 -0400 | |
59569 | +++ linux-3.0.3/kernel/sysctl.c 2011-08-23 21:48:14.000000000 -0400 | |
59570 | @@ -85,6 +85,13 @@ | |
59571 | ||
59572 | ||
59573 | #if defined(CONFIG_SYSCTL) | |
59574 | +#include <linux/grsecurity.h> | |
59575 | +#include <linux/grinternal.h> | |
59576 | + | |
59577 | +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op); | |
59578 | +extern int gr_handle_sysctl_mod(const char *dirname, const char *name, | |
59579 | + const int op); | |
59580 | +extern int gr_handle_chroot_sysctl(const int op); | |
59581 | ||
59582 | /* External variables not in a header file. */ | |
59583 | extern int sysctl_overcommit_memory; | |
59584 | @@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_tabl | |
59585 | } | |
59586 | ||
59587 | #endif | |
59588 | +extern struct ctl_table grsecurity_table[]; | |
59589 | ||
59590 | static struct ctl_table root_table[]; | |
59591 | static struct ctl_table_root sysctl_table_root; | |
59592 | @@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[]; | |
59593 | int sysctl_legacy_va_layout; | |
59594 | #endif | |
59595 | ||
59596 | +#ifdef CONFIG_PAX_SOFTMODE | |
59597 | +static ctl_table pax_table[] = { | |
59598 | + { | |
59599 | + .procname = "softmode", | |
59600 | + .data = &pax_softmode, | |
59601 | + .maxlen = sizeof(unsigned int), | |
59602 | + .mode = 0600, | |
59603 | + .proc_handler = &proc_dointvec, | |
59604 | + }, | |
59605 | + | |
59606 | + { } | |
59607 | +}; | |
59608 | +#endif | |
59609 | + | |
59610 | /* The default sysctl tables: */ | |
59611 | ||
59612 | static struct ctl_table root_table[] = { | |
59613 | @@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000; | |
59614 | #endif | |
59615 | ||
59616 | static struct ctl_table kern_table[] = { | |
59617 | +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS) | |
59618 | + { | |
59619 | + .procname = "grsecurity", | |
59620 | + .mode = 0500, | |
59621 | + .child = grsecurity_table, | |
59622 | + }, | |
59623 | +#endif | |
59624 | + | |
59625 | +#ifdef CONFIG_PAX_SOFTMODE | |
59626 | + { | |
59627 | + .procname = "pax", | |
59628 | + .mode = 0500, | |
59629 | + .child = pax_table, | |
59630 | + }, | |
59631 | +#endif | |
59632 | + | |
59633 | { | |
59634 | .procname = "sched_child_runs_first", | |
59635 | .data = &sysctl_sched_child_runs_first, | |
59636 | @@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = { | |
59637 | .data = &modprobe_path, | |
59638 | .maxlen = KMOD_PATH_LEN, | |
59639 | .mode = 0644, | |
59640 | - .proc_handler = proc_dostring, | |
59641 | + .proc_handler = proc_dostring_modpriv, | |
59642 | }, | |
59643 | { | |
59644 | .procname = "modules_disabled", | |
59645 | @@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = { | |
59646 | .extra1 = &zero, | |
59647 | .extra2 = &one, | |
59648 | }, | |
59649 | +#endif | |
59650 | { | |
59651 | .procname = "kptr_restrict", | |
59652 | .data = &kptr_restrict, | |
59653 | .maxlen = sizeof(int), | |
59654 | .mode = 0644, | |
59655 | .proc_handler = proc_dmesg_restrict, | |
59656 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
59657 | + .extra1 = &two, | |
59658 | +#else | |
59659 | .extra1 = &zero, | |
59660 | +#endif | |
59661 | .extra2 = &two, | |
59662 | }, | |
59663 | -#endif | |
59664 | { | |
59665 | .procname = "ngroups_max", | |
59666 | .data = &ngroups_max, | |
59667 | @@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = { | |
59668 | .proc_handler = proc_dointvec_minmax, | |
59669 | .extra1 = &zero, | |
59670 | }, | |
59671 | + { | |
59672 | + .procname = "heap_stack_gap", | |
59673 | + .data = &sysctl_heap_stack_gap, | |
59674 | + .maxlen = sizeof(sysctl_heap_stack_gap), | |
59675 | + .mode = 0644, | |
59676 | + .proc_handler = proc_doulongvec_minmax, | |
59677 | + }, | |
59678 | #else | |
59679 | { | |
59680 | .procname = "nr_trim_pages", | |
59681 | @@ -1714,6 +1763,17 @@ static int test_perm(int mode, int op) | |
59682 | int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op) | |
59683 | { | |
59684 | int mode; | |
59685 | + int error; | |
59686 | + | |
59687 | + if (table->parent != NULL && table->parent->procname != NULL && | |
59688 | + table->procname != NULL && | |
59689 | + gr_handle_sysctl_mod(table->parent->procname, table->procname, op)) | |
59690 | + return -EACCES; | |
59691 | + if (gr_handle_chroot_sysctl(op)) | |
59692 | + return -EACCES; | |
59693 | + error = gr_handle_sysctl(table, op); | |
59694 | + if (error) | |
59695 | + return error; | |
59696 | ||
59697 | if (root->permissions) | |
59698 | mode = root->permissions(root, current->nsproxy, table); | |
59699 | @@ -2118,6 +2178,16 @@ int proc_dostring(struct ctl_table *tabl | |
59700 | buffer, lenp, ppos); | |
59701 | } | |
59702 | ||
59703 | +int proc_dostring_modpriv(struct ctl_table *table, int write, | |
59704 | + void __user *buffer, size_t *lenp, loff_t *ppos) | |
59705 | +{ | |
59706 | + if (write && !capable(CAP_SYS_MODULE)) | |
59707 | + return -EPERM; | |
59708 | + | |
59709 | + return _proc_do_string(table->data, table->maxlen, write, | |
59710 | + buffer, lenp, ppos); | |
59711 | +} | |
59712 | + | |
59713 | static size_t proc_skip_spaces(char **buf) | |
59714 | { | |
59715 | size_t ret; | |
59716 | @@ -2223,6 +2293,8 @@ static int proc_put_long(void __user **b | |
59717 | len = strlen(tmp); | |
59718 | if (len > *size) | |
59719 | len = *size; | |
59720 | + if (len > sizeof(tmp)) | |
59721 | + len = sizeof(tmp); | |
59722 | if (copy_to_user(*buf, tmp, len)) | |
59723 | return -EFAULT; | |
59724 | *size -= len; | |
59725 | @@ -2539,8 +2611,11 @@ static int __do_proc_doulongvec_minmax(v | |
59726 | *i = val; | |
59727 | } else { | |
59728 | val = convdiv * (*i) / convmul; | |
59729 | - if (!first) | |
59730 | + if (!first) { | |
59731 | err = proc_put_char(&buffer, &left, '\t'); | |
59732 | + if (err) | |
59733 | + break; | |
59734 | + } | |
59735 | err = proc_put_long(&buffer, &left, val, false); | |
59736 | if (err) | |
59737 | break; | |
59738 | @@ -2935,6 +3010,12 @@ int proc_dostring(struct ctl_table *tabl | |
59739 | return -ENOSYS; | |
59740 | } | |
59741 | ||
59742 | +int proc_dostring_modpriv(struct ctl_table *table, int write, | |
59743 | + void __user *buffer, size_t *lenp, loff_t *ppos) | |
59744 | +{ | |
59745 | + return -ENOSYS; | |
59746 | +} | |
59747 | + | |
59748 | int proc_dointvec(struct ctl_table *table, int write, | |
59749 | void __user *buffer, size_t *lenp, loff_t *ppos) | |
59750 | { | |
59751 | @@ -2991,6 +3072,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax); | |
59752 | EXPORT_SYMBOL(proc_dointvec_userhz_jiffies); | |
59753 | EXPORT_SYMBOL(proc_dointvec_ms_jiffies); | |
59754 | EXPORT_SYMBOL(proc_dostring); | |
59755 | +EXPORT_SYMBOL(proc_dostring_modpriv); | |
59756 | EXPORT_SYMBOL(proc_doulongvec_minmax); | |
59757 | EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax); | |
59758 | EXPORT_SYMBOL(register_sysctl_table); | |
59759 | diff -urNp linux-3.0.3/kernel/sysctl_check.c linux-3.0.3/kernel/sysctl_check.c | |
59760 | --- linux-3.0.3/kernel/sysctl_check.c 2011-07-21 22:17:23.000000000 -0400 | |
59761 | +++ linux-3.0.3/kernel/sysctl_check.c 2011-08-23 21:48:14.000000000 -0400 | |
59762 | @@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n | |
59763 | set_fail(&fail, table, "Directory with extra2"); | |
59764 | } else { | |
59765 | if ((table->proc_handler == proc_dostring) || | |
59766 | + (table->proc_handler == proc_dostring_modpriv) || | |
59767 | (table->proc_handler == proc_dointvec) || | |
59768 | (table->proc_handler == proc_dointvec_minmax) || | |
59769 | (table->proc_handler == proc_dointvec_jiffies) || | |
59770 | diff -urNp linux-3.0.3/kernel/taskstats.c linux-3.0.3/kernel/taskstats.c | |
59771 | --- linux-3.0.3/kernel/taskstats.c 2011-07-21 22:17:23.000000000 -0400 | |
59772 | +++ linux-3.0.3/kernel/taskstats.c 2011-08-23 21:48:14.000000000 -0400 | |
59773 | @@ -27,9 +27,12 @@ | |
59774 | #include <linux/cgroup.h> | |
59775 | #include <linux/fs.h> | |
59776 | #include <linux/file.h> | |
59777 | +#include <linux/grsecurity.h> | |
59778 | #include <net/genetlink.h> | |
59779 | #include <asm/atomic.h> | |
59780 | ||
59781 | +extern int gr_is_taskstats_denied(int pid); | |
59782 | + | |
59783 | /* | |
59784 | * Maximum length of a cpumask that can be specified in | |
59785 | * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute | |
59786 | @@ -558,6 +561,9 @@ err: | |
59787 | ||
59788 | static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) | |
59789 | { | |
59790 | + if (gr_is_taskstats_denied(current->pid)) | |
59791 | + return -EACCES; | |
59792 | + | |
59793 | if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK]) | |
59794 | return cmd_attr_register_cpumask(info); | |
59795 | else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK]) | |
59796 | diff -urNp linux-3.0.3/kernel/time/alarmtimer.c linux-3.0.3/kernel/time/alarmtimer.c | |
59797 | --- linux-3.0.3/kernel/time/alarmtimer.c 2011-07-21 22:17:23.000000000 -0400 | |
59798 | +++ linux-3.0.3/kernel/time/alarmtimer.c 2011-08-23 21:47:56.000000000 -0400 | |
59799 | @@ -685,7 +685,7 @@ static int __init alarmtimer_init(void) | |
59800 | { | |
59801 | int error = 0; | |
59802 | int i; | |
59803 | - struct k_clock alarm_clock = { | |
59804 | + static struct k_clock alarm_clock = { | |
59805 | .clock_getres = alarm_clock_getres, | |
59806 | .clock_get = alarm_clock_get, | |
59807 | .timer_create = alarm_timer_create, | |
59808 | diff -urNp linux-3.0.3/kernel/time/tick-broadcast.c linux-3.0.3/kernel/time/tick-broadcast.c | |
59809 | --- linux-3.0.3/kernel/time/tick-broadcast.c 2011-07-21 22:17:23.000000000 -0400 | |
59810 | +++ linux-3.0.3/kernel/time/tick-broadcast.c 2011-08-23 21:47:56.000000000 -0400 | |
59811 | @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl | |
59812 | * then clear the broadcast bit. | |
59813 | */ | |
59814 | if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) { | |
59815 | - int cpu = smp_processor_id(); | |
59816 | + cpu = smp_processor_id(); | |
59817 | ||
59818 | cpumask_clear_cpu(cpu, tick_get_broadcast_mask()); | |
59819 | tick_broadcast_clear_oneshot(cpu); | |
59820 | diff -urNp linux-3.0.3/kernel/time/timekeeping.c linux-3.0.3/kernel/time/timekeeping.c | |
59821 | --- linux-3.0.3/kernel/time/timekeeping.c 2011-07-21 22:17:23.000000000 -0400 | |
59822 | +++ linux-3.0.3/kernel/time/timekeeping.c 2011-08-23 21:48:14.000000000 -0400 | |
59823 | @@ -14,6 +14,7 @@ | |
59824 | #include <linux/init.h> | |
59825 | #include <linux/mm.h> | |
59826 | #include <linux/sched.h> | |
59827 | +#include <linux/grsecurity.h> | |
59828 | #include <linux/syscore_ops.h> | |
59829 | #include <linux/clocksource.h> | |
59830 | #include <linux/jiffies.h> | |
59831 | @@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe | |
59832 | if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC) | |
59833 | return -EINVAL; | |
59834 | ||
59835 | + gr_log_timechange(); | |
59836 | + | |
59837 | write_seqlock_irqsave(&xtime_lock, flags); | |
59838 | ||
59839 | timekeeping_forward_now(); | |
59840 | diff -urNp linux-3.0.3/kernel/time/timer_list.c linux-3.0.3/kernel/time/timer_list.c | |
59841 | --- linux-3.0.3/kernel/time/timer_list.c 2011-07-21 22:17:23.000000000 -0400 | |
59842 | +++ linux-3.0.3/kernel/time/timer_list.c 2011-08-23 21:48:14.000000000 -0400 | |
59843 | @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, | |
59844 | ||
59845 | static void print_name_offset(struct seq_file *m, void *sym) | |
59846 | { | |
59847 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
59848 | + SEQ_printf(m, "<%p>", NULL); | |
59849 | +#else | |
59850 | char symname[KSYM_NAME_LEN]; | |
59851 | ||
59852 | if (lookup_symbol_name((unsigned long)sym, symname) < 0) | |
59853 | SEQ_printf(m, "<%pK>", sym); | |
59854 | else | |
59855 | SEQ_printf(m, "%s", symname); | |
59856 | +#endif | |
59857 | } | |
59858 | ||
59859 | static void | |
59860 | @@ -112,7 +116,11 @@ next_one: | |
59861 | static void | |
59862 | print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now) | |
59863 | { | |
59864 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
59865 | + SEQ_printf(m, " .base: %p\n", NULL); | |
59866 | +#else | |
59867 | SEQ_printf(m, " .base: %pK\n", base); | |
59868 | +#endif | |
59869 | SEQ_printf(m, " .index: %d\n", | |
59870 | base->index); | |
59871 | SEQ_printf(m, " .resolution: %Lu nsecs\n", | |
59872 | @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs | |
59873 | { | |
59874 | struct proc_dir_entry *pe; | |
59875 | ||
59876 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
59877 | + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops); | |
59878 | +#else | |
59879 | pe = proc_create("timer_list", 0444, NULL, &timer_list_fops); | |
59880 | +#endif | |
59881 | if (!pe) | |
59882 | return -ENOMEM; | |
59883 | return 0; | |
59884 | diff -urNp linux-3.0.3/kernel/time/timer_stats.c linux-3.0.3/kernel/time/timer_stats.c | |
59885 | --- linux-3.0.3/kernel/time/timer_stats.c 2011-07-21 22:17:23.000000000 -0400 | |
59886 | +++ linux-3.0.3/kernel/time/timer_stats.c 2011-08-23 21:48:14.000000000 -0400 | |
59887 | @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop; | |
59888 | static unsigned long nr_entries; | |
59889 | static struct entry entries[MAX_ENTRIES]; | |
59890 | ||
59891 | -static atomic_t overflow_count; | |
59892 | +static atomic_unchecked_t overflow_count; | |
59893 | ||
59894 | /* | |
59895 | * The entries are in a hash-table, for fast lookup: | |
59896 | @@ -140,7 +140,7 @@ static void reset_entries(void) | |
59897 | nr_entries = 0; | |
59898 | memset(entries, 0, sizeof(entries)); | |
59899 | memset(tstat_hash_table, 0, sizeof(tstat_hash_table)); | |
59900 | - atomic_set(&overflow_count, 0); | |
59901 | + atomic_set_unchecked(&overflow_count, 0); | |
59902 | } | |
59903 | ||
59904 | static struct entry *alloc_entry(void) | |
59905 | @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time | |
59906 | if (likely(entry)) | |
59907 | entry->count++; | |
59908 | else | |
59909 | - atomic_inc(&overflow_count); | |
59910 | + atomic_inc_unchecked(&overflow_count); | |
59911 | ||
59912 | out_unlock: | |
59913 | raw_spin_unlock_irqrestore(lock, flags); | |
59914 | @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time | |
59915 | ||
59916 | static void print_name_offset(struct seq_file *m, unsigned long addr) | |
59917 | { | |
59918 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
59919 | + seq_printf(m, "<%p>", NULL); | |
59920 | +#else | |
59921 | char symname[KSYM_NAME_LEN]; | |
59922 | ||
59923 | if (lookup_symbol_name(addr, symname) < 0) | |
59924 | seq_printf(m, "<%p>", (void *)addr); | |
59925 | else | |
59926 | seq_printf(m, "%s", symname); | |
59927 | +#endif | |
59928 | } | |
59929 | ||
59930 | static int tstats_show(struct seq_file *m, void *v) | |
59931 | @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file * | |
59932 | ||
59933 | seq_puts(m, "Timer Stats Version: v0.2\n"); | |
59934 | seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms); | |
59935 | - if (atomic_read(&overflow_count)) | |
59936 | + if (atomic_read_unchecked(&overflow_count)) | |
59937 | seq_printf(m, "Overflow: %d entries\n", | |
59938 | - atomic_read(&overflow_count)); | |
59939 | + atomic_read_unchecked(&overflow_count)); | |
59940 | ||
59941 | for (i = 0; i < nr_entries; i++) { | |
59942 | entry = entries + i; | |
59943 | @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi | |
59944 | { | |
59945 | struct proc_dir_entry *pe; | |
59946 | ||
59947 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
59948 | + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops); | |
59949 | +#else | |
59950 | pe = proc_create("timer_stats", 0644, NULL, &tstats_fops); | |
59951 | +#endif | |
59952 | if (!pe) | |
59953 | return -ENOMEM; | |
59954 | return 0; | |
59955 | diff -urNp linux-3.0.3/kernel/time.c linux-3.0.3/kernel/time.c | |
59956 | --- linux-3.0.3/kernel/time.c 2011-07-21 22:17:23.000000000 -0400 | |
59957 | +++ linux-3.0.3/kernel/time.c 2011-08-23 21:48:14.000000000 -0400 | |
59958 | @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim | |
59959 | return error; | |
59960 | ||
59961 | if (tz) { | |
59962 | + /* we log in do_settimeofday called below, so don't log twice | |
59963 | + */ | |
59964 | + if (!tv) | |
59965 | + gr_log_timechange(); | |
59966 | + | |
59967 | /* SMP safe, global irq locking makes it work. */ | |
59968 | sys_tz = *tz; | |
59969 | update_vsyscall_tz(); | |
59970 | diff -urNp linux-3.0.3/kernel/timer.c linux-3.0.3/kernel/timer.c | |
59971 | --- linux-3.0.3/kernel/timer.c 2011-07-21 22:17:23.000000000 -0400 | |
59972 | +++ linux-3.0.3/kernel/timer.c 2011-08-23 21:47:56.000000000 -0400 | |
59973 | @@ -1304,7 +1304,7 @@ void update_process_times(int user_tick) | |
59974 | /* | |
59975 | * This function runs timers and the timer-tq in bottom half context. | |
59976 | */ | |
59977 | -static void run_timer_softirq(struct softirq_action *h) | |
59978 | +static void run_timer_softirq(void) | |
59979 | { | |
59980 | struct tvec_base *base = __this_cpu_read(tvec_bases); | |
59981 | ||
59982 | diff -urNp linux-3.0.3/kernel/trace/blktrace.c linux-3.0.3/kernel/trace/blktrace.c | |
59983 | --- linux-3.0.3/kernel/trace/blktrace.c 2011-07-21 22:17:23.000000000 -0400 | |
59984 | +++ linux-3.0.3/kernel/trace/blktrace.c 2011-08-23 21:47:56.000000000 -0400 | |
59985 | @@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f | |
59986 | struct blk_trace *bt = filp->private_data; | |
59987 | char buf[16]; | |
59988 | ||
59989 | - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped)); | |
59990 | + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped)); | |
59991 | ||
59992 | return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf)); | |
59993 | } | |
59994 | @@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str | |
59995 | return 1; | |
59996 | ||
59997 | bt = buf->chan->private_data; | |
59998 | - atomic_inc(&bt->dropped); | |
59999 | + atomic_inc_unchecked(&bt->dropped); | |
60000 | return 0; | |
60001 | } | |
60002 | ||
60003 | @@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu | |
60004 | ||
60005 | bt->dir = dir; | |
60006 | bt->dev = dev; | |
60007 | - atomic_set(&bt->dropped, 0); | |
60008 | + atomic_set_unchecked(&bt->dropped, 0); | |
60009 | ||
60010 | ret = -EIO; | |
60011 | bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt, | |
60012 | diff -urNp linux-3.0.3/kernel/trace/ftrace.c linux-3.0.3/kernel/trace/ftrace.c | |
60013 | --- linux-3.0.3/kernel/trace/ftrace.c 2011-07-21 22:17:23.000000000 -0400 | |
60014 | +++ linux-3.0.3/kernel/trace/ftrace.c 2011-08-23 21:47:56.000000000 -0400 | |
60015 | @@ -1566,12 +1566,17 @@ ftrace_code_disable(struct module *mod, | |
60016 | if (unlikely(ftrace_disabled)) | |
60017 | return 0; | |
60018 | ||
60019 | + ret = ftrace_arch_code_modify_prepare(); | |
60020 | + FTRACE_WARN_ON(ret); | |
60021 | + if (ret) | |
60022 | + return 0; | |
60023 | + | |
60024 | ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR); | |
60025 | + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process()); | |
60026 | if (ret) { | |
60027 | ftrace_bug(ret, ip); | |
60028 | - return 0; | |
60029 | } | |
60030 | - return 1; | |
60031 | + return ret ? 0 : 1; | |
60032 | } | |
60033 | ||
60034 | /* | |
60035 | @@ -2550,7 +2555,7 @@ static void ftrace_free_entry_rcu(struct | |
60036 | ||
60037 | int | |
60038 | register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, | |
60039 | - void *data) | |
60040 | + void *data) | |
60041 | { | |
60042 | struct ftrace_func_probe *entry; | |
60043 | struct ftrace_page *pg; | |
60044 | diff -urNp linux-3.0.3/kernel/trace/trace.c linux-3.0.3/kernel/trace/trace.c | |
60045 | --- linux-3.0.3/kernel/trace/trace.c 2011-07-21 22:17:23.000000000 -0400 | |
60046 | +++ linux-3.0.3/kernel/trace/trace.c 2011-08-23 21:48:14.000000000 -0400 | |
60047 | @@ -3339,6 +3339,8 @@ static ssize_t tracing_splice_read_pipe( | |
60048 | size_t rem; | |
60049 | unsigned int i; | |
60050 | ||
60051 | + pax_track_stack(); | |
60052 | + | |
60053 | if (splice_grow_spd(pipe, &spd)) | |
60054 | return -ENOMEM; | |
60055 | ||
60056 | @@ -3822,6 +3824,8 @@ tracing_buffers_splice_read(struct file | |
60057 | int entries, size, i; | |
60058 | size_t ret; | |
60059 | ||
60060 | + pax_track_stack(); | |
60061 | + | |
60062 | if (splice_grow_spd(pipe, &spd)) | |
60063 | return -ENOMEM; | |
60064 | ||
60065 | @@ -3990,10 +3994,9 @@ static const struct file_operations trac | |
60066 | }; | |
60067 | #endif | |
60068 | ||
60069 | -static struct dentry *d_tracer; | |
60070 | - | |
60071 | struct dentry *tracing_init_dentry(void) | |
60072 | { | |
60073 | + static struct dentry *d_tracer; | |
60074 | static int once; | |
60075 | ||
60076 | if (d_tracer) | |
60077 | @@ -4013,10 +4016,9 @@ struct dentry *tracing_init_dentry(void) | |
60078 | return d_tracer; | |
60079 | } | |
60080 | ||
60081 | -static struct dentry *d_percpu; | |
60082 | - | |
60083 | struct dentry *tracing_dentry_percpu(void) | |
60084 | { | |
60085 | + static struct dentry *d_percpu; | |
60086 | static int once; | |
60087 | struct dentry *d_tracer; | |
60088 | ||
60089 | diff -urNp linux-3.0.3/kernel/trace/trace_events.c linux-3.0.3/kernel/trace/trace_events.c | |
60090 | --- linux-3.0.3/kernel/trace/trace_events.c 2011-08-23 21:44:40.000000000 -0400 | |
60091 | +++ linux-3.0.3/kernel/trace/trace_events.c 2011-08-23 21:47:56.000000000 -0400 | |
60092 | @@ -1318,10 +1318,6 @@ static LIST_HEAD(ftrace_module_file_list | |
60093 | struct ftrace_module_file_ops { | |
60094 | struct list_head list; | |
60095 | struct module *mod; | |
60096 | - struct file_operations id; | |
60097 | - struct file_operations enable; | |
60098 | - struct file_operations format; | |
60099 | - struct file_operations filter; | |
60100 | }; | |
60101 | ||
60102 | static struct ftrace_module_file_ops * | |
60103 | @@ -1342,17 +1338,12 @@ trace_create_file_ops(struct module *mod | |
60104 | ||
60105 | file_ops->mod = mod; | |
60106 | ||
60107 | - file_ops->id = ftrace_event_id_fops; | |
60108 | - file_ops->id.owner = mod; | |
60109 | - | |
60110 | - file_ops->enable = ftrace_enable_fops; | |
60111 | - file_ops->enable.owner = mod; | |
60112 | - | |
60113 | - file_ops->filter = ftrace_event_filter_fops; | |
60114 | - file_ops->filter.owner = mod; | |
60115 | - | |
60116 | - file_ops->format = ftrace_event_format_fops; | |
60117 | - file_ops->format.owner = mod; | |
60118 | + pax_open_kernel(); | |
60119 | + *(void **)&mod->trace_id.owner = mod; | |
60120 | + *(void **)&mod->trace_enable.owner = mod; | |
60121 | + *(void **)&mod->trace_filter.owner = mod; | |
60122 | + *(void **)&mod->trace_format.owner = mod; | |
60123 | + pax_close_kernel(); | |
60124 | ||
60125 | list_add(&file_ops->list, &ftrace_module_file_list); | |
60126 | ||
60127 | @@ -1376,8 +1367,8 @@ static void trace_module_add_events(stru | |
60128 | ||
60129 | for_each_event(call, start, end) { | |
60130 | __trace_add_event_call(*call, mod, | |
60131 | - &file_ops->id, &file_ops->enable, | |
60132 | - &file_ops->filter, &file_ops->format); | |
60133 | + &mod->trace_id, &mod->trace_enable, | |
60134 | + &mod->trace_filter, &mod->trace_format); | |
60135 | } | |
60136 | } | |
60137 | ||
60138 | diff -urNp linux-3.0.3/kernel/trace/trace_mmiotrace.c linux-3.0.3/kernel/trace/trace_mmiotrace.c | |
60139 | --- linux-3.0.3/kernel/trace/trace_mmiotrace.c 2011-07-21 22:17:23.000000000 -0400 | |
60140 | +++ linux-3.0.3/kernel/trace/trace_mmiotrace.c 2011-08-23 21:47:56.000000000 -0400 | |
60141 | @@ -24,7 +24,7 @@ struct header_iter { | |
60142 | static struct trace_array *mmio_trace_array; | |
60143 | static bool overrun_detected; | |
60144 | static unsigned long prev_overruns; | |
60145 | -static atomic_t dropped_count; | |
60146 | +static atomic_unchecked_t dropped_count; | |
60147 | ||
60148 | static void mmio_reset_data(struct trace_array *tr) | |
60149 | { | |
60150 | @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter | |
60151 | ||
60152 | static unsigned long count_overruns(struct trace_iterator *iter) | |
60153 | { | |
60154 | - unsigned long cnt = atomic_xchg(&dropped_count, 0); | |
60155 | + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0); | |
60156 | unsigned long over = ring_buffer_overruns(iter->tr->buffer); | |
60157 | ||
60158 | if (over > prev_overruns) | |
60159 | @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct | |
60160 | event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW, | |
60161 | sizeof(*entry), 0, pc); | |
60162 | if (!event) { | |
60163 | - atomic_inc(&dropped_count); | |
60164 | + atomic_inc_unchecked(&dropped_count); | |
60165 | return; | |
60166 | } | |
60167 | entry = ring_buffer_event_data(event); | |
60168 | @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct | |
60169 | event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP, | |
60170 | sizeof(*entry), 0, pc); | |
60171 | if (!event) { | |
60172 | - atomic_inc(&dropped_count); | |
60173 | + atomic_inc_unchecked(&dropped_count); | |
60174 | return; | |
60175 | } | |
60176 | entry = ring_buffer_event_data(event); | |
60177 | diff -urNp linux-3.0.3/kernel/trace/trace_output.c linux-3.0.3/kernel/trace/trace_output.c | |
60178 | --- linux-3.0.3/kernel/trace/trace_output.c 2011-07-21 22:17:23.000000000 -0400 | |
60179 | +++ linux-3.0.3/kernel/trace/trace_output.c 2011-08-23 21:47:56.000000000 -0400 | |
60180 | @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, | |
60181 | ||
60182 | p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len); | |
60183 | if (!IS_ERR(p)) { | |
60184 | - p = mangle_path(s->buffer + s->len, p, "\n"); | |
60185 | + p = mangle_path(s->buffer + s->len, p, "\n\\"); | |
60186 | if (p) { | |
60187 | s->len = p - s->buffer; | |
60188 | return 1; | |
60189 | diff -urNp linux-3.0.3/kernel/trace/trace_stack.c linux-3.0.3/kernel/trace/trace_stack.c | |
60190 | --- linux-3.0.3/kernel/trace/trace_stack.c 2011-07-21 22:17:23.000000000 -0400 | |
60191 | +++ linux-3.0.3/kernel/trace/trace_stack.c 2011-08-23 21:47:56.000000000 -0400 | |
60192 | @@ -50,7 +50,7 @@ static inline void check_stack(void) | |
60193 | return; | |
60194 | ||
60195 | /* we do not handle interrupt stacks yet */ | |
60196 | - if (!object_is_on_stack(&this_size)) | |
60197 | + if (!object_starts_on_stack(&this_size)) | |
60198 | return; | |
60199 | ||
60200 | local_irq_save(flags); | |
60201 | diff -urNp linux-3.0.3/kernel/trace/trace_workqueue.c linux-3.0.3/kernel/trace/trace_workqueue.c | |
60202 | --- linux-3.0.3/kernel/trace/trace_workqueue.c 2011-07-21 22:17:23.000000000 -0400 | |
60203 | +++ linux-3.0.3/kernel/trace/trace_workqueue.c 2011-08-23 21:47:56.000000000 -0400 | |
60204 | @@ -22,7 +22,7 @@ struct cpu_workqueue_stats { | |
60205 | int cpu; | |
60206 | pid_t pid; | |
60207 | /* Can be inserted from interrupt or user context, need to be atomic */ | |
60208 | - atomic_t inserted; | |
60209 | + atomic_unchecked_t inserted; | |
60210 | /* | |
60211 | * Don't need to be atomic, works are serialized in a single workqueue thread | |
60212 | * on a single CPU. | |
60213 | @@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore, | |
60214 | spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags); | |
60215 | list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) { | |
60216 | if (node->pid == wq_thread->pid) { | |
60217 | - atomic_inc(&node->inserted); | |
60218 | + atomic_inc_unchecked(&node->inserted); | |
60219 | goto found; | |
60220 | } | |
60221 | } | |
60222 | @@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se | |
60223 | tsk = get_pid_task(pid, PIDTYPE_PID); | |
60224 | if (tsk) { | |
60225 | seq_printf(s, "%3d %6d %6u %s\n", cws->cpu, | |
60226 | - atomic_read(&cws->inserted), cws->executed, | |
60227 | + atomic_read_unchecked(&cws->inserted), cws->executed, | |
60228 | tsk->comm); | |
60229 | put_task_struct(tsk); | |
60230 | } | |
60231 | diff -urNp linux-3.0.3/lib/bug.c linux-3.0.3/lib/bug.c | |
60232 | --- linux-3.0.3/lib/bug.c 2011-07-21 22:17:23.000000000 -0400 | |
60233 | +++ linux-3.0.3/lib/bug.c 2011-08-23 21:47:56.000000000 -0400 | |
60234 | @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l | |
60235 | return BUG_TRAP_TYPE_NONE; | |
60236 | ||
60237 | bug = find_bug(bugaddr); | |
60238 | + if (!bug) | |
60239 | + return BUG_TRAP_TYPE_NONE; | |
60240 | ||
60241 | file = NULL; | |
60242 | line = 0; | |
60243 | diff -urNp linux-3.0.3/lib/debugobjects.c linux-3.0.3/lib/debugobjects.c | |
60244 | --- linux-3.0.3/lib/debugobjects.c 2011-07-21 22:17:23.000000000 -0400 | |
60245 | +++ linux-3.0.3/lib/debugobjects.c 2011-08-23 21:47:56.000000000 -0400 | |
60246 | @@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi | |
60247 | if (limit > 4) | |
60248 | return; | |
60249 | ||
60250 | - is_on_stack = object_is_on_stack(addr); | |
60251 | + is_on_stack = object_starts_on_stack(addr); | |
60252 | if (is_on_stack == onstack) | |
60253 | return; | |
60254 | ||
60255 | diff -urNp linux-3.0.3/lib/dma-debug.c linux-3.0.3/lib/dma-debug.c | |
60256 | --- linux-3.0.3/lib/dma-debug.c 2011-07-21 22:17:23.000000000 -0400 | |
60257 | +++ linux-3.0.3/lib/dma-debug.c 2011-08-23 21:47:56.000000000 -0400 | |
60258 | @@ -870,7 +870,7 @@ out: | |
60259 | ||
60260 | static void check_for_stack(struct device *dev, void *addr) | |
60261 | { | |
60262 | - if (object_is_on_stack(addr)) | |
60263 | + if (object_starts_on_stack(addr)) | |
60264 | err_printk(dev, NULL, "DMA-API: device driver maps memory from" | |
60265 | "stack [addr=%p]\n", addr); | |
60266 | } | |
60267 | diff -urNp linux-3.0.3/lib/extable.c linux-3.0.3/lib/extable.c | |
60268 | --- linux-3.0.3/lib/extable.c 2011-07-21 22:17:23.000000000 -0400 | |
60269 | +++ linux-3.0.3/lib/extable.c 2011-08-23 21:47:56.000000000 -0400 | |
60270 | @@ -13,6 +13,7 @@ | |
60271 | #include <linux/init.h> | |
60272 | #include <linux/sort.h> | |
60273 | #include <asm/uaccess.h> | |
60274 | +#include <asm/pgtable.h> | |
60275 | ||
60276 | #ifndef ARCH_HAS_SORT_EXTABLE | |
60277 | /* | |
60278 | @@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const v | |
60279 | void sort_extable(struct exception_table_entry *start, | |
60280 | struct exception_table_entry *finish) | |
60281 | { | |
60282 | + pax_open_kernel(); | |
60283 | sort(start, finish - start, sizeof(struct exception_table_entry), | |
60284 | cmp_ex, NULL); | |
60285 | + pax_close_kernel(); | |
60286 | } | |
60287 | ||
60288 | #ifdef CONFIG_MODULES | |
60289 | diff -urNp linux-3.0.3/lib/inflate.c linux-3.0.3/lib/inflate.c | |
60290 | --- linux-3.0.3/lib/inflate.c 2011-07-21 22:17:23.000000000 -0400 | |
60291 | +++ linux-3.0.3/lib/inflate.c 2011-08-23 21:47:56.000000000 -0400 | |
60292 | @@ -269,7 +269,7 @@ static void free(void *where) | |
60293 | malloc_ptr = free_mem_ptr; | |
60294 | } | |
60295 | #else | |
60296 | -#define malloc(a) kmalloc(a, GFP_KERNEL) | |
60297 | +#define malloc(a) kmalloc((a), GFP_KERNEL) | |
60298 | #define free(a) kfree(a) | |
60299 | #endif | |
60300 | ||
60301 | diff -urNp linux-3.0.3/lib/Kconfig.debug linux-3.0.3/lib/Kconfig.debug | |
60302 | --- linux-3.0.3/lib/Kconfig.debug 2011-07-21 22:17:23.000000000 -0400 | |
60303 | +++ linux-3.0.3/lib/Kconfig.debug 2011-08-23 21:48:14.000000000 -0400 | |
60304 | @@ -1088,6 +1088,7 @@ config LATENCYTOP | |
60305 | depends on DEBUG_KERNEL | |
60306 | depends on STACKTRACE_SUPPORT | |
60307 | depends on PROC_FS | |
60308 | + depends on !GRKERNSEC_HIDESYM | |
60309 | select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE | |
60310 | select KALLSYMS | |
60311 | select KALLSYMS_ALL | |
60312 | diff -urNp linux-3.0.3/lib/kref.c linux-3.0.3/lib/kref.c | |
60313 | --- linux-3.0.3/lib/kref.c 2011-07-21 22:17:23.000000000 -0400 | |
60314 | +++ linux-3.0.3/lib/kref.c 2011-08-23 21:47:56.000000000 -0400 | |
60315 | @@ -52,7 +52,7 @@ void kref_get(struct kref *kref) | |
60316 | */ | |
60317 | int kref_put(struct kref *kref, void (*release)(struct kref *kref)) | |
60318 | { | |
60319 | - WARN_ON(release == NULL); | |
60320 | + BUG_ON(release == NULL); | |
60321 | WARN_ON(release == (void (*)(struct kref *))kfree); | |
60322 | ||
60323 | if (atomic_dec_and_test(&kref->refcount)) { | |
60324 | diff -urNp linux-3.0.3/lib/radix-tree.c linux-3.0.3/lib/radix-tree.c | |
60325 | --- linux-3.0.3/lib/radix-tree.c 2011-07-21 22:17:23.000000000 -0400 | |
60326 | +++ linux-3.0.3/lib/radix-tree.c 2011-08-23 21:47:56.000000000 -0400 | |
60327 | @@ -80,7 +80,7 @@ struct radix_tree_preload { | |
60328 | int nr; | |
60329 | struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH]; | |
60330 | }; | |
60331 | -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, }; | |
60332 | +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads); | |
60333 | ||
60334 | static inline void *ptr_to_indirect(void *ptr) | |
60335 | { | |
60336 | diff -urNp linux-3.0.3/lib/vsprintf.c linux-3.0.3/lib/vsprintf.c | |
60337 | --- linux-3.0.3/lib/vsprintf.c 2011-07-21 22:17:23.000000000 -0400 | |
60338 | +++ linux-3.0.3/lib/vsprintf.c 2011-08-23 21:48:14.000000000 -0400 | |
60339 | @@ -16,6 +16,9 @@ | |
60340 | * - scnprintf and vscnprintf | |
60341 | */ | |
60342 | ||
60343 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
60344 | +#define __INCLUDED_BY_HIDESYM 1 | |
60345 | +#endif | |
60346 | #include <stdarg.h> | |
60347 | #include <linux/module.h> | |
60348 | #include <linux/types.h> | |
60349 | @@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end | |
60350 | char sym[KSYM_SYMBOL_LEN]; | |
60351 | if (ext == 'B') | |
60352 | sprint_backtrace(sym, value); | |
60353 | - else if (ext != 'f' && ext != 's') | |
60354 | + else if (ext != 'f' && ext != 's' && ext != 'a') | |
60355 | sprint_symbol(sym, value); | |
60356 | else | |
60357 | kallsyms_lookup(value, NULL, NULL, NULL, sym); | |
60358 | @@ -799,7 +802,11 @@ char *uuid_string(char *buf, char *end, | |
60359 | return string(buf, end, uuid, spec); | |
60360 | } | |
60361 | ||
60362 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
60363 | +int kptr_restrict __read_mostly = 2; | |
60364 | +#else | |
60365 | int kptr_restrict __read_mostly; | |
60366 | +#endif | |
60367 | ||
60368 | /* | |
60369 | * Show a '%p' thing. A kernel extension is that the '%p' is followed | |
60370 | @@ -813,6 +820,8 @@ int kptr_restrict __read_mostly; | |
60371 | * - 'S' For symbolic direct pointers with offset | |
60372 | * - 's' For symbolic direct pointers without offset | |
60373 | * - 'B' For backtraced symbolic direct pointers with offset | |
60374 | + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM | |
60375 | + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM | |
60376 | * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref] | |
60377 | * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201] | |
60378 | * - 'M' For a 6-byte MAC address, it prints the address in the | |
60379 | @@ -857,12 +866,12 @@ char *pointer(const char *fmt, char *buf | |
60380 | { | |
60381 | if (!ptr && *fmt != 'K') { | |
60382 | /* | |
60383 | - * Print (null) with the same width as a pointer so it makes | |
60384 | + * Print (nil) with the same width as a pointer so it makes | |
60385 | * tabular output look nice. | |
60386 | */ | |
60387 | if (spec.field_width == -1) | |
60388 | spec.field_width = 2 * sizeof(void *); | |
60389 | - return string(buf, end, "(null)", spec); | |
60390 | + return string(buf, end, "(nil)", spec); | |
60391 | } | |
60392 | ||
60393 | switch (*fmt) { | |
60394 | @@ -872,6 +881,13 @@ char *pointer(const char *fmt, char *buf | |
60395 | /* Fallthrough */ | |
60396 | case 'S': | |
60397 | case 's': | |
60398 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
60399 | + break; | |
60400 | +#else | |
60401 | + return symbol_string(buf, end, ptr, spec, *fmt); | |
60402 | +#endif | |
60403 | + case 'A': | |
60404 | + case 'a': | |
60405 | case 'B': | |
60406 | return symbol_string(buf, end, ptr, spec, *fmt); | |
60407 | case 'R': | |
60408 | @@ -1631,11 +1647,11 @@ int bstr_printf(char *buf, size_t size, | |
60409 | typeof(type) value; \ | |
60410 | if (sizeof(type) == 8) { \ | |
60411 | args = PTR_ALIGN(args, sizeof(u32)); \ | |
60412 | - *(u32 *)&value = *(u32 *)args; \ | |
60413 | - *((u32 *)&value + 1) = *(u32 *)(args + 4); \ | |
60414 | + *(u32 *)&value = *(const u32 *)args; \ | |
60415 | + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \ | |
60416 | } else { \ | |
60417 | args = PTR_ALIGN(args, sizeof(type)); \ | |
60418 | - value = *(typeof(type) *)args; \ | |
60419 | + value = *(const typeof(type) *)args; \ | |
60420 | } \ | |
60421 | args += sizeof(type); \ | |
60422 | value; \ | |
60423 | @@ -1698,7 +1714,7 @@ int bstr_printf(char *buf, size_t size, | |
60424 | case FORMAT_TYPE_STR: { | |
60425 | const char *str_arg = args; | |
60426 | args += strlen(str_arg) + 1; | |
60427 | - str = string(str, end, (char *)str_arg, spec); | |
60428 | + str = string(str, end, str_arg, spec); | |
60429 | break; | |
60430 | } | |
60431 | ||
60432 | diff -urNp linux-3.0.3/localversion-grsec linux-3.0.3/localversion-grsec | |
60433 | --- linux-3.0.3/localversion-grsec 1969-12-31 19:00:00.000000000 -0500 | |
60434 | +++ linux-3.0.3/localversion-grsec 2011-08-23 21:48:14.000000000 -0400 | |
60435 | @@ -0,0 +1 @@ | |
60436 | +-grsec | |
60437 | diff -urNp linux-3.0.3/Makefile linux-3.0.3/Makefile | |
60438 | --- linux-3.0.3/Makefile 2011-08-23 21:44:40.000000000 -0400 | |
60439 | +++ linux-3.0.3/Makefile 2011-08-27 21:15:31.000000000 -0400 | |
60440 | @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" | |
60441 | ||
60442 | HOSTCC = gcc | |
60443 | HOSTCXX = g++ | |
60444 | -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer | |
60445 | -HOSTCXXFLAGS = -O2 | |
60446 | +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks | |
60447 | +HOSTCFLAGS += $(call cc-option, -Wno-empty-body) | |
60448 | +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks | |
60449 | ||
60450 | # Decide whether to build built-in, modular, or both. | |
60451 | # Normally, just do built-in. | |
60452 | @@ -365,10 +366,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h | |
60453 | KBUILD_CPPFLAGS := -D__KERNEL__ | |
60454 | ||
60455 | KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ | |
60456 | + -W -Wno-unused-parameter -Wno-missing-field-initializers \ | |
60457 | -fno-strict-aliasing -fno-common \ | |
60458 | -Werror-implicit-function-declaration \ | |
60459 | -Wno-format-security \ | |
60460 | -fno-delete-null-pointer-checks | |
60461 | +KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body) | |
60462 | KBUILD_AFLAGS_KERNEL := | |
60463 | KBUILD_CFLAGS_KERNEL := | |
60464 | KBUILD_AFLAGS := -D__ASSEMBLY__ | |
60465 | @@ -564,6 +567,25 @@ else | |
60466 | KBUILD_CFLAGS += -O2 | |
60467 | endif | |
60468 | ||
60469 | +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC)), y) | |
60470 | +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN | |
60471 | +ifdef CONFIG_PAX_MEMORY_STACKLEAK | |
60472 | +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100 | |
60473 | +endif | |
60474 | +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN | |
60475 | +gcc-plugins0: | |
60476 | + $(Q)$(MAKE) $(build)=tools/gcc | |
60477 | +gcc-plugins: scripts_basic gcc-plugins0 | |
60478 | +else | |
60479 | +gcc-plugins: | |
60480 | +ifeq ($(call cc-ifversion, -ge, 0405, y), y) | |
60481 | + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.)) | |
60482 | +else | |
60483 | + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least" | |
60484 | +endif | |
60485 | + $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure" | |
60486 | +endif | |
60487 | + | |
60488 | include $(srctree)/arch/$(SRCARCH)/Makefile | |
60489 | ||
60490 | ifneq ($(CONFIG_FRAME_WARN),0) | |
60491 | @@ -708,7 +730,7 @@ export mod_strip_cmd | |
60492 | ||
60493 | ||
60494 | ifeq ($(KBUILD_EXTMOD),) | |
60495 | -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ | |
60496 | +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/ | |
60497 | ||
60498 | vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ | |
60499 | $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ | |
60500 | @@ -907,6 +929,7 @@ define rule_vmlinux-modpost | |
60501 | endef | |
60502 | ||
60503 | # vmlinux image - including updated kernel symbols | |
60504 | +vmlinux: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) | |
60505 | vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o $(kallsyms.o) FORCE | |
60506 | ifdef CONFIG_HEADERS_CHECK | |
60507 | $(Q)$(MAKE) -f $(srctree)/Makefile headers_check | |
60508 | @@ -973,7 +996,7 @@ ifneq ($(KBUILD_SRC),) | |
60509 | endif | |
60510 | ||
60511 | # prepare2 creates a makefile if using a separate output directory | |
60512 | -prepare2: prepare3 outputmakefile asm-generic | |
60513 | +prepare2: prepare3 outputmakefile asm-generic gcc-plugins | |
60514 | ||
60515 | prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \ | |
60516 | include/config/auto.conf | |
60517 | @@ -1087,6 +1110,7 @@ all: modules | |
60518 | # using awk while concatenating to the final file. | |
60519 | ||
60520 | PHONY += modules | |
60521 | +modules: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) | |
60522 | modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin | |
60523 | $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order | |
60524 | @$(kecho) ' Building modules, stage 2.'; | |
60525 | @@ -1359,6 +1383,7 @@ PHONY += $(module-dirs) modules | |
60526 | $(module-dirs): crmodverdir $(objtree)/Module.symvers | |
60527 | $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) | |
60528 | ||
60529 | +modules: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) | |
60530 | modules: $(module-dirs) | |
60531 | @$(kecho) ' Building modules, stage 2.'; | |
60532 | $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost | |
60533 | @@ -1404,7 +1429,7 @@ clean: $(clean-dirs) | |
60534 | $(call cmd,rmdirs) | |
60535 | $(call cmd,rmfiles) | |
60536 | @find $(if $(KBUILD_EXTMOD), $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \ | |
60537 | - \( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \ | |
60538 | + \( -name '*.[oas]' -o -name '*.[ks]o' -o -name '.*.cmd' \ | |
60539 | -o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \ | |
60540 | -o -name '*.symtypes' -o -name 'modules.order' \ | |
60541 | -o -name modules.builtin -o -name '.tmp_*.o.*' \ | |
60542 | diff -urNp linux-3.0.3/mm/filemap.c linux-3.0.3/mm/filemap.c | |
60543 | --- linux-3.0.3/mm/filemap.c 2011-07-21 22:17:23.000000000 -0400 | |
60544 | +++ linux-3.0.3/mm/filemap.c 2011-08-23 21:48:14.000000000 -0400 | |
60545 | @@ -1763,7 +1763,7 @@ int generic_file_mmap(struct file * file | |
60546 | struct address_space *mapping = file->f_mapping; | |
60547 | ||
60548 | if (!mapping->a_ops->readpage) | |
60549 | - return -ENOEXEC; | |
60550 | + return -ENODEV; | |
60551 | file_accessed(file); | |
60552 | vma->vm_ops = &generic_file_vm_ops; | |
60553 | vma->vm_flags |= VM_CAN_NONLINEAR; | |
60554 | @@ -2169,6 +2169,7 @@ inline int generic_write_checks(struct f | |
60555 | *pos = i_size_read(inode); | |
60556 | ||
60557 | if (limit != RLIM_INFINITY) { | |
60558 | + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0); | |
60559 | if (*pos >= limit) { | |
60560 | send_sig(SIGXFSZ, current, 0); | |
60561 | return -EFBIG; | |
60562 | diff -urNp linux-3.0.3/mm/fremap.c linux-3.0.3/mm/fremap.c | |
60563 | --- linux-3.0.3/mm/fremap.c 2011-07-21 22:17:23.000000000 -0400 | |
60564 | +++ linux-3.0.3/mm/fremap.c 2011-08-23 21:47:56.000000000 -0400 | |
60565 | @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign | |
60566 | retry: | |
60567 | vma = find_vma(mm, start); | |
60568 | ||
60569 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60570 | + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC)) | |
60571 | + goto out; | |
60572 | +#endif | |
60573 | + | |
60574 | /* | |
60575 | * Make sure the vma is shared, that it supports prefaulting, | |
60576 | * and that the remapped range is valid and fully within | |
60577 | diff -urNp linux-3.0.3/mm/highmem.c linux-3.0.3/mm/highmem.c | |
60578 | --- linux-3.0.3/mm/highmem.c 2011-07-21 22:17:23.000000000 -0400 | |
60579 | +++ linux-3.0.3/mm/highmem.c 2011-08-23 21:47:56.000000000 -0400 | |
60580 | @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void) | |
60581 | * So no dangers, even with speculative execution. | |
60582 | */ | |
60583 | page = pte_page(pkmap_page_table[i]); | |
60584 | + pax_open_kernel(); | |
60585 | pte_clear(&init_mm, (unsigned long)page_address(page), | |
60586 | &pkmap_page_table[i]); | |
60587 | - | |
60588 | + pax_close_kernel(); | |
60589 | set_page_address(page, NULL); | |
60590 | need_flush = 1; | |
60591 | } | |
60592 | @@ -186,9 +187,11 @@ start: | |
60593 | } | |
60594 | } | |
60595 | vaddr = PKMAP_ADDR(last_pkmap_nr); | |
60596 | + | |
60597 | + pax_open_kernel(); | |
60598 | set_pte_at(&init_mm, vaddr, | |
60599 | &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot)); | |
60600 | - | |
60601 | + pax_close_kernel(); | |
60602 | pkmap_count[last_pkmap_nr] = 1; | |
60603 | set_page_address(page, (void *)vaddr); | |
60604 | ||
60605 | diff -urNp linux-3.0.3/mm/huge_memory.c linux-3.0.3/mm/huge_memory.c | |
60606 | --- linux-3.0.3/mm/huge_memory.c 2011-07-21 22:17:23.000000000 -0400 | |
60607 | +++ linux-3.0.3/mm/huge_memory.c 2011-08-23 21:47:56.000000000 -0400 | |
60608 | @@ -702,7 +702,7 @@ out: | |
60609 | * run pte_offset_map on the pmd, if an huge pmd could | |
60610 | * materialize from under us from a different thread. | |
60611 | */ | |
60612 | - if (unlikely(__pte_alloc(mm, vma, pmd, address))) | |
60613 | + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address))) | |
60614 | return VM_FAULT_OOM; | |
60615 | /* if an huge pmd materialized from under us just retry later */ | |
60616 | if (unlikely(pmd_trans_huge(*pmd))) | |
60617 | diff -urNp linux-3.0.3/mm/hugetlb.c linux-3.0.3/mm/hugetlb.c | |
60618 | --- linux-3.0.3/mm/hugetlb.c 2011-07-21 22:17:23.000000000 -0400 | |
60619 | +++ linux-3.0.3/mm/hugetlb.c 2011-08-23 21:47:56.000000000 -0400 | |
60620 | @@ -2339,6 +2339,27 @@ static int unmap_ref_private(struct mm_s | |
60621 | return 1; | |
60622 | } | |
60623 | ||
60624 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60625 | +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m) | |
60626 | +{ | |
60627 | + struct mm_struct *mm = vma->vm_mm; | |
60628 | + struct vm_area_struct *vma_m; | |
60629 | + unsigned long address_m; | |
60630 | + pte_t *ptep_m; | |
60631 | + | |
60632 | + vma_m = pax_find_mirror_vma(vma); | |
60633 | + if (!vma_m) | |
60634 | + return; | |
60635 | + | |
60636 | + BUG_ON(address >= SEGMEXEC_TASK_SIZE); | |
60637 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
60638 | + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK); | |
60639 | + get_page(page_m); | |
60640 | + hugepage_add_anon_rmap(page_m, vma_m, address_m); | |
60641 | + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0)); | |
60642 | +} | |
60643 | +#endif | |
60644 | + | |
60645 | /* | |
60646 | * Hugetlb_cow() should be called with page lock of the original hugepage held. | |
60647 | */ | |
60648 | @@ -2440,6 +2461,11 @@ retry_avoidcopy: | |
60649 | make_huge_pte(vma, new_page, 1)); | |
60650 | page_remove_rmap(old_page); | |
60651 | hugepage_add_new_anon_rmap(new_page, vma, address); | |
60652 | + | |
60653 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60654 | + pax_mirror_huge_pte(vma, address, new_page); | |
60655 | +#endif | |
60656 | + | |
60657 | /* Make the old page be freed below */ | |
60658 | new_page = old_page; | |
60659 | mmu_notifier_invalidate_range_end(mm, | |
60660 | @@ -2591,6 +2617,10 @@ retry: | |
60661 | && (vma->vm_flags & VM_SHARED))); | |
60662 | set_huge_pte_at(mm, address, ptep, new_pte); | |
60663 | ||
60664 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60665 | + pax_mirror_huge_pte(vma, address, page); | |
60666 | +#endif | |
60667 | + | |
60668 | if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) { | |
60669 | /* Optimization, do the COW without a second fault */ | |
60670 | ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page); | |
60671 | @@ -2620,6 +2650,10 @@ int hugetlb_fault(struct mm_struct *mm, | |
60672 | static DEFINE_MUTEX(hugetlb_instantiation_mutex); | |
60673 | struct hstate *h = hstate_vma(vma); | |
60674 | ||
60675 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60676 | + struct vm_area_struct *vma_m; | |
60677 | +#endif | |
60678 | + | |
60679 | ptep = huge_pte_offset(mm, address); | |
60680 | if (ptep) { | |
60681 | entry = huge_ptep_get(ptep); | |
60682 | @@ -2631,6 +2665,26 @@ int hugetlb_fault(struct mm_struct *mm, | |
60683 | VM_FAULT_SET_HINDEX(h - hstates); | |
60684 | } | |
60685 | ||
60686 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60687 | + vma_m = pax_find_mirror_vma(vma); | |
60688 | + if (vma_m) { | |
60689 | + unsigned long address_m; | |
60690 | + | |
60691 | + if (vma->vm_start > vma_m->vm_start) { | |
60692 | + address_m = address; | |
60693 | + address -= SEGMEXEC_TASK_SIZE; | |
60694 | + vma = vma_m; | |
60695 | + h = hstate_vma(vma); | |
60696 | + } else | |
60697 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
60698 | + | |
60699 | + if (!huge_pte_alloc(mm, address_m, huge_page_size(h))) | |
60700 | + return VM_FAULT_OOM; | |
60701 | + address_m &= HPAGE_MASK; | |
60702 | + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL); | |
60703 | + } | |
60704 | +#endif | |
60705 | + | |
60706 | ptep = huge_pte_alloc(mm, address, huge_page_size(h)); | |
60707 | if (!ptep) | |
60708 | return VM_FAULT_OOM; | |
60709 | diff -urNp linux-3.0.3/mm/internal.h linux-3.0.3/mm/internal.h | |
60710 | --- linux-3.0.3/mm/internal.h 2011-07-21 22:17:23.000000000 -0400 | |
60711 | +++ linux-3.0.3/mm/internal.h 2011-08-23 21:47:56.000000000 -0400 | |
60712 | @@ -49,6 +49,7 @@ extern void putback_lru_page(struct page | |
60713 | * in mm/page_alloc.c | |
60714 | */ | |
60715 | extern void __free_pages_bootmem(struct page *page, unsigned int order); | |
60716 | +extern void free_compound_page(struct page *page); | |
60717 | extern void prep_compound_page(struct page *page, unsigned long order); | |
60718 | #ifdef CONFIG_MEMORY_FAILURE | |
60719 | extern bool is_free_buddy_page(struct page *page); | |
60720 | diff -urNp linux-3.0.3/mm/Kconfig linux-3.0.3/mm/Kconfig | |
60721 | --- linux-3.0.3/mm/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
60722 | +++ linux-3.0.3/mm/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
60723 | @@ -240,7 +240,7 @@ config KSM | |
60724 | config DEFAULT_MMAP_MIN_ADDR | |
60725 | int "Low address space to protect from user allocation" | |
60726 | depends on MMU | |
60727 | - default 4096 | |
60728 | + default 65536 | |
60729 | help | |
60730 | This is the portion of low virtual memory which should be protected | |
60731 | from userspace allocation. Keeping a user from writing to low pages | |
60732 | diff -urNp linux-3.0.3/mm/kmemleak.c linux-3.0.3/mm/kmemleak.c | |
60733 | --- linux-3.0.3/mm/kmemleak.c 2011-07-21 22:17:23.000000000 -0400 | |
60734 | +++ linux-3.0.3/mm/kmemleak.c 2011-08-23 21:48:14.000000000 -0400 | |
60735 | @@ -357,7 +357,7 @@ static void print_unreferenced(struct se | |
60736 | ||
60737 | for (i = 0; i < object->trace_len; i++) { | |
60738 | void *ptr = (void *)object->trace[i]; | |
60739 | - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr); | |
60740 | + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr); | |
60741 | } | |
60742 | } | |
60743 | ||
60744 | diff -urNp linux-3.0.3/mm/madvise.c linux-3.0.3/mm/madvise.c | |
60745 | --- linux-3.0.3/mm/madvise.c 2011-07-21 22:17:23.000000000 -0400 | |
60746 | +++ linux-3.0.3/mm/madvise.c 2011-08-23 21:47:56.000000000 -0400 | |
60747 | @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a | |
60748 | pgoff_t pgoff; | |
60749 | unsigned long new_flags = vma->vm_flags; | |
60750 | ||
60751 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60752 | + struct vm_area_struct *vma_m; | |
60753 | +#endif | |
60754 | + | |
60755 | switch (behavior) { | |
60756 | case MADV_NORMAL: | |
60757 | new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ; | |
60758 | @@ -110,6 +114,13 @@ success: | |
60759 | /* | |
60760 | * vm_flags is protected by the mmap_sem held in write mode. | |
60761 | */ | |
60762 | + | |
60763 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60764 | + vma_m = pax_find_mirror_vma(vma); | |
60765 | + if (vma_m) | |
60766 | + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT); | |
60767 | +#endif | |
60768 | + | |
60769 | vma->vm_flags = new_flags; | |
60770 | ||
60771 | out: | |
60772 | @@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a | |
60773 | struct vm_area_struct ** prev, | |
60774 | unsigned long start, unsigned long end) | |
60775 | { | |
60776 | + | |
60777 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60778 | + struct vm_area_struct *vma_m; | |
60779 | +#endif | |
60780 | + | |
60781 | *prev = vma; | |
60782 | if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP)) | |
60783 | return -EINVAL; | |
60784 | @@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a | |
60785 | zap_page_range(vma, start, end - start, &details); | |
60786 | } else | |
60787 | zap_page_range(vma, start, end - start, NULL); | |
60788 | + | |
60789 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60790 | + vma_m = pax_find_mirror_vma(vma); | |
60791 | + if (vma_m) { | |
60792 | + if (unlikely(vma->vm_flags & VM_NONLINEAR)) { | |
60793 | + struct zap_details details = { | |
60794 | + .nonlinear_vma = vma_m, | |
60795 | + .last_index = ULONG_MAX, | |
60796 | + }; | |
60797 | + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details); | |
60798 | + } else | |
60799 | + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL); | |
60800 | + } | |
60801 | +#endif | |
60802 | + | |
60803 | return 0; | |
60804 | } | |
60805 | ||
60806 | @@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, | |
60807 | if (end < start) | |
60808 | goto out; | |
60809 | ||
60810 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60811 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) { | |
60812 | + if (end > SEGMEXEC_TASK_SIZE) | |
60813 | + goto out; | |
60814 | + } else | |
60815 | +#endif | |
60816 | + | |
60817 | + if (end > TASK_SIZE) | |
60818 | + goto out; | |
60819 | + | |
60820 | error = 0; | |
60821 | if (end == start) | |
60822 | goto out; | |
60823 | diff -urNp linux-3.0.3/mm/memory.c linux-3.0.3/mm/memory.c | |
60824 | --- linux-3.0.3/mm/memory.c 2011-08-23 21:44:40.000000000 -0400 | |
60825 | +++ linux-3.0.3/mm/memory.c 2011-08-23 21:47:56.000000000 -0400 | |
60826 | @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct | |
60827 | return; | |
60828 | ||
60829 | pmd = pmd_offset(pud, start); | |
60830 | + | |
60831 | +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD) | |
60832 | pud_clear(pud); | |
60833 | pmd_free_tlb(tlb, pmd, start); | |
60834 | +#endif | |
60835 | + | |
60836 | } | |
60837 | ||
60838 | static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd, | |
60839 | @@ -489,9 +493,12 @@ static inline void free_pud_range(struct | |
60840 | if (end - 1 > ceiling - 1) | |
60841 | return; | |
60842 | ||
60843 | +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD) | |
60844 | pud = pud_offset(pgd, start); | |
60845 | pgd_clear(pgd); | |
60846 | pud_free_tlb(tlb, pud, start); | |
60847 | +#endif | |
60848 | + | |
60849 | } | |
60850 | ||
60851 | /* | |
60852 | @@ -1577,12 +1584,6 @@ no_page_table: | |
60853 | return page; | |
60854 | } | |
60855 | ||
60856 | -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr) | |
60857 | -{ | |
60858 | - return stack_guard_page_start(vma, addr) || | |
60859 | - stack_guard_page_end(vma, addr+PAGE_SIZE); | |
60860 | -} | |
60861 | - | |
60862 | /** | |
60863 | * __get_user_pages() - pin user pages in memory | |
60864 | * @tsk: task_struct of target task | |
60865 | @@ -1655,10 +1656,10 @@ int __get_user_pages(struct task_struct | |
60866 | (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE); | |
60867 | i = 0; | |
60868 | ||
60869 | - do { | |
60870 | + while (nr_pages) { | |
60871 | struct vm_area_struct *vma; | |
60872 | ||
60873 | - vma = find_extend_vma(mm, start); | |
60874 | + vma = find_vma(mm, start); | |
60875 | if (!vma && in_gate_area(mm, start)) { | |
60876 | unsigned long pg = start & PAGE_MASK; | |
60877 | pgd_t *pgd; | |
60878 | @@ -1706,7 +1707,7 @@ int __get_user_pages(struct task_struct | |
60879 | goto next_page; | |
60880 | } | |
60881 | ||
60882 | - if (!vma || | |
60883 | + if (!vma || start < vma->vm_start || | |
60884 | (vma->vm_flags & (VM_IO | VM_PFNMAP)) || | |
60885 | !(vm_flags & vma->vm_flags)) | |
60886 | return i ? : -EFAULT; | |
60887 | @@ -1733,11 +1734,6 @@ int __get_user_pages(struct task_struct | |
60888 | int ret; | |
60889 | unsigned int fault_flags = 0; | |
60890 | ||
60891 | - /* For mlock, just skip the stack guard page. */ | |
60892 | - if (foll_flags & FOLL_MLOCK) { | |
60893 | - if (stack_guard_page(vma, start)) | |
60894 | - goto next_page; | |
60895 | - } | |
60896 | if (foll_flags & FOLL_WRITE) | |
60897 | fault_flags |= FAULT_FLAG_WRITE; | |
60898 | if (nonblocking) | |
60899 | @@ -1811,7 +1807,7 @@ next_page: | |
60900 | start += PAGE_SIZE; | |
60901 | nr_pages--; | |
60902 | } while (nr_pages && start < vma->vm_end); | |
60903 | - } while (nr_pages); | |
60904 | + } | |
60905 | return i; | |
60906 | } | |
60907 | EXPORT_SYMBOL(__get_user_pages); | |
60908 | @@ -2018,6 +2014,10 @@ static int insert_page(struct vm_area_st | |
60909 | page_add_file_rmap(page); | |
60910 | set_pte_at(mm, addr, pte, mk_pte(page, prot)); | |
60911 | ||
60912 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60913 | + pax_mirror_file_pte(vma, addr, page, ptl); | |
60914 | +#endif | |
60915 | + | |
60916 | retval = 0; | |
60917 | pte_unmap_unlock(pte, ptl); | |
60918 | return retval; | |
60919 | @@ -2052,10 +2052,22 @@ out: | |
60920 | int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, | |
60921 | struct page *page) | |
60922 | { | |
60923 | + | |
60924 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60925 | + struct vm_area_struct *vma_m; | |
60926 | +#endif | |
60927 | + | |
60928 | if (addr < vma->vm_start || addr >= vma->vm_end) | |
60929 | return -EFAULT; | |
60930 | if (!page_count(page)) | |
60931 | return -EINVAL; | |
60932 | + | |
60933 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60934 | + vma_m = pax_find_mirror_vma(vma); | |
60935 | + if (vma_m) | |
60936 | + vma_m->vm_flags |= VM_INSERTPAGE; | |
60937 | +#endif | |
60938 | + | |
60939 | vma->vm_flags |= VM_INSERTPAGE; | |
60940 | return insert_page(vma, addr, page, vma->vm_page_prot); | |
60941 | } | |
60942 | @@ -2141,6 +2153,7 @@ int vm_insert_mixed(struct vm_area_struc | |
60943 | unsigned long pfn) | |
60944 | { | |
60945 | BUG_ON(!(vma->vm_flags & VM_MIXEDMAP)); | |
60946 | + BUG_ON(vma->vm_mirror); | |
60947 | ||
60948 | if (addr < vma->vm_start || addr >= vma->vm_end) | |
60949 | return -EFAULT; | |
60950 | @@ -2456,6 +2469,186 @@ static inline void cow_user_page(struct | |
60951 | copy_user_highpage(dst, src, va, vma); | |
60952 | } | |
60953 | ||
60954 | +#ifdef CONFIG_PAX_SEGMEXEC | |
60955 | +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd) | |
60956 | +{ | |
60957 | + struct mm_struct *mm = vma->vm_mm; | |
60958 | + spinlock_t *ptl; | |
60959 | + pte_t *pte, entry; | |
60960 | + | |
60961 | + pte = pte_offset_map_lock(mm, pmd, address, &ptl); | |
60962 | + entry = *pte; | |
60963 | + if (!pte_present(entry)) { | |
60964 | + if (!pte_none(entry)) { | |
60965 | + BUG_ON(pte_file(entry)); | |
60966 | + free_swap_and_cache(pte_to_swp_entry(entry)); | |
60967 | + pte_clear_not_present_full(mm, address, pte, 0); | |
60968 | + } | |
60969 | + } else { | |
60970 | + struct page *page; | |
60971 | + | |
60972 | + flush_cache_page(vma, address, pte_pfn(entry)); | |
60973 | + entry = ptep_clear_flush(vma, address, pte); | |
60974 | + BUG_ON(pte_dirty(entry)); | |
60975 | + page = vm_normal_page(vma, address, entry); | |
60976 | + if (page) { | |
60977 | + update_hiwater_rss(mm); | |
60978 | + if (PageAnon(page)) | |
60979 | + dec_mm_counter_fast(mm, MM_ANONPAGES); | |
60980 | + else | |
60981 | + dec_mm_counter_fast(mm, MM_FILEPAGES); | |
60982 | + page_remove_rmap(page); | |
60983 | + page_cache_release(page); | |
60984 | + } | |
60985 | + } | |
60986 | + pte_unmap_unlock(pte, ptl); | |
60987 | +} | |
60988 | + | |
60989 | +/* PaX: if vma is mirrored, synchronize the mirror's PTE | |
60990 | + * | |
60991 | + * the ptl of the lower mapped page is held on entry and is not released on exit | |
60992 | + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc) | |
60993 | + */ | |
60994 | +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl) | |
60995 | +{ | |
60996 | + struct mm_struct *mm = vma->vm_mm; | |
60997 | + unsigned long address_m; | |
60998 | + spinlock_t *ptl_m; | |
60999 | + struct vm_area_struct *vma_m; | |
61000 | + pmd_t *pmd_m; | |
61001 | + pte_t *pte_m, entry_m; | |
61002 | + | |
61003 | + BUG_ON(!page_m || !PageAnon(page_m)); | |
61004 | + | |
61005 | + vma_m = pax_find_mirror_vma(vma); | |
61006 | + if (!vma_m) | |
61007 | + return; | |
61008 | + | |
61009 | + BUG_ON(!PageLocked(page_m)); | |
61010 | + BUG_ON(address >= SEGMEXEC_TASK_SIZE); | |
61011 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
61012 | + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m); | |
61013 | + pte_m = pte_offset_map(pmd_m, address_m); | |
61014 | + ptl_m = pte_lockptr(mm, pmd_m); | |
61015 | + if (ptl != ptl_m) { | |
61016 | + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING); | |
61017 | + if (!pte_none(*pte_m)) | |
61018 | + goto out; | |
61019 | + } | |
61020 | + | |
61021 | + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot); | |
61022 | + page_cache_get(page_m); | |
61023 | + page_add_anon_rmap(page_m, vma_m, address_m); | |
61024 | + inc_mm_counter_fast(mm, MM_ANONPAGES); | |
61025 | + set_pte_at(mm, address_m, pte_m, entry_m); | |
61026 | + update_mmu_cache(vma_m, address_m, entry_m); | |
61027 | +out: | |
61028 | + if (ptl != ptl_m) | |
61029 | + spin_unlock(ptl_m); | |
61030 | + pte_unmap(pte_m); | |
61031 | + unlock_page(page_m); | |
61032 | +} | |
61033 | + | |
61034 | +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl) | |
61035 | +{ | |
61036 | + struct mm_struct *mm = vma->vm_mm; | |
61037 | + unsigned long address_m; | |
61038 | + spinlock_t *ptl_m; | |
61039 | + struct vm_area_struct *vma_m; | |
61040 | + pmd_t *pmd_m; | |
61041 | + pte_t *pte_m, entry_m; | |
61042 | + | |
61043 | + BUG_ON(!page_m || PageAnon(page_m)); | |
61044 | + | |
61045 | + vma_m = pax_find_mirror_vma(vma); | |
61046 | + if (!vma_m) | |
61047 | + return; | |
61048 | + | |
61049 | + BUG_ON(address >= SEGMEXEC_TASK_SIZE); | |
61050 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
61051 | + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m); | |
61052 | + pte_m = pte_offset_map(pmd_m, address_m); | |
61053 | + ptl_m = pte_lockptr(mm, pmd_m); | |
61054 | + if (ptl != ptl_m) { | |
61055 | + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING); | |
61056 | + if (!pte_none(*pte_m)) | |
61057 | + goto out; | |
61058 | + } | |
61059 | + | |
61060 | + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot); | |
61061 | + page_cache_get(page_m); | |
61062 | + page_add_file_rmap(page_m); | |
61063 | + inc_mm_counter_fast(mm, MM_FILEPAGES); | |
61064 | + set_pte_at(mm, address_m, pte_m, entry_m); | |
61065 | + update_mmu_cache(vma_m, address_m, entry_m); | |
61066 | +out: | |
61067 | + if (ptl != ptl_m) | |
61068 | + spin_unlock(ptl_m); | |
61069 | + pte_unmap(pte_m); | |
61070 | +} | |
61071 | + | |
61072 | +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl) | |
61073 | +{ | |
61074 | + struct mm_struct *mm = vma->vm_mm; | |
61075 | + unsigned long address_m; | |
61076 | + spinlock_t *ptl_m; | |
61077 | + struct vm_area_struct *vma_m; | |
61078 | + pmd_t *pmd_m; | |
61079 | + pte_t *pte_m, entry_m; | |
61080 | + | |
61081 | + vma_m = pax_find_mirror_vma(vma); | |
61082 | + if (!vma_m) | |
61083 | + return; | |
61084 | + | |
61085 | + BUG_ON(address >= SEGMEXEC_TASK_SIZE); | |
61086 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
61087 | + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m); | |
61088 | + pte_m = pte_offset_map(pmd_m, address_m); | |
61089 | + ptl_m = pte_lockptr(mm, pmd_m); | |
61090 | + if (ptl != ptl_m) { | |
61091 | + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING); | |
61092 | + if (!pte_none(*pte_m)) | |
61093 | + goto out; | |
61094 | + } | |
61095 | + | |
61096 | + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot); | |
61097 | + set_pte_at(mm, address_m, pte_m, entry_m); | |
61098 | +out: | |
61099 | + if (ptl != ptl_m) | |
61100 | + spin_unlock(ptl_m); | |
61101 | + pte_unmap(pte_m); | |
61102 | +} | |
61103 | + | |
61104 | +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl) | |
61105 | +{ | |
61106 | + struct page *page_m; | |
61107 | + pte_t entry; | |
61108 | + | |
61109 | + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC)) | |
61110 | + goto out; | |
61111 | + | |
61112 | + entry = *pte; | |
61113 | + page_m = vm_normal_page(vma, address, entry); | |
61114 | + if (!page_m) | |
61115 | + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl); | |
61116 | + else if (PageAnon(page_m)) { | |
61117 | + if (pax_find_mirror_vma(vma)) { | |
61118 | + pte_unmap_unlock(pte, ptl); | |
61119 | + lock_page(page_m); | |
61120 | + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl); | |
61121 | + if (pte_same(entry, *pte)) | |
61122 | + pax_mirror_anon_pte(vma, address, page_m, ptl); | |
61123 | + else | |
61124 | + unlock_page(page_m); | |
61125 | + } | |
61126 | + } else | |
61127 | + pax_mirror_file_pte(vma, address, page_m, ptl); | |
61128 | + | |
61129 | +out: | |
61130 | + pte_unmap_unlock(pte, ptl); | |
61131 | +} | |
61132 | +#endif | |
61133 | + | |
61134 | /* | |
61135 | * This routine handles present pages, when users try to write | |
61136 | * to a shared page. It is done by copying the page to a new address | |
61137 | @@ -2667,6 +2860,12 @@ gotten: | |
61138 | */ | |
61139 | page_table = pte_offset_map_lock(mm, pmd, address, &ptl); | |
61140 | if (likely(pte_same(*page_table, orig_pte))) { | |
61141 | + | |
61142 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61143 | + if (pax_find_mirror_vma(vma)) | |
61144 | + BUG_ON(!trylock_page(new_page)); | |
61145 | +#endif | |
61146 | + | |
61147 | if (old_page) { | |
61148 | if (!PageAnon(old_page)) { | |
61149 | dec_mm_counter_fast(mm, MM_FILEPAGES); | |
61150 | @@ -2718,6 +2917,10 @@ gotten: | |
61151 | page_remove_rmap(old_page); | |
61152 | } | |
61153 | ||
61154 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61155 | + pax_mirror_anon_pte(vma, address, new_page, ptl); | |
61156 | +#endif | |
61157 | + | |
61158 | /* Free the old page.. */ | |
61159 | new_page = old_page; | |
61160 | ret |= VM_FAULT_WRITE; | |
61161 | @@ -2997,6 +3200,11 @@ static int do_swap_page(struct mm_struct | |
61162 | swap_free(entry); | |
61163 | if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page)) | |
61164 | try_to_free_swap(page); | |
61165 | + | |
61166 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61167 | + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma)) | |
61168 | +#endif | |
61169 | + | |
61170 | unlock_page(page); | |
61171 | if (swapcache) { | |
61172 | /* | |
61173 | @@ -3020,6 +3228,11 @@ static int do_swap_page(struct mm_struct | |
61174 | ||
61175 | /* No need to invalidate - it was non-present before */ | |
61176 | update_mmu_cache(vma, address, page_table); | |
61177 | + | |
61178 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61179 | + pax_mirror_anon_pte(vma, address, page, ptl); | |
61180 | +#endif | |
61181 | + | |
61182 | unlock: | |
61183 | pte_unmap_unlock(page_table, ptl); | |
61184 | out: | |
61185 | @@ -3039,40 +3252,6 @@ out_release: | |
61186 | } | |
61187 | ||
61188 | /* | |
61189 | - * This is like a special single-page "expand_{down|up}wards()", | |
61190 | - * except we must first make sure that 'address{-|+}PAGE_SIZE' | |
61191 | - * doesn't hit another vma. | |
61192 | - */ | |
61193 | -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address) | |
61194 | -{ | |
61195 | - address &= PAGE_MASK; | |
61196 | - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) { | |
61197 | - struct vm_area_struct *prev = vma->vm_prev; | |
61198 | - | |
61199 | - /* | |
61200 | - * Is there a mapping abutting this one below? | |
61201 | - * | |
61202 | - * That's only ok if it's the same stack mapping | |
61203 | - * that has gotten split.. | |
61204 | - */ | |
61205 | - if (prev && prev->vm_end == address) | |
61206 | - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; | |
61207 | - | |
61208 | - expand_downwards(vma, address - PAGE_SIZE); | |
61209 | - } | |
61210 | - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) { | |
61211 | - struct vm_area_struct *next = vma->vm_next; | |
61212 | - | |
61213 | - /* As VM_GROWSDOWN but s/below/above/ */ | |
61214 | - if (next && next->vm_start == address + PAGE_SIZE) | |
61215 | - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; | |
61216 | - | |
61217 | - expand_upwards(vma, address + PAGE_SIZE); | |
61218 | - } | |
61219 | - return 0; | |
61220 | -} | |
61221 | - | |
61222 | -/* | |
61223 | * We enter with non-exclusive mmap_sem (to exclude vma changes, | |
61224 | * but allow concurrent faults), and pte mapped but not yet locked. | |
61225 | * We return with mmap_sem still held, but pte unmapped and unlocked. | |
61226 | @@ -3081,27 +3260,23 @@ static int do_anonymous_page(struct mm_s | |
61227 | unsigned long address, pte_t *page_table, pmd_t *pmd, | |
61228 | unsigned int flags) | |
61229 | { | |
61230 | - struct page *page; | |
61231 | + struct page *page = NULL; | |
61232 | spinlock_t *ptl; | |
61233 | pte_t entry; | |
61234 | ||
61235 | - pte_unmap(page_table); | |
61236 | - | |
61237 | - /* Check if we need to add a guard page to the stack */ | |
61238 | - if (check_stack_guard_page(vma, address) < 0) | |
61239 | - return VM_FAULT_SIGBUS; | |
61240 | - | |
61241 | - /* Use the zero-page for reads */ | |
61242 | if (!(flags & FAULT_FLAG_WRITE)) { | |
61243 | entry = pte_mkspecial(pfn_pte(my_zero_pfn(address), | |
61244 | vma->vm_page_prot)); | |
61245 | - page_table = pte_offset_map_lock(mm, pmd, address, &ptl); | |
61246 | + ptl = pte_lockptr(mm, pmd); | |
61247 | + spin_lock(ptl); | |
61248 | if (!pte_none(*page_table)) | |
61249 | goto unlock; | |
61250 | goto setpte; | |
61251 | } | |
61252 | ||
61253 | /* Allocate our own private page. */ | |
61254 | + pte_unmap(page_table); | |
61255 | + | |
61256 | if (unlikely(anon_vma_prepare(vma))) | |
61257 | goto oom; | |
61258 | page = alloc_zeroed_user_highpage_movable(vma, address); | |
61259 | @@ -3120,6 +3295,11 @@ static int do_anonymous_page(struct mm_s | |
61260 | if (!pte_none(*page_table)) | |
61261 | goto release; | |
61262 | ||
61263 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61264 | + if (pax_find_mirror_vma(vma)) | |
61265 | + BUG_ON(!trylock_page(page)); | |
61266 | +#endif | |
61267 | + | |
61268 | inc_mm_counter_fast(mm, MM_ANONPAGES); | |
61269 | page_add_new_anon_rmap(page, vma, address); | |
61270 | setpte: | |
61271 | @@ -3127,6 +3307,12 @@ setpte: | |
61272 | ||
61273 | /* No need to invalidate - it was non-present before */ | |
61274 | update_mmu_cache(vma, address, page_table); | |
61275 | + | |
61276 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61277 | + if (page) | |
61278 | + pax_mirror_anon_pte(vma, address, page, ptl); | |
61279 | +#endif | |
61280 | + | |
61281 | unlock: | |
61282 | pte_unmap_unlock(page_table, ptl); | |
61283 | return 0; | |
61284 | @@ -3264,6 +3450,12 @@ static int __do_fault(struct mm_struct * | |
61285 | */ | |
61286 | /* Only go through if we didn't race with anybody else... */ | |
61287 | if (likely(pte_same(*page_table, orig_pte))) { | |
61288 | + | |
61289 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61290 | + if (anon && pax_find_mirror_vma(vma)) | |
61291 | + BUG_ON(!trylock_page(page)); | |
61292 | +#endif | |
61293 | + | |
61294 | flush_icache_page(vma, page); | |
61295 | entry = mk_pte(page, vma->vm_page_prot); | |
61296 | if (flags & FAULT_FLAG_WRITE) | |
61297 | @@ -3283,6 +3475,14 @@ static int __do_fault(struct mm_struct * | |
61298 | ||
61299 | /* no need to invalidate: a not-present page won't be cached */ | |
61300 | update_mmu_cache(vma, address, page_table); | |
61301 | + | |
61302 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61303 | + if (anon) | |
61304 | + pax_mirror_anon_pte(vma, address, page, ptl); | |
61305 | + else | |
61306 | + pax_mirror_file_pte(vma, address, page, ptl); | |
61307 | +#endif | |
61308 | + | |
61309 | } else { | |
61310 | if (charged) | |
61311 | mem_cgroup_uncharge_page(page); | |
61312 | @@ -3430,6 +3630,12 @@ int handle_pte_fault(struct mm_struct *m | |
61313 | if (flags & FAULT_FLAG_WRITE) | |
61314 | flush_tlb_fix_spurious_fault(vma, address); | |
61315 | } | |
61316 | + | |
61317 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61318 | + pax_mirror_pte(vma, address, pte, pmd, ptl); | |
61319 | + return 0; | |
61320 | +#endif | |
61321 | + | |
61322 | unlock: | |
61323 | pte_unmap_unlock(pte, ptl); | |
61324 | return 0; | |
61325 | @@ -3446,6 +3652,10 @@ int handle_mm_fault(struct mm_struct *mm | |
61326 | pmd_t *pmd; | |
61327 | pte_t *pte; | |
61328 | ||
61329 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61330 | + struct vm_area_struct *vma_m; | |
61331 | +#endif | |
61332 | + | |
61333 | __set_current_state(TASK_RUNNING); | |
61334 | ||
61335 | count_vm_event(PGFAULT); | |
61336 | @@ -3457,6 +3667,34 @@ int handle_mm_fault(struct mm_struct *mm | |
61337 | if (unlikely(is_vm_hugetlb_page(vma))) | |
61338 | return hugetlb_fault(mm, vma, address, flags); | |
61339 | ||
61340 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61341 | + vma_m = pax_find_mirror_vma(vma); | |
61342 | + if (vma_m) { | |
61343 | + unsigned long address_m; | |
61344 | + pgd_t *pgd_m; | |
61345 | + pud_t *pud_m; | |
61346 | + pmd_t *pmd_m; | |
61347 | + | |
61348 | + if (vma->vm_start > vma_m->vm_start) { | |
61349 | + address_m = address; | |
61350 | + address -= SEGMEXEC_TASK_SIZE; | |
61351 | + vma = vma_m; | |
61352 | + } else | |
61353 | + address_m = address + SEGMEXEC_TASK_SIZE; | |
61354 | + | |
61355 | + pgd_m = pgd_offset(mm, address_m); | |
61356 | + pud_m = pud_alloc(mm, pgd_m, address_m); | |
61357 | + if (!pud_m) | |
61358 | + return VM_FAULT_OOM; | |
61359 | + pmd_m = pmd_alloc(mm, pud_m, address_m); | |
61360 | + if (!pmd_m) | |
61361 | + return VM_FAULT_OOM; | |
61362 | + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m)) | |
61363 | + return VM_FAULT_OOM; | |
61364 | + pax_unmap_mirror_pte(vma_m, address_m, pmd_m); | |
61365 | + } | |
61366 | +#endif | |
61367 | + | |
61368 | pgd = pgd_offset(mm, address); | |
61369 | pud = pud_alloc(mm, pgd, address); | |
61370 | if (!pud) | |
61371 | @@ -3486,7 +3724,7 @@ int handle_mm_fault(struct mm_struct *mm | |
61372 | * run pte_offset_map on the pmd, if an huge pmd could | |
61373 | * materialize from under us from a different thread. | |
61374 | */ | |
61375 | - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address)) | |
61376 | + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address))) | |
61377 | return VM_FAULT_OOM; | |
61378 | /* if an huge pmd materialized from under us just retry later */ | |
61379 | if (unlikely(pmd_trans_huge(*pmd))) | |
61380 | @@ -3590,7 +3828,7 @@ static int __init gate_vma_init(void) | |
61381 | gate_vma.vm_start = FIXADDR_USER_START; | |
61382 | gate_vma.vm_end = FIXADDR_USER_END; | |
61383 | gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC; | |
61384 | - gate_vma.vm_page_prot = __P101; | |
61385 | + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags); | |
61386 | /* | |
61387 | * Make sure the vDSO gets into every core dump. | |
61388 | * Dumping its contents makes post-mortem fully interpretable later | |
61389 | diff -urNp linux-3.0.3/mm/memory-failure.c linux-3.0.3/mm/memory-failure.c | |
61390 | --- linux-3.0.3/mm/memory-failure.c 2011-07-21 22:17:23.000000000 -0400 | |
61391 | +++ linux-3.0.3/mm/memory-failure.c 2011-08-23 21:47:56.000000000 -0400 | |
61392 | @@ -59,7 +59,7 @@ int sysctl_memory_failure_early_kill __r | |
61393 | ||
61394 | int sysctl_memory_failure_recovery __read_mostly = 1; | |
61395 | ||
61396 | -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0); | |
61397 | +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0); | |
61398 | ||
61399 | #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE) | |
61400 | ||
61401 | @@ -1008,7 +1008,7 @@ int __memory_failure(unsigned long pfn, | |
61402 | } | |
61403 | ||
61404 | nr_pages = 1 << compound_trans_order(hpage); | |
61405 | - atomic_long_add(nr_pages, &mce_bad_pages); | |
61406 | + atomic_long_add_unchecked(nr_pages, &mce_bad_pages); | |
61407 | ||
61408 | /* | |
61409 | * We need/can do nothing about count=0 pages. | |
61410 | @@ -1038,7 +1038,7 @@ int __memory_failure(unsigned long pfn, | |
61411 | if (!PageHWPoison(hpage) | |
61412 | || (hwpoison_filter(p) && TestClearPageHWPoison(p)) | |
61413 | || (p != hpage && TestSetPageHWPoison(hpage))) { | |
61414 | - atomic_long_sub(nr_pages, &mce_bad_pages); | |
61415 | + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages); | |
61416 | return 0; | |
61417 | } | |
61418 | set_page_hwpoison_huge_page(hpage); | |
61419 | @@ -1096,7 +1096,7 @@ int __memory_failure(unsigned long pfn, | |
61420 | } | |
61421 | if (hwpoison_filter(p)) { | |
61422 | if (TestClearPageHWPoison(p)) | |
61423 | - atomic_long_sub(nr_pages, &mce_bad_pages); | |
61424 | + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages); | |
61425 | unlock_page(hpage); | |
61426 | put_page(hpage); | |
61427 | return 0; | |
61428 | @@ -1222,7 +1222,7 @@ int unpoison_memory(unsigned long pfn) | |
61429 | return 0; | |
61430 | } | |
61431 | if (TestClearPageHWPoison(p)) | |
61432 | - atomic_long_sub(nr_pages, &mce_bad_pages); | |
61433 | + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages); | |
61434 | pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn); | |
61435 | return 0; | |
61436 | } | |
61437 | @@ -1236,7 +1236,7 @@ int unpoison_memory(unsigned long pfn) | |
61438 | */ | |
61439 | if (TestClearPageHWPoison(page)) { | |
61440 | pr_info("MCE: Software-unpoisoned page %#lx\n", pfn); | |
61441 | - atomic_long_sub(nr_pages, &mce_bad_pages); | |
61442 | + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages); | |
61443 | freeit = 1; | |
61444 | if (PageHuge(page)) | |
61445 | clear_page_hwpoison_huge_page(page); | |
61446 | @@ -1349,7 +1349,7 @@ static int soft_offline_huge_page(struct | |
61447 | } | |
61448 | done: | |
61449 | if (!PageHWPoison(hpage)) | |
61450 | - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages); | |
61451 | + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages); | |
61452 | set_page_hwpoison_huge_page(hpage); | |
61453 | dequeue_hwpoisoned_huge_page(hpage); | |
61454 | /* keep elevated page count for bad page */ | |
61455 | @@ -1480,7 +1480,7 @@ int soft_offline_page(struct page *page, | |
61456 | return ret; | |
61457 | ||
61458 | done: | |
61459 | - atomic_long_add(1, &mce_bad_pages); | |
61460 | + atomic_long_add_unchecked(1, &mce_bad_pages); | |
61461 | SetPageHWPoison(page); | |
61462 | /* keep elevated page count for bad page */ | |
61463 | return ret; | |
61464 | diff -urNp linux-3.0.3/mm/mempolicy.c linux-3.0.3/mm/mempolicy.c | |
61465 | --- linux-3.0.3/mm/mempolicy.c 2011-07-21 22:17:23.000000000 -0400 | |
61466 | +++ linux-3.0.3/mm/mempolicy.c 2011-08-23 21:48:14.000000000 -0400 | |
61467 | @@ -639,6 +639,10 @@ static int mbind_range(struct mm_struct | |
61468 | unsigned long vmstart; | |
61469 | unsigned long vmend; | |
61470 | ||
61471 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61472 | + struct vm_area_struct *vma_m; | |
61473 | +#endif | |
61474 | + | |
61475 | vma = find_vma_prev(mm, start, &prev); | |
61476 | if (!vma || vma->vm_start > start) | |
61477 | return -EFAULT; | |
61478 | @@ -669,6 +673,16 @@ static int mbind_range(struct mm_struct | |
61479 | err = policy_vma(vma, new_pol); | |
61480 | if (err) | |
61481 | goto out; | |
61482 | + | |
61483 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61484 | + vma_m = pax_find_mirror_vma(vma); | |
61485 | + if (vma_m) { | |
61486 | + err = policy_vma(vma_m, new_pol); | |
61487 | + if (err) | |
61488 | + goto out; | |
61489 | + } | |
61490 | +#endif | |
61491 | + | |
61492 | } | |
61493 | ||
61494 | out: | |
61495 | @@ -1102,6 +1116,17 @@ static long do_mbind(unsigned long start | |
61496 | ||
61497 | if (end < start) | |
61498 | return -EINVAL; | |
61499 | + | |
61500 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61501 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) { | |
61502 | + if (end > SEGMEXEC_TASK_SIZE) | |
61503 | + return -EINVAL; | |
61504 | + } else | |
61505 | +#endif | |
61506 | + | |
61507 | + if (end > TASK_SIZE) | |
61508 | + return -EINVAL; | |
61509 | + | |
61510 | if (end == start) | |
61511 | return 0; | |
61512 | ||
61513 | @@ -1320,6 +1345,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi | |
61514 | if (!mm) | |
61515 | goto out; | |
61516 | ||
61517 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
61518 | + if (mm != current->mm && | |
61519 | + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) { | |
61520 | + err = -EPERM; | |
61521 | + goto out; | |
61522 | + } | |
61523 | +#endif | |
61524 | + | |
61525 | /* | |
61526 | * Check if this process has the right to modify the specified | |
61527 | * process. The right exists if the process has administrative | |
61528 | @@ -1329,8 +1362,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi | |
61529 | rcu_read_lock(); | |
61530 | tcred = __task_cred(task); | |
61531 | if (cred->euid != tcred->suid && cred->euid != tcred->uid && | |
61532 | - cred->uid != tcred->suid && cred->uid != tcred->uid && | |
61533 | - !capable(CAP_SYS_NICE)) { | |
61534 | + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) { | |
61535 | rcu_read_unlock(); | |
61536 | err = -EPERM; | |
61537 | goto out; | |
61538 | diff -urNp linux-3.0.3/mm/migrate.c linux-3.0.3/mm/migrate.c | |
61539 | --- linux-3.0.3/mm/migrate.c 2011-07-21 22:17:23.000000000 -0400 | |
61540 | +++ linux-3.0.3/mm/migrate.c 2011-08-23 21:48:14.000000000 -0400 | |
61541 | @@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struc | |
61542 | unsigned long chunk_start; | |
61543 | int err; | |
61544 | ||
61545 | + pax_track_stack(); | |
61546 | + | |
61547 | task_nodes = cpuset_mems_allowed(task); | |
61548 | ||
61549 | err = -ENOMEM; | |
61550 | @@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, | |
61551 | if (!mm) | |
61552 | return -EINVAL; | |
61553 | ||
61554 | +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP | |
61555 | + if (mm != current->mm && | |
61556 | + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) { | |
61557 | + err = -EPERM; | |
61558 | + goto out; | |
61559 | + } | |
61560 | +#endif | |
61561 | + | |
61562 | /* | |
61563 | * Check if this process has the right to modify the specified | |
61564 | * process. The right exists if the process has administrative | |
61565 | @@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, | |
61566 | rcu_read_lock(); | |
61567 | tcred = __task_cred(task); | |
61568 | if (cred->euid != tcred->suid && cred->euid != tcred->uid && | |
61569 | - cred->uid != tcred->suid && cred->uid != tcred->uid && | |
61570 | - !capable(CAP_SYS_NICE)) { | |
61571 | + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) { | |
61572 | rcu_read_unlock(); | |
61573 | err = -EPERM; | |
61574 | goto out; | |
61575 | diff -urNp linux-3.0.3/mm/mlock.c linux-3.0.3/mm/mlock.c | |
61576 | --- linux-3.0.3/mm/mlock.c 2011-07-21 22:17:23.000000000 -0400 | |
61577 | +++ linux-3.0.3/mm/mlock.c 2011-08-23 21:48:14.000000000 -0400 | |
61578 | @@ -13,6 +13,7 @@ | |
61579 | #include <linux/pagemap.h> | |
61580 | #include <linux/mempolicy.h> | |
61581 | #include <linux/syscalls.h> | |
61582 | +#include <linux/security.h> | |
61583 | #include <linux/sched.h> | |
61584 | #include <linux/module.h> | |
61585 | #include <linux/rmap.h> | |
61586 | @@ -377,6 +378,9 @@ static int do_mlock(unsigned long start, | |
61587 | return -EINVAL; | |
61588 | if (end == start) | |
61589 | return 0; | |
61590 | + if (end > TASK_SIZE) | |
61591 | + return -EINVAL; | |
61592 | + | |
61593 | vma = find_vma_prev(current->mm, start, &prev); | |
61594 | if (!vma || vma->vm_start > start) | |
61595 | return -ENOMEM; | |
61596 | @@ -387,6 +391,11 @@ static int do_mlock(unsigned long start, | |
61597 | for (nstart = start ; ; ) { | |
61598 | vm_flags_t newflags; | |
61599 | ||
61600 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61601 | + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) | |
61602 | + break; | |
61603 | +#endif | |
61604 | + | |
61605 | /* Here we know that vma->vm_start <= nstart < vma->vm_end. */ | |
61606 | ||
61607 | newflags = vma->vm_flags | VM_LOCKED; | |
61608 | @@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st | |
61609 | lock_limit >>= PAGE_SHIFT; | |
61610 | ||
61611 | /* check against resource limits */ | |
61612 | + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1); | |
61613 | if ((locked <= lock_limit) || capable(CAP_IPC_LOCK)) | |
61614 | error = do_mlock(start, len, 1); | |
61615 | up_write(¤t->mm->mmap_sem); | |
61616 | @@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, | |
61617 | static int do_mlockall(int flags) | |
61618 | { | |
61619 | struct vm_area_struct * vma, * prev = NULL; | |
61620 | - unsigned int def_flags = 0; | |
61621 | ||
61622 | if (flags & MCL_FUTURE) | |
61623 | - def_flags = VM_LOCKED; | |
61624 | - current->mm->def_flags = def_flags; | |
61625 | + current->mm->def_flags |= VM_LOCKED; | |
61626 | + else | |
61627 | + current->mm->def_flags &= ~VM_LOCKED; | |
61628 | if (flags == MCL_FUTURE) | |
61629 | goto out; | |
61630 | ||
61631 | for (vma = current->mm->mmap; vma ; vma = prev->vm_next) { | |
61632 | vm_flags_t newflags; | |
61633 | ||
61634 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61635 | + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) | |
61636 | + break; | |
61637 | +#endif | |
61638 | + | |
61639 | + BUG_ON(vma->vm_end > TASK_SIZE); | |
61640 | newflags = vma->vm_flags | VM_LOCKED; | |
61641 | if (!(flags & MCL_CURRENT)) | |
61642 | newflags &= ~VM_LOCKED; | |
61643 | @@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags) | |
61644 | lock_limit >>= PAGE_SHIFT; | |
61645 | ||
61646 | ret = -ENOMEM; | |
61647 | + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1); | |
61648 | if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) || | |
61649 | capable(CAP_IPC_LOCK)) | |
61650 | ret = do_mlockall(flags); | |
61651 | diff -urNp linux-3.0.3/mm/mmap.c linux-3.0.3/mm/mmap.c | |
61652 | --- linux-3.0.3/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400 | |
61653 | +++ linux-3.0.3/mm/mmap.c 2011-08-23 21:48:14.000000000 -0400 | |
61654 | @@ -46,6 +46,16 @@ | |
61655 | #define arch_rebalance_pgtables(addr, len) (addr) | |
61656 | #endif | |
61657 | ||
61658 | +static inline void verify_mm_writelocked(struct mm_struct *mm) | |
61659 | +{ | |
61660 | +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX) | |
61661 | + if (unlikely(down_read_trylock(&mm->mmap_sem))) { | |
61662 | + up_read(&mm->mmap_sem); | |
61663 | + BUG(); | |
61664 | + } | |
61665 | +#endif | |
61666 | +} | |
61667 | + | |
61668 | static void unmap_region(struct mm_struct *mm, | |
61669 | struct vm_area_struct *vma, struct vm_area_struct *prev, | |
61670 | unsigned long start, unsigned long end); | |
61671 | @@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc | |
61672 | * x: (no) no x: (no) yes x: (no) yes x: (yes) yes | |
61673 | * | |
61674 | */ | |
61675 | -pgprot_t protection_map[16] = { | |
61676 | +pgprot_t protection_map[16] __read_only = { | |
61677 | __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111, | |
61678 | __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111 | |
61679 | }; | |
61680 | ||
61681 | -pgprot_t vm_get_page_prot(unsigned long vm_flags) | |
61682 | +pgprot_t vm_get_page_prot(vm_flags_t vm_flags) | |
61683 | { | |
61684 | - return __pgprot(pgprot_val(protection_map[vm_flags & | |
61685 | + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags & | |
61686 | (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) | | |
61687 | pgprot_val(arch_vm_get_page_prot(vm_flags))); | |
61688 | + | |
61689 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32) | |
61690 | + if (!(__supported_pte_mask & _PAGE_NX) && | |
61691 | + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC && | |
61692 | + (vm_flags & (VM_READ | VM_WRITE))) | |
61693 | + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot))))); | |
61694 | +#endif | |
61695 | + | |
61696 | + return prot; | |
61697 | } | |
61698 | EXPORT_SYMBOL(vm_get_page_prot); | |
61699 | ||
61700 | int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */ | |
61701 | int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */ | |
61702 | int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT; | |
61703 | +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024; | |
61704 | /* | |
61705 | * Make sure vm_committed_as in one cacheline and not cacheline shared with | |
61706 | * other variables. It can be updated by several CPUs frequently. | |
61707 | @@ -236,6 +256,7 @@ static struct vm_area_struct *remove_vma | |
61708 | struct vm_area_struct *next = vma->vm_next; | |
61709 | ||
61710 | might_sleep(); | |
61711 | + BUG_ON(vma->vm_mirror); | |
61712 | if (vma->vm_ops && vma->vm_ops->close) | |
61713 | vma->vm_ops->close(vma); | |
61714 | if (vma->vm_file) { | |
61715 | @@ -280,6 +301,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) | |
61716 | * not page aligned -Ram Gupta | |
61717 | */ | |
61718 | rlim = rlimit(RLIMIT_DATA); | |
61719 | + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1); | |
61720 | if (rlim < RLIM_INFINITY && (brk - mm->start_brk) + | |
61721 | (mm->end_data - mm->start_data) > rlim) | |
61722 | goto out; | |
61723 | @@ -697,6 +719,12 @@ static int | |
61724 | can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags, | |
61725 | struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff) | |
61726 | { | |
61727 | + | |
61728 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61729 | + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE) | |
61730 | + return 0; | |
61731 | +#endif | |
61732 | + | |
61733 | if (is_mergeable_vma(vma, file, vm_flags) && | |
61734 | is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) { | |
61735 | if (vma->vm_pgoff == vm_pgoff) | |
61736 | @@ -716,6 +744,12 @@ static int | |
61737 | can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, | |
61738 | struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff) | |
61739 | { | |
61740 | + | |
61741 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61742 | + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE) | |
61743 | + return 0; | |
61744 | +#endif | |
61745 | + | |
61746 | if (is_mergeable_vma(vma, file, vm_flags) && | |
61747 | is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) { | |
61748 | pgoff_t vm_pglen; | |
61749 | @@ -758,13 +792,20 @@ can_vma_merge_after(struct vm_area_struc | |
61750 | struct vm_area_struct *vma_merge(struct mm_struct *mm, | |
61751 | struct vm_area_struct *prev, unsigned long addr, | |
61752 | unsigned long end, unsigned long vm_flags, | |
61753 | - struct anon_vma *anon_vma, struct file *file, | |
61754 | + struct anon_vma *anon_vma, struct file *file, | |
61755 | pgoff_t pgoff, struct mempolicy *policy) | |
61756 | { | |
61757 | pgoff_t pglen = (end - addr) >> PAGE_SHIFT; | |
61758 | struct vm_area_struct *area, *next; | |
61759 | int err; | |
61760 | ||
61761 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61762 | + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE; | |
61763 | + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL; | |
61764 | + | |
61765 | + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end); | |
61766 | +#endif | |
61767 | + | |
61768 | /* | |
61769 | * We later require that vma->vm_flags == vm_flags, | |
61770 | * so this tests vma->vm_flags & VM_SPECIAL, too. | |
61771 | @@ -780,6 +821,15 @@ struct vm_area_struct *vma_merge(struct | |
61772 | if (next && next->vm_end == end) /* cases 6, 7, 8 */ | |
61773 | next = next->vm_next; | |
61774 | ||
61775 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61776 | + if (prev) | |
61777 | + prev_m = pax_find_mirror_vma(prev); | |
61778 | + if (area) | |
61779 | + area_m = pax_find_mirror_vma(area); | |
61780 | + if (next) | |
61781 | + next_m = pax_find_mirror_vma(next); | |
61782 | +#endif | |
61783 | + | |
61784 | /* | |
61785 | * Can it merge with the predecessor? | |
61786 | */ | |
61787 | @@ -799,9 +849,24 @@ struct vm_area_struct *vma_merge(struct | |
61788 | /* cases 1, 6 */ | |
61789 | err = vma_adjust(prev, prev->vm_start, | |
61790 | next->vm_end, prev->vm_pgoff, NULL); | |
61791 | - } else /* cases 2, 5, 7 */ | |
61792 | + | |
61793 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61794 | + if (!err && prev_m) | |
61795 | + err = vma_adjust(prev_m, prev_m->vm_start, | |
61796 | + next_m->vm_end, prev_m->vm_pgoff, NULL); | |
61797 | +#endif | |
61798 | + | |
61799 | + } else { /* cases 2, 5, 7 */ | |
61800 | err = vma_adjust(prev, prev->vm_start, | |
61801 | end, prev->vm_pgoff, NULL); | |
61802 | + | |
61803 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61804 | + if (!err && prev_m) | |
61805 | + err = vma_adjust(prev_m, prev_m->vm_start, | |
61806 | + end_m, prev_m->vm_pgoff, NULL); | |
61807 | +#endif | |
61808 | + | |
61809 | + } | |
61810 | if (err) | |
61811 | return NULL; | |
61812 | khugepaged_enter_vma_merge(prev); | |
61813 | @@ -815,12 +880,27 @@ struct vm_area_struct *vma_merge(struct | |
61814 | mpol_equal(policy, vma_policy(next)) && | |
61815 | can_vma_merge_before(next, vm_flags, | |
61816 | anon_vma, file, pgoff+pglen)) { | |
61817 | - if (prev && addr < prev->vm_end) /* case 4 */ | |
61818 | + if (prev && addr < prev->vm_end) { /* case 4 */ | |
61819 | err = vma_adjust(prev, prev->vm_start, | |
61820 | addr, prev->vm_pgoff, NULL); | |
61821 | - else /* cases 3, 8 */ | |
61822 | + | |
61823 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61824 | + if (!err && prev_m) | |
61825 | + err = vma_adjust(prev_m, prev_m->vm_start, | |
61826 | + addr_m, prev_m->vm_pgoff, NULL); | |
61827 | +#endif | |
61828 | + | |
61829 | + } else { /* cases 3, 8 */ | |
61830 | err = vma_adjust(area, addr, next->vm_end, | |
61831 | next->vm_pgoff - pglen, NULL); | |
61832 | + | |
61833 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61834 | + if (!err && area_m) | |
61835 | + err = vma_adjust(area_m, addr_m, next_m->vm_end, | |
61836 | + next_m->vm_pgoff - pglen, NULL); | |
61837 | +#endif | |
61838 | + | |
61839 | + } | |
61840 | if (err) | |
61841 | return NULL; | |
61842 | khugepaged_enter_vma_merge(area); | |
61843 | @@ -929,14 +1009,11 @@ none: | |
61844 | void vm_stat_account(struct mm_struct *mm, unsigned long flags, | |
61845 | struct file *file, long pages) | |
61846 | { | |
61847 | - const unsigned long stack_flags | |
61848 | - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN); | |
61849 | - | |
61850 | if (file) { | |
61851 | mm->shared_vm += pages; | |
61852 | if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC) | |
61853 | mm->exec_vm += pages; | |
61854 | - } else if (flags & stack_flags) | |
61855 | + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN)) | |
61856 | mm->stack_vm += pages; | |
61857 | if (flags & (VM_RESERVED|VM_IO)) | |
61858 | mm->reserved_vm += pages; | |
61859 | @@ -963,7 +1040,7 @@ unsigned long do_mmap_pgoff(struct file | |
61860 | * (the exception is when the underlying filesystem is noexec | |
61861 | * mounted, in which case we dont add PROT_EXEC.) | |
61862 | */ | |
61863 | - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC)) | |
61864 | + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC)) | |
61865 | if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC))) | |
61866 | prot |= PROT_EXEC; | |
61867 | ||
61868 | @@ -989,7 +1066,7 @@ unsigned long do_mmap_pgoff(struct file | |
61869 | /* Obtain the address to map to. we verify (or select) it and ensure | |
61870 | * that it represents a valid section of the address space. | |
61871 | */ | |
61872 | - addr = get_unmapped_area(file, addr, len, pgoff, flags); | |
61873 | + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0)); | |
61874 | if (addr & ~PAGE_MASK) | |
61875 | return addr; | |
61876 | ||
61877 | @@ -1000,6 +1077,36 @@ unsigned long do_mmap_pgoff(struct file | |
61878 | vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) | | |
61879 | mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC; | |
61880 | ||
61881 | +#ifdef CONFIG_PAX_MPROTECT | |
61882 | + if (mm->pax_flags & MF_PAX_MPROTECT) { | |
61883 | +#ifndef CONFIG_PAX_MPROTECT_COMPAT | |
61884 | + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) { | |
61885 | + gr_log_rwxmmap(file); | |
61886 | + | |
61887 | +#ifdef CONFIG_PAX_EMUPLT | |
61888 | + vm_flags &= ~VM_EXEC; | |
61889 | +#else | |
61890 | + return -EPERM; | |
61891 | +#endif | |
61892 | + | |
61893 | + } | |
61894 | + | |
61895 | + if (!(vm_flags & VM_EXEC)) | |
61896 | + vm_flags &= ~VM_MAYEXEC; | |
61897 | +#else | |
61898 | + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC) | |
61899 | + vm_flags &= ~(VM_EXEC | VM_MAYEXEC); | |
61900 | +#endif | |
61901 | + else | |
61902 | + vm_flags &= ~VM_MAYWRITE; | |
61903 | + } | |
61904 | +#endif | |
61905 | + | |
61906 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32) | |
61907 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file) | |
61908 | + vm_flags &= ~VM_PAGEEXEC; | |
61909 | +#endif | |
61910 | + | |
61911 | if (flags & MAP_LOCKED) | |
61912 | if (!can_do_mlock()) | |
61913 | return -EPERM; | |
61914 | @@ -1011,6 +1118,7 @@ unsigned long do_mmap_pgoff(struct file | |
61915 | locked += mm->locked_vm; | |
61916 | lock_limit = rlimit(RLIMIT_MEMLOCK); | |
61917 | lock_limit >>= PAGE_SHIFT; | |
61918 | + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1); | |
61919 | if (locked > lock_limit && !capable(CAP_IPC_LOCK)) | |
61920 | return -EAGAIN; | |
61921 | } | |
61922 | @@ -1081,6 +1189,9 @@ unsigned long do_mmap_pgoff(struct file | |
61923 | if (error) | |
61924 | return error; | |
61925 | ||
61926 | + if (!gr_acl_handle_mmap(file, prot)) | |
61927 | + return -EACCES; | |
61928 | + | |
61929 | return mmap_region(file, addr, len, flags, vm_flags, pgoff); | |
61930 | } | |
61931 | EXPORT_SYMBOL(do_mmap_pgoff); | |
61932 | @@ -1161,7 +1272,7 @@ int vma_wants_writenotify(struct vm_area | |
61933 | vm_flags_t vm_flags = vma->vm_flags; | |
61934 | ||
61935 | /* If it was private or non-writable, the write bit is already clear */ | |
61936 | - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED))) | |
61937 | + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED)) | |
61938 | return 0; | |
61939 | ||
61940 | /* The backer wishes to know when pages are first written to? */ | |
61941 | @@ -1210,14 +1321,24 @@ unsigned long mmap_region(struct file *f | |
61942 | unsigned long charged = 0; | |
61943 | struct inode *inode = file ? file->f_path.dentry->d_inode : NULL; | |
61944 | ||
61945 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61946 | + struct vm_area_struct *vma_m = NULL; | |
61947 | +#endif | |
61948 | + | |
61949 | + /* | |
61950 | + * mm->mmap_sem is required to protect against another thread | |
61951 | + * changing the mappings in case we sleep. | |
61952 | + */ | |
61953 | + verify_mm_writelocked(mm); | |
61954 | + | |
61955 | /* Clear old maps */ | |
61956 | error = -ENOMEM; | |
61957 | -munmap_back: | |
61958 | vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent); | |
61959 | if (vma && vma->vm_start < addr + len) { | |
61960 | if (do_munmap(mm, addr, len)) | |
61961 | return -ENOMEM; | |
61962 | - goto munmap_back; | |
61963 | + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent); | |
61964 | + BUG_ON(vma && vma->vm_start < addr + len); | |
61965 | } | |
61966 | ||
61967 | /* Check against address space limit. */ | |
61968 | @@ -1266,6 +1387,16 @@ munmap_back: | |
61969 | goto unacct_error; | |
61970 | } | |
61971 | ||
61972 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61973 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) { | |
61974 | + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
61975 | + if (!vma_m) { | |
61976 | + error = -ENOMEM; | |
61977 | + goto free_vma; | |
61978 | + } | |
61979 | + } | |
61980 | +#endif | |
61981 | + | |
61982 | vma->vm_mm = mm; | |
61983 | vma->vm_start = addr; | |
61984 | vma->vm_end = addr + len; | |
61985 | @@ -1289,6 +1420,19 @@ munmap_back: | |
61986 | error = file->f_op->mmap(file, vma); | |
61987 | if (error) | |
61988 | goto unmap_and_free_vma; | |
61989 | + | |
61990 | +#ifdef CONFIG_PAX_SEGMEXEC | |
61991 | + if (vma_m && (vm_flags & VM_EXECUTABLE)) | |
61992 | + added_exe_file_vma(mm); | |
61993 | +#endif | |
61994 | + | |
61995 | +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32) | |
61996 | + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) { | |
61997 | + vma->vm_flags |= VM_PAGEEXEC; | |
61998 | + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
61999 | + } | |
62000 | +#endif | |
62001 | + | |
62002 | if (vm_flags & VM_EXECUTABLE) | |
62003 | added_exe_file_vma(mm); | |
62004 | ||
62005 | @@ -1324,6 +1468,11 @@ munmap_back: | |
62006 | vma_link(mm, vma, prev, rb_link, rb_parent); | |
62007 | file = vma->vm_file; | |
62008 | ||
62009 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62010 | + if (vma_m) | |
62011 | + BUG_ON(pax_mirror_vma(vma_m, vma)); | |
62012 | +#endif | |
62013 | + | |
62014 | /* Once vma denies write, undo our temporary denial count */ | |
62015 | if (correct_wcount) | |
62016 | atomic_inc(&inode->i_writecount); | |
62017 | @@ -1332,6 +1481,7 @@ out: | |
62018 | ||
62019 | mm->total_vm += len >> PAGE_SHIFT; | |
62020 | vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT); | |
62021 | + track_exec_limit(mm, addr, addr + len, vm_flags); | |
62022 | if (vm_flags & VM_LOCKED) { | |
62023 | if (!mlock_vma_pages_range(vma, addr, addr + len)) | |
62024 | mm->locked_vm += (len >> PAGE_SHIFT); | |
62025 | @@ -1349,6 +1499,12 @@ unmap_and_free_vma: | |
62026 | unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); | |
62027 | charged = 0; | |
62028 | free_vma: | |
62029 | + | |
62030 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62031 | + if (vma_m) | |
62032 | + kmem_cache_free(vm_area_cachep, vma_m); | |
62033 | +#endif | |
62034 | + | |
62035 | kmem_cache_free(vm_area_cachep, vma); | |
62036 | unacct_error: | |
62037 | if (charged) | |
62038 | @@ -1356,6 +1512,44 @@ unacct_error: | |
62039 | return error; | |
62040 | } | |
62041 | ||
62042 | +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len) | |
62043 | +{ | |
62044 | + if (!vma) { | |
62045 | +#ifdef CONFIG_STACK_GROWSUP | |
62046 | + if (addr > sysctl_heap_stack_gap) | |
62047 | + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap); | |
62048 | + else | |
62049 | + vma = find_vma(current->mm, 0); | |
62050 | + if (vma && (vma->vm_flags & VM_GROWSUP)) | |
62051 | + return false; | |
62052 | +#endif | |
62053 | + return true; | |
62054 | + } | |
62055 | + | |
62056 | + if (addr + len > vma->vm_start) | |
62057 | + return false; | |
62058 | + | |
62059 | + if (vma->vm_flags & VM_GROWSDOWN) | |
62060 | + return sysctl_heap_stack_gap <= vma->vm_start - addr - len; | |
62061 | +#ifdef CONFIG_STACK_GROWSUP | |
62062 | + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) | |
62063 | + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap; | |
62064 | +#endif | |
62065 | + | |
62066 | + return true; | |
62067 | +} | |
62068 | + | |
62069 | +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len) | |
62070 | +{ | |
62071 | + if (vma->vm_start < len) | |
62072 | + return -ENOMEM; | |
62073 | + if (!(vma->vm_flags & VM_GROWSDOWN)) | |
62074 | + return vma->vm_start - len; | |
62075 | + if (sysctl_heap_stack_gap <= vma->vm_start - len) | |
62076 | + return vma->vm_start - len - sysctl_heap_stack_gap; | |
62077 | + return -ENOMEM; | |
62078 | +} | |
62079 | + | |
62080 | /* Get an address range which is currently unmapped. | |
62081 | * For shmat() with addr=0. | |
62082 | * | |
62083 | @@ -1382,18 +1576,23 @@ arch_get_unmapped_area(struct file *filp | |
62084 | if (flags & MAP_FIXED) | |
62085 | return addr; | |
62086 | ||
62087 | +#ifdef CONFIG_PAX_RANDMMAP | |
62088 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
62089 | +#endif | |
62090 | + | |
62091 | if (addr) { | |
62092 | addr = PAGE_ALIGN(addr); | |
62093 | - vma = find_vma(mm, addr); | |
62094 | - if (TASK_SIZE - len >= addr && | |
62095 | - (!vma || addr + len <= vma->vm_start)) | |
62096 | - return addr; | |
62097 | + if (TASK_SIZE - len >= addr) { | |
62098 | + vma = find_vma(mm, addr); | |
62099 | + if (check_heap_stack_gap(vma, addr, len)) | |
62100 | + return addr; | |
62101 | + } | |
62102 | } | |
62103 | if (len > mm->cached_hole_size) { | |
62104 | - start_addr = addr = mm->free_area_cache; | |
62105 | + start_addr = addr = mm->free_area_cache; | |
62106 | } else { | |
62107 | - start_addr = addr = TASK_UNMAPPED_BASE; | |
62108 | - mm->cached_hole_size = 0; | |
62109 | + start_addr = addr = mm->mmap_base; | |
62110 | + mm->cached_hole_size = 0; | |
62111 | } | |
62112 | ||
62113 | full_search: | |
62114 | @@ -1404,34 +1603,40 @@ full_search: | |
62115 | * Start a new search - just in case we missed | |
62116 | * some holes. | |
62117 | */ | |
62118 | - if (start_addr != TASK_UNMAPPED_BASE) { | |
62119 | - addr = TASK_UNMAPPED_BASE; | |
62120 | - start_addr = addr; | |
62121 | + if (start_addr != mm->mmap_base) { | |
62122 | + start_addr = addr = mm->mmap_base; | |
62123 | mm->cached_hole_size = 0; | |
62124 | goto full_search; | |
62125 | } | |
62126 | return -ENOMEM; | |
62127 | } | |
62128 | - if (!vma || addr + len <= vma->vm_start) { | |
62129 | - /* | |
62130 | - * Remember the place where we stopped the search: | |
62131 | - */ | |
62132 | - mm->free_area_cache = addr + len; | |
62133 | - return addr; | |
62134 | - } | |
62135 | + if (check_heap_stack_gap(vma, addr, len)) | |
62136 | + break; | |
62137 | if (addr + mm->cached_hole_size < vma->vm_start) | |
62138 | mm->cached_hole_size = vma->vm_start - addr; | |
62139 | addr = vma->vm_end; | |
62140 | } | |
62141 | + | |
62142 | + /* | |
62143 | + * Remember the place where we stopped the search: | |
62144 | + */ | |
62145 | + mm->free_area_cache = addr + len; | |
62146 | + return addr; | |
62147 | } | |
62148 | #endif | |
62149 | ||
62150 | void arch_unmap_area(struct mm_struct *mm, unsigned long addr) | |
62151 | { | |
62152 | + | |
62153 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62154 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr) | |
62155 | + return; | |
62156 | +#endif | |
62157 | + | |
62158 | /* | |
62159 | * Is this a new hole at the lowest possible address? | |
62160 | */ | |
62161 | - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) { | |
62162 | + if (addr >= mm->mmap_base && addr < mm->free_area_cache) { | |
62163 | mm->free_area_cache = addr; | |
62164 | mm->cached_hole_size = ~0UL; | |
62165 | } | |
62166 | @@ -1449,7 +1654,7 @@ arch_get_unmapped_area_topdown(struct fi | |
62167 | { | |
62168 | struct vm_area_struct *vma; | |
62169 | struct mm_struct *mm = current->mm; | |
62170 | - unsigned long addr = addr0; | |
62171 | + unsigned long base = mm->mmap_base, addr = addr0; | |
62172 | ||
62173 | /* requested length too big for entire address space */ | |
62174 | if (len > TASK_SIZE) | |
62175 | @@ -1458,13 +1663,18 @@ arch_get_unmapped_area_topdown(struct fi | |
62176 | if (flags & MAP_FIXED) | |
62177 | return addr; | |
62178 | ||
62179 | +#ifdef CONFIG_PAX_RANDMMAP | |
62180 | + if (!(mm->pax_flags & MF_PAX_RANDMMAP)) | |
62181 | +#endif | |
62182 | + | |
62183 | /* requesting a specific address */ | |
62184 | if (addr) { | |
62185 | addr = PAGE_ALIGN(addr); | |
62186 | - vma = find_vma(mm, addr); | |
62187 | - if (TASK_SIZE - len >= addr && | |
62188 | - (!vma || addr + len <= vma->vm_start)) | |
62189 | - return addr; | |
62190 | + if (TASK_SIZE - len >= addr) { | |
62191 | + vma = find_vma(mm, addr); | |
62192 | + if (check_heap_stack_gap(vma, addr, len)) | |
62193 | + return addr; | |
62194 | + } | |
62195 | } | |
62196 | ||
62197 | /* check if free_area_cache is useful for us */ | |
62198 | @@ -1479,7 +1689,7 @@ arch_get_unmapped_area_topdown(struct fi | |
62199 | /* make sure it can fit in the remaining address space */ | |
62200 | if (addr > len) { | |
62201 | vma = find_vma(mm, addr-len); | |
62202 | - if (!vma || addr <= vma->vm_start) | |
62203 | + if (check_heap_stack_gap(vma, addr - len, len)) | |
62204 | /* remember the address as a hint for next time */ | |
62205 | return (mm->free_area_cache = addr-len); | |
62206 | } | |
62207 | @@ -1496,7 +1706,7 @@ arch_get_unmapped_area_topdown(struct fi | |
62208 | * return with success: | |
62209 | */ | |
62210 | vma = find_vma(mm, addr); | |
62211 | - if (!vma || addr+len <= vma->vm_start) | |
62212 | + if (check_heap_stack_gap(vma, addr, len)) | |
62213 | /* remember the address as a hint for next time */ | |
62214 | return (mm->free_area_cache = addr); | |
62215 | ||
62216 | @@ -1505,8 +1715,8 @@ arch_get_unmapped_area_topdown(struct fi | |
62217 | mm->cached_hole_size = vma->vm_start - addr; | |
62218 | ||
62219 | /* try just below the current vma->vm_start */ | |
62220 | - addr = vma->vm_start-len; | |
62221 | - } while (len < vma->vm_start); | |
62222 | + addr = skip_heap_stack_gap(vma, len); | |
62223 | + } while (!IS_ERR_VALUE(addr)); | |
62224 | ||
62225 | bottomup: | |
62226 | /* | |
62227 | @@ -1515,13 +1725,21 @@ bottomup: | |
62228 | * can happen with large stack limits and large mmap() | |
62229 | * allocations. | |
62230 | */ | |
62231 | + mm->mmap_base = TASK_UNMAPPED_BASE; | |
62232 | + | |
62233 | +#ifdef CONFIG_PAX_RANDMMAP | |
62234 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
62235 | + mm->mmap_base += mm->delta_mmap; | |
62236 | +#endif | |
62237 | + | |
62238 | + mm->free_area_cache = mm->mmap_base; | |
62239 | mm->cached_hole_size = ~0UL; | |
62240 | - mm->free_area_cache = TASK_UNMAPPED_BASE; | |
62241 | addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags); | |
62242 | /* | |
62243 | * Restore the topdown base: | |
62244 | */ | |
62245 | - mm->free_area_cache = mm->mmap_base; | |
62246 | + mm->mmap_base = base; | |
62247 | + mm->free_area_cache = base; | |
62248 | mm->cached_hole_size = ~0UL; | |
62249 | ||
62250 | return addr; | |
62251 | @@ -1530,6 +1748,12 @@ bottomup: | |
62252 | ||
62253 | void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr) | |
62254 | { | |
62255 | + | |
62256 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62257 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr) | |
62258 | + return; | |
62259 | +#endif | |
62260 | + | |
62261 | /* | |
62262 | * Is this a new hole at the highest possible address? | |
62263 | */ | |
62264 | @@ -1537,8 +1761,10 @@ void arch_unmap_area_topdown(struct mm_s | |
62265 | mm->free_area_cache = addr; | |
62266 | ||
62267 | /* dont allow allocations above current base */ | |
62268 | - if (mm->free_area_cache > mm->mmap_base) | |
62269 | + if (mm->free_area_cache > mm->mmap_base) { | |
62270 | mm->free_area_cache = mm->mmap_base; | |
62271 | + mm->cached_hole_size = ~0UL; | |
62272 | + } | |
62273 | } | |
62274 | ||
62275 | unsigned long | |
62276 | @@ -1646,6 +1872,28 @@ out: | |
62277 | return prev ? prev->vm_next : vma; | |
62278 | } | |
62279 | ||
62280 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62281 | +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma) | |
62282 | +{ | |
62283 | + struct vm_area_struct *vma_m; | |
62284 | + | |
62285 | + BUG_ON(!vma || vma->vm_start >= vma->vm_end); | |
62286 | + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) { | |
62287 | + BUG_ON(vma->vm_mirror); | |
62288 | + return NULL; | |
62289 | + } | |
62290 | + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end); | |
62291 | + vma_m = vma->vm_mirror; | |
62292 | + BUG_ON(!vma_m || vma_m->vm_mirror != vma); | |
62293 | + BUG_ON(vma->vm_file != vma_m->vm_file); | |
62294 | + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start); | |
62295 | + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff); | |
62296 | + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root); | |
62297 | + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED)); | |
62298 | + return vma_m; | |
62299 | +} | |
62300 | +#endif | |
62301 | + | |
62302 | /* | |
62303 | * Verify that the stack growth is acceptable and | |
62304 | * update accounting. This is shared with both the | |
62305 | @@ -1662,6 +1910,7 @@ static int acct_stack_growth(struct vm_a | |
62306 | return -ENOMEM; | |
62307 | ||
62308 | /* Stack limit test */ | |
62309 | + gr_learn_resource(current, RLIMIT_STACK, size, 1); | |
62310 | if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) | |
62311 | return -ENOMEM; | |
62312 | ||
62313 | @@ -1672,6 +1921,7 @@ static int acct_stack_growth(struct vm_a | |
62314 | locked = mm->locked_vm + grow; | |
62315 | limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur); | |
62316 | limit >>= PAGE_SHIFT; | |
62317 | + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1); | |
62318 | if (locked > limit && !capable(CAP_IPC_LOCK)) | |
62319 | return -ENOMEM; | |
62320 | } | |
62321 | @@ -1702,37 +1952,48 @@ static int acct_stack_growth(struct vm_a | |
62322 | * PA-RISC uses this for its stack; IA64 for its Register Backing Store. | |
62323 | * vma is the last one with address > vma->vm_end. Have to extend vma. | |
62324 | */ | |
62325 | +#ifndef CONFIG_IA64 | |
62326 | +static | |
62327 | +#endif | |
62328 | int expand_upwards(struct vm_area_struct *vma, unsigned long address) | |
62329 | { | |
62330 | int error; | |
62331 | + bool locknext; | |
62332 | ||
62333 | if (!(vma->vm_flags & VM_GROWSUP)) | |
62334 | return -EFAULT; | |
62335 | ||
62336 | + /* Also guard against wrapping around to address 0. */ | |
62337 | + if (address < PAGE_ALIGN(address+1)) | |
62338 | + address = PAGE_ALIGN(address+1); | |
62339 | + else | |
62340 | + return -ENOMEM; | |
62341 | + | |
62342 | /* | |
62343 | * We must make sure the anon_vma is allocated | |
62344 | * so that the anon_vma locking is not a noop. | |
62345 | */ | |
62346 | if (unlikely(anon_vma_prepare(vma))) | |
62347 | return -ENOMEM; | |
62348 | + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN); | |
62349 | + if (locknext && anon_vma_prepare(vma->vm_next)) | |
62350 | + return -ENOMEM; | |
62351 | vma_lock_anon_vma(vma); | |
62352 | + if (locknext) | |
62353 | + vma_lock_anon_vma(vma->vm_next); | |
62354 | ||
62355 | /* | |
62356 | * vma->vm_start/vm_end cannot change under us because the caller | |
62357 | * is required to hold the mmap_sem in read mode. We need the | |
62358 | - * anon_vma lock to serialize against concurrent expand_stacks. | |
62359 | - * Also guard against wrapping around to address 0. | |
62360 | + * anon_vma locks to serialize against concurrent expand_stacks | |
62361 | + * and expand_upwards. | |
62362 | */ | |
62363 | - if (address < PAGE_ALIGN(address+4)) | |
62364 | - address = PAGE_ALIGN(address+4); | |
62365 | - else { | |
62366 | - vma_unlock_anon_vma(vma); | |
62367 | - return -ENOMEM; | |
62368 | - } | |
62369 | error = 0; | |
62370 | ||
62371 | /* Somebody else might have raced and expanded it already */ | |
62372 | - if (address > vma->vm_end) { | |
62373 | + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap) | |
62374 | + error = -ENOMEM; | |
62375 | + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) { | |
62376 | unsigned long size, grow; | |
62377 | ||
62378 | size = address - vma->vm_start; | |
62379 | @@ -1747,6 +2008,8 @@ int expand_upwards(struct vm_area_struct | |
62380 | } | |
62381 | } | |
62382 | } | |
62383 | + if (locknext) | |
62384 | + vma_unlock_anon_vma(vma->vm_next); | |
62385 | vma_unlock_anon_vma(vma); | |
62386 | khugepaged_enter_vma_merge(vma); | |
62387 | return error; | |
62388 | @@ -1760,6 +2023,8 @@ int expand_downwards(struct vm_area_stru | |
62389 | unsigned long address) | |
62390 | { | |
62391 | int error; | |
62392 | + bool lockprev = false; | |
62393 | + struct vm_area_struct *prev; | |
62394 | ||
62395 | /* | |
62396 | * We must make sure the anon_vma is allocated | |
62397 | @@ -1773,6 +2038,15 @@ int expand_downwards(struct vm_area_stru | |
62398 | if (error) | |
62399 | return error; | |
62400 | ||
62401 | + prev = vma->vm_prev; | |
62402 | +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64) | |
62403 | + lockprev = prev && (prev->vm_flags & VM_GROWSUP); | |
62404 | +#endif | |
62405 | + if (lockprev && anon_vma_prepare(prev)) | |
62406 | + return -ENOMEM; | |
62407 | + if (lockprev) | |
62408 | + vma_lock_anon_vma(prev); | |
62409 | + | |
62410 | vma_lock_anon_vma(vma); | |
62411 | ||
62412 | /* | |
62413 | @@ -1782,9 +2056,17 @@ int expand_downwards(struct vm_area_stru | |
62414 | */ | |
62415 | ||
62416 | /* Somebody else might have raced and expanded it already */ | |
62417 | - if (address < vma->vm_start) { | |
62418 | + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap) | |
62419 | + error = -ENOMEM; | |
62420 | + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) { | |
62421 | unsigned long size, grow; | |
62422 | ||
62423 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62424 | + struct vm_area_struct *vma_m; | |
62425 | + | |
62426 | + vma_m = pax_find_mirror_vma(vma); | |
62427 | +#endif | |
62428 | + | |
62429 | size = vma->vm_end - address; | |
62430 | grow = (vma->vm_start - address) >> PAGE_SHIFT; | |
62431 | ||
62432 | @@ -1794,11 +2076,22 @@ int expand_downwards(struct vm_area_stru | |
62433 | if (!error) { | |
62434 | vma->vm_start = address; | |
62435 | vma->vm_pgoff -= grow; | |
62436 | + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags); | |
62437 | + | |
62438 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62439 | + if (vma_m) { | |
62440 | + vma_m->vm_start -= grow << PAGE_SHIFT; | |
62441 | + vma_m->vm_pgoff -= grow; | |
62442 | + } | |
62443 | +#endif | |
62444 | + | |
62445 | perf_event_mmap(vma); | |
62446 | } | |
62447 | } | |
62448 | } | |
62449 | vma_unlock_anon_vma(vma); | |
62450 | + if (lockprev) | |
62451 | + vma_unlock_anon_vma(prev); | |
62452 | khugepaged_enter_vma_merge(vma); | |
62453 | return error; | |
62454 | } | |
62455 | @@ -1868,6 +2161,13 @@ static void remove_vma_list(struct mm_st | |
62456 | do { | |
62457 | long nrpages = vma_pages(vma); | |
62458 | ||
62459 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62460 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) { | |
62461 | + vma = remove_vma(vma); | |
62462 | + continue; | |
62463 | + } | |
62464 | +#endif | |
62465 | + | |
62466 | mm->total_vm -= nrpages; | |
62467 | vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages); | |
62468 | vma = remove_vma(vma); | |
62469 | @@ -1913,6 +2213,16 @@ detach_vmas_to_be_unmapped(struct mm_str | |
62470 | insertion_point = (prev ? &prev->vm_next : &mm->mmap); | |
62471 | vma->vm_prev = NULL; | |
62472 | do { | |
62473 | + | |
62474 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62475 | + if (vma->vm_mirror) { | |
62476 | + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma); | |
62477 | + vma->vm_mirror->vm_mirror = NULL; | |
62478 | + vma->vm_mirror->vm_flags &= ~VM_EXEC; | |
62479 | + vma->vm_mirror = NULL; | |
62480 | + } | |
62481 | +#endif | |
62482 | + | |
62483 | rb_erase(&vma->vm_rb, &mm->mm_rb); | |
62484 | mm->map_count--; | |
62485 | tail_vma = vma; | |
62486 | @@ -1941,14 +2251,33 @@ static int __split_vma(struct mm_struct | |
62487 | struct vm_area_struct *new; | |
62488 | int err = -ENOMEM; | |
62489 | ||
62490 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62491 | + struct vm_area_struct *vma_m, *new_m = NULL; | |
62492 | + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE; | |
62493 | +#endif | |
62494 | + | |
62495 | if (is_vm_hugetlb_page(vma) && (addr & | |
62496 | ~(huge_page_mask(hstate_vma(vma))))) | |
62497 | return -EINVAL; | |
62498 | ||
62499 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62500 | + vma_m = pax_find_mirror_vma(vma); | |
62501 | +#endif | |
62502 | + | |
62503 | new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); | |
62504 | if (!new) | |
62505 | goto out_err; | |
62506 | ||
62507 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62508 | + if (vma_m) { | |
62509 | + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); | |
62510 | + if (!new_m) { | |
62511 | + kmem_cache_free(vm_area_cachep, new); | |
62512 | + goto out_err; | |
62513 | + } | |
62514 | + } | |
62515 | +#endif | |
62516 | + | |
62517 | /* most fields are the same, copy all, and then fixup */ | |
62518 | *new = *vma; | |
62519 | ||
62520 | @@ -1961,6 +2290,22 @@ static int __split_vma(struct mm_struct | |
62521 | new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT); | |
62522 | } | |
62523 | ||
62524 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62525 | + if (vma_m) { | |
62526 | + *new_m = *vma_m; | |
62527 | + INIT_LIST_HEAD(&new_m->anon_vma_chain); | |
62528 | + new_m->vm_mirror = new; | |
62529 | + new->vm_mirror = new_m; | |
62530 | + | |
62531 | + if (new_below) | |
62532 | + new_m->vm_end = addr_m; | |
62533 | + else { | |
62534 | + new_m->vm_start = addr_m; | |
62535 | + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT); | |
62536 | + } | |
62537 | + } | |
62538 | +#endif | |
62539 | + | |
62540 | pol = mpol_dup(vma_policy(vma)); | |
62541 | if (IS_ERR(pol)) { | |
62542 | err = PTR_ERR(pol); | |
62543 | @@ -1986,6 +2331,42 @@ static int __split_vma(struct mm_struct | |
62544 | else | |
62545 | err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new); | |
62546 | ||
62547 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62548 | + if (!err && vma_m) { | |
62549 | + if (anon_vma_clone(new_m, vma_m)) | |
62550 | + goto out_free_mpol; | |
62551 | + | |
62552 | + mpol_get(pol); | |
62553 | + vma_set_policy(new_m, pol); | |
62554 | + | |
62555 | + if (new_m->vm_file) { | |
62556 | + get_file(new_m->vm_file); | |
62557 | + if (vma_m->vm_flags & VM_EXECUTABLE) | |
62558 | + added_exe_file_vma(mm); | |
62559 | + } | |
62560 | + | |
62561 | + if (new_m->vm_ops && new_m->vm_ops->open) | |
62562 | + new_m->vm_ops->open(new_m); | |
62563 | + | |
62564 | + if (new_below) | |
62565 | + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff + | |
62566 | + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m); | |
62567 | + else | |
62568 | + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m); | |
62569 | + | |
62570 | + if (err) { | |
62571 | + if (new_m->vm_ops && new_m->vm_ops->close) | |
62572 | + new_m->vm_ops->close(new_m); | |
62573 | + if (new_m->vm_file) { | |
62574 | + if (vma_m->vm_flags & VM_EXECUTABLE) | |
62575 | + removed_exe_file_vma(mm); | |
62576 | + fput(new_m->vm_file); | |
62577 | + } | |
62578 | + mpol_put(pol); | |
62579 | + } | |
62580 | + } | |
62581 | +#endif | |
62582 | + | |
62583 | /* Success. */ | |
62584 | if (!err) | |
62585 | return 0; | |
62586 | @@ -1998,10 +2379,18 @@ static int __split_vma(struct mm_struct | |
62587 | removed_exe_file_vma(mm); | |
62588 | fput(new->vm_file); | |
62589 | } | |
62590 | - unlink_anon_vmas(new); | |
62591 | out_free_mpol: | |
62592 | mpol_put(pol); | |
62593 | out_free_vma: | |
62594 | + | |
62595 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62596 | + if (new_m) { | |
62597 | + unlink_anon_vmas(new_m); | |
62598 | + kmem_cache_free(vm_area_cachep, new_m); | |
62599 | + } | |
62600 | +#endif | |
62601 | + | |
62602 | + unlink_anon_vmas(new); | |
62603 | kmem_cache_free(vm_area_cachep, new); | |
62604 | out_err: | |
62605 | return err; | |
62606 | @@ -2014,6 +2403,15 @@ static int __split_vma(struct mm_struct | |
62607 | int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, | |
62608 | unsigned long addr, int new_below) | |
62609 | { | |
62610 | + | |
62611 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62612 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) { | |
62613 | + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE); | |
62614 | + if (mm->map_count >= sysctl_max_map_count-1) | |
62615 | + return -ENOMEM; | |
62616 | + } else | |
62617 | +#endif | |
62618 | + | |
62619 | if (mm->map_count >= sysctl_max_map_count) | |
62620 | return -ENOMEM; | |
62621 | ||
62622 | @@ -2025,11 +2423,30 @@ int split_vma(struct mm_struct *mm, stru | |
62623 | * work. This now handles partial unmappings. | |
62624 | * Jeremy Fitzhardinge <jeremy@goop.org> | |
62625 | */ | |
62626 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62627 | int do_munmap(struct mm_struct *mm, unsigned long start, size_t len) | |
62628 | { | |
62629 | + int ret = __do_munmap(mm, start, len); | |
62630 | + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC)) | |
62631 | + return ret; | |
62632 | + | |
62633 | + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len); | |
62634 | +} | |
62635 | + | |
62636 | +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len) | |
62637 | +#else | |
62638 | +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len) | |
62639 | +#endif | |
62640 | +{ | |
62641 | unsigned long end; | |
62642 | struct vm_area_struct *vma, *prev, *last; | |
62643 | ||
62644 | + /* | |
62645 | + * mm->mmap_sem is required to protect against another thread | |
62646 | + * changing the mappings in case we sleep. | |
62647 | + */ | |
62648 | + verify_mm_writelocked(mm); | |
62649 | + | |
62650 | if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start) | |
62651 | return -EINVAL; | |
62652 | ||
62653 | @@ -2104,6 +2521,8 @@ int do_munmap(struct mm_struct *mm, unsi | |
62654 | /* Fix up all other VM information */ | |
62655 | remove_vma_list(mm, vma); | |
62656 | ||
62657 | + track_exec_limit(mm, start, end, 0UL); | |
62658 | + | |
62659 | return 0; | |
62660 | } | |
62661 | ||
62662 | @@ -2116,22 +2535,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a | |
62663 | ||
62664 | profile_munmap(addr); | |
62665 | ||
62666 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62667 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && | |
62668 | + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len)) | |
62669 | + return -EINVAL; | |
62670 | +#endif | |
62671 | + | |
62672 | down_write(&mm->mmap_sem); | |
62673 | ret = do_munmap(mm, addr, len); | |
62674 | up_write(&mm->mmap_sem); | |
62675 | return ret; | |
62676 | } | |
62677 | ||
62678 | -static inline void verify_mm_writelocked(struct mm_struct *mm) | |
62679 | -{ | |
62680 | -#ifdef CONFIG_DEBUG_VM | |
62681 | - if (unlikely(down_read_trylock(&mm->mmap_sem))) { | |
62682 | - WARN_ON(1); | |
62683 | - up_read(&mm->mmap_sem); | |
62684 | - } | |
62685 | -#endif | |
62686 | -} | |
62687 | - | |
62688 | /* | |
62689 | * this is really a simplified "do_mmap". it only handles | |
62690 | * anonymous maps. eventually we may be able to do some | |
62691 | @@ -2145,6 +2560,7 @@ unsigned long do_brk(unsigned long addr, | |
62692 | struct rb_node ** rb_link, * rb_parent; | |
62693 | pgoff_t pgoff = addr >> PAGE_SHIFT; | |
62694 | int error; | |
62695 | + unsigned long charged; | |
62696 | ||
62697 | len = PAGE_ALIGN(len); | |
62698 | if (!len) | |
62699 | @@ -2156,16 +2572,30 @@ unsigned long do_brk(unsigned long addr, | |
62700 | ||
62701 | flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; | |
62702 | ||
62703 | +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) | |
62704 | + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) { | |
62705 | + flags &= ~VM_EXEC; | |
62706 | + | |
62707 | +#ifdef CONFIG_PAX_MPROTECT | |
62708 | + if (mm->pax_flags & MF_PAX_MPROTECT) | |
62709 | + flags &= ~VM_MAYEXEC; | |
62710 | +#endif | |
62711 | + | |
62712 | + } | |
62713 | +#endif | |
62714 | + | |
62715 | error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED); | |
62716 | if (error & ~PAGE_MASK) | |
62717 | return error; | |
62718 | ||
62719 | + charged = len >> PAGE_SHIFT; | |
62720 | + | |
62721 | /* | |
62722 | * mlock MCL_FUTURE? | |
62723 | */ | |
62724 | if (mm->def_flags & VM_LOCKED) { | |
62725 | unsigned long locked, lock_limit; | |
62726 | - locked = len >> PAGE_SHIFT; | |
62727 | + locked = charged; | |
62728 | locked += mm->locked_vm; | |
62729 | lock_limit = rlimit(RLIMIT_MEMLOCK); | |
62730 | lock_limit >>= PAGE_SHIFT; | |
62731 | @@ -2182,22 +2612,22 @@ unsigned long do_brk(unsigned long addr, | |
62732 | /* | |
62733 | * Clear old maps. this also does some error checking for us | |
62734 | */ | |
62735 | - munmap_back: | |
62736 | vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent); | |
62737 | if (vma && vma->vm_start < addr + len) { | |
62738 | if (do_munmap(mm, addr, len)) | |
62739 | return -ENOMEM; | |
62740 | - goto munmap_back; | |
62741 | + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent); | |
62742 | + BUG_ON(vma && vma->vm_start < addr + len); | |
62743 | } | |
62744 | ||
62745 | /* Check against address space limits *after* clearing old maps... */ | |
62746 | - if (!may_expand_vm(mm, len >> PAGE_SHIFT)) | |
62747 | + if (!may_expand_vm(mm, charged)) | |
62748 | return -ENOMEM; | |
62749 | ||
62750 | if (mm->map_count > sysctl_max_map_count) | |
62751 | return -ENOMEM; | |
62752 | ||
62753 | - if (security_vm_enough_memory(len >> PAGE_SHIFT)) | |
62754 | + if (security_vm_enough_memory(charged)) | |
62755 | return -ENOMEM; | |
62756 | ||
62757 | /* Can we just expand an old private anonymous mapping? */ | |
62758 | @@ -2211,7 +2641,7 @@ unsigned long do_brk(unsigned long addr, | |
62759 | */ | |
62760 | vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
62761 | if (!vma) { | |
62762 | - vm_unacct_memory(len >> PAGE_SHIFT); | |
62763 | + vm_unacct_memory(charged); | |
62764 | return -ENOMEM; | |
62765 | } | |
62766 | ||
62767 | @@ -2225,11 +2655,12 @@ unsigned long do_brk(unsigned long addr, | |
62768 | vma_link(mm, vma, prev, rb_link, rb_parent); | |
62769 | out: | |
62770 | perf_event_mmap(vma); | |
62771 | - mm->total_vm += len >> PAGE_SHIFT; | |
62772 | + mm->total_vm += charged; | |
62773 | if (flags & VM_LOCKED) { | |
62774 | if (!mlock_vma_pages_range(vma, addr, addr + len)) | |
62775 | - mm->locked_vm += (len >> PAGE_SHIFT); | |
62776 | + mm->locked_vm += charged; | |
62777 | } | |
62778 | + track_exec_limit(mm, addr, addr + len, flags); | |
62779 | return addr; | |
62780 | } | |
62781 | ||
62782 | @@ -2276,8 +2707,10 @@ void exit_mmap(struct mm_struct *mm) | |
62783 | * Walk the list again, actually closing and freeing it, | |
62784 | * with preemption enabled, without holding any MM locks. | |
62785 | */ | |
62786 | - while (vma) | |
62787 | + while (vma) { | |
62788 | + vma->vm_mirror = NULL; | |
62789 | vma = remove_vma(vma); | |
62790 | + } | |
62791 | ||
62792 | BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT); | |
62793 | } | |
62794 | @@ -2291,6 +2724,13 @@ int insert_vm_struct(struct mm_struct * | |
62795 | struct vm_area_struct * __vma, * prev; | |
62796 | struct rb_node ** rb_link, * rb_parent; | |
62797 | ||
62798 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62799 | + struct vm_area_struct *vma_m = NULL; | |
62800 | +#endif | |
62801 | + | |
62802 | + if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1)) | |
62803 | + return -EPERM; | |
62804 | + | |
62805 | /* | |
62806 | * The vm_pgoff of a purely anonymous vma should be irrelevant | |
62807 | * until its first write fault, when page's anon_vma and index | |
62808 | @@ -2313,7 +2753,22 @@ int insert_vm_struct(struct mm_struct * | |
62809 | if ((vma->vm_flags & VM_ACCOUNT) && | |
62810 | security_vm_enough_memory_mm(mm, vma_pages(vma))) | |
62811 | return -ENOMEM; | |
62812 | + | |
62813 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62814 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) { | |
62815 | + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
62816 | + if (!vma_m) | |
62817 | + return -ENOMEM; | |
62818 | + } | |
62819 | +#endif | |
62820 | + | |
62821 | vma_link(mm, vma, prev, rb_link, rb_parent); | |
62822 | + | |
62823 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62824 | + if (vma_m) | |
62825 | + BUG_ON(pax_mirror_vma(vma_m, vma)); | |
62826 | +#endif | |
62827 | + | |
62828 | return 0; | |
62829 | } | |
62830 | ||
62831 | @@ -2331,6 +2786,8 @@ struct vm_area_struct *copy_vma(struct v | |
62832 | struct rb_node **rb_link, *rb_parent; | |
62833 | struct mempolicy *pol; | |
62834 | ||
62835 | + BUG_ON(vma->vm_mirror); | |
62836 | + | |
62837 | /* | |
62838 | * If anonymous vma has not yet been faulted, update new pgoff | |
62839 | * to match new location, to increase its chance of merging. | |
62840 | @@ -2381,6 +2838,39 @@ struct vm_area_struct *copy_vma(struct v | |
62841 | return NULL; | |
62842 | } | |
62843 | ||
62844 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62845 | +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma) | |
62846 | +{ | |
62847 | + struct vm_area_struct *prev_m; | |
62848 | + struct rb_node **rb_link_m, *rb_parent_m; | |
62849 | + struct mempolicy *pol_m; | |
62850 | + | |
62851 | + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)); | |
62852 | + BUG_ON(vma->vm_mirror || vma_m->vm_mirror); | |
62853 | + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m))); | |
62854 | + *vma_m = *vma; | |
62855 | + INIT_LIST_HEAD(&vma_m->anon_vma_chain); | |
62856 | + if (anon_vma_clone(vma_m, vma)) | |
62857 | + return -ENOMEM; | |
62858 | + pol_m = vma_policy(vma_m); | |
62859 | + mpol_get(pol_m); | |
62860 | + vma_set_policy(vma_m, pol_m); | |
62861 | + vma_m->vm_start += SEGMEXEC_TASK_SIZE; | |
62862 | + vma_m->vm_end += SEGMEXEC_TASK_SIZE; | |
62863 | + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED); | |
62864 | + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags); | |
62865 | + if (vma_m->vm_file) | |
62866 | + get_file(vma_m->vm_file); | |
62867 | + if (vma_m->vm_ops && vma_m->vm_ops->open) | |
62868 | + vma_m->vm_ops->open(vma_m); | |
62869 | + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m); | |
62870 | + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m); | |
62871 | + vma_m->vm_mirror = vma; | |
62872 | + vma->vm_mirror = vma_m; | |
62873 | + return 0; | |
62874 | +} | |
62875 | +#endif | |
62876 | + | |
62877 | /* | |
62878 | * Return true if the calling process may expand its vm space by the passed | |
62879 | * number of pages | |
62880 | @@ -2391,7 +2881,7 @@ int may_expand_vm(struct mm_struct *mm, | |
62881 | unsigned long lim; | |
62882 | ||
62883 | lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT; | |
62884 | - | |
62885 | + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1); | |
62886 | if (cur + npages > lim) | |
62887 | return 0; | |
62888 | return 1; | |
62889 | @@ -2462,6 +2952,22 @@ int install_special_mapping(struct mm_st | |
62890 | vma->vm_start = addr; | |
62891 | vma->vm_end = addr + len; | |
62892 | ||
62893 | +#ifdef CONFIG_PAX_MPROTECT | |
62894 | + if (mm->pax_flags & MF_PAX_MPROTECT) { | |
62895 | +#ifndef CONFIG_PAX_MPROTECT_COMPAT | |
62896 | + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) | |
62897 | + return -EPERM; | |
62898 | + if (!(vm_flags & VM_EXEC)) | |
62899 | + vm_flags &= ~VM_MAYEXEC; | |
62900 | +#else | |
62901 | + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC) | |
62902 | + vm_flags &= ~(VM_EXEC | VM_MAYEXEC); | |
62903 | +#endif | |
62904 | + else | |
62905 | + vm_flags &= ~VM_MAYWRITE; | |
62906 | + } | |
62907 | +#endif | |
62908 | + | |
62909 | vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND; | |
62910 | vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); | |
62911 | ||
62912 | diff -urNp linux-3.0.3/mm/mprotect.c linux-3.0.3/mm/mprotect.c | |
62913 | --- linux-3.0.3/mm/mprotect.c 2011-07-21 22:17:23.000000000 -0400 | |
62914 | +++ linux-3.0.3/mm/mprotect.c 2011-08-23 21:48:14.000000000 -0400 | |
62915 | @@ -23,10 +23,16 @@ | |
62916 | #include <linux/mmu_notifier.h> | |
62917 | #include <linux/migrate.h> | |
62918 | #include <linux/perf_event.h> | |
62919 | + | |
62920 | +#ifdef CONFIG_PAX_MPROTECT | |
62921 | +#include <linux/elf.h> | |
62922 | +#endif | |
62923 | + | |
62924 | #include <asm/uaccess.h> | |
62925 | #include <asm/pgtable.h> | |
62926 | #include <asm/cacheflush.h> | |
62927 | #include <asm/tlbflush.h> | |
62928 | +#include <asm/mmu_context.h> | |
62929 | ||
62930 | #ifndef pgprot_modify | |
62931 | static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot) | |
62932 | @@ -141,6 +147,48 @@ static void change_protection(struct vm_ | |
62933 | flush_tlb_range(vma, start, end); | |
62934 | } | |
62935 | ||
62936 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
62937 | +/* called while holding the mmap semaphor for writing except stack expansion */ | |
62938 | +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) | |
62939 | +{ | |
62940 | + unsigned long oldlimit, newlimit = 0UL; | |
62941 | + | |
62942 | + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX)) | |
62943 | + return; | |
62944 | + | |
62945 | + spin_lock(&mm->page_table_lock); | |
62946 | + oldlimit = mm->context.user_cs_limit; | |
62947 | + if ((prot & VM_EXEC) && oldlimit < end) | |
62948 | + /* USER_CS limit moved up */ | |
62949 | + newlimit = end; | |
62950 | + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end) | |
62951 | + /* USER_CS limit moved down */ | |
62952 | + newlimit = start; | |
62953 | + | |
62954 | + if (newlimit) { | |
62955 | + mm->context.user_cs_limit = newlimit; | |
62956 | + | |
62957 | +#ifdef CONFIG_SMP | |
62958 | + wmb(); | |
62959 | + cpus_clear(mm->context.cpu_user_cs_mask); | |
62960 | + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask); | |
62961 | +#endif | |
62962 | + | |
62963 | + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id()); | |
62964 | + } | |
62965 | + spin_unlock(&mm->page_table_lock); | |
62966 | + if (newlimit == end) { | |
62967 | + struct vm_area_struct *vma = find_vma(mm, oldlimit); | |
62968 | + | |
62969 | + for (; vma && vma->vm_start < end; vma = vma->vm_next) | |
62970 | + if (is_vm_hugetlb_page(vma)) | |
62971 | + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot); | |
62972 | + else | |
62973 | + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma)); | |
62974 | + } | |
62975 | +} | |
62976 | +#endif | |
62977 | + | |
62978 | int | |
62979 | mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, | |
62980 | unsigned long start, unsigned long end, unsigned long newflags) | |
62981 | @@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm | |
62982 | int error; | |
62983 | int dirty_accountable = 0; | |
62984 | ||
62985 | +#ifdef CONFIG_PAX_SEGMEXEC | |
62986 | + struct vm_area_struct *vma_m = NULL; | |
62987 | + unsigned long start_m, end_m; | |
62988 | + | |
62989 | + start_m = start + SEGMEXEC_TASK_SIZE; | |
62990 | + end_m = end + SEGMEXEC_TASK_SIZE; | |
62991 | +#endif | |
62992 | + | |
62993 | if (newflags == oldflags) { | |
62994 | *pprev = vma; | |
62995 | return 0; | |
62996 | } | |
62997 | ||
62998 | + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) { | |
62999 | + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next; | |
63000 | + | |
63001 | + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end) | |
63002 | + return -ENOMEM; | |
63003 | + | |
63004 | + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end) | |
63005 | + return -ENOMEM; | |
63006 | + } | |
63007 | + | |
63008 | /* | |
63009 | * If we make a private mapping writable we increase our commit; | |
63010 | * but (without finer accounting) cannot reduce our commit if we | |
63011 | @@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm | |
63012 | } | |
63013 | } | |
63014 | ||
63015 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63016 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) { | |
63017 | + if (start != vma->vm_start) { | |
63018 | + error = split_vma(mm, vma, start, 1); | |
63019 | + if (error) | |
63020 | + goto fail; | |
63021 | + BUG_ON(!*pprev || (*pprev)->vm_next == vma); | |
63022 | + *pprev = (*pprev)->vm_next; | |
63023 | + } | |
63024 | + | |
63025 | + if (end != vma->vm_end) { | |
63026 | + error = split_vma(mm, vma, end, 0); | |
63027 | + if (error) | |
63028 | + goto fail; | |
63029 | + } | |
63030 | + | |
63031 | + if (pax_find_mirror_vma(vma)) { | |
63032 | + error = __do_munmap(mm, start_m, end_m - start_m); | |
63033 | + if (error) | |
63034 | + goto fail; | |
63035 | + } else { | |
63036 | + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); | |
63037 | + if (!vma_m) { | |
63038 | + error = -ENOMEM; | |
63039 | + goto fail; | |
63040 | + } | |
63041 | + vma->vm_flags = newflags; | |
63042 | + error = pax_mirror_vma(vma_m, vma); | |
63043 | + if (error) { | |
63044 | + vma->vm_flags = oldflags; | |
63045 | + goto fail; | |
63046 | + } | |
63047 | + } | |
63048 | + } | |
63049 | +#endif | |
63050 | + | |
63051 | /* | |
63052 | * First try to merge with previous and/or next vma. | |
63053 | */ | |
63054 | @@ -204,9 +306,21 @@ success: | |
63055 | * vm_flags and vm_page_prot are protected by the mmap_sem | |
63056 | * held in write mode. | |
63057 | */ | |
63058 | + | |
63059 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63060 | + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ)) | |
63061 | + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ; | |
63062 | +#endif | |
63063 | + | |
63064 | vma->vm_flags = newflags; | |
63065 | + | |
63066 | +#ifdef CONFIG_PAX_MPROTECT | |
63067 | + if (mm->binfmt && mm->binfmt->handle_mprotect) | |
63068 | + mm->binfmt->handle_mprotect(vma, newflags); | |
63069 | +#endif | |
63070 | + | |
63071 | vma->vm_page_prot = pgprot_modify(vma->vm_page_prot, | |
63072 | - vm_get_page_prot(newflags)); | |
63073 | + vm_get_page_prot(vma->vm_flags)); | |
63074 | ||
63075 | if (vma_wants_writenotify(vma)) { | |
63076 | vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED); | |
63077 | @@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, | |
63078 | end = start + len; | |
63079 | if (end <= start) | |
63080 | return -ENOMEM; | |
63081 | + | |
63082 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63083 | + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) { | |
63084 | + if (end > SEGMEXEC_TASK_SIZE) | |
63085 | + return -EINVAL; | |
63086 | + } else | |
63087 | +#endif | |
63088 | + | |
63089 | + if (end > TASK_SIZE) | |
63090 | + return -EINVAL; | |
63091 | + | |
63092 | if (!arch_validate_prot(prot)) | |
63093 | return -EINVAL; | |
63094 | ||
63095 | @@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, | |
63096 | /* | |
63097 | * Does the application expect PROT_READ to imply PROT_EXEC: | |
63098 | */ | |
63099 | - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC)) | |
63100 | + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC)) | |
63101 | prot |= PROT_EXEC; | |
63102 | ||
63103 | vm_flags = calc_vm_prot_bits(prot); | |
63104 | @@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, | |
63105 | if (start > vma->vm_start) | |
63106 | prev = vma; | |
63107 | ||
63108 | +#ifdef CONFIG_PAX_MPROTECT | |
63109 | + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect) | |
63110 | + current->mm->binfmt->handle_mprotect(vma, vm_flags); | |
63111 | +#endif | |
63112 | + | |
63113 | for (nstart = start ; ; ) { | |
63114 | unsigned long newflags; | |
63115 | ||
63116 | @@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, | |
63117 | ||
63118 | /* newflags >> 4 shift VM_MAY% in place of VM_% */ | |
63119 | if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) { | |
63120 | + if (prot & (PROT_WRITE | PROT_EXEC)) | |
63121 | + gr_log_rwxmprotect(vma->vm_file); | |
63122 | + | |
63123 | + error = -EACCES; | |
63124 | + goto out; | |
63125 | + } | |
63126 | + | |
63127 | + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) { | |
63128 | error = -EACCES; | |
63129 | goto out; | |
63130 | } | |
63131 | @@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, | |
63132 | error = mprotect_fixup(vma, &prev, nstart, tmp, newflags); | |
63133 | if (error) | |
63134 | goto out; | |
63135 | + | |
63136 | + track_exec_limit(current->mm, nstart, tmp, vm_flags); | |
63137 | + | |
63138 | nstart = tmp; | |
63139 | ||
63140 | if (nstart < prev->vm_end) | |
63141 | diff -urNp linux-3.0.3/mm/mremap.c linux-3.0.3/mm/mremap.c | |
63142 | --- linux-3.0.3/mm/mremap.c 2011-07-21 22:17:23.000000000 -0400 | |
63143 | +++ linux-3.0.3/mm/mremap.c 2011-08-23 21:47:56.000000000 -0400 | |
63144 | @@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_str | |
63145 | continue; | |
63146 | pte = ptep_clear_flush(vma, old_addr, old_pte); | |
63147 | pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr); | |
63148 | + | |
63149 | +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT | |
63150 | + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC) | |
63151 | + pte = pte_exprotect(pte); | |
63152 | +#endif | |
63153 | + | |
63154 | set_pte_at(mm, new_addr, new_pte, pte); | |
63155 | } | |
63156 | ||
63157 | @@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_res | |
63158 | if (is_vm_hugetlb_page(vma)) | |
63159 | goto Einval; | |
63160 | ||
63161 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63162 | + if (pax_find_mirror_vma(vma)) | |
63163 | + goto Einval; | |
63164 | +#endif | |
63165 | + | |
63166 | /* We can't remap across vm area boundaries */ | |
63167 | if (old_len > vma->vm_end - addr) | |
63168 | goto Efault; | |
63169 | @@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned | |
63170 | unsigned long ret = -EINVAL; | |
63171 | unsigned long charged = 0; | |
63172 | unsigned long map_flags; | |
63173 | + unsigned long pax_task_size = TASK_SIZE; | |
63174 | ||
63175 | if (new_addr & ~PAGE_MASK) | |
63176 | goto out; | |
63177 | ||
63178 | - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len) | |
63179 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63180 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
63181 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
63182 | +#endif | |
63183 | + | |
63184 | + pax_task_size -= PAGE_SIZE; | |
63185 | + | |
63186 | + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len) | |
63187 | goto out; | |
63188 | ||
63189 | /* Check if the location we're moving into overlaps the | |
63190 | * old location at all, and fail if it does. | |
63191 | */ | |
63192 | - if ((new_addr <= addr) && (new_addr+new_len) > addr) | |
63193 | - goto out; | |
63194 | - | |
63195 | - if ((addr <= new_addr) && (addr+old_len) > new_addr) | |
63196 | + if (addr + old_len > new_addr && new_addr + new_len > addr) | |
63197 | goto out; | |
63198 | ||
63199 | ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1); | |
63200 | @@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long ad | |
63201 | struct vm_area_struct *vma; | |
63202 | unsigned long ret = -EINVAL; | |
63203 | unsigned long charged = 0; | |
63204 | + unsigned long pax_task_size = TASK_SIZE; | |
63205 | ||
63206 | if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE)) | |
63207 | goto out; | |
63208 | @@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long ad | |
63209 | if (!new_len) | |
63210 | goto out; | |
63211 | ||
63212 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63213 | + if (mm->pax_flags & MF_PAX_SEGMEXEC) | |
63214 | + pax_task_size = SEGMEXEC_TASK_SIZE; | |
63215 | +#endif | |
63216 | + | |
63217 | + pax_task_size -= PAGE_SIZE; | |
63218 | + | |
63219 | + if (new_len > pax_task_size || addr > pax_task_size-new_len || | |
63220 | + old_len > pax_task_size || addr > pax_task_size-old_len) | |
63221 | + goto out; | |
63222 | + | |
63223 | if (flags & MREMAP_FIXED) { | |
63224 | if (flags & MREMAP_MAYMOVE) | |
63225 | ret = mremap_to(addr, old_len, new_addr, new_len); | |
63226 | @@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long ad | |
63227 | addr + new_len); | |
63228 | } | |
63229 | ret = addr; | |
63230 | + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags); | |
63231 | goto out; | |
63232 | } | |
63233 | } | |
63234 | @@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long ad | |
63235 | ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1); | |
63236 | if (ret) | |
63237 | goto out; | |
63238 | + | |
63239 | + map_flags = vma->vm_flags; | |
63240 | ret = move_vma(vma, addr, old_len, new_len, new_addr); | |
63241 | + if (!(ret & ~PAGE_MASK)) { | |
63242 | + track_exec_limit(current->mm, addr, addr + old_len, 0UL); | |
63243 | + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags); | |
63244 | + } | |
63245 | } | |
63246 | out: | |
63247 | if (ret & ~PAGE_MASK) | |
63248 | diff -urNp linux-3.0.3/mm/nobootmem.c linux-3.0.3/mm/nobootmem.c | |
63249 | --- linux-3.0.3/mm/nobootmem.c 2011-07-21 22:17:23.000000000 -0400 | |
63250 | +++ linux-3.0.3/mm/nobootmem.c 2011-08-23 21:47:56.000000000 -0400 | |
63251 | @@ -110,19 +110,30 @@ static void __init __free_pages_memory(u | |
63252 | unsigned long __init free_all_memory_core_early(int nodeid) | |
63253 | { | |
63254 | int i; | |
63255 | - u64 start, end; | |
63256 | + u64 start, end, startrange, endrange; | |
63257 | unsigned long count = 0; | |
63258 | - struct range *range = NULL; | |
63259 | + struct range *range = NULL, rangerange = { 0, 0 }; | |
63260 | int nr_range; | |
63261 | ||
63262 | nr_range = get_free_all_memory_range(&range, nodeid); | |
63263 | + startrange = __pa(range) >> PAGE_SHIFT; | |
63264 | + endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT; | |
63265 | ||
63266 | for (i = 0; i < nr_range; i++) { | |
63267 | start = range[i].start; | |
63268 | end = range[i].end; | |
63269 | + if (start <= endrange && startrange < end) { | |
63270 | + BUG_ON(rangerange.start | rangerange.end); | |
63271 | + rangerange = range[i]; | |
63272 | + continue; | |
63273 | + } | |
63274 | count += end - start; | |
63275 | __free_pages_memory(start, end); | |
63276 | } | |
63277 | + start = rangerange.start; | |
63278 | + end = rangerange.end; | |
63279 | + count += end - start; | |
63280 | + __free_pages_memory(start, end); | |
63281 | ||
63282 | return count; | |
63283 | } | |
63284 | diff -urNp linux-3.0.3/mm/nommu.c linux-3.0.3/mm/nommu.c | |
63285 | --- linux-3.0.3/mm/nommu.c 2011-07-21 22:17:23.000000000 -0400 | |
63286 | +++ linux-3.0.3/mm/nommu.c 2011-08-23 21:47:56.000000000 -0400 | |
63287 | @@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI | |
63288 | int sysctl_overcommit_ratio = 50; /* default is 50% */ | |
63289 | int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT; | |
63290 | int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS; | |
63291 | -int heap_stack_gap = 0; | |
63292 | ||
63293 | atomic_long_t mmap_pages_allocated; | |
63294 | ||
63295 | @@ -826,15 +825,6 @@ struct vm_area_struct *find_vma(struct m | |
63296 | EXPORT_SYMBOL(find_vma); | |
63297 | ||
63298 | /* | |
63299 | - * find a VMA | |
63300 | - * - we don't extend stack VMAs under NOMMU conditions | |
63301 | - */ | |
63302 | -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr) | |
63303 | -{ | |
63304 | - return find_vma(mm, addr); | |
63305 | -} | |
63306 | - | |
63307 | -/* | |
63308 | * expand a stack to a given address | |
63309 | * - not supported under NOMMU conditions | |
63310 | */ | |
63311 | @@ -1554,6 +1544,7 @@ int split_vma(struct mm_struct *mm, stru | |
63312 | ||
63313 | /* most fields are the same, copy all, and then fixup */ | |
63314 | *new = *vma; | |
63315 | + INIT_LIST_HEAD(&new->anon_vma_chain); | |
63316 | *region = *vma->vm_region; | |
63317 | new->vm_region = region; | |
63318 | ||
63319 | diff -urNp linux-3.0.3/mm/page_alloc.c linux-3.0.3/mm/page_alloc.c | |
63320 | --- linux-3.0.3/mm/page_alloc.c 2011-07-21 22:17:23.000000000 -0400 | |
63321 | +++ linux-3.0.3/mm/page_alloc.c 2011-08-23 21:48:14.000000000 -0400 | |
63322 | @@ -340,7 +340,7 @@ out: | |
63323 | * This usage means that zero-order pages may not be compound. | |
63324 | */ | |
63325 | ||
63326 | -static void free_compound_page(struct page *page) | |
63327 | +void free_compound_page(struct page *page) | |
63328 | { | |
63329 | __free_pages_ok(page, compound_order(page)); | |
63330 | } | |
63331 | @@ -653,6 +653,10 @@ static bool free_pages_prepare(struct pa | |
63332 | int i; | |
63333 | int bad = 0; | |
63334 | ||
63335 | +#ifdef CONFIG_PAX_MEMORY_SANITIZE | |
63336 | + unsigned long index = 1UL << order; | |
63337 | +#endif | |
63338 | + | |
63339 | trace_mm_page_free_direct(page, order); | |
63340 | kmemcheck_free_shadow(page, order); | |
63341 | ||
63342 | @@ -668,6 +672,12 @@ static bool free_pages_prepare(struct pa | |
63343 | debug_check_no_obj_freed(page_address(page), | |
63344 | PAGE_SIZE << order); | |
63345 | } | |
63346 | + | |
63347 | +#ifdef CONFIG_PAX_MEMORY_SANITIZE | |
63348 | + for (; index; --index) | |
63349 | + sanitize_highpage(page + index - 1); | |
63350 | +#endif | |
63351 | + | |
63352 | arch_free_page(page, order); | |
63353 | kernel_map_pages(page, 1 << order, 0); | |
63354 | ||
63355 | @@ -783,8 +793,10 @@ static int prep_new_page(struct page *pa | |
63356 | arch_alloc_page(page, order); | |
63357 | kernel_map_pages(page, 1 << order, 1); | |
63358 | ||
63359 | +#ifndef CONFIG_PAX_MEMORY_SANITIZE | |
63360 | if (gfp_flags & __GFP_ZERO) | |
63361 | prep_zero_page(page, order, gfp_flags); | |
63362 | +#endif | |
63363 | ||
63364 | if (order && (gfp_flags & __GFP_COMP)) | |
63365 | prep_compound_page(page, order); | |
63366 | @@ -2525,6 +2537,8 @@ void show_free_areas(unsigned int filter | |
63367 | int cpu; | |
63368 | struct zone *zone; | |
63369 | ||
63370 | + pax_track_stack(); | |
63371 | + | |
63372 | for_each_populated_zone(zone) { | |
63373 | if (skip_free_areas_node(filter, zone_to_nid(zone))) | |
63374 | continue; | |
63375 | diff -urNp linux-3.0.3/mm/percpu.c linux-3.0.3/mm/percpu.c | |
63376 | --- linux-3.0.3/mm/percpu.c 2011-07-21 22:17:23.000000000 -0400 | |
63377 | +++ linux-3.0.3/mm/percpu.c 2011-08-23 21:47:56.000000000 -0400 | |
63378 | @@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu | |
63379 | static unsigned int pcpu_last_unit_cpu __read_mostly; | |
63380 | ||
63381 | /* the address of the first chunk which starts with the kernel static area */ | |
63382 | -void *pcpu_base_addr __read_mostly; | |
63383 | +void *pcpu_base_addr __read_only; | |
63384 | EXPORT_SYMBOL_GPL(pcpu_base_addr); | |
63385 | ||
63386 | static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */ | |
63387 | diff -urNp linux-3.0.3/mm/rmap.c linux-3.0.3/mm/rmap.c | |
63388 | --- linux-3.0.3/mm/rmap.c 2011-07-21 22:17:23.000000000 -0400 | |
63389 | +++ linux-3.0.3/mm/rmap.c 2011-08-23 21:47:56.000000000 -0400 | |
63390 | @@ -153,6 +153,10 @@ int anon_vma_prepare(struct vm_area_stru | |
63391 | struct anon_vma *anon_vma = vma->anon_vma; | |
63392 | struct anon_vma_chain *avc; | |
63393 | ||
63394 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63395 | + struct anon_vma_chain *avc_m = NULL; | |
63396 | +#endif | |
63397 | + | |
63398 | might_sleep(); | |
63399 | if (unlikely(!anon_vma)) { | |
63400 | struct mm_struct *mm = vma->vm_mm; | |
63401 | @@ -162,6 +166,12 @@ int anon_vma_prepare(struct vm_area_stru | |
63402 | if (!avc) | |
63403 | goto out_enomem; | |
63404 | ||
63405 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63406 | + avc_m = anon_vma_chain_alloc(GFP_KERNEL); | |
63407 | + if (!avc_m) | |
63408 | + goto out_enomem_free_avc; | |
63409 | +#endif | |
63410 | + | |
63411 | anon_vma = find_mergeable_anon_vma(vma); | |
63412 | allocated = NULL; | |
63413 | if (!anon_vma) { | |
63414 | @@ -175,6 +185,21 @@ int anon_vma_prepare(struct vm_area_stru | |
63415 | /* page_table_lock to protect against threads */ | |
63416 | spin_lock(&mm->page_table_lock); | |
63417 | if (likely(!vma->anon_vma)) { | |
63418 | + | |
63419 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63420 | + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma); | |
63421 | + | |
63422 | + if (vma_m) { | |
63423 | + BUG_ON(vma_m->anon_vma); | |
63424 | + vma_m->anon_vma = anon_vma; | |
63425 | + avc_m->anon_vma = anon_vma; | |
63426 | + avc_m->vma = vma; | |
63427 | + list_add(&avc_m->same_vma, &vma_m->anon_vma_chain); | |
63428 | + list_add(&avc_m->same_anon_vma, &anon_vma->head); | |
63429 | + avc_m = NULL; | |
63430 | + } | |
63431 | +#endif | |
63432 | + | |
63433 | vma->anon_vma = anon_vma; | |
63434 | avc->anon_vma = anon_vma; | |
63435 | avc->vma = vma; | |
63436 | @@ -188,12 +213,24 @@ int anon_vma_prepare(struct vm_area_stru | |
63437 | ||
63438 | if (unlikely(allocated)) | |
63439 | put_anon_vma(allocated); | |
63440 | + | |
63441 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63442 | + if (unlikely(avc_m)) | |
63443 | + anon_vma_chain_free(avc_m); | |
63444 | +#endif | |
63445 | + | |
63446 | if (unlikely(avc)) | |
63447 | anon_vma_chain_free(avc); | |
63448 | } | |
63449 | return 0; | |
63450 | ||
63451 | out_enomem_free_avc: | |
63452 | + | |
63453 | +#ifdef CONFIG_PAX_SEGMEXEC | |
63454 | + if (avc_m) | |
63455 | + anon_vma_chain_free(avc_m); | |
63456 | +#endif | |
63457 | + | |
63458 | anon_vma_chain_free(avc); | |
63459 | out_enomem: | |
63460 | return -ENOMEM; | |
63461 | @@ -244,7 +281,7 @@ static void anon_vma_chain_link(struct v | |
63462 | * Attach the anon_vmas from src to dst. | |
63463 | * Returns 0 on success, -ENOMEM on failure. | |
63464 | */ | |
63465 | -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) | |
63466 | +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src) | |
63467 | { | |
63468 | struct anon_vma_chain *avc, *pavc; | |
63469 | struct anon_vma *root = NULL; | |
63470 | @@ -277,7 +314,7 @@ int anon_vma_clone(struct vm_area_struct | |
63471 | * the corresponding VMA in the parent process is attached to. | |
63472 | * Returns 0 on success, non-zero on failure. | |
63473 | */ | |
63474 | -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) | |
63475 | +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma) | |
63476 | { | |
63477 | struct anon_vma_chain *avc; | |
63478 | struct anon_vma *anon_vma; | |
63479 | diff -urNp linux-3.0.3/mm/shmem.c linux-3.0.3/mm/shmem.c | |
63480 | --- linux-3.0.3/mm/shmem.c 2011-07-21 22:17:23.000000000 -0400 | |
63481 | +++ linux-3.0.3/mm/shmem.c 2011-08-23 21:48:14.000000000 -0400 | |
63482 | @@ -31,7 +31,7 @@ | |
63483 | #include <linux/percpu_counter.h> | |
63484 | #include <linux/swap.h> | |
63485 | ||
63486 | -static struct vfsmount *shm_mnt; | |
63487 | +struct vfsmount *shm_mnt; | |
63488 | ||
63489 | #ifdef CONFIG_SHMEM | |
63490 | /* | |
63491 | @@ -1101,6 +1101,8 @@ static int shmem_writepage(struct page * | |
63492 | goto unlock; | |
63493 | } | |
63494 | entry = shmem_swp_entry(info, index, NULL); | |
63495 | + if (!entry) | |
63496 | + goto unlock; | |
63497 | if (entry->val) { | |
63498 | /* | |
63499 | * The more uptodate page coming down from a stacked | |
63500 | @@ -1172,6 +1174,8 @@ static struct page *shmem_swapin(swp_ent | |
63501 | struct vm_area_struct pvma; | |
63502 | struct page *page; | |
63503 | ||
63504 | + pax_track_stack(); | |
63505 | + | |
63506 | spol = mpol_cond_copy(&mpol, | |
63507 | mpol_shared_policy_lookup(&info->policy, idx)); | |
63508 | ||
63509 | @@ -2568,8 +2572,7 @@ int shmem_fill_super(struct super_block | |
63510 | int err = -ENOMEM; | |
63511 | ||
63512 | /* Round up to L1_CACHE_BYTES to resist false sharing */ | |
63513 | - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info), | |
63514 | - L1_CACHE_BYTES), GFP_KERNEL); | |
63515 | + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL); | |
63516 | if (!sbinfo) | |
63517 | return -ENOMEM; | |
63518 | ||
63519 | diff -urNp linux-3.0.3/mm/slab.c linux-3.0.3/mm/slab.c | |
63520 | --- linux-3.0.3/mm/slab.c 2011-07-21 22:17:23.000000000 -0400 | |
63521 | +++ linux-3.0.3/mm/slab.c 2011-08-23 21:48:14.000000000 -0400 | |
63522 | @@ -151,7 +151,7 @@ | |
63523 | ||
63524 | /* Legal flag mask for kmem_cache_create(). */ | |
63525 | #if DEBUG | |
63526 | -# define CREATE_MASK (SLAB_RED_ZONE | \ | |
63527 | +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \ | |
63528 | SLAB_POISON | SLAB_HWCACHE_ALIGN | \ | |
63529 | SLAB_CACHE_DMA | \ | |
63530 | SLAB_STORE_USER | \ | |
63531 | @@ -159,7 +159,7 @@ | |
63532 | SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \ | |
63533 | SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK) | |
63534 | #else | |
63535 | -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \ | |
63536 | +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \ | |
63537 | SLAB_CACHE_DMA | \ | |
63538 | SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \ | |
63539 | SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \ | |
63540 | @@ -288,7 +288,7 @@ struct kmem_list3 { | |
63541 | * Need this for bootstrapping a per node allocator. | |
63542 | */ | |
63543 | #define NUM_INIT_LISTS (3 * MAX_NUMNODES) | |
63544 | -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS]; | |
63545 | +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS]; | |
63546 | #define CACHE_CACHE 0 | |
63547 | #define SIZE_AC MAX_NUMNODES | |
63548 | #define SIZE_L3 (2 * MAX_NUMNODES) | |
63549 | @@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_ | |
63550 | if ((x)->max_freeable < i) \ | |
63551 | (x)->max_freeable = i; \ | |
63552 | } while (0) | |
63553 | -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit) | |
63554 | -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss) | |
63555 | -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit) | |
63556 | -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss) | |
63557 | +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit) | |
63558 | +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss) | |
63559 | +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit) | |
63560 | +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss) | |
63561 | #else | |
63562 | #define STATS_INC_ACTIVE(x) do { } while (0) | |
63563 | #define STATS_DEC_ACTIVE(x) do { } while (0) | |
63564 | @@ -538,7 +538,7 @@ static inline void *index_to_obj(struct | |
63565 | * reciprocal_divide(offset, cache->reciprocal_buffer_size) | |
63566 | */ | |
63567 | static inline unsigned int obj_to_index(const struct kmem_cache *cache, | |
63568 | - const struct slab *slab, void *obj) | |
63569 | + const struct slab *slab, const void *obj) | |
63570 | { | |
63571 | u32 offset = (obj - slab->s_mem); | |
63572 | return reciprocal_divide(offset, cache->reciprocal_buffer_size); | |
63573 | @@ -564,7 +564,7 @@ struct cache_names { | |
63574 | static struct cache_names __initdata cache_names[] = { | |
63575 | #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" }, | |
63576 | #include <linux/kmalloc_sizes.h> | |
63577 | - {NULL,} | |
63578 | + {NULL} | |
63579 | #undef CACHE | |
63580 | }; | |
63581 | ||
63582 | @@ -1530,7 +1530,7 @@ void __init kmem_cache_init(void) | |
63583 | sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name, | |
63584 | sizes[INDEX_AC].cs_size, | |
63585 | ARCH_KMALLOC_MINALIGN, | |
63586 | - ARCH_KMALLOC_FLAGS|SLAB_PANIC, | |
63587 | + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY, | |
63588 | NULL); | |
63589 | ||
63590 | if (INDEX_AC != INDEX_L3) { | |
63591 | @@ -1538,7 +1538,7 @@ void __init kmem_cache_init(void) | |
63592 | kmem_cache_create(names[INDEX_L3].name, | |
63593 | sizes[INDEX_L3].cs_size, | |
63594 | ARCH_KMALLOC_MINALIGN, | |
63595 | - ARCH_KMALLOC_FLAGS|SLAB_PANIC, | |
63596 | + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY, | |
63597 | NULL); | |
63598 | } | |
63599 | ||
63600 | @@ -1556,7 +1556,7 @@ void __init kmem_cache_init(void) | |
63601 | sizes->cs_cachep = kmem_cache_create(names->name, | |
63602 | sizes->cs_size, | |
63603 | ARCH_KMALLOC_MINALIGN, | |
63604 | - ARCH_KMALLOC_FLAGS|SLAB_PANIC, | |
63605 | + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY, | |
63606 | NULL); | |
63607 | } | |
63608 | #ifdef CONFIG_ZONE_DMA | |
63609 | @@ -4272,10 +4272,10 @@ static int s_show(struct seq_file *m, vo | |
63610 | } | |
63611 | /* cpu stats */ | |
63612 | { | |
63613 | - unsigned long allochit = atomic_read(&cachep->allochit); | |
63614 | - unsigned long allocmiss = atomic_read(&cachep->allocmiss); | |
63615 | - unsigned long freehit = atomic_read(&cachep->freehit); | |
63616 | - unsigned long freemiss = atomic_read(&cachep->freemiss); | |
63617 | + unsigned long allochit = atomic_read_unchecked(&cachep->allochit); | |
63618 | + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss); | |
63619 | + unsigned long freehit = atomic_read_unchecked(&cachep->freehit); | |
63620 | + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss); | |
63621 | ||
63622 | seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu", | |
63623 | allochit, allocmiss, freehit, freemiss); | |
63624 | @@ -4532,15 +4532,66 @@ static const struct file_operations proc | |
63625 | ||
63626 | static int __init slab_proc_init(void) | |
63627 | { | |
63628 | - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations); | |
63629 | + mode_t gr_mode = S_IRUGO; | |
63630 | + | |
63631 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
63632 | + gr_mode = S_IRUSR; | |
63633 | +#endif | |
63634 | + | |
63635 | + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations); | |
63636 | #ifdef CONFIG_DEBUG_SLAB_LEAK | |
63637 | - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations); | |
63638 | + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations); | |
63639 | #endif | |
63640 | return 0; | |
63641 | } | |
63642 | module_init(slab_proc_init); | |
63643 | #endif | |
63644 | ||
63645 | +void check_object_size(const void *ptr, unsigned long n, bool to) | |
63646 | +{ | |
63647 | + | |
63648 | +#ifdef CONFIG_PAX_USERCOPY | |
63649 | + struct page *page; | |
63650 | + struct kmem_cache *cachep = NULL; | |
63651 | + struct slab *slabp; | |
63652 | + unsigned int objnr; | |
63653 | + unsigned long offset; | |
63654 | + | |
63655 | + if (!n) | |
63656 | + return; | |
63657 | + | |
63658 | + if (ZERO_OR_NULL_PTR(ptr)) | |
63659 | + goto report; | |
63660 | + | |
63661 | + if (!virt_addr_valid(ptr)) | |
63662 | + return; | |
63663 | + | |
63664 | + page = virt_to_head_page(ptr); | |
63665 | + | |
63666 | + if (!PageSlab(page)) { | |
63667 | + if (object_is_on_stack(ptr, n) == -1) | |
63668 | + goto report; | |
63669 | + return; | |
63670 | + } | |
63671 | + | |
63672 | + cachep = page_get_cache(page); | |
63673 | + if (!(cachep->flags & SLAB_USERCOPY)) | |
63674 | + goto report; | |
63675 | + | |
63676 | + slabp = page_get_slab(page); | |
63677 | + objnr = obj_to_index(cachep, slabp, ptr); | |
63678 | + BUG_ON(objnr >= cachep->num); | |
63679 | + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep); | |
63680 | + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset) | |
63681 | + return; | |
63682 | + | |
63683 | +report: | |
63684 | + pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL); | |
63685 | +#endif | |
63686 | + | |
63687 | +} | |
63688 | +EXPORT_SYMBOL(check_object_size); | |
63689 | + | |
63690 | /** | |
63691 | * ksize - get the actual amount of memory allocated for a given object | |
63692 | * @objp: Pointer to the object | |
63693 | diff -urNp linux-3.0.3/mm/slob.c linux-3.0.3/mm/slob.c | |
63694 | --- linux-3.0.3/mm/slob.c 2011-07-21 22:17:23.000000000 -0400 | |
63695 | +++ linux-3.0.3/mm/slob.c 2011-08-23 21:47:56.000000000 -0400 | |
63696 | @@ -29,7 +29,7 @@ | |
63697 | * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls | |
63698 | * alloc_pages() directly, allocating compound pages so the page order | |
63699 | * does not have to be separately tracked, and also stores the exact | |
63700 | - * allocation size in page->private so that it can be used to accurately | |
63701 | + * allocation size in slob_page->size so that it can be used to accurately | |
63702 | * provide ksize(). These objects are detected in kfree() because slob_page() | |
63703 | * is false for them. | |
63704 | * | |
63705 | @@ -58,6 +58,7 @@ | |
63706 | */ | |
63707 | ||
63708 | #include <linux/kernel.h> | |
63709 | +#include <linux/sched.h> | |
63710 | #include <linux/slab.h> | |
63711 | #include <linux/mm.h> | |
63712 | #include <linux/swap.h> /* struct reclaim_state */ | |
63713 | @@ -102,7 +103,8 @@ struct slob_page { | |
63714 | unsigned long flags; /* mandatory */ | |
63715 | atomic_t _count; /* mandatory */ | |
63716 | slobidx_t units; /* free units left in page */ | |
63717 | - unsigned long pad[2]; | |
63718 | + unsigned long pad[1]; | |
63719 | + unsigned long size; /* size when >=PAGE_SIZE */ | |
63720 | slob_t *free; /* first free slob_t in page */ | |
63721 | struct list_head list; /* linked list of free pages */ | |
63722 | }; | |
63723 | @@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large); | |
63724 | */ | |
63725 | static inline int is_slob_page(struct slob_page *sp) | |
63726 | { | |
63727 | - return PageSlab((struct page *)sp); | |
63728 | + return PageSlab((struct page *)sp) && !sp->size; | |
63729 | } | |
63730 | ||
63731 | static inline void set_slob_page(struct slob_page *sp) | |
63732 | @@ -150,7 +152,7 @@ static inline void clear_slob_page(struc | |
63733 | ||
63734 | static inline struct slob_page *slob_page(const void *addr) | |
63735 | { | |
63736 | - return (struct slob_page *)virt_to_page(addr); | |
63737 | + return (struct slob_page *)virt_to_head_page(addr); | |
63738 | } | |
63739 | ||
63740 | /* | |
63741 | @@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_ | |
63742 | /* | |
63743 | * Return the size of a slob block. | |
63744 | */ | |
63745 | -static slobidx_t slob_units(slob_t *s) | |
63746 | +static slobidx_t slob_units(const slob_t *s) | |
63747 | { | |
63748 | if (s->units > 0) | |
63749 | return s->units; | |
63750 | @@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s) | |
63751 | /* | |
63752 | * Return the next free slob block pointer after this one. | |
63753 | */ | |
63754 | -static slob_t *slob_next(slob_t *s) | |
63755 | +static slob_t *slob_next(const slob_t *s) | |
63756 | { | |
63757 | slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK); | |
63758 | slobidx_t next; | |
63759 | @@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s) | |
63760 | /* | |
63761 | * Returns true if s is the last free block in its page. | |
63762 | */ | |
63763 | -static int slob_last(slob_t *s) | |
63764 | +static int slob_last(const slob_t *s) | |
63765 | { | |
63766 | return !((unsigned long)slob_next(s) & ~PAGE_MASK); | |
63767 | } | |
63768 | @@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i | |
63769 | if (!page) | |
63770 | return NULL; | |
63771 | ||
63772 | + set_slob_page(page); | |
63773 | return page_address(page); | |
63774 | } | |
63775 | ||
63776 | @@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp | |
63777 | if (!b) | |
63778 | return NULL; | |
63779 | sp = slob_page(b); | |
63780 | - set_slob_page(sp); | |
63781 | ||
63782 | spin_lock_irqsave(&slob_lock, flags); | |
63783 | sp->units = SLOB_UNITS(PAGE_SIZE); | |
63784 | sp->free = b; | |
63785 | + sp->size = 0; | |
63786 | INIT_LIST_HEAD(&sp->list); | |
63787 | set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE)); | |
63788 | set_slob_page_free(sp, slob_list); | |
63789 | @@ -476,10 +479,9 @@ out: | |
63790 | * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend. | |
63791 | */ | |
63792 | ||
63793 | -void *__kmalloc_node(size_t size, gfp_t gfp, int node) | |
63794 | +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align) | |
63795 | { | |
63796 | - unsigned int *m; | |
63797 | - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN); | |
63798 | + slob_t *m; | |
63799 | void *ret; | |
63800 | ||
63801 | lockdep_trace_alloc(gfp); | |
63802 | @@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t | |
63803 | ||
63804 | if (!m) | |
63805 | return NULL; | |
63806 | - *m = size; | |
63807 | + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT); | |
63808 | + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT); | |
63809 | + m[0].units = size; | |
63810 | + m[1].units = align; | |
63811 | ret = (void *)m + align; | |
63812 | ||
63813 | trace_kmalloc_node(_RET_IP_, ret, | |
63814 | @@ -504,16 +509,25 @@ void *__kmalloc_node(size_t size, gfp_t | |
63815 | gfp |= __GFP_COMP; | |
63816 | ret = slob_new_pages(gfp, order, node); | |
63817 | if (ret) { | |
63818 | - struct page *page; | |
63819 | - page = virt_to_page(ret); | |
63820 | - page->private = size; | |
63821 | + struct slob_page *sp; | |
63822 | + sp = slob_page(ret); | |
63823 | + sp->size = size; | |
63824 | } | |
63825 | ||
63826 | trace_kmalloc_node(_RET_IP_, ret, | |
63827 | size, PAGE_SIZE << order, gfp, node); | |
63828 | } | |
63829 | ||
63830 | - kmemleak_alloc(ret, size, 1, gfp); | |
63831 | + return ret; | |
63832 | +} | |
63833 | + | |
63834 | +void *__kmalloc_node(size_t size, gfp_t gfp, int node) | |
63835 | +{ | |
63836 | + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN); | |
63837 | + void *ret = __kmalloc_node_align(size, gfp, node, align); | |
63838 | + | |
63839 | + if (!ZERO_OR_NULL_PTR(ret)) | |
63840 | + kmemleak_alloc(ret, size, 1, gfp); | |
63841 | return ret; | |
63842 | } | |
63843 | EXPORT_SYMBOL(__kmalloc_node); | |
63844 | @@ -531,13 +545,88 @@ void kfree(const void *block) | |
63845 | sp = slob_page(block); | |
63846 | if (is_slob_page(sp)) { | |
63847 | int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN); | |
63848 | - unsigned int *m = (unsigned int *)(block - align); | |
63849 | - slob_free(m, *m + align); | |
63850 | - } else | |
63851 | + slob_t *m = (slob_t *)(block - align); | |
63852 | + slob_free(m, m[0].units + align); | |
63853 | + } else { | |
63854 | + clear_slob_page(sp); | |
63855 | + free_slob_page(sp); | |
63856 | + sp->size = 0; | |
63857 | put_page(&sp->page); | |
63858 | + } | |
63859 | } | |
63860 | EXPORT_SYMBOL(kfree); | |
63861 | ||
63862 | +void check_object_size(const void *ptr, unsigned long n, bool to) | |
63863 | +{ | |
63864 | + | |
63865 | +#ifdef CONFIG_PAX_USERCOPY | |
63866 | + struct slob_page *sp; | |
63867 | + const slob_t *free; | |
63868 | + const void *base; | |
63869 | + unsigned long flags; | |
63870 | + | |
63871 | + if (!n) | |
63872 | + return; | |
63873 | + | |
63874 | + if (ZERO_OR_NULL_PTR(ptr)) | |
63875 | + goto report; | |
63876 | + | |
63877 | + if (!virt_addr_valid(ptr)) | |
63878 | + return; | |
63879 | + | |
63880 | + sp = slob_page(ptr); | |
63881 | + if (!PageSlab((struct page*)sp)) { | |
63882 | + if (object_is_on_stack(ptr, n) == -1) | |
63883 | + goto report; | |
63884 | + return; | |
63885 | + } | |
63886 | + | |
63887 | + if (sp->size) { | |
63888 | + base = page_address(&sp->page); | |
63889 | + if (base <= ptr && n <= sp->size - (ptr - base)) | |
63890 | + return; | |
63891 | + goto report; | |
63892 | + } | |
63893 | + | |
63894 | + /* some tricky double walking to find the chunk */ | |
63895 | + spin_lock_irqsave(&slob_lock, flags); | |
63896 | + base = (void *)((unsigned long)ptr & PAGE_MASK); | |
63897 | + free = sp->free; | |
63898 | + | |
63899 | + while (!slob_last(free) && (void *)free <= ptr) { | |
63900 | + base = free + slob_units(free); | |
63901 | + free = slob_next(free); | |
63902 | + } | |
63903 | + | |
63904 | + while (base < (void *)free) { | |
63905 | + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units; | |
63906 | + int size = SLOB_UNIT * SLOB_UNITS(m + align); | |
63907 | + int offset; | |
63908 | + | |
63909 | + if (ptr < base + align) | |
63910 | + break; | |
63911 | + | |
63912 | + offset = ptr - base - align; | |
63913 | + if (offset >= m) { | |
63914 | + base += size; | |
63915 | + continue; | |
63916 | + } | |
63917 | + | |
63918 | + if (n > m - offset) | |
63919 | + break; | |
63920 | + | |
63921 | + spin_unlock_irqrestore(&slob_lock, flags); | |
63922 | + return; | |
63923 | + } | |
63924 | + | |
63925 | + spin_unlock_irqrestore(&slob_lock, flags); | |
63926 | +report: | |
63927 | + pax_report_usercopy(ptr, n, to, NULL); | |
63928 | +#endif | |
63929 | + | |
63930 | +} | |
63931 | +EXPORT_SYMBOL(check_object_size); | |
63932 | + | |
63933 | /* can't use ksize for kmem_cache_alloc memory, only kmalloc */ | |
63934 | size_t ksize(const void *block) | |
63935 | { | |
63936 | @@ -550,10 +639,10 @@ size_t ksize(const void *block) | |
63937 | sp = slob_page(block); | |
63938 | if (is_slob_page(sp)) { | |
63939 | int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN); | |
63940 | - unsigned int *m = (unsigned int *)(block - align); | |
63941 | - return SLOB_UNITS(*m) * SLOB_UNIT; | |
63942 | + slob_t *m = (slob_t *)(block - align); | |
63943 | + return SLOB_UNITS(m[0].units) * SLOB_UNIT; | |
63944 | } else | |
63945 | - return sp->page.private; | |
63946 | + return sp->size; | |
63947 | } | |
63948 | EXPORT_SYMBOL(ksize); | |
63949 | ||
63950 | @@ -569,8 +658,13 @@ struct kmem_cache *kmem_cache_create(con | |
63951 | { | |
63952 | struct kmem_cache *c; | |
63953 | ||
63954 | +#ifdef CONFIG_PAX_USERCOPY | |
63955 | + c = __kmalloc_node_align(sizeof(struct kmem_cache), | |
63956 | + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN); | |
63957 | +#else | |
63958 | c = slob_alloc(sizeof(struct kmem_cache), | |
63959 | GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1); | |
63960 | +#endif | |
63961 | ||
63962 | if (c) { | |
63963 | c->name = name; | |
63964 | @@ -608,17 +702,25 @@ void *kmem_cache_alloc_node(struct kmem_ | |
63965 | { | |
63966 | void *b; | |
63967 | ||
63968 | +#ifdef CONFIG_PAX_USERCOPY | |
63969 | + b = __kmalloc_node_align(c->size, flags, node, c->align); | |
63970 | +#else | |
63971 | if (c->size < PAGE_SIZE) { | |
63972 | b = slob_alloc(c->size, flags, c->align, node); | |
63973 | trace_kmem_cache_alloc_node(_RET_IP_, b, c->size, | |
63974 | SLOB_UNITS(c->size) * SLOB_UNIT, | |
63975 | flags, node); | |
63976 | } else { | |
63977 | + struct slob_page *sp; | |
63978 | + | |
63979 | b = slob_new_pages(flags, get_order(c->size), node); | |
63980 | + sp = slob_page(b); | |
63981 | + sp->size = c->size; | |
63982 | trace_kmem_cache_alloc_node(_RET_IP_, b, c->size, | |
63983 | PAGE_SIZE << get_order(c->size), | |
63984 | flags, node); | |
63985 | } | |
63986 | +#endif | |
63987 | ||
63988 | if (c->ctor) | |
63989 | c->ctor(b); | |
63990 | @@ -630,10 +732,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node); | |
63991 | ||
63992 | static void __kmem_cache_free(void *b, int size) | |
63993 | { | |
63994 | - if (size < PAGE_SIZE) | |
63995 | + struct slob_page *sp = slob_page(b); | |
63996 | + | |
63997 | + if (is_slob_page(sp)) | |
63998 | slob_free(b, size); | |
63999 | - else | |
64000 | + else { | |
64001 | + clear_slob_page(sp); | |
64002 | + free_slob_page(sp); | |
64003 | + sp->size = 0; | |
64004 | slob_free_pages(b, get_order(size)); | |
64005 | + } | |
64006 | } | |
64007 | ||
64008 | static void kmem_rcu_free(struct rcu_head *head) | |
64009 | @@ -646,17 +754,31 @@ static void kmem_rcu_free(struct rcu_hea | |
64010 | ||
64011 | void kmem_cache_free(struct kmem_cache *c, void *b) | |
64012 | { | |
64013 | + int size = c->size; | |
64014 | + | |
64015 | +#ifdef CONFIG_PAX_USERCOPY | |
64016 | + if (size + c->align < PAGE_SIZE) { | |
64017 | + size += c->align; | |
64018 | + b -= c->align; | |
64019 | + } | |
64020 | +#endif | |
64021 | + | |
64022 | kmemleak_free_recursive(b, c->flags); | |
64023 | if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) { | |
64024 | struct slob_rcu *slob_rcu; | |
64025 | - slob_rcu = b + (c->size - sizeof(struct slob_rcu)); | |
64026 | - slob_rcu->size = c->size; | |
64027 | + slob_rcu = b + (size - sizeof(struct slob_rcu)); | |
64028 | + slob_rcu->size = size; | |
64029 | call_rcu(&slob_rcu->head, kmem_rcu_free); | |
64030 | } else { | |
64031 | - __kmem_cache_free(b, c->size); | |
64032 | + __kmem_cache_free(b, size); | |
64033 | } | |
64034 | ||
64035 | +#ifdef CONFIG_PAX_USERCOPY | |
64036 | + trace_kfree(_RET_IP_, b); | |
64037 | +#else | |
64038 | trace_kmem_cache_free(_RET_IP_, b); | |
64039 | +#endif | |
64040 | + | |
64041 | } | |
64042 | EXPORT_SYMBOL(kmem_cache_free); | |
64043 | ||
64044 | diff -urNp linux-3.0.3/mm/slub.c linux-3.0.3/mm/slub.c | |
64045 | --- linux-3.0.3/mm/slub.c 2011-07-21 22:17:23.000000000 -0400 | |
64046 | +++ linux-3.0.3/mm/slub.c 2011-08-23 21:48:14.000000000 -0400 | |
64047 | @@ -442,7 +442,7 @@ static void print_track(const char *s, s | |
64048 | if (!t->addr) | |
64049 | return; | |
64050 | ||
64051 | - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n", | |
64052 | + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n", | |
64053 | s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid); | |
64054 | } | |
64055 | ||
64056 | @@ -2137,6 +2137,8 @@ void kmem_cache_free(struct kmem_cache * | |
64057 | ||
64058 | page = virt_to_head_page(x); | |
64059 | ||
64060 | + BUG_ON(!PageSlab(page)); | |
64061 | + | |
64062 | slab_free(s, page, x, _RET_IP_); | |
64063 | ||
64064 | trace_kmem_cache_free(_RET_IP_, x); | |
64065 | @@ -2170,7 +2172,7 @@ static int slub_min_objects; | |
64066 | * Merge control. If this is set then no merging of slab caches will occur. | |
64067 | * (Could be removed. This was introduced to pacify the merge skeptics.) | |
64068 | */ | |
64069 | -static int slub_nomerge; | |
64070 | +static int slub_nomerge = 1; | |
64071 | ||
64072 | /* | |
64073 | * Calculate the order of allocation given an slab object size. | |
64074 | @@ -2594,7 +2596,7 @@ static int kmem_cache_open(struct kmem_c | |
64075 | * list to avoid pounding the page allocator excessively. | |
64076 | */ | |
64077 | set_min_partial(s, ilog2(s->size)); | |
64078 | - s->refcount = 1; | |
64079 | + atomic_set(&s->refcount, 1); | |
64080 | #ifdef CONFIG_NUMA | |
64081 | s->remote_node_defrag_ratio = 1000; | |
64082 | #endif | |
64083 | @@ -2699,8 +2701,7 @@ static inline int kmem_cache_close(struc | |
64084 | void kmem_cache_destroy(struct kmem_cache *s) | |
64085 | { | |
64086 | down_write(&slub_lock); | |
64087 | - s->refcount--; | |
64088 | - if (!s->refcount) { | |
64089 | + if (atomic_dec_and_test(&s->refcount)) { | |
64090 | list_del(&s->list); | |
64091 | if (kmem_cache_close(s)) { | |
64092 | printk(KERN_ERR "SLUB %s: %s called for cache that " | |
64093 | @@ -2910,6 +2911,46 @@ void *__kmalloc_node(size_t size, gfp_t | |
64094 | EXPORT_SYMBOL(__kmalloc_node); | |
64095 | #endif | |
64096 | ||
64097 | +void check_object_size(const void *ptr, unsigned long n, bool to) | |
64098 | +{ | |
64099 | + | |
64100 | +#ifdef CONFIG_PAX_USERCOPY | |
64101 | + struct page *page; | |
64102 | + struct kmem_cache *s = NULL; | |
64103 | + unsigned long offset; | |
64104 | + | |
64105 | + if (!n) | |
64106 | + return; | |
64107 | + | |
64108 | + if (ZERO_OR_NULL_PTR(ptr)) | |
64109 | + goto report; | |
64110 | + | |
64111 | + if (!virt_addr_valid(ptr)) | |
64112 | + return; | |
64113 | + | |
64114 | + page = virt_to_head_page(ptr); | |
64115 | + | |
64116 | + if (!PageSlab(page)) { | |
64117 | + if (object_is_on_stack(ptr, n) == -1) | |
64118 | + goto report; | |
64119 | + return; | |
64120 | + } | |
64121 | + | |
64122 | + s = page->slab; | |
64123 | + if (!(s->flags & SLAB_USERCOPY)) | |
64124 | + goto report; | |
64125 | + | |
64126 | + offset = (ptr - page_address(page)) % s->size; | |
64127 | + if (offset <= s->objsize && n <= s->objsize - offset) | |
64128 | + return; | |
64129 | + | |
64130 | +report: | |
64131 | + pax_report_usercopy(ptr, n, to, s ? s->name : NULL); | |
64132 | +#endif | |
64133 | + | |
64134 | +} | |
64135 | +EXPORT_SYMBOL(check_object_size); | |
64136 | + | |
64137 | size_t ksize(const void *object) | |
64138 | { | |
64139 | struct page *page; | |
64140 | @@ -3154,7 +3195,7 @@ static void __init kmem_cache_bootstrap_ | |
64141 | int node; | |
64142 | ||
64143 | list_add(&s->list, &slab_caches); | |
64144 | - s->refcount = -1; | |
64145 | + atomic_set(&s->refcount, -1); | |
64146 | ||
64147 | for_each_node_state(node, N_NORMAL_MEMORY) { | |
64148 | struct kmem_cache_node *n = get_node(s, node); | |
64149 | @@ -3271,17 +3312,17 @@ void __init kmem_cache_init(void) | |
64150 | ||
64151 | /* Caches that are not of the two-to-the-power-of size */ | |
64152 | if (KMALLOC_MIN_SIZE <= 32) { | |
64153 | - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0); | |
64154 | + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY); | |
64155 | caches++; | |
64156 | } | |
64157 | ||
64158 | if (KMALLOC_MIN_SIZE <= 64) { | |
64159 | - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0); | |
64160 | + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY); | |
64161 | caches++; | |
64162 | } | |
64163 | ||
64164 | for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) { | |
64165 | - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0); | |
64166 | + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY); | |
64167 | caches++; | |
64168 | } | |
64169 | ||
64170 | @@ -3349,7 +3390,7 @@ static int slab_unmergeable(struct kmem_ | |
64171 | /* | |
64172 | * We may have set a slab to be unmergeable during bootstrap. | |
64173 | */ | |
64174 | - if (s->refcount < 0) | |
64175 | + if (atomic_read(&s->refcount) < 0) | |
64176 | return 1; | |
64177 | ||
64178 | return 0; | |
64179 | @@ -3408,7 +3449,7 @@ struct kmem_cache *kmem_cache_create(con | |
64180 | down_write(&slub_lock); | |
64181 | s = find_mergeable(size, align, flags, name, ctor); | |
64182 | if (s) { | |
64183 | - s->refcount++; | |
64184 | + atomic_inc(&s->refcount); | |
64185 | /* | |
64186 | * Adjust the object sizes so that we clear | |
64187 | * the complete object on kzalloc. | |
64188 | @@ -3417,7 +3458,7 @@ struct kmem_cache *kmem_cache_create(con | |
64189 | s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *))); | |
64190 | ||
64191 | if (sysfs_slab_alias(s, name)) { | |
64192 | - s->refcount--; | |
64193 | + atomic_dec(&s->refcount); | |
64194 | goto err; | |
64195 | } | |
64196 | up_write(&slub_lock); | |
64197 | @@ -4150,7 +4191,7 @@ SLAB_ATTR_RO(ctor); | |
64198 | ||
64199 | static ssize_t aliases_show(struct kmem_cache *s, char *buf) | |
64200 | { | |
64201 | - return sprintf(buf, "%d\n", s->refcount - 1); | |
64202 | + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1); | |
64203 | } | |
64204 | SLAB_ATTR_RO(aliases); | |
64205 | ||
64206 | @@ -4894,7 +4935,13 @@ static const struct file_operations proc | |
64207 | ||
64208 | static int __init slab_proc_init(void) | |
64209 | { | |
64210 | - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations); | |
64211 | + mode_t gr_mode = S_IRUGO; | |
64212 | + | |
64213 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
64214 | + gr_mode = S_IRUSR; | |
64215 | +#endif | |
64216 | + | |
64217 | + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations); | |
64218 | return 0; | |
64219 | } | |
64220 | module_init(slab_proc_init); | |
64221 | diff -urNp linux-3.0.3/mm/swap.c linux-3.0.3/mm/swap.c | |
64222 | --- linux-3.0.3/mm/swap.c 2011-07-21 22:17:23.000000000 -0400 | |
64223 | +++ linux-3.0.3/mm/swap.c 2011-08-23 21:47:56.000000000 -0400 | |
64224 | @@ -31,6 +31,7 @@ | |
64225 | #include <linux/backing-dev.h> | |
64226 | #include <linux/memcontrol.h> | |
64227 | #include <linux/gfp.h> | |
64228 | +#include <linux/hugetlb.h> | |
64229 | ||
64230 | #include "internal.h" | |
64231 | ||
64232 | @@ -71,6 +72,8 @@ static void __put_compound_page(struct p | |
64233 | ||
64234 | __page_cache_release(page); | |
64235 | dtor = get_compound_page_dtor(page); | |
64236 | + if (!PageHuge(page)) | |
64237 | + BUG_ON(dtor != free_compound_page); | |
64238 | (*dtor)(page); | |
64239 | } | |
64240 | ||
64241 | diff -urNp linux-3.0.3/mm/swapfile.c linux-3.0.3/mm/swapfile.c | |
64242 | --- linux-3.0.3/mm/swapfile.c 2011-07-21 22:17:23.000000000 -0400 | |
64243 | +++ linux-3.0.3/mm/swapfile.c 2011-08-23 21:47:56.000000000 -0400 | |
64244 | @@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex); | |
64245 | ||
64246 | static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait); | |
64247 | /* Activity counter to indicate that a swapon or swapoff has occurred */ | |
64248 | -static atomic_t proc_poll_event = ATOMIC_INIT(0); | |
64249 | +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0); | |
64250 | ||
64251 | static inline unsigned char swap_count(unsigned char ent) | |
64252 | { | |
64253 | @@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __us | |
64254 | } | |
64255 | filp_close(swap_file, NULL); | |
64256 | err = 0; | |
64257 | - atomic_inc(&proc_poll_event); | |
64258 | + atomic_inc_unchecked(&proc_poll_event); | |
64259 | wake_up_interruptible(&proc_poll_wait); | |
64260 | ||
64261 | out_dput: | |
64262 | @@ -1692,8 +1692,8 @@ static unsigned swaps_poll(struct file * | |
64263 | ||
64264 | poll_wait(file, &proc_poll_wait, wait); | |
64265 | ||
64266 | - if (s->event != atomic_read(&proc_poll_event)) { | |
64267 | - s->event = atomic_read(&proc_poll_event); | |
64268 | + if (s->event != atomic_read_unchecked(&proc_poll_event)) { | |
64269 | + s->event = atomic_read_unchecked(&proc_poll_event); | |
64270 | return POLLIN | POLLRDNORM | POLLERR | POLLPRI; | |
64271 | } | |
64272 | ||
64273 | @@ -1799,7 +1799,7 @@ static int swaps_open(struct inode *inod | |
64274 | } | |
64275 | ||
64276 | s->seq.private = s; | |
64277 | - s->event = atomic_read(&proc_poll_event); | |
64278 | + s->event = atomic_read_unchecked(&proc_poll_event); | |
64279 | return ret; | |
64280 | } | |
64281 | ||
64282 | @@ -2133,7 +2133,7 @@ SYSCALL_DEFINE2(swapon, const char __use | |
64283 | (p->flags & SWP_DISCARDABLE) ? "D" : ""); | |
64284 | ||
64285 | mutex_unlock(&swapon_mutex); | |
64286 | - atomic_inc(&proc_poll_event); | |
64287 | + atomic_inc_unchecked(&proc_poll_event); | |
64288 | wake_up_interruptible(&proc_poll_wait); | |
64289 | ||
64290 | if (S_ISREG(inode->i_mode)) | |
64291 | diff -urNp linux-3.0.3/mm/util.c linux-3.0.3/mm/util.c | |
64292 | --- linux-3.0.3/mm/util.c 2011-07-21 22:17:23.000000000 -0400 | |
64293 | +++ linux-3.0.3/mm/util.c 2011-08-23 21:47:56.000000000 -0400 | |
64294 | @@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user); | |
64295 | * allocated buffer. Use this if you don't want to free the buffer immediately | |
64296 | * like, for example, with RCU. | |
64297 | */ | |
64298 | +#undef __krealloc | |
64299 | void *__krealloc(const void *p, size_t new_size, gfp_t flags) | |
64300 | { | |
64301 | void *ret; | |
64302 | @@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc); | |
64303 | * behaves exactly like kmalloc(). If @size is 0 and @p is not a | |
64304 | * %NULL pointer, the object pointed to is freed. | |
64305 | */ | |
64306 | +#undef krealloc | |
64307 | void *krealloc(const void *p, size_t new_size, gfp_t flags) | |
64308 | { | |
64309 | void *ret; | |
64310 | @@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *m | |
64311 | void arch_pick_mmap_layout(struct mm_struct *mm) | |
64312 | { | |
64313 | mm->mmap_base = TASK_UNMAPPED_BASE; | |
64314 | + | |
64315 | +#ifdef CONFIG_PAX_RANDMMAP | |
64316 | + if (mm->pax_flags & MF_PAX_RANDMMAP) | |
64317 | + mm->mmap_base += mm->delta_mmap; | |
64318 | +#endif | |
64319 | + | |
64320 | mm->get_unmapped_area = arch_get_unmapped_area; | |
64321 | mm->unmap_area = arch_unmap_area; | |
64322 | } | |
64323 | diff -urNp linux-3.0.3/mm/vmalloc.c linux-3.0.3/mm/vmalloc.c | |
64324 | --- linux-3.0.3/mm/vmalloc.c 2011-08-23 21:44:40.000000000 -0400 | |
64325 | +++ linux-3.0.3/mm/vmalloc.c 2011-08-23 21:47:56.000000000 -0400 | |
64326 | @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, | |
64327 | ||
64328 | pte = pte_offset_kernel(pmd, addr); | |
64329 | do { | |
64330 | - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte); | |
64331 | - WARN_ON(!pte_none(ptent) && !pte_present(ptent)); | |
64332 | + | |
64333 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
64334 | + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) { | |
64335 | + BUG_ON(!pte_exec(*pte)); | |
64336 | + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC)); | |
64337 | + continue; | |
64338 | + } | |
64339 | +#endif | |
64340 | + | |
64341 | + { | |
64342 | + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte); | |
64343 | + WARN_ON(!pte_none(ptent) && !pte_present(ptent)); | |
64344 | + } | |
64345 | } while (pte++, addr += PAGE_SIZE, addr != end); | |
64346 | } | |
64347 | ||
64348 | @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un | |
64349 | unsigned long end, pgprot_t prot, struct page **pages, int *nr) | |
64350 | { | |
64351 | pte_t *pte; | |
64352 | + int ret = -ENOMEM; | |
64353 | ||
64354 | /* | |
64355 | * nr is a running index into the array which helps higher level | |
64356 | @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un | |
64357 | pte = pte_alloc_kernel(pmd, addr); | |
64358 | if (!pte) | |
64359 | return -ENOMEM; | |
64360 | + | |
64361 | + pax_open_kernel(); | |
64362 | do { | |
64363 | struct page *page = pages[*nr]; | |
64364 | ||
64365 | - if (WARN_ON(!pte_none(*pte))) | |
64366 | - return -EBUSY; | |
64367 | - if (WARN_ON(!page)) | |
64368 | - return -ENOMEM; | |
64369 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
64370 | + if (pgprot_val(prot) & _PAGE_NX) | |
64371 | +#endif | |
64372 | + | |
64373 | + if (WARN_ON(!pte_none(*pte))) { | |
64374 | + ret = -EBUSY; | |
64375 | + goto out; | |
64376 | + } | |
64377 | + if (WARN_ON(!page)) { | |
64378 | + ret = -ENOMEM; | |
64379 | + goto out; | |
64380 | + } | |
64381 | set_pte_at(&init_mm, addr, pte, mk_pte(page, prot)); | |
64382 | (*nr)++; | |
64383 | } while (pte++, addr += PAGE_SIZE, addr != end); | |
64384 | - return 0; | |
64385 | + ret = 0; | |
64386 | +out: | |
64387 | + pax_close_kernel(); | |
64388 | + return ret; | |
64389 | } | |
64390 | ||
64391 | static int vmap_pmd_range(pud_t *pud, unsigned long addr, | |
64392 | @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void | |
64393 | * and fall back on vmalloc() if that fails. Others | |
64394 | * just put it in the vmalloc space. | |
64395 | */ | |
64396 | -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR) | |
64397 | +#ifdef CONFIG_MODULES | |
64398 | +#ifdef MODULES_VADDR | |
64399 | unsigned long addr = (unsigned long)x; | |
64400 | if (addr >= MODULES_VADDR && addr < MODULES_END) | |
64401 | return 1; | |
64402 | #endif | |
64403 | + | |
64404 | +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) | |
64405 | + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END) | |
64406 | + return 1; | |
64407 | +#endif | |
64408 | + | |
64409 | +#endif | |
64410 | + | |
64411 | return is_vmalloc_addr(x); | |
64412 | } | |
64413 | ||
64414 | @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void | |
64415 | ||
64416 | if (!pgd_none(*pgd)) { | |
64417 | pud_t *pud = pud_offset(pgd, addr); | |
64418 | +#ifdef CONFIG_X86 | |
64419 | + if (!pud_large(*pud)) | |
64420 | +#endif | |
64421 | if (!pud_none(*pud)) { | |
64422 | pmd_t *pmd = pmd_offset(pud, addr); | |
64423 | +#ifdef CONFIG_X86 | |
64424 | + if (!pmd_large(*pmd)) | |
64425 | +#endif | |
64426 | if (!pmd_none(*pmd)) { | |
64427 | pte_t *ptep, pte; | |
64428 | ||
64429 | @@ -1297,6 +1337,16 @@ static struct vm_struct *__get_vm_area_n | |
64430 | struct vm_struct *area; | |
64431 | ||
64432 | BUG_ON(in_interrupt()); | |
64433 | + | |
64434 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC) | |
64435 | + if (flags & VM_KERNEXEC) { | |
64436 | + if (start != VMALLOC_START || end != VMALLOC_END) | |
64437 | + return NULL; | |
64438 | + start = (unsigned long)MODULES_EXEC_VADDR; | |
64439 | + end = (unsigned long)MODULES_EXEC_END; | |
64440 | + } | |
64441 | +#endif | |
64442 | + | |
64443 | if (flags & VM_IOREMAP) { | |
64444 | int bit = fls(size); | |
64445 | ||
64446 | @@ -1515,6 +1565,11 @@ void *vmap(struct page **pages, unsigned | |
64447 | if (count > totalram_pages) | |
64448 | return NULL; | |
64449 | ||
64450 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC) | |
64451 | + if (!(pgprot_val(prot) & _PAGE_NX)) | |
64452 | + flags |= VM_KERNEXEC; | |
64453 | +#endif | |
64454 | + | |
64455 | area = get_vm_area_caller((count << PAGE_SHIFT), flags, | |
64456 | __builtin_return_address(0)); | |
64457 | if (!area) | |
64458 | @@ -1616,6 +1671,13 @@ void *__vmalloc_node_range(unsigned long | |
64459 | if (!size || (size >> PAGE_SHIFT) > totalram_pages) | |
64460 | return NULL; | |
64461 | ||
64462 | +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC) | |
64463 | + if (!(pgprot_val(prot) & _PAGE_NX)) | |
64464 | + area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END, | |
64465 | + node, gfp_mask, caller); | |
64466 | + else | |
64467 | +#endif | |
64468 | + | |
64469 | area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node, | |
64470 | gfp_mask, caller); | |
64471 | ||
64472 | @@ -1655,6 +1717,7 @@ static void *__vmalloc_node(unsigned lon | |
64473 | gfp_mask, prot, node, caller); | |
64474 | } | |
64475 | ||
64476 | +#undef __vmalloc | |
64477 | void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot) | |
64478 | { | |
64479 | return __vmalloc_node(size, 1, gfp_mask, prot, -1, | |
64480 | @@ -1678,6 +1741,7 @@ static inline void *__vmalloc_node_flags | |
64481 | * For tight control over page level allocator and protection flags | |
64482 | * use __vmalloc() instead. | |
64483 | */ | |
64484 | +#undef vmalloc | |
64485 | void *vmalloc(unsigned long size) | |
64486 | { | |
64487 | return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM); | |
64488 | @@ -1694,6 +1758,7 @@ EXPORT_SYMBOL(vmalloc); | |
64489 | * For tight control over page level allocator and protection flags | |
64490 | * use __vmalloc() instead. | |
64491 | */ | |
64492 | +#undef vzalloc | |
64493 | void *vzalloc(unsigned long size) | |
64494 | { | |
64495 | return __vmalloc_node_flags(size, -1, | |
64496 | @@ -1708,6 +1773,7 @@ EXPORT_SYMBOL(vzalloc); | |
64497 | * The resulting memory area is zeroed so it can be mapped to userspace | |
64498 | * without leaking data. | |
64499 | */ | |
64500 | +#undef vmalloc_user | |
64501 | void *vmalloc_user(unsigned long size) | |
64502 | { | |
64503 | struct vm_struct *area; | |
64504 | @@ -1735,6 +1801,7 @@ EXPORT_SYMBOL(vmalloc_user); | |
64505 | * For tight control over page level allocator and protection flags | |
64506 | * use __vmalloc() instead. | |
64507 | */ | |
64508 | +#undef vmalloc_node | |
64509 | void *vmalloc_node(unsigned long size, int node) | |
64510 | { | |
64511 | return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL, | |
64512 | @@ -1754,6 +1821,7 @@ EXPORT_SYMBOL(vmalloc_node); | |
64513 | * For tight control over page level allocator and protection flags | |
64514 | * use __vmalloc_node() instead. | |
64515 | */ | |
64516 | +#undef vzalloc_node | |
64517 | void *vzalloc_node(unsigned long size, int node) | |
64518 | { | |
64519 | return __vmalloc_node_flags(size, node, | |
64520 | @@ -1776,10 +1844,10 @@ EXPORT_SYMBOL(vzalloc_node); | |
64521 | * For tight control over page level allocator and protection flags | |
64522 | * use __vmalloc() instead. | |
64523 | */ | |
64524 | - | |
64525 | +#undef vmalloc_exec | |
64526 | void *vmalloc_exec(unsigned long size) | |
64527 | { | |
64528 | - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC, | |
64529 | + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC, | |
64530 | -1, __builtin_return_address(0)); | |
64531 | } | |
64532 | ||
64533 | @@ -1798,6 +1866,7 @@ void *vmalloc_exec(unsigned long size) | |
64534 | * Allocate enough 32bit PA addressable pages to cover @size from the | |
64535 | * page level allocator and map them into contiguous kernel virtual space. | |
64536 | */ | |
64537 | +#undef vmalloc_32 | |
64538 | void *vmalloc_32(unsigned long size) | |
64539 | { | |
64540 | return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL, | |
64541 | @@ -1812,6 +1881,7 @@ EXPORT_SYMBOL(vmalloc_32); | |
64542 | * The resulting memory area is 32bit addressable and zeroed so it can be | |
64543 | * mapped to userspace without leaking data. | |
64544 | */ | |
64545 | +#undef vmalloc_32_user | |
64546 | void *vmalloc_32_user(unsigned long size) | |
64547 | { | |
64548 | struct vm_struct *area; | |
64549 | @@ -2074,6 +2144,8 @@ int remap_vmalloc_range(struct vm_area_s | |
64550 | unsigned long uaddr = vma->vm_start; | |
64551 | unsigned long usize = vma->vm_end - vma->vm_start; | |
64552 | ||
64553 | + BUG_ON(vma->vm_mirror); | |
64554 | + | |
64555 | if ((PAGE_SIZE-1) & (unsigned long)addr) | |
64556 | return -EINVAL; | |
64557 | ||
64558 | diff -urNp linux-3.0.3/mm/vmstat.c linux-3.0.3/mm/vmstat.c | |
64559 | --- linux-3.0.3/mm/vmstat.c 2011-07-21 22:17:23.000000000 -0400 | |
64560 | +++ linux-3.0.3/mm/vmstat.c 2011-08-23 21:48:14.000000000 -0400 | |
64561 | @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu) | |
64562 | * | |
64563 | * vm_stat contains the global counters | |
64564 | */ | |
64565 | -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
64566 | +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS]; | |
64567 | EXPORT_SYMBOL(vm_stat); | |
64568 | ||
64569 | #ifdef CONFIG_SMP | |
64570 | @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu) | |
64571 | v = p->vm_stat_diff[i]; | |
64572 | p->vm_stat_diff[i] = 0; | |
64573 | local_irq_restore(flags); | |
64574 | - atomic_long_add(v, &zone->vm_stat[i]); | |
64575 | + atomic_long_add_unchecked(v, &zone->vm_stat[i]); | |
64576 | global_diff[i] += v; | |
64577 | #ifdef CONFIG_NUMA | |
64578 | /* 3 seconds idle till flush */ | |
64579 | @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu) | |
64580 | ||
64581 | for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++) | |
64582 | if (global_diff[i]) | |
64583 | - atomic_long_add(global_diff[i], &vm_stat[i]); | |
64584 | + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]); | |
64585 | } | |
64586 | ||
64587 | #endif | |
64588 | @@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void) | |
64589 | start_cpu_timer(cpu); | |
64590 | #endif | |
64591 | #ifdef CONFIG_PROC_FS | |
64592 | - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations); | |
64593 | - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops); | |
64594 | - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations); | |
64595 | - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations); | |
64596 | + { | |
64597 | + mode_t gr_mode = S_IRUGO; | |
64598 | +#ifdef CONFIG_GRKERNSEC_PROC_ADD | |
64599 | + gr_mode = S_IRUSR; | |
64600 | +#endif | |
64601 | + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations); | |
64602 | + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops); | |
64603 | +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP | |
64604 | + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations); | |
64605 | +#else | |
64606 | + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations); | |
64607 | +#endif | |
64608 | + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations); | |
64609 | + } | |
64610 | #endif | |
64611 | return 0; | |
64612 | } | |
64613 | diff -urNp linux-3.0.3/net/8021q/vlan.c linux-3.0.3/net/8021q/vlan.c | |
64614 | --- linux-3.0.3/net/8021q/vlan.c 2011-07-21 22:17:23.000000000 -0400 | |
64615 | +++ linux-3.0.3/net/8021q/vlan.c 2011-08-23 21:47:56.000000000 -0400 | |
64616 | @@ -591,8 +591,7 @@ static int vlan_ioctl_handler(struct net | |
64617 | err = -EPERM; | |
64618 | if (!capable(CAP_NET_ADMIN)) | |
64619 | break; | |
64620 | - if ((args.u.name_type >= 0) && | |
64621 | - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) { | |
64622 | + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) { | |
64623 | struct vlan_net *vn; | |
64624 | ||
64625 | vn = net_generic(net, vlan_net_id); | |
64626 | diff -urNp linux-3.0.3/net/atm/atm_misc.c linux-3.0.3/net/atm/atm_misc.c | |
64627 | --- linux-3.0.3/net/atm/atm_misc.c 2011-07-21 22:17:23.000000000 -0400 | |
64628 | +++ linux-3.0.3/net/atm/atm_misc.c 2011-08-23 21:47:56.000000000 -0400 | |
64629 | @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int | |
64630 | if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf) | |
64631 | return 1; | |
64632 | atm_return(vcc, truesize); | |
64633 | - atomic_inc(&vcc->stats->rx_drop); | |
64634 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
64635 | return 0; | |
64636 | } | |
64637 | EXPORT_SYMBOL(atm_charge); | |
64638 | @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct | |
64639 | } | |
64640 | } | |
64641 | atm_return(vcc, guess); | |
64642 | - atomic_inc(&vcc->stats->rx_drop); | |
64643 | + atomic_inc_unchecked(&vcc->stats->rx_drop); | |
64644 | return NULL; | |
64645 | } | |
64646 | EXPORT_SYMBOL(atm_alloc_charge); | |
64647 | @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal); | |
64648 | ||
64649 | void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to) | |
64650 | { | |
64651 | -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i) | |
64652 | +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i) | |
64653 | __SONET_ITEMS | |
64654 | #undef __HANDLE_ITEM | |
64655 | } | |
64656 | @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats); | |
64657 | ||
64658 | void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to) | |
64659 | { | |
64660 | -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i) | |
64661 | +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i) | |
64662 | __SONET_ITEMS | |
64663 | #undef __HANDLE_ITEM | |
64664 | } | |
64665 | diff -urNp linux-3.0.3/net/atm/lec.h linux-3.0.3/net/atm/lec.h | |
64666 | --- linux-3.0.3/net/atm/lec.h 2011-07-21 22:17:23.000000000 -0400 | |
64667 | +++ linux-3.0.3/net/atm/lec.h 2011-08-23 21:47:56.000000000 -0400 | |
64668 | @@ -48,7 +48,7 @@ struct lane2_ops { | |
64669 | const u8 *tlvs, u32 sizeoftlvs); | |
64670 | void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr, | |
64671 | const u8 *tlvs, u32 sizeoftlvs); | |
64672 | -}; | |
64673 | +} __no_const; | |
64674 | ||
64675 | /* | |
64676 | * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType | |
64677 | diff -urNp linux-3.0.3/net/atm/mpc.h linux-3.0.3/net/atm/mpc.h | |
64678 | --- linux-3.0.3/net/atm/mpc.h 2011-07-21 22:17:23.000000000 -0400 | |
64679 | +++ linux-3.0.3/net/atm/mpc.h 2011-08-23 21:47:56.000000000 -0400 | |
64680 | @@ -33,7 +33,7 @@ struct mpoa_client { | |
64681 | struct mpc_parameters parameters; /* parameters for this client */ | |
64682 | ||
64683 | const struct net_device_ops *old_ops; | |
64684 | - struct net_device_ops new_ops; | |
64685 | + net_device_ops_no_const new_ops; | |
64686 | }; | |
64687 | ||
64688 | ||
64689 | diff -urNp linux-3.0.3/net/atm/mpoa_caches.c linux-3.0.3/net/atm/mpoa_caches.c | |
64690 | --- linux-3.0.3/net/atm/mpoa_caches.c 2011-07-21 22:17:23.000000000 -0400 | |
64691 | +++ linux-3.0.3/net/atm/mpoa_caches.c 2011-08-23 21:48:14.000000000 -0400 | |
64692 | @@ -255,6 +255,8 @@ static void check_resolving_entries(stru | |
64693 | struct timeval now; | |
64694 | struct k_message msg; | |
64695 | ||
64696 | + pax_track_stack(); | |
64697 | + | |
64698 | do_gettimeofday(&now); | |
64699 | ||
64700 | read_lock_bh(&client->ingress_lock); | |
64701 | diff -urNp linux-3.0.3/net/atm/proc.c linux-3.0.3/net/atm/proc.c | |
64702 | --- linux-3.0.3/net/atm/proc.c 2011-07-21 22:17:23.000000000 -0400 | |
64703 | +++ linux-3.0.3/net/atm/proc.c 2011-08-23 21:47:56.000000000 -0400 | |
64704 | @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s | |
64705 | const struct k_atm_aal_stats *stats) | |
64706 | { | |
64707 | seq_printf(seq, "%s ( %d %d %d %d %d )", aal, | |
64708 | - atomic_read(&stats->tx), atomic_read(&stats->tx_err), | |
64709 | - atomic_read(&stats->rx), atomic_read(&stats->rx_err), | |
64710 | - atomic_read(&stats->rx_drop)); | |
64711 | + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err), | |
64712 | + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err), | |
64713 | + atomic_read_unchecked(&stats->rx_drop)); | |
64714 | } | |
64715 | ||
64716 | static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev) | |
64717 | diff -urNp linux-3.0.3/net/atm/resources.c linux-3.0.3/net/atm/resources.c | |
64718 | --- linux-3.0.3/net/atm/resources.c 2011-07-21 22:17:23.000000000 -0400 | |
64719 | +++ linux-3.0.3/net/atm/resources.c 2011-08-23 21:47:56.000000000 -0400 | |
64720 | @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister); | |
64721 | static void copy_aal_stats(struct k_atm_aal_stats *from, | |
64722 | struct atm_aal_stats *to) | |
64723 | { | |
64724 | -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i) | |
64725 | +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i) | |
64726 | __AAL_STAT_ITEMS | |
64727 | #undef __HANDLE_ITEM | |
64728 | } | |
64729 | @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_ | |
64730 | static void subtract_aal_stats(struct k_atm_aal_stats *from, | |
64731 | struct atm_aal_stats *to) | |
64732 | { | |
64733 | -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i) | |
64734 | +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i) | |
64735 | __AAL_STAT_ITEMS | |
64736 | #undef __HANDLE_ITEM | |
64737 | } | |
64738 | diff -urNp linux-3.0.3/net/batman-adv/hard-interface.c linux-3.0.3/net/batman-adv/hard-interface.c | |
64739 | --- linux-3.0.3/net/batman-adv/hard-interface.c 2011-07-21 22:17:23.000000000 -0400 | |
64740 | +++ linux-3.0.3/net/batman-adv/hard-interface.c 2011-08-23 21:47:56.000000000 -0400 | |
64741 | @@ -351,8 +351,8 @@ int hardif_enable_interface(struct hard_ | |
64742 | hard_iface->batman_adv_ptype.dev = hard_iface->net_dev; | |
64743 | dev_add_pack(&hard_iface->batman_adv_ptype); | |
64744 | ||
64745 | - atomic_set(&hard_iface->seqno, 1); | |
64746 | - atomic_set(&hard_iface->frag_seqno, 1); | |
64747 | + atomic_set_unchecked(&hard_iface->seqno, 1); | |
64748 | + atomic_set_unchecked(&hard_iface->frag_seqno, 1); | |
64749 | bat_info(hard_iface->soft_iface, "Adding interface: %s\n", | |
64750 | hard_iface->net_dev->name); | |
64751 | ||
64752 | diff -urNp linux-3.0.3/net/batman-adv/routing.c linux-3.0.3/net/batman-adv/routing.c | |
64753 | --- linux-3.0.3/net/batman-adv/routing.c 2011-07-21 22:17:23.000000000 -0400 | |
64754 | +++ linux-3.0.3/net/batman-adv/routing.c 2011-08-23 21:47:56.000000000 -0400 | |
64755 | @@ -627,7 +627,7 @@ void receive_bat_packet(struct ethhdr *e | |
64756 | return; | |
64757 | ||
64758 | /* could be changed by schedule_own_packet() */ | |
64759 | - if_incoming_seqno = atomic_read(&if_incoming->seqno); | |
64760 | + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno); | |
64761 | ||
64762 | has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0); | |
64763 | ||
64764 | diff -urNp linux-3.0.3/net/batman-adv/send.c linux-3.0.3/net/batman-adv/send.c | |
64765 | --- linux-3.0.3/net/batman-adv/send.c 2011-07-21 22:17:23.000000000 -0400 | |
64766 | +++ linux-3.0.3/net/batman-adv/send.c 2011-08-23 21:47:56.000000000 -0400 | |
64767 | @@ -279,7 +279,7 @@ void schedule_own_packet(struct hard_ifa | |
64768 | ||
64769 | /* change sequence number to network order */ | |
64770 | batman_packet->seqno = | |
64771 | - htonl((uint32_t)atomic_read(&hard_iface->seqno)); | |
64772 | + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno)); | |
64773 | ||
64774 | if (vis_server == VIS_TYPE_SERVER_SYNC) | |
64775 | batman_packet->flags |= VIS_SERVER; | |
64776 | @@ -293,7 +293,7 @@ void schedule_own_packet(struct hard_ifa | |
64777 | else | |
64778 | batman_packet->gw_flags = 0; | |
64779 | ||
64780 | - atomic_inc(&hard_iface->seqno); | |
64781 | + atomic_inc_unchecked(&hard_iface->seqno); | |
64782 | ||
64783 | slide_own_bcast_window(hard_iface); | |
64784 | send_time = own_send_time(bat_priv); | |
64785 | diff -urNp linux-3.0.3/net/batman-adv/soft-interface.c linux-3.0.3/net/batman-adv/soft-interface.c | |
64786 | --- linux-3.0.3/net/batman-adv/soft-interface.c 2011-07-21 22:17:23.000000000 -0400 | |
64787 | +++ linux-3.0.3/net/batman-adv/soft-interface.c 2011-08-23 21:47:56.000000000 -0400 | |
64788 | @@ -628,7 +628,7 @@ int interface_tx(struct sk_buff *skb, st | |
64789 | ||
64790 | /* set broadcast sequence number */ | |
64791 | bcast_packet->seqno = | |
64792 | - htonl(atomic_inc_return(&bat_priv->bcast_seqno)); | |
64793 | + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno)); | |
64794 | ||
64795 | add_bcast_packet_to_list(bat_priv, skb); | |
64796 | ||
64797 | @@ -830,7 +830,7 @@ struct net_device *softif_create(char *n | |
64798 | atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN); | |
64799 | ||
64800 | atomic_set(&bat_priv->mesh_state, MESH_INACTIVE); | |
64801 | - atomic_set(&bat_priv->bcast_seqno, 1); | |
64802 | + atomic_set_unchecked(&bat_priv->bcast_seqno, 1); | |
64803 | atomic_set(&bat_priv->tt_local_changed, 0); | |
64804 | ||
64805 | bat_priv->primary_if = NULL; | |
64806 | diff -urNp linux-3.0.3/net/batman-adv/types.h linux-3.0.3/net/batman-adv/types.h | |
64807 | --- linux-3.0.3/net/batman-adv/types.h 2011-07-21 22:17:23.000000000 -0400 | |
64808 | +++ linux-3.0.3/net/batman-adv/types.h 2011-08-23 21:47:56.000000000 -0400 | |
64809 | @@ -38,8 +38,8 @@ struct hard_iface { | |
64810 | int16_t if_num; | |
64811 | char if_status; | |
64812 | struct net_device *net_dev; | |
64813 | - atomic_t seqno; | |
64814 | - atomic_t frag_seqno; | |
64815 | + atomic_unchecked_t seqno; | |
64816 | + atomic_unchecked_t frag_seqno; | |
64817 | unsigned char *packet_buff; | |
64818 | int packet_len; | |
64819 | struct kobject *hardif_obj; | |
64820 | @@ -142,7 +142,7 @@ struct bat_priv { | |
64821 | atomic_t orig_interval; /* uint */ | |
64822 | atomic_t hop_penalty; /* uint */ | |
64823 | atomic_t log_level; /* uint */ | |
64824 | - atomic_t bcast_seqno; | |
64825 | + atomic_unchecked_t bcast_seqno; | |
64826 | atomic_t bcast_queue_left; | |
64827 | atomic_t batman_queue_left; | |
64828 | char num_ifaces; | |
64829 | diff -urNp linux-3.0.3/net/batman-adv/unicast.c linux-3.0.3/net/batman-adv/unicast.c | |
64830 | --- linux-3.0.3/net/batman-adv/unicast.c 2011-07-21 22:17:23.000000000 -0400 | |
64831 | +++ linux-3.0.3/net/batman-adv/unicast.c 2011-08-23 21:47:56.000000000 -0400 | |
64832 | @@ -265,7 +265,7 @@ int frag_send_skb(struct sk_buff *skb, s | |
64833 | frag1->flags = UNI_FRAG_HEAD | large_tail; | |
64834 | frag2->flags = large_tail; | |
64835 | ||
64836 | - seqno = atomic_add_return(2, &hard_iface->frag_seqno); | |
64837 | + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno); | |
64838 | frag1->seqno = htons(seqno - 1); | |
64839 | frag2->seqno = htons(seqno); | |
64840 | ||
64841 | diff -urNp linux-3.0.3/net/bridge/br_multicast.c linux-3.0.3/net/bridge/br_multicast.c | |
64842 | --- linux-3.0.3/net/bridge/br_multicast.c 2011-07-21 22:17:23.000000000 -0400 | |
64843 | +++ linux-3.0.3/net/bridge/br_multicast.c 2011-08-23 21:47:56.000000000 -0400 | |
64844 | @@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct | |
64845 | nexthdr = ip6h->nexthdr; | |
64846 | offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr); | |
64847 | ||
64848 | - if (offset < 0 || nexthdr != IPPROTO_ICMPV6) | |
64849 | + if (nexthdr != IPPROTO_ICMPV6) | |
64850 | return 0; | |
64851 | ||
64852 | /* Okay, we found ICMPv6 header */ | |
64853 | diff -urNp linux-3.0.3/net/bridge/netfilter/ebtables.c linux-3.0.3/net/bridge/netfilter/ebtables.c | |
64854 | --- linux-3.0.3/net/bridge/netfilter/ebtables.c 2011-07-21 22:17:23.000000000 -0400 | |
64855 | +++ linux-3.0.3/net/bridge/netfilter/ebtables.c 2011-08-23 21:48:14.000000000 -0400 | |
64856 | @@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s | |
64857 | tmp.valid_hooks = t->table->valid_hooks; | |
64858 | } | |
64859 | mutex_unlock(&ebt_mutex); | |
64860 | - if (copy_to_user(user, &tmp, *len) != 0){ | |
64861 | + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){ | |
64862 | BUGPRINT("c2u Didn't work\n"); | |
64863 | ret = -EFAULT; | |
64864 | break; | |
64865 | @@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use | |
64866 | int ret; | |
64867 | void __user *pos; | |
64868 | ||
64869 | + pax_track_stack(); | |
64870 | + | |
64871 | memset(&tinfo, 0, sizeof(tinfo)); | |
64872 | ||
64873 | if (cmd == EBT_SO_GET_ENTRIES) { | |
64874 | diff -urNp linux-3.0.3/net/caif/caif_socket.c linux-3.0.3/net/caif/caif_socket.c | |
64875 | --- linux-3.0.3/net/caif/caif_socket.c 2011-07-21 22:17:23.000000000 -0400 | |
64876 | +++ linux-3.0.3/net/caif/caif_socket.c 2011-08-23 21:47:56.000000000 -0400 | |
64877 | @@ -48,19 +48,20 @@ static struct dentry *debugfsdir; | |
64878 | #ifdef CONFIG_DEBUG_FS | |
64879 | struct debug_fs_counter { | |
64880 | atomic_t caif_nr_socks; | |
64881 | - atomic_t caif_sock_create; | |
64882 | - atomic_t num_connect_req; | |
64883 | - atomic_t num_connect_resp; | |
64884 | - atomic_t num_connect_fail_resp; | |
64885 | - atomic_t num_disconnect; | |
64886 | - atomic_t num_remote_shutdown_ind; | |
64887 | - atomic_t num_tx_flow_off_ind; | |
64888 | - atomic_t num_tx_flow_on_ind; | |
64889 | - atomic_t num_rx_flow_off; | |
64890 | - atomic_t num_rx_flow_on; | |
64891 | + atomic_unchecked_t caif_sock_create; | |
64892 | + atomic_unchecked_t num_connect_req; | |
64893 | + atomic_unchecked_t num_connect_resp; | |
64894 | + atomic_unchecked_t num_connect_fail_resp; | |
64895 | + atomic_unchecked_t num_disconnect; | |
64896 | + atomic_unchecked_t num_remote_shutdown_ind; | |
64897 | + atomic_unchecked_t num_tx_flow_off_ind; | |
64898 | + atomic_unchecked_t num_tx_flow_on_ind; | |
64899 | + atomic_unchecked_t num_rx_flow_off; | |
64900 | + atomic_unchecked_t num_rx_flow_on; | |
64901 | }; | |
64902 | static struct debug_fs_counter cnt; | |
64903 | #define dbfs_atomic_inc(v) atomic_inc_return(v) | |
64904 | +#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v) | |
64905 | #define dbfs_atomic_dec(v) atomic_dec_return(v) | |
64906 | #else | |
64907 | #define dbfs_atomic_inc(v) 0 | |
64908 | @@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct soc | |
64909 | atomic_read(&cf_sk->sk.sk_rmem_alloc), | |
64910 | sk_rcvbuf_lowwater(cf_sk)); | |
64911 | set_rx_flow_off(cf_sk); | |
64912 | - dbfs_atomic_inc(&cnt.num_rx_flow_off); | |
64913 | + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off); | |
64914 | caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ); | |
64915 | } | |
64916 | ||
64917 | @@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct soc | |
64918 | set_rx_flow_off(cf_sk); | |
64919 | if (net_ratelimit()) | |
64920 | pr_debug("sending flow OFF due to rmem_schedule\n"); | |
64921 | - dbfs_atomic_inc(&cnt.num_rx_flow_off); | |
64922 | + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off); | |
64923 | caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ); | |
64924 | } | |
64925 | skb->dev = NULL; | |
64926 | @@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer | |
64927 | switch (flow) { | |
64928 | case CAIF_CTRLCMD_FLOW_ON_IND: | |
64929 | /* OK from modem to start sending again */ | |
64930 | - dbfs_atomic_inc(&cnt.num_tx_flow_on_ind); | |
64931 | + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind); | |
64932 | set_tx_flow_on(cf_sk); | |
64933 | cf_sk->sk.sk_state_change(&cf_sk->sk); | |
64934 | break; | |
64935 | ||
64936 | case CAIF_CTRLCMD_FLOW_OFF_IND: | |
64937 | /* Modem asks us to shut up */ | |
64938 | - dbfs_atomic_inc(&cnt.num_tx_flow_off_ind); | |
64939 | + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind); | |
64940 | set_tx_flow_off(cf_sk); | |
64941 | cf_sk->sk.sk_state_change(&cf_sk->sk); | |
64942 | break; | |
64943 | @@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer | |
64944 | /* We're now connected */ | |
64945 | caif_client_register_refcnt(&cf_sk->layer, | |
64946 | cfsk_hold, cfsk_put); | |
64947 | - dbfs_atomic_inc(&cnt.num_connect_resp); | |
64948 | + dbfs_atomic_inc_unchecked(&cnt.num_connect_resp); | |
64949 | cf_sk->sk.sk_state = CAIF_CONNECTED; | |
64950 | set_tx_flow_on(cf_sk); | |
64951 | cf_sk->sk.sk_state_change(&cf_sk->sk); | |
64952 | @@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer | |
64953 | ||
64954 | case CAIF_CTRLCMD_INIT_FAIL_RSP: | |
64955 | /* Connect request failed */ | |
64956 | - dbfs_atomic_inc(&cnt.num_connect_fail_resp); | |
64957 | + dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp); | |
64958 | cf_sk->sk.sk_err = ECONNREFUSED; | |
64959 | cf_sk->sk.sk_state = CAIF_DISCONNECTED; | |
64960 | cf_sk->sk.sk_shutdown = SHUTDOWN_MASK; | |
64961 | @@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer | |
64962 | ||
64963 | case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND: | |
64964 | /* Modem has closed this connection, or device is down. */ | |
64965 | - dbfs_atomic_inc(&cnt.num_remote_shutdown_ind); | |
64966 | + dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind); | |
64967 | cf_sk->sk.sk_shutdown = SHUTDOWN_MASK; | |
64968 | cf_sk->sk.sk_err = ECONNRESET; | |
64969 | set_rx_flow_on(cf_sk); | |
64970 | @@ -297,7 +298,7 @@ static void caif_check_flow_release(stru | |
64971 | return; | |
64972 | ||
64973 | if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) { | |
64974 | - dbfs_atomic_inc(&cnt.num_rx_flow_on); | |
64975 | + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on); | |
64976 | set_rx_flow_on(cf_sk); | |
64977 | caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ); | |
64978 | } | |
64979 | @@ -854,7 +855,7 @@ static int caif_connect(struct socket *s | |
64980 | /*ifindex = id of the interface.*/ | |
64981 | cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if; | |
64982 | ||
64983 | - dbfs_atomic_inc(&cnt.num_connect_req); | |
64984 | + dbfs_atomic_inc_unchecked(&cnt.num_connect_req); | |
64985 | cf_sk->layer.receive = caif_sktrecv_cb; | |
64986 | ||
64987 | err = caif_connect_client(sock_net(sk), &cf_sk->conn_req, | |
64988 | @@ -943,7 +944,7 @@ static int caif_release(struct socket *s | |
64989 | spin_unlock_bh(&sk->sk_receive_queue.lock); | |
64990 | sock->sk = NULL; | |
64991 | ||
64992 | - dbfs_atomic_inc(&cnt.num_disconnect); | |
64993 | + dbfs_atomic_inc_unchecked(&cnt.num_disconnect); | |
64994 | ||
64995 | WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir)); | |
64996 | if (cf_sk->debugfs_socket_dir != NULL) | |
64997 | @@ -1122,7 +1123,7 @@ static int caif_create(struct net *net, | |
64998 | cf_sk->conn_req.protocol = protocol; | |
64999 | /* Increase the number of sockets created. */ | |
65000 | dbfs_atomic_inc(&cnt.caif_nr_socks); | |
65001 | - num = dbfs_atomic_inc(&cnt.caif_sock_create); | |
65002 | + num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create); | |
65003 | #ifdef CONFIG_DEBUG_FS | |
65004 | if (!IS_ERR(debugfsdir)) { | |
65005 | ||
65006 | diff -urNp linux-3.0.3/net/caif/cfctrl.c linux-3.0.3/net/caif/cfctrl.c | |
65007 | --- linux-3.0.3/net/caif/cfctrl.c 2011-07-21 22:17:23.000000000 -0400 | |
65008 | +++ linux-3.0.3/net/caif/cfctrl.c 2011-08-23 21:48:14.000000000 -0400 | |
65009 | @@ -9,6 +9,7 @@ | |
65010 | #include <linux/stddef.h> | |
65011 | #include <linux/spinlock.h> | |
65012 | #include <linux/slab.h> | |
65013 | +#include <linux/sched.h> | |
65014 | #include <net/caif/caif_layer.h> | |
65015 | #include <net/caif/cfpkt.h> | |
65016 | #include <net/caif/cfctrl.h> | |
65017 | @@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void) | |
65018 | dev_info.id = 0xff; | |
65019 | memset(this, 0, sizeof(*this)); | |
65020 | cfsrvl_init(&this->serv, 0, &dev_info, false); | |
65021 | - atomic_set(&this->req_seq_no, 1); | |
65022 | - atomic_set(&this->rsp_seq_no, 1); | |
65023 | + atomic_set_unchecked(&this->req_seq_no, 1); | |
65024 | + atomic_set_unchecked(&this->rsp_seq_no, 1); | |
65025 | this->serv.layer.receive = cfctrl_recv; | |
65026 | sprintf(this->serv.layer.name, "ctrl"); | |
65027 | this->serv.layer.ctrlcmd = cfctrl_ctrlcmd; | |
65028 | @@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfc | |
65029 | struct cfctrl_request_info *req) | |
65030 | { | |
65031 | spin_lock_bh(&ctrl->info_list_lock); | |
65032 | - atomic_inc(&ctrl->req_seq_no); | |
65033 | - req->sequence_no = atomic_read(&ctrl->req_seq_no); | |
65034 | + atomic_inc_unchecked(&ctrl->req_seq_no); | |
65035 | + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no); | |
65036 | list_add_tail(&req->list, &ctrl->list); | |
65037 | spin_unlock_bh(&ctrl->info_list_lock); | |
65038 | } | |
65039 | @@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctr | |
65040 | if (p != first) | |
65041 | pr_warn("Requests are not received in order\n"); | |
65042 | ||
65043 | - atomic_set(&ctrl->rsp_seq_no, | |
65044 | + atomic_set_unchecked(&ctrl->rsp_seq_no, | |
65045 | p->sequence_no); | |
65046 | list_del(&p->list); | |
65047 | goto out; | |
65048 | @@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *l | |
65049 | struct cfctrl *cfctrl = container_obj(layer); | |
65050 | struct cfctrl_request_info rsp, *req; | |
65051 | ||
65052 | + pax_track_stack(); | |
65053 | ||
65054 | cfpkt_extr_head(pkt, &cmdrsp, 1); | |
65055 | cmd = cmdrsp & CFCTRL_CMD_MASK; | |
65056 | diff -urNp linux-3.0.3/net/core/datagram.c linux-3.0.3/net/core/datagram.c | |
65057 | --- linux-3.0.3/net/core/datagram.c 2011-07-21 22:17:23.000000000 -0400 | |
65058 | +++ linux-3.0.3/net/core/datagram.c 2011-08-23 21:47:56.000000000 -0400 | |
65059 | @@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s | |
65060 | } | |
65061 | ||
65062 | kfree_skb(skb); | |
65063 | - atomic_inc(&sk->sk_drops); | |
65064 | + atomic_inc_unchecked(&sk->sk_drops); | |
65065 | sk_mem_reclaim_partial(sk); | |
65066 | ||
65067 | return err; | |
65068 | diff -urNp linux-3.0.3/net/core/dev.c linux-3.0.3/net/core/dev.c | |
65069 | --- linux-3.0.3/net/core/dev.c 2011-07-21 22:17:23.000000000 -0400 | |
65070 | +++ linux-3.0.3/net/core/dev.c 2011-08-23 21:48:14.000000000 -0400 | |
65071 | @@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha | |
65072 | if (no_module && capable(CAP_NET_ADMIN)) | |
65073 | no_module = request_module("netdev-%s", name); | |
65074 | if (no_module && capable(CAP_SYS_MODULE)) { | |
65075 | +#ifdef CONFIG_GRKERNSEC_MODHARDEN | |
65076 | + ___request_module(true, "grsec_modharden_netdev", "%s", name); | |
65077 | +#else | |
65078 | if (!request_module("%s", name)) | |
65079 | pr_err("Loading kernel module for a network device " | |
65080 | "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s " | |
65081 | "instead\n", name); | |
65082 | +#endif | |
65083 | } | |
65084 | } | |
65085 | EXPORT_SYMBOL(dev_load); | |
65086 | @@ -1959,7 +1963,7 @@ static int illegal_highdma(struct net_de | |
65087 | ||
65088 | struct dev_gso_cb { | |
65089 | void (*destructor)(struct sk_buff *skb); | |
65090 | -}; | |
65091 | +} __no_const; | |
65092 | ||
65093 | #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb) | |
65094 | ||
65095 | @@ -2912,7 +2916,7 @@ int netif_rx_ni(struct sk_buff *skb) | |
65096 | } | |
65097 | EXPORT_SYMBOL(netif_rx_ni); | |
65098 | ||
65099 | -static void net_tx_action(struct softirq_action *h) | |
65100 | +static void net_tx_action(void) | |
65101 | { | |
65102 | struct softnet_data *sd = &__get_cpu_var(softnet_data); | |
65103 | ||
65104 | @@ -3761,7 +3765,7 @@ void netif_napi_del(struct napi_struct * | |
65105 | } | |
65106 | EXPORT_SYMBOL(netif_napi_del); | |
65107 | ||
65108 | -static void net_rx_action(struct softirq_action *h) | |
65109 | +static void net_rx_action(void) | |
65110 | { | |
65111 | struct softnet_data *sd = &__get_cpu_var(softnet_data); | |
65112 | unsigned long time_limit = jiffies + 2; | |
65113 | diff -urNp linux-3.0.3/net/core/flow.c linux-3.0.3/net/core/flow.c | |
65114 | --- linux-3.0.3/net/core/flow.c 2011-07-21 22:17:23.000000000 -0400 | |
65115 | +++ linux-3.0.3/net/core/flow.c 2011-08-23 21:47:56.000000000 -0400 | |
65116 | @@ -60,7 +60,7 @@ struct flow_cache { | |
65117 | struct timer_list rnd_timer; | |
65118 | }; | |
65119 | ||
65120 | -atomic_t flow_cache_genid = ATOMIC_INIT(0); | |
65121 | +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0); | |
65122 | EXPORT_SYMBOL(flow_cache_genid); | |
65123 | static struct flow_cache flow_cache_global; | |
65124 | static struct kmem_cache *flow_cachep __read_mostly; | |
65125 | @@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig | |
65126 | ||
65127 | static int flow_entry_valid(struct flow_cache_entry *fle) | |
65128 | { | |
65129 | - if (atomic_read(&flow_cache_genid) != fle->genid) | |
65130 | + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid) | |
65131 | return 0; | |
65132 | if (fle->object && !fle->object->ops->check(fle->object)) | |
65133 | return 0; | |
65134 | @@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const | |
65135 | hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]); | |
65136 | fcp->hash_count++; | |
65137 | } | |
65138 | - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) { | |
65139 | + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) { | |
65140 | flo = fle->object; | |
65141 | if (!flo) | |
65142 | goto ret_object; | |
65143 | @@ -274,7 +274,7 @@ nocache: | |
65144 | } | |
65145 | flo = resolver(net, key, family, dir, flo, ctx); | |
65146 | if (fle) { | |
65147 | - fle->genid = atomic_read(&flow_cache_genid); | |
65148 | + fle->genid = atomic_read_unchecked(&flow_cache_genid); | |
65149 | if (!IS_ERR(flo)) | |
65150 | fle->object = flo; | |
65151 | else | |
65152 | diff -urNp linux-3.0.3/net/core/rtnetlink.c linux-3.0.3/net/core/rtnetlink.c | |
65153 | --- linux-3.0.3/net/core/rtnetlink.c 2011-07-21 22:17:23.000000000 -0400 | |
65154 | +++ linux-3.0.3/net/core/rtnetlink.c 2011-08-23 21:47:56.000000000 -0400 | |
65155 | @@ -56,7 +56,7 @@ | |
65156 | struct rtnl_link { | |
65157 | rtnl_doit_func doit; | |
65158 | rtnl_dumpit_func dumpit; | |
65159 | -}; | |
65160 | +} __no_const; | |
65161 | ||
65162 | static DEFINE_MUTEX(rtnl_mutex); | |
65163 | ||
65164 | diff -urNp linux-3.0.3/net/core/skbuff.c linux-3.0.3/net/core/skbuff.c | |
65165 | --- linux-3.0.3/net/core/skbuff.c 2011-07-21 22:17:23.000000000 -0400 | |
65166 | +++ linux-3.0.3/net/core/skbuff.c 2011-08-23 21:48:14.000000000 -0400 | |
65167 | @@ -1543,6 +1543,8 @@ int skb_splice_bits(struct sk_buff *skb, | |
65168 | struct sock *sk = skb->sk; | |
65169 | int ret = 0; | |
65170 | ||
65171 | + pax_track_stack(); | |
65172 | + | |
65173 | if (splice_grow_spd(pipe, &spd)) | |
65174 | return -ENOMEM; | |
65175 | ||
65176 | diff -urNp linux-3.0.3/net/core/sock.c linux-3.0.3/net/core/sock.c | |
65177 | --- linux-3.0.3/net/core/sock.c 2011-07-21 22:17:23.000000000 -0400 | |
65178 | +++ linux-3.0.3/net/core/sock.c 2011-08-23 21:48:14.000000000 -0400 | |
65179 | @@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk, | |
65180 | */ | |
65181 | if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= | |
65182 | (unsigned)sk->sk_rcvbuf) { | |
65183 | - atomic_inc(&sk->sk_drops); | |
65184 | + atomic_inc_unchecked(&sk->sk_drops); | |
65185 | return -ENOMEM; | |
65186 | } | |
65187 | ||
65188 | @@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk, | |
65189 | return err; | |
65190 | ||
65191 | if (!sk_rmem_schedule(sk, skb->truesize)) { | |
65192 | - atomic_inc(&sk->sk_drops); | |
65193 | + atomic_inc_unchecked(&sk->sk_drops); | |
65194 | return -ENOBUFS; | |
65195 | } | |
65196 | ||
65197 | @@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk, | |
65198 | skb_dst_force(skb); | |
65199 | ||
65200 | spin_lock_irqsave(&list->lock, flags); | |
65201 | - skb->dropcount = atomic_read(&sk->sk_drops); | |
65202 | + skb->dropcount = atomic_read_unchecked(&sk->sk_drops); | |
65203 | __skb_queue_tail(list, skb); | |
65204 | spin_unlock_irqrestore(&list->lock, flags); | |
65205 | ||
65206 | @@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru | |
65207 | skb->dev = NULL; | |
65208 | ||
65209 | if (sk_rcvqueues_full(sk, skb)) { | |
65210 | - atomic_inc(&sk->sk_drops); | |
65211 | + atomic_inc_unchecked(&sk->sk_drops); | |
65212 | goto discard_and_relse; | |
65213 | } | |
65214 | if (nested) | |
65215 | @@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru | |
65216 | mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_); | |
65217 | } else if (sk_add_backlog(sk, skb)) { | |
65218 | bh_unlock_sock(sk); | |
65219 | - atomic_inc(&sk->sk_drops); | |
65220 | + atomic_inc_unchecked(&sk->sk_drops); | |
65221 | goto discard_and_relse; | |
65222 | } | |
65223 | ||
65224 | @@ -921,7 +921,7 @@ int sock_getsockopt(struct socket *sock, | |
65225 | if (len > sizeof(peercred)) | |
65226 | len = sizeof(peercred); | |
65227 | cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred); | |
65228 | - if (copy_to_user(optval, &peercred, len)) | |
65229 | + if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len)) | |
65230 | return -EFAULT; | |
65231 | goto lenout; | |
65232 | } | |
65233 | @@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock, | |
65234 | return -ENOTCONN; | |
65235 | if (lv < len) | |
65236 | return -EINVAL; | |
65237 | - if (copy_to_user(optval, address, len)) | |
65238 | + if (len > sizeof(address) || copy_to_user(optval, address, len)) | |
65239 | return -EFAULT; | |
65240 | goto lenout; | |
65241 | } | |
65242 | @@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock, | |
65243 | ||
65244 | if (len > lv) | |
65245 | len = lv; | |
65246 | - if (copy_to_user(optval, &v, len)) | |
65247 | + if (len > sizeof(v) || copy_to_user(optval, &v, len)) | |
65248 | return -EFAULT; | |
65249 | lenout: | |
65250 | if (put_user(len, optlen)) | |
65251 | @@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock, | |
65252 | */ | |
65253 | smp_wmb(); | |
65254 | atomic_set(&sk->sk_refcnt, 1); | |
65255 | - atomic_set(&sk->sk_drops, 0); | |
65256 | + atomic_set_unchecked(&sk->sk_drops, 0); | |
65257 | } | |
65258 | EXPORT_SYMBOL(sock_init_data); | |
65259 | ||
65260 | diff -urNp linux-3.0.3/net/decnet/sysctl_net_decnet.c linux-3.0.3/net/decnet/sysctl_net_decnet.c | |
65261 | --- linux-3.0.3/net/decnet/sysctl_net_decnet.c 2011-07-21 22:17:23.000000000 -0400 | |
65262 | +++ linux-3.0.3/net/decnet/sysctl_net_decnet.c 2011-08-23 21:47:56.000000000 -0400 | |
65263 | @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t | |
65264 | ||
65265 | if (len > *lenp) len = *lenp; | |
65266 | ||
65267 | - if (copy_to_user(buffer, addr, len)) | |
65268 | + if (len > sizeof addr || copy_to_user(buffer, addr, len)) | |
65269 | return -EFAULT; | |
65270 | ||
65271 | *lenp = len; | |
65272 | @@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table | |
65273 | ||
65274 | if (len > *lenp) len = *lenp; | |
65275 | ||
65276 | - if (copy_to_user(buffer, devname, len)) | |
65277 | + if (len > sizeof devname || copy_to_user(buffer, devname, len)) | |
65278 | return -EFAULT; | |
65279 | ||
65280 | *lenp = len; | |
65281 | diff -urNp linux-3.0.3/net/econet/Kconfig linux-3.0.3/net/econet/Kconfig | |
65282 | --- linux-3.0.3/net/econet/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
65283 | +++ linux-3.0.3/net/econet/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
65284 | @@ -4,7 +4,7 @@ | |
65285 | ||
65286 | config ECONET | |
65287 | tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)" | |
65288 | - depends on EXPERIMENTAL && INET | |
65289 | + depends on EXPERIMENTAL && INET && BROKEN | |
65290 | ---help--- | |
65291 | Econet is a fairly old and slow networking protocol mainly used by | |
65292 | Acorn computers to access file and print servers. It uses native | |
65293 | diff -urNp linux-3.0.3/net/ipv4/fib_frontend.c linux-3.0.3/net/ipv4/fib_frontend.c | |
65294 | --- linux-3.0.3/net/ipv4/fib_frontend.c 2011-07-21 22:17:23.000000000 -0400 | |
65295 | +++ linux-3.0.3/net/ipv4/fib_frontend.c 2011-08-23 21:47:56.000000000 -0400 | |
65296 | @@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct not | |
65297 | #ifdef CONFIG_IP_ROUTE_MULTIPATH | |
65298 | fib_sync_up(dev); | |
65299 | #endif | |
65300 | - atomic_inc(&net->ipv4.dev_addr_genid); | |
65301 | + atomic_inc_unchecked(&net->ipv4.dev_addr_genid); | |
65302 | rt_cache_flush(dev_net(dev), -1); | |
65303 | break; | |
65304 | case NETDEV_DOWN: | |
65305 | fib_del_ifaddr(ifa, NULL); | |
65306 | - atomic_inc(&net->ipv4.dev_addr_genid); | |
65307 | + atomic_inc_unchecked(&net->ipv4.dev_addr_genid); | |
65308 | if (ifa->ifa_dev->ifa_list == NULL) { | |
65309 | /* Last address was deleted from this interface. | |
65310 | * Disable IP. | |
65311 | @@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notif | |
65312 | #ifdef CONFIG_IP_ROUTE_MULTIPATH | |
65313 | fib_sync_up(dev); | |
65314 | #endif | |
65315 | - atomic_inc(&net->ipv4.dev_addr_genid); | |
65316 | + atomic_inc_unchecked(&net->ipv4.dev_addr_genid); | |
65317 | rt_cache_flush(dev_net(dev), -1); | |
65318 | break; | |
65319 | case NETDEV_DOWN: | |
65320 | diff -urNp linux-3.0.3/net/ipv4/fib_semantics.c linux-3.0.3/net/ipv4/fib_semantics.c | |
65321 | --- linux-3.0.3/net/ipv4/fib_semantics.c 2011-07-21 22:17:23.000000000 -0400 | |
65322 | +++ linux-3.0.3/net/ipv4/fib_semantics.c 2011-08-23 21:47:56.000000000 -0400 | |
65323 | @@ -691,7 +691,7 @@ __be32 fib_info_update_nh_saddr(struct n | |
65324 | nh->nh_saddr = inet_select_addr(nh->nh_dev, | |
65325 | nh->nh_gw, | |
65326 | nh->nh_parent->fib_scope); | |
65327 | - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid); | |
65328 | + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid); | |
65329 | ||
65330 | return nh->nh_saddr; | |
65331 | } | |
65332 | diff -urNp linux-3.0.3/net/ipv4/inet_diag.c linux-3.0.3/net/ipv4/inet_diag.c | |
65333 | --- linux-3.0.3/net/ipv4/inet_diag.c 2011-07-21 22:17:23.000000000 -0400 | |
65334 | +++ linux-3.0.3/net/ipv4/inet_diag.c 2011-08-23 21:48:14.000000000 -0400 | |
65335 | @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc | |
65336 | r->idiag_retrans = 0; | |
65337 | ||
65338 | r->id.idiag_if = sk->sk_bound_dev_if; | |
65339 | + | |
65340 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65341 | + r->id.idiag_cookie[0] = 0; | |
65342 | + r->id.idiag_cookie[1] = 0; | |
65343 | +#else | |
65344 | r->id.idiag_cookie[0] = (u32)(unsigned long)sk; | |
65345 | r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1); | |
65346 | +#endif | |
65347 | ||
65348 | r->id.idiag_sport = inet->inet_sport; | |
65349 | r->id.idiag_dport = inet->inet_dport; | |
65350 | @@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in | |
65351 | r->idiag_family = tw->tw_family; | |
65352 | r->idiag_retrans = 0; | |
65353 | r->id.idiag_if = tw->tw_bound_dev_if; | |
65354 | + | |
65355 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65356 | + r->id.idiag_cookie[0] = 0; | |
65357 | + r->id.idiag_cookie[1] = 0; | |
65358 | +#else | |
65359 | r->id.idiag_cookie[0] = (u32)(unsigned long)tw; | |
65360 | r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1); | |
65361 | +#endif | |
65362 | + | |
65363 | r->id.idiag_sport = tw->tw_sport; | |
65364 | r->id.idiag_dport = tw->tw_dport; | |
65365 | r->id.idiag_src[0] = tw->tw_rcv_saddr; | |
65366 | @@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk | |
65367 | if (sk == NULL) | |
65368 | goto unlock; | |
65369 | ||
65370 | +#ifndef CONFIG_GRKERNSEC_HIDESYM | |
65371 | err = -ESTALE; | |
65372 | if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE || | |
65373 | req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) && | |
65374 | ((u32)(unsigned long)sk != req->id.idiag_cookie[0] || | |
65375 | (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1])) | |
65376 | goto out; | |
65377 | +#endif | |
65378 | ||
65379 | err = -ENOMEM; | |
65380 | rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) + | |
65381 | @@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_ | |
65382 | r->idiag_retrans = req->retrans; | |
65383 | ||
65384 | r->id.idiag_if = sk->sk_bound_dev_if; | |
65385 | + | |
65386 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65387 | + r->id.idiag_cookie[0] = 0; | |
65388 | + r->id.idiag_cookie[1] = 0; | |
65389 | +#else | |
65390 | r->id.idiag_cookie[0] = (u32)(unsigned long)req; | |
65391 | r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1); | |
65392 | +#endif | |
65393 | ||
65394 | tmo = req->expires - jiffies; | |
65395 | if (tmo < 0) | |
65396 | diff -urNp linux-3.0.3/net/ipv4/inet_hashtables.c linux-3.0.3/net/ipv4/inet_hashtables.c | |
65397 | --- linux-3.0.3/net/ipv4/inet_hashtables.c 2011-08-23 21:44:40.000000000 -0400 | |
65398 | +++ linux-3.0.3/net/ipv4/inet_hashtables.c 2011-08-23 21:55:24.000000000 -0400 | |
65399 | @@ -18,12 +18,15 @@ | |
65400 | #include <linux/sched.h> | |
65401 | #include <linux/slab.h> | |
65402 | #include <linux/wait.h> | |
65403 | +#include <linux/security.h> | |
65404 | ||
65405 | #include <net/inet_connection_sock.h> | |
65406 | #include <net/inet_hashtables.h> | |
65407 | #include <net/secure_seq.h> | |
65408 | #include <net/ip.h> | |
65409 | ||
65410 | +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet); | |
65411 | + | |
65412 | /* | |
65413 | * Allocate and initialize a new local port bind bucket. | |
65414 | * The bindhash mutex for snum's hash chain must be held here. | |
65415 | @@ -530,6 +533,8 @@ ok: | |
65416 | twrefcnt += inet_twsk_bind_unhash(tw, hinfo); | |
65417 | spin_unlock(&head->lock); | |
65418 | ||
65419 | + gr_update_task_in_ip_table(current, inet_sk(sk)); | |
65420 | + | |
65421 | if (tw) { | |
65422 | inet_twsk_deschedule(tw, death_row); | |
65423 | while (twrefcnt) { | |
65424 | diff -urNp linux-3.0.3/net/ipv4/inetpeer.c linux-3.0.3/net/ipv4/inetpeer.c | |
65425 | --- linux-3.0.3/net/ipv4/inetpeer.c 2011-08-23 21:44:40.000000000 -0400 | |
65426 | +++ linux-3.0.3/net/ipv4/inetpeer.c 2011-08-23 21:48:14.000000000 -0400 | |
65427 | @@ -481,6 +481,8 @@ struct inet_peer *inet_getpeer(struct in | |
65428 | unsigned int sequence; | |
65429 | int invalidated, newrefcnt = 0; | |
65430 | ||
65431 | + pax_track_stack(); | |
65432 | + | |
65433 | /* Look up for the address quickly, lockless. | |
65434 | * Because of a concurrent writer, we might not find an existing entry. | |
65435 | */ | |
65436 | @@ -517,8 +519,8 @@ found: /* The existing node has been fo | |
65437 | if (p) { | |
65438 | p->daddr = *daddr; | |
65439 | atomic_set(&p->refcnt, 1); | |
65440 | - atomic_set(&p->rid, 0); | |
65441 | - atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4)); | |
65442 | + atomic_set_unchecked(&p->rid, 0); | |
65443 | + atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4)); | |
65444 | p->tcp_ts_stamp = 0; | |
65445 | p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; | |
65446 | p->rate_tokens = 0; | |
65447 | diff -urNp linux-3.0.3/net/ipv4/ip_fragment.c linux-3.0.3/net/ipv4/ip_fragment.c | |
65448 | --- linux-3.0.3/net/ipv4/ip_fragment.c 2011-07-21 22:17:23.000000000 -0400 | |
65449 | +++ linux-3.0.3/net/ipv4/ip_fragment.c 2011-08-23 21:47:56.000000000 -0400 | |
65450 | @@ -315,7 +315,7 @@ static inline int ip_frag_too_far(struct | |
65451 | return 0; | |
65452 | ||
65453 | start = qp->rid; | |
65454 | - end = atomic_inc_return(&peer->rid); | |
65455 | + end = atomic_inc_return_unchecked(&peer->rid); | |
65456 | qp->rid = end; | |
65457 | ||
65458 | rc = qp->q.fragments && (end - start) > max; | |
65459 | diff -urNp linux-3.0.3/net/ipv4/ip_sockglue.c linux-3.0.3/net/ipv4/ip_sockglue.c | |
65460 | --- linux-3.0.3/net/ipv4/ip_sockglue.c 2011-07-21 22:17:23.000000000 -0400 | |
65461 | +++ linux-3.0.3/net/ipv4/ip_sockglue.c 2011-08-23 21:48:14.000000000 -0400 | |
65462 | @@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock | |
65463 | int val; | |
65464 | int len; | |
65465 | ||
65466 | + pax_track_stack(); | |
65467 | + | |
65468 | if (level != SOL_IP) | |
65469 | return -EOPNOTSUPP; | |
65470 | ||
65471 | @@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock | |
65472 | len = min_t(unsigned int, len, opt->optlen); | |
65473 | if (put_user(len, optlen)) | |
65474 | return -EFAULT; | |
65475 | - if (copy_to_user(optval, opt->__data, len)) | |
65476 | + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) || | |
65477 | + copy_to_user(optval, opt->__data, len)) | |
65478 | return -EFAULT; | |
65479 | return 0; | |
65480 | } | |
65481 | diff -urNp linux-3.0.3/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-3.0.3/net/ipv4/netfilter/nf_nat_snmp_basic.c | |
65482 | --- linux-3.0.3/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-07-21 22:17:23.000000000 -0400 | |
65483 | +++ linux-3.0.3/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-08-23 21:47:56.000000000 -0400 | |
65484 | @@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode( | |
65485 | ||
65486 | *len = 0; | |
65487 | ||
65488 | - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC); | |
65489 | + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC); | |
65490 | if (*octets == NULL) { | |
65491 | if (net_ratelimit()) | |
65492 | pr_notice("OOM in bsalg (%d)\n", __LINE__); | |
65493 | diff -urNp linux-3.0.3/net/ipv4/ping.c linux-3.0.3/net/ipv4/ping.c | |
65494 | --- linux-3.0.3/net/ipv4/ping.c 2011-07-21 22:17:23.000000000 -0400 | |
65495 | +++ linux-3.0.3/net/ipv4/ping.c 2011-08-23 21:47:56.000000000 -0400 | |
65496 | @@ -837,7 +837,7 @@ static void ping_format_sock(struct sock | |
65497 | sk_rmem_alloc_get(sp), | |
65498 | 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), | |
65499 | atomic_read(&sp->sk_refcnt), sp, | |
65500 | - atomic_read(&sp->sk_drops), len); | |
65501 | + atomic_read_unchecked(&sp->sk_drops), len); | |
65502 | } | |
65503 | ||
65504 | static int ping_seq_show(struct seq_file *seq, void *v) | |
65505 | diff -urNp linux-3.0.3/net/ipv4/raw.c linux-3.0.3/net/ipv4/raw.c | |
65506 | --- linux-3.0.3/net/ipv4/raw.c 2011-07-21 22:17:23.000000000 -0400 | |
65507 | +++ linux-3.0.3/net/ipv4/raw.c 2011-08-23 21:48:14.000000000 -0400 | |
65508 | @@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk, | |
65509 | int raw_rcv(struct sock *sk, struct sk_buff *skb) | |
65510 | { | |
65511 | if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) { | |
65512 | - atomic_inc(&sk->sk_drops); | |
65513 | + atomic_inc_unchecked(&sk->sk_drops); | |
65514 | kfree_skb(skb); | |
65515 | return NET_RX_DROP; | |
65516 | } | |
65517 | @@ -736,16 +736,20 @@ static int raw_init(struct sock *sk) | |
65518 | ||
65519 | static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen) | |
65520 | { | |
65521 | + struct icmp_filter filter; | |
65522 | + | |
65523 | if (optlen > sizeof(struct icmp_filter)) | |
65524 | optlen = sizeof(struct icmp_filter); | |
65525 | - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen)) | |
65526 | + if (copy_from_user(&filter, optval, optlen)) | |
65527 | return -EFAULT; | |
65528 | + raw_sk(sk)->filter = filter; | |
65529 | return 0; | |
65530 | } | |
65531 | ||
65532 | static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen) | |
65533 | { | |
65534 | int len, ret = -EFAULT; | |
65535 | + struct icmp_filter filter; | |
65536 | ||
65537 | if (get_user(len, optlen)) | |
65538 | goto out; | |
65539 | @@ -755,8 +759,9 @@ static int raw_geticmpfilter(struct sock | |
65540 | if (len > sizeof(struct icmp_filter)) | |
65541 | len = sizeof(struct icmp_filter); | |
65542 | ret = -EFAULT; | |
65543 | - if (put_user(len, optlen) || | |
65544 | - copy_to_user(optval, &raw_sk(sk)->filter, len)) | |
65545 | + filter = raw_sk(sk)->filter; | |
65546 | + if (put_user(len, optlen) || len > sizeof filter || | |
65547 | + copy_to_user(optval, &filter, len)) | |
65548 | goto out; | |
65549 | ret = 0; | |
65550 | out: return ret; | |
65551 | @@ -984,7 +989,13 @@ static void raw_sock_seq_show(struct seq | |
65552 | sk_wmem_alloc_get(sp), | |
65553 | sk_rmem_alloc_get(sp), | |
65554 | 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), | |
65555 | - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops)); | |
65556 | + atomic_read(&sp->sk_refcnt), | |
65557 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65558 | + NULL, | |
65559 | +#else | |
65560 | + sp, | |
65561 | +#endif | |
65562 | + atomic_read_unchecked(&sp->sk_drops)); | |
65563 | } | |
65564 | ||
65565 | static int raw_seq_show(struct seq_file *seq, void *v) | |
65566 | diff -urNp linux-3.0.3/net/ipv4/route.c linux-3.0.3/net/ipv4/route.c | |
65567 | --- linux-3.0.3/net/ipv4/route.c 2011-08-23 21:44:40.000000000 -0400 | |
65568 | +++ linux-3.0.3/net/ipv4/route.c 2011-08-23 21:47:56.000000000 -0400 | |
65569 | @@ -304,7 +304,7 @@ static inline unsigned int rt_hash(__be3 | |
65570 | ||
65571 | static inline int rt_genid(struct net *net) | |
65572 | { | |
65573 | - return atomic_read(&net->ipv4.rt_genid); | |
65574 | + return atomic_read_unchecked(&net->ipv4.rt_genid); | |
65575 | } | |
65576 | ||
65577 | #ifdef CONFIG_PROC_FS | |
65578 | @@ -833,7 +833,7 @@ static void rt_cache_invalidate(struct n | |
65579 | unsigned char shuffle; | |
65580 | ||
65581 | get_random_bytes(&shuffle, sizeof(shuffle)); | |
65582 | - atomic_add(shuffle + 1U, &net->ipv4.rt_genid); | |
65583 | + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid); | |
65584 | } | |
65585 | ||
65586 | /* | |
65587 | @@ -2834,7 +2834,7 @@ static int rt_fill_info(struct net *net, | |
65588 | error = rt->dst.error; | |
65589 | if (peer) { | |
65590 | inet_peer_refcheck(rt->peer); | |
65591 | - id = atomic_read(&peer->ip_id_count) & 0xffff; | |
65592 | + id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff; | |
65593 | if (peer->tcp_ts_stamp) { | |
65594 | ts = peer->tcp_ts; | |
65595 | tsage = get_seconds() - peer->tcp_ts_stamp; | |
65596 | diff -urNp linux-3.0.3/net/ipv4/tcp.c linux-3.0.3/net/ipv4/tcp.c | |
65597 | --- linux-3.0.3/net/ipv4/tcp.c 2011-07-21 22:17:23.000000000 -0400 | |
65598 | +++ linux-3.0.3/net/ipv4/tcp.c 2011-08-23 21:48:14.000000000 -0400 | |
65599 | @@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock | |
65600 | int val; | |
65601 | int err = 0; | |
65602 | ||
65603 | + pax_track_stack(); | |
65604 | + | |
65605 | /* These are data/string values, all the others are ints */ | |
65606 | switch (optname) { | |
65607 | case TCP_CONGESTION: { | |
65608 | @@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock | |
65609 | struct tcp_sock *tp = tcp_sk(sk); | |
65610 | int val, len; | |
65611 | ||
65612 | + pax_track_stack(); | |
65613 | + | |
65614 | if (get_user(len, optlen)) | |
65615 | return -EFAULT; | |
65616 | ||
65617 | diff -urNp linux-3.0.3/net/ipv4/tcp_ipv4.c linux-3.0.3/net/ipv4/tcp_ipv4.c | |
65618 | --- linux-3.0.3/net/ipv4/tcp_ipv4.c 2011-08-23 21:44:40.000000000 -0400 | |
65619 | +++ linux-3.0.3/net/ipv4/tcp_ipv4.c 2011-08-23 21:48:14.000000000 -0400 | |
65620 | @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly; | |
65621 | int sysctl_tcp_low_latency __read_mostly; | |
65622 | EXPORT_SYMBOL(sysctl_tcp_low_latency); | |
65623 | ||
65624 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65625 | +extern int grsec_enable_blackhole; | |
65626 | +#endif | |
65627 | ||
65628 | #ifdef CONFIG_TCP_MD5SIG | |
65629 | static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, | |
65630 | @@ -1607,6 +1610,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc | |
65631 | return 0; | |
65632 | ||
65633 | reset: | |
65634 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65635 | + if (!grsec_enable_blackhole) | |
65636 | +#endif | |
65637 | tcp_v4_send_reset(rsk, skb); | |
65638 | discard: | |
65639 | kfree_skb(skb); | |
65640 | @@ -1669,12 +1675,19 @@ int tcp_v4_rcv(struct sk_buff *skb) | |
65641 | TCP_SKB_CB(skb)->sacked = 0; | |
65642 | ||
65643 | sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); | |
65644 | - if (!sk) | |
65645 | + if (!sk) { | |
65646 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65647 | + ret = 1; | |
65648 | +#endif | |
65649 | goto no_tcp_socket; | |
65650 | - | |
65651 | + } | |
65652 | process: | |
65653 | - if (sk->sk_state == TCP_TIME_WAIT) | |
65654 | + if (sk->sk_state == TCP_TIME_WAIT) { | |
65655 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65656 | + ret = 2; | |
65657 | +#endif | |
65658 | goto do_time_wait; | |
65659 | + } | |
65660 | ||
65661 | if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { | |
65662 | NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); | |
65663 | @@ -1724,6 +1737,10 @@ no_tcp_socket: | |
65664 | bad_packet: | |
65665 | TCP_INC_STATS_BH(net, TCP_MIB_INERRS); | |
65666 | } else { | |
65667 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65668 | + if (!grsec_enable_blackhole || (ret == 1 && | |
65669 | + (skb->dev->flags & IFF_LOOPBACK))) | |
65670 | +#endif | |
65671 | tcp_v4_send_reset(NULL, skb); | |
65672 | } | |
65673 | ||
65674 | @@ -2388,7 +2405,11 @@ static void get_openreq4(struct sock *sk | |
65675 | 0, /* non standard timer */ | |
65676 | 0, /* open_requests have no inode */ | |
65677 | atomic_read(&sk->sk_refcnt), | |
65678 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65679 | + NULL, | |
65680 | +#else | |
65681 | req, | |
65682 | +#endif | |
65683 | len); | |
65684 | } | |
65685 | ||
65686 | @@ -2438,7 +2459,12 @@ static void get_tcp4_sock(struct sock *s | |
65687 | sock_i_uid(sk), | |
65688 | icsk->icsk_probes_out, | |
65689 | sock_i_ino(sk), | |
65690 | - atomic_read(&sk->sk_refcnt), sk, | |
65691 | + atomic_read(&sk->sk_refcnt), | |
65692 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65693 | + NULL, | |
65694 | +#else | |
65695 | + sk, | |
65696 | +#endif | |
65697 | jiffies_to_clock_t(icsk->icsk_rto), | |
65698 | jiffies_to_clock_t(icsk->icsk_ack.ato), | |
65699 | (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong, | |
65700 | @@ -2466,7 +2492,13 @@ static void get_timewait4_sock(struct in | |
65701 | " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n", | |
65702 | i, src, srcp, dest, destp, tw->tw_substate, 0, 0, | |
65703 | 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, | |
65704 | - atomic_read(&tw->tw_refcnt), tw, len); | |
65705 | + atomic_read(&tw->tw_refcnt), | |
65706 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65707 | + NULL, | |
65708 | +#else | |
65709 | + tw, | |
65710 | +#endif | |
65711 | + len); | |
65712 | } | |
65713 | ||
65714 | #define TMPSZ 150 | |
65715 | diff -urNp linux-3.0.3/net/ipv4/tcp_minisocks.c linux-3.0.3/net/ipv4/tcp_minisocks.c | |
65716 | --- linux-3.0.3/net/ipv4/tcp_minisocks.c 2011-07-21 22:17:23.000000000 -0400 | |
65717 | +++ linux-3.0.3/net/ipv4/tcp_minisocks.c 2011-08-23 21:48:14.000000000 -0400 | |
65718 | @@ -27,6 +27,10 @@ | |
65719 | #include <net/inet_common.h> | |
65720 | #include <net/xfrm.h> | |
65721 | ||
65722 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65723 | +extern int grsec_enable_blackhole; | |
65724 | +#endif | |
65725 | + | |
65726 | int sysctl_tcp_syncookies __read_mostly = 1; | |
65727 | EXPORT_SYMBOL(sysctl_tcp_syncookies); | |
65728 | ||
65729 | @@ -745,6 +749,10 @@ listen_overflow: | |
65730 | ||
65731 | embryonic_reset: | |
65732 | NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); | |
65733 | + | |
65734 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65735 | + if (!grsec_enable_blackhole) | |
65736 | +#endif | |
65737 | if (!(flg & TCP_FLAG_RST)) | |
65738 | req->rsk_ops->send_reset(sk, skb); | |
65739 | ||
65740 | diff -urNp linux-3.0.3/net/ipv4/tcp_output.c linux-3.0.3/net/ipv4/tcp_output.c | |
65741 | --- linux-3.0.3/net/ipv4/tcp_output.c 2011-07-21 22:17:23.000000000 -0400 | |
65742 | +++ linux-3.0.3/net/ipv4/tcp_output.c 2011-08-23 21:48:14.000000000 -0400 | |
65743 | @@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s | |
65744 | int mss; | |
65745 | int s_data_desired = 0; | |
65746 | ||
65747 | + pax_track_stack(); | |
65748 | + | |
65749 | if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired) | |
65750 | s_data_desired = cvp->s_data_desired; | |
65751 | skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC); | |
65752 | diff -urNp linux-3.0.3/net/ipv4/tcp_probe.c linux-3.0.3/net/ipv4/tcp_probe.c | |
65753 | --- linux-3.0.3/net/ipv4/tcp_probe.c 2011-07-21 22:17:23.000000000 -0400 | |
65754 | +++ linux-3.0.3/net/ipv4/tcp_probe.c 2011-08-23 21:47:56.000000000 -0400 | |
65755 | @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file | |
65756 | if (cnt + width >= len) | |
65757 | break; | |
65758 | ||
65759 | - if (copy_to_user(buf + cnt, tbuf, width)) | |
65760 | + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width)) | |
65761 | return -EFAULT; | |
65762 | cnt += width; | |
65763 | } | |
65764 | diff -urNp linux-3.0.3/net/ipv4/tcp_timer.c linux-3.0.3/net/ipv4/tcp_timer.c | |
65765 | --- linux-3.0.3/net/ipv4/tcp_timer.c 2011-07-21 22:17:23.000000000 -0400 | |
65766 | +++ linux-3.0.3/net/ipv4/tcp_timer.c 2011-08-23 21:48:14.000000000 -0400 | |
65767 | @@ -22,6 +22,10 @@ | |
65768 | #include <linux/gfp.h> | |
65769 | #include <net/tcp.h> | |
65770 | ||
65771 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65772 | +extern int grsec_lastack_retries; | |
65773 | +#endif | |
65774 | + | |
65775 | int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES; | |
65776 | int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES; | |
65777 | int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME; | |
65778 | @@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock | |
65779 | } | |
65780 | } | |
65781 | ||
65782 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65783 | + if ((sk->sk_state == TCP_LAST_ACK) && | |
65784 | + (grsec_lastack_retries > 0) && | |
65785 | + (grsec_lastack_retries < retry_until)) | |
65786 | + retry_until = grsec_lastack_retries; | |
65787 | +#endif | |
65788 | + | |
65789 | if (retransmits_timed_out(sk, retry_until, | |
65790 | syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) { | |
65791 | /* Has it gone just too far? */ | |
65792 | diff -urNp linux-3.0.3/net/ipv4/udp.c linux-3.0.3/net/ipv4/udp.c | |
65793 | --- linux-3.0.3/net/ipv4/udp.c 2011-07-21 22:17:23.000000000 -0400 | |
65794 | +++ linux-3.0.3/net/ipv4/udp.c 2011-08-23 21:48:14.000000000 -0400 | |
65795 | @@ -86,6 +86,7 @@ | |
65796 | #include <linux/types.h> | |
65797 | #include <linux/fcntl.h> | |
65798 | #include <linux/module.h> | |
65799 | +#include <linux/security.h> | |
65800 | #include <linux/socket.h> | |
65801 | #include <linux/sockios.h> | |
65802 | #include <linux/igmp.h> | |
65803 | @@ -107,6 +108,10 @@ | |
65804 | #include <net/xfrm.h> | |
65805 | #include "udp_impl.h" | |
65806 | ||
65807 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65808 | +extern int grsec_enable_blackhole; | |
65809 | +#endif | |
65810 | + | |
65811 | struct udp_table udp_table __read_mostly; | |
65812 | EXPORT_SYMBOL(udp_table); | |
65813 | ||
65814 | @@ -564,6 +569,9 @@ found: | |
65815 | return s; | |
65816 | } | |
65817 | ||
65818 | +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb); | |
65819 | +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr); | |
65820 | + | |
65821 | /* | |
65822 | * This routine is called by the ICMP module when it gets some | |
65823 | * sort of error condition. If err < 0 then the socket should | |
65824 | @@ -855,9 +863,18 @@ int udp_sendmsg(struct kiocb *iocb, stru | |
65825 | dport = usin->sin_port; | |
65826 | if (dport == 0) | |
65827 | return -EINVAL; | |
65828 | + | |
65829 | + err = gr_search_udp_sendmsg(sk, usin); | |
65830 | + if (err) | |
65831 | + return err; | |
65832 | } else { | |
65833 | if (sk->sk_state != TCP_ESTABLISHED) | |
65834 | return -EDESTADDRREQ; | |
65835 | + | |
65836 | + err = gr_search_udp_sendmsg(sk, NULL); | |
65837 | + if (err) | |
65838 | + return err; | |
65839 | + | |
65840 | daddr = inet->inet_daddr; | |
65841 | dport = inet->inet_dport; | |
65842 | /* Open fast path for connected socket. | |
65843 | @@ -1098,7 +1115,7 @@ static unsigned int first_packet_length( | |
65844 | udp_lib_checksum_complete(skb)) { | |
65845 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, | |
65846 | IS_UDPLITE(sk)); | |
65847 | - atomic_inc(&sk->sk_drops); | |
65848 | + atomic_inc_unchecked(&sk->sk_drops); | |
65849 | __skb_unlink(skb, rcvq); | |
65850 | __skb_queue_tail(&list_kill, skb); | |
65851 | } | |
65852 | @@ -1184,6 +1201,10 @@ try_again: | |
65853 | if (!skb) | |
65854 | goto out; | |
65855 | ||
65856 | + err = gr_search_udp_recvmsg(sk, skb); | |
65857 | + if (err) | |
65858 | + goto out_free; | |
65859 | + | |
65860 | ulen = skb->len - sizeof(struct udphdr); | |
65861 | if (len > ulen) | |
65862 | len = ulen; | |
65863 | @@ -1483,7 +1504,7 @@ int udp_queue_rcv_skb(struct sock *sk, s | |
65864 | ||
65865 | drop: | |
65866 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite); | |
65867 | - atomic_inc(&sk->sk_drops); | |
65868 | + atomic_inc_unchecked(&sk->sk_drops); | |
65869 | kfree_skb(skb); | |
65870 | return -1; | |
65871 | } | |
65872 | @@ -1502,7 +1523,7 @@ static void flush_stack(struct sock **st | |
65873 | skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC); | |
65874 | ||
65875 | if (!skb1) { | |
65876 | - atomic_inc(&sk->sk_drops); | |
65877 | + atomic_inc_unchecked(&sk->sk_drops); | |
65878 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, | |
65879 | IS_UDPLITE(sk)); | |
65880 | UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, | |
65881 | @@ -1671,6 +1692,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, | |
65882 | goto csum_error; | |
65883 | ||
65884 | UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); | |
65885 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
65886 | + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK)) | |
65887 | +#endif | |
65888 | icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); | |
65889 | ||
65890 | /* | |
65891 | @@ -2098,8 +2122,13 @@ static void udp4_format_sock(struct sock | |
65892 | sk_wmem_alloc_get(sp), | |
65893 | sk_rmem_alloc_get(sp), | |
65894 | 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), | |
65895 | - atomic_read(&sp->sk_refcnt), sp, | |
65896 | - atomic_read(&sp->sk_drops), len); | |
65897 | + atomic_read(&sp->sk_refcnt), | |
65898 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
65899 | + NULL, | |
65900 | +#else | |
65901 | + sp, | |
65902 | +#endif | |
65903 | + atomic_read_unchecked(&sp->sk_drops), len); | |
65904 | } | |
65905 | ||
65906 | int udp4_seq_show(struct seq_file *seq, void *v) | |
65907 | diff -urNp linux-3.0.3/net/ipv6/inet6_connection_sock.c linux-3.0.3/net/ipv6/inet6_connection_sock.c | |
65908 | --- linux-3.0.3/net/ipv6/inet6_connection_sock.c 2011-07-21 22:17:23.000000000 -0400 | |
65909 | +++ linux-3.0.3/net/ipv6/inet6_connection_sock.c 2011-08-23 21:47:56.000000000 -0400 | |
65910 | @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock * | |
65911 | #ifdef CONFIG_XFRM | |
65912 | { | |
65913 | struct rt6_info *rt = (struct rt6_info *)dst; | |
65914 | - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid); | |
65915 | + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid); | |
65916 | } | |
65917 | #endif | |
65918 | } | |
65919 | @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check( | |
65920 | #ifdef CONFIG_XFRM | |
65921 | if (dst) { | |
65922 | struct rt6_info *rt = (struct rt6_info *)dst; | |
65923 | - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) { | |
65924 | + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) { | |
65925 | __sk_dst_reset(sk); | |
65926 | dst = NULL; | |
65927 | } | |
65928 | diff -urNp linux-3.0.3/net/ipv6/ipv6_sockglue.c linux-3.0.3/net/ipv6/ipv6_sockglue.c | |
65929 | --- linux-3.0.3/net/ipv6/ipv6_sockglue.c 2011-07-21 22:17:23.000000000 -0400 | |
65930 | +++ linux-3.0.3/net/ipv6/ipv6_sockglue.c 2011-08-23 21:48:14.000000000 -0400 | |
65931 | @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc | |
65932 | int val, valbool; | |
65933 | int retv = -ENOPROTOOPT; | |
65934 | ||
65935 | + pax_track_stack(); | |
65936 | + | |
65937 | if (optval == NULL) | |
65938 | val=0; | |
65939 | else { | |
65940 | @@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc | |
65941 | int len; | |
65942 | int val; | |
65943 | ||
65944 | + pax_track_stack(); | |
65945 | + | |
65946 | if (ip6_mroute_opt(optname)) | |
65947 | return ip6_mroute_getsockopt(sk, optname, optval, optlen); | |
65948 | ||
65949 | diff -urNp linux-3.0.3/net/ipv6/raw.c linux-3.0.3/net/ipv6/raw.c | |
65950 | --- linux-3.0.3/net/ipv6/raw.c 2011-07-21 22:17:23.000000000 -0400 | |
65951 | +++ linux-3.0.3/net/ipv6/raw.c 2011-08-23 21:48:14.000000000 -0400 | |
65952 | @@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s | |
65953 | { | |
65954 | if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) && | |
65955 | skb_checksum_complete(skb)) { | |
65956 | - atomic_inc(&sk->sk_drops); | |
65957 | + atomic_inc_unchecked(&sk->sk_drops); | |
65958 | kfree_skb(skb); | |
65959 | return NET_RX_DROP; | |
65960 | } | |
65961 | @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk | |
65962 | struct raw6_sock *rp = raw6_sk(sk); | |
65963 | ||
65964 | if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) { | |
65965 | - atomic_inc(&sk->sk_drops); | |
65966 | + atomic_inc_unchecked(&sk->sk_drops); | |
65967 | kfree_skb(skb); | |
65968 | return NET_RX_DROP; | |
65969 | } | |
65970 | @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk | |
65971 | ||
65972 | if (inet->hdrincl) { | |
65973 | if (skb_checksum_complete(skb)) { | |
65974 | - atomic_inc(&sk->sk_drops); | |
65975 | + atomic_inc_unchecked(&sk->sk_drops); | |
65976 | kfree_skb(skb); | |
65977 | return NET_RX_DROP; | |
65978 | } | |
65979 | @@ -601,7 +601,7 @@ out: | |
65980 | return err; | |
65981 | } | |
65982 | ||
65983 | -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length, | |
65984 | +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length, | |
65985 | struct flowi6 *fl6, struct dst_entry **dstp, | |
65986 | unsigned int flags) | |
65987 | { | |
65988 | @@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i | |
65989 | u16 proto; | |
65990 | int err; | |
65991 | ||
65992 | + pax_track_stack(); | |
65993 | + | |
65994 | /* Rough check on arithmetic overflow, | |
65995 | better check is made in ip6_append_data(). | |
65996 | */ | |
65997 | @@ -909,12 +911,15 @@ do_confirm: | |
65998 | static int rawv6_seticmpfilter(struct sock *sk, int level, int optname, | |
65999 | char __user *optval, int optlen) | |
66000 | { | |
66001 | + struct icmp6_filter filter; | |
66002 | + | |
66003 | switch (optname) { | |
66004 | case ICMPV6_FILTER: | |
66005 | if (optlen > sizeof(struct icmp6_filter)) | |
66006 | optlen = sizeof(struct icmp6_filter); | |
66007 | - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen)) | |
66008 | + if (copy_from_user(&filter, optval, optlen)) | |
66009 | return -EFAULT; | |
66010 | + raw6_sk(sk)->filter = filter; | |
66011 | return 0; | |
66012 | default: | |
66013 | return -ENOPROTOOPT; | |
66014 | @@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct so | |
66015 | char __user *optval, int __user *optlen) | |
66016 | { | |
66017 | int len; | |
66018 | + struct icmp6_filter filter; | |
66019 | ||
66020 | switch (optname) { | |
66021 | case ICMPV6_FILTER: | |
66022 | @@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so | |
66023 | len = sizeof(struct icmp6_filter); | |
66024 | if (put_user(len, optlen)) | |
66025 | return -EFAULT; | |
66026 | - if (copy_to_user(optval, &raw6_sk(sk)->filter, len)) | |
66027 | + filter = raw6_sk(sk)->filter; | |
66028 | + if (len > sizeof filter || copy_to_user(optval, &filter, len)) | |
66029 | return -EFAULT; | |
66030 | return 0; | |
66031 | default: | |
66032 | @@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se | |
66033 | 0, 0L, 0, | |
66034 | sock_i_uid(sp), 0, | |
66035 | sock_i_ino(sp), | |
66036 | - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops)); | |
66037 | + atomic_read(&sp->sk_refcnt), | |
66038 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
66039 | + NULL, | |
66040 | +#else | |
66041 | + sp, | |
66042 | +#endif | |
66043 | + atomic_read_unchecked(&sp->sk_drops)); | |
66044 | } | |
66045 | ||
66046 | static int raw6_seq_show(struct seq_file *seq, void *v) | |
66047 | diff -urNp linux-3.0.3/net/ipv6/tcp_ipv6.c linux-3.0.3/net/ipv6/tcp_ipv6.c | |
66048 | --- linux-3.0.3/net/ipv6/tcp_ipv6.c 2011-08-23 21:44:40.000000000 -0400 | |
66049 | +++ linux-3.0.3/net/ipv6/tcp_ipv6.c 2011-08-23 21:48:14.000000000 -0400 | |
66050 | @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5 | |
66051 | } | |
66052 | #endif | |
66053 | ||
66054 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66055 | +extern int grsec_enable_blackhole; | |
66056 | +#endif | |
66057 | + | |
66058 | static void tcp_v6_hash(struct sock *sk) | |
66059 | { | |
66060 | if (sk->sk_state != TCP_CLOSE) { | |
66061 | @@ -1662,6 +1666,9 @@ static int tcp_v6_do_rcv(struct sock *sk | |
66062 | return 0; | |
66063 | ||
66064 | reset: | |
66065 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66066 | + if (!grsec_enable_blackhole) | |
66067 | +#endif | |
66068 | tcp_v6_send_reset(sk, skb); | |
66069 | discard: | |
66070 | if (opt_skb) | |
66071 | @@ -1741,12 +1748,20 @@ static int tcp_v6_rcv(struct sk_buff *sk | |
66072 | TCP_SKB_CB(skb)->sacked = 0; | |
66073 | ||
66074 | sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); | |
66075 | - if (!sk) | |
66076 | + if (!sk) { | |
66077 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66078 | + ret = 1; | |
66079 | +#endif | |
66080 | goto no_tcp_socket; | |
66081 | + } | |
66082 | ||
66083 | process: | |
66084 | - if (sk->sk_state == TCP_TIME_WAIT) | |
66085 | + if (sk->sk_state == TCP_TIME_WAIT) { | |
66086 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66087 | + ret = 2; | |
66088 | +#endif | |
66089 | goto do_time_wait; | |
66090 | + } | |
66091 | ||
66092 | if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) { | |
66093 | NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); | |
66094 | @@ -1794,6 +1809,10 @@ no_tcp_socket: | |
66095 | bad_packet: | |
66096 | TCP_INC_STATS_BH(net, TCP_MIB_INERRS); | |
66097 | } else { | |
66098 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66099 | + if (!grsec_enable_blackhole || (ret == 1 && | |
66100 | + (skb->dev->flags & IFF_LOOPBACK))) | |
66101 | +#endif | |
66102 | tcp_v6_send_reset(NULL, skb); | |
66103 | } | |
66104 | ||
66105 | @@ -2054,7 +2073,13 @@ static void get_openreq6(struct seq_file | |
66106 | uid, | |
66107 | 0, /* non standard timer */ | |
66108 | 0, /* open_requests have no inode */ | |
66109 | - 0, req); | |
66110 | + 0, | |
66111 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
66112 | + NULL | |
66113 | +#else | |
66114 | + req | |
66115 | +#endif | |
66116 | + ); | |
66117 | } | |
66118 | ||
66119 | static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) | |
66120 | @@ -2104,7 +2129,12 @@ static void get_tcp6_sock(struct seq_fil | |
66121 | sock_i_uid(sp), | |
66122 | icsk->icsk_probes_out, | |
66123 | sock_i_ino(sp), | |
66124 | - atomic_read(&sp->sk_refcnt), sp, | |
66125 | + atomic_read(&sp->sk_refcnt), | |
66126 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
66127 | + NULL, | |
66128 | +#else | |
66129 | + sp, | |
66130 | +#endif | |
66131 | jiffies_to_clock_t(icsk->icsk_rto), | |
66132 | jiffies_to_clock_t(icsk->icsk_ack.ato), | |
66133 | (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong, | |
66134 | @@ -2139,7 +2169,13 @@ static void get_timewait6_sock(struct se | |
66135 | dest->s6_addr32[2], dest->s6_addr32[3], destp, | |
66136 | tw->tw_substate, 0, 0, | |
66137 | 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, | |
66138 | - atomic_read(&tw->tw_refcnt), tw); | |
66139 | + atomic_read(&tw->tw_refcnt), | |
66140 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
66141 | + NULL | |
66142 | +#else | |
66143 | + tw | |
66144 | +#endif | |
66145 | + ); | |
66146 | } | |
66147 | ||
66148 | static int tcp6_seq_show(struct seq_file *seq, void *v) | |
66149 | diff -urNp linux-3.0.3/net/ipv6/udp.c linux-3.0.3/net/ipv6/udp.c | |
66150 | --- linux-3.0.3/net/ipv6/udp.c 2011-08-23 21:44:40.000000000 -0400 | |
66151 | +++ linux-3.0.3/net/ipv6/udp.c 2011-08-23 21:48:14.000000000 -0400 | |
66152 | @@ -50,6 +50,10 @@ | |
66153 | #include <linux/seq_file.h> | |
66154 | #include "udp_impl.h" | |
66155 | ||
66156 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66157 | +extern int grsec_enable_blackhole; | |
66158 | +#endif | |
66159 | + | |
66160 | int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2) | |
66161 | { | |
66162 | const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr; | |
66163 | @@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk | |
66164 | ||
66165 | return 0; | |
66166 | drop: | |
66167 | - atomic_inc(&sk->sk_drops); | |
66168 | + atomic_inc_unchecked(&sk->sk_drops); | |
66169 | drop_no_sk_drops_inc: | |
66170 | UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite); | |
66171 | kfree_skb(skb); | |
66172 | @@ -624,7 +628,7 @@ static void flush_stack(struct sock **st | |
66173 | continue; | |
66174 | } | |
66175 | drop: | |
66176 | - atomic_inc(&sk->sk_drops); | |
66177 | + atomic_inc_unchecked(&sk->sk_drops); | |
66178 | UDP6_INC_STATS_BH(sock_net(sk), | |
66179 | UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk)); | |
66180 | UDP6_INC_STATS_BH(sock_net(sk), | |
66181 | @@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, | |
66182 | UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, | |
66183 | proto == IPPROTO_UDPLITE); | |
66184 | ||
66185 | +#ifdef CONFIG_GRKERNSEC_BLACKHOLE | |
66186 | + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK)) | |
66187 | +#endif | |
66188 | icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0); | |
66189 | ||
66190 | kfree_skb(skb); | |
66191 | @@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, | |
66192 | if (!sock_owned_by_user(sk)) | |
66193 | udpv6_queue_rcv_skb(sk, skb); | |
66194 | else if (sk_add_backlog(sk, skb)) { | |
66195 | - atomic_inc(&sk->sk_drops); | |
66196 | + atomic_inc_unchecked(&sk->sk_drops); | |
66197 | bh_unlock_sock(sk); | |
66198 | sock_put(sk); | |
66199 | goto discard; | |
66200 | @@ -1406,8 +1413,13 @@ static void udp6_sock_seq_show(struct se | |
66201 | 0, 0L, 0, | |
66202 | sock_i_uid(sp), 0, | |
66203 | sock_i_ino(sp), | |
66204 | - atomic_read(&sp->sk_refcnt), sp, | |
66205 | - atomic_read(&sp->sk_drops)); | |
66206 | + atomic_read(&sp->sk_refcnt), | |
66207 | +#ifdef CONFIG_GRKERNSEC_HIDESYM | |
66208 | + NULL, | |
66209 | +#else | |
66210 | + sp, | |
66211 | +#endif | |
66212 | + atomic_read_unchecked(&sp->sk_drops)); | |
66213 | } | |
66214 | ||
66215 | int udp6_seq_show(struct seq_file *seq, void *v) | |
66216 | diff -urNp linux-3.0.3/net/irda/ircomm/ircomm_tty.c linux-3.0.3/net/irda/ircomm/ircomm_tty.c | |
66217 | --- linux-3.0.3/net/irda/ircomm/ircomm_tty.c 2011-07-21 22:17:23.000000000 -0400 | |
66218 | +++ linux-3.0.3/net/irda/ircomm/ircomm_tty.c 2011-08-23 21:47:56.000000000 -0400 | |
66219 | @@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(st | |
66220 | add_wait_queue(&self->open_wait, &wait); | |
66221 | ||
66222 | IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n", | |
66223 | - __FILE__,__LINE__, tty->driver->name, self->open_count ); | |
66224 | + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) ); | |
66225 | ||
66226 | /* As far as I can see, we protect open_count - Jean II */ | |
66227 | spin_lock_irqsave(&self->spinlock, flags); | |
66228 | if (!tty_hung_up_p(filp)) { | |
66229 | extra_count = 1; | |
66230 | - self->open_count--; | |
66231 | + local_dec(&self->open_count); | |
66232 | } | |
66233 | spin_unlock_irqrestore(&self->spinlock, flags); | |
66234 | - self->blocked_open++; | |
66235 | + local_inc(&self->blocked_open); | |
66236 | ||
66237 | while (1) { | |
66238 | if (tty->termios->c_cflag & CBAUD) { | |
66239 | @@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(st | |
66240 | } | |
66241 | ||
66242 | IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n", | |
66243 | - __FILE__,__LINE__, tty->driver->name, self->open_count ); | |
66244 | + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) ); | |
66245 | ||
66246 | schedule(); | |
66247 | } | |
66248 | @@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(st | |
66249 | if (extra_count) { | |
66250 | /* ++ is not atomic, so this should be protected - Jean II */ | |
66251 | spin_lock_irqsave(&self->spinlock, flags); | |
66252 | - self->open_count++; | |
66253 | + local_inc(&self->open_count); | |
66254 | spin_unlock_irqrestore(&self->spinlock, flags); | |
66255 | } | |
66256 | - self->blocked_open--; | |
66257 | + local_dec(&self->blocked_open); | |
66258 | ||
66259 | IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n", | |
66260 | - __FILE__,__LINE__, tty->driver->name, self->open_count); | |
66261 | + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count)); | |
66262 | ||
66263 | if (!retval) | |
66264 | self->flags |= ASYNC_NORMAL_ACTIVE; | |
66265 | @@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_st | |
66266 | } | |
66267 | /* ++ is not atomic, so this should be protected - Jean II */ | |
66268 | spin_lock_irqsave(&self->spinlock, flags); | |
66269 | - self->open_count++; | |
66270 | + local_inc(&self->open_count); | |
66271 | ||
66272 | tty->driver_data = self; | |
66273 | self->tty = tty; | |
66274 | spin_unlock_irqrestore(&self->spinlock, flags); | |
66275 | ||
66276 | IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name, | |
66277 | - self->line, self->open_count); | |
66278 | + self->line, local_read(&self->open_count)); | |
66279 | ||
66280 | /* Not really used by us, but lets do it anyway */ | |
66281 | self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0; | |
66282 | @@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_ | |
66283 | return; | |
66284 | } | |
66285 | ||
66286 | - if ((tty->count == 1) && (self->open_count != 1)) { | |
66287 | + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) { | |
66288 | /* | |
66289 | * Uh, oh. tty->count is 1, which means that the tty | |
66290 | * structure will be freed. state->count should always | |
66291 | @@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_ | |
66292 | */ | |
66293 | IRDA_DEBUG(0, "%s(), bad serial port count; " | |
66294 | "tty->count is 1, state->count is %d\n", __func__ , | |
66295 | - self->open_count); | |
66296 | - self->open_count = 1; | |
66297 | + local_read(&self->open_count)); | |
66298 | + local_set(&self->open_count, 1); | |
66299 | } | |
66300 | ||
66301 | - if (--self->open_count < 0) { | |
66302 | + if (local_dec_return(&self->open_count) < 0) { | |
66303 | IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n", | |
66304 | - __func__, self->line, self->open_count); | |
66305 | - self->open_count = 0; | |
66306 | + __func__, self->line, local_read(&self->open_count)); | |
66307 | + local_set(&self->open_count, 0); | |
66308 | } | |
66309 | - if (self->open_count) { | |
66310 | + if (local_read(&self->open_count)) { | |
66311 | spin_unlock_irqrestore(&self->spinlock, flags); | |
66312 | ||
66313 | IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ ); | |
66314 | @@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_ | |
66315 | tty->closing = 0; | |
66316 | self->tty = NULL; | |
66317 | ||
66318 | - if (self->blocked_open) { | |
66319 | + if (local_read(&self->blocked_open)) { | |
66320 | if (self->close_delay) | |
66321 | schedule_timeout_interruptible(self->close_delay); | |
66322 | wake_up_interruptible(&self->open_wait); | |
66323 | @@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty | |
66324 | spin_lock_irqsave(&self->spinlock, flags); | |
66325 | self->flags &= ~ASYNC_NORMAL_ACTIVE; | |
66326 | self->tty = NULL; | |
66327 | - self->open_count = 0; | |
66328 | + local_set(&self->open_count, 0); | |
66329 | spin_unlock_irqrestore(&self->spinlock, flags); | |
66330 | ||
66331 | wake_up_interruptible(&self->open_wait); | |
66332 | @@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct | |
66333 | seq_putc(m, '\n'); | |
66334 | ||
66335 | seq_printf(m, "Role: %s\n", self->client ? "client" : "server"); | |
66336 | - seq_printf(m, "Open count: %d\n", self->open_count); | |
66337 | + seq_printf(m, "Open count: %d\n", local_read(&self->open_count)); | |
66338 | seq_printf(m, "Max data size: %d\n", self->max_data_size); | |
66339 | seq_printf(m, "Max header size: %d\n", self->max_header_size); | |
66340 | ||
66341 | diff -urNp linux-3.0.3/net/iucv/af_iucv.c linux-3.0.3/net/iucv/af_iucv.c | |
66342 | --- linux-3.0.3/net/iucv/af_iucv.c 2011-07-21 22:17:23.000000000 -0400 | |
66343 | +++ linux-3.0.3/net/iucv/af_iucv.c 2011-08-23 21:47:56.000000000 -0400 | |
66344 | @@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct soc | |
66345 | ||
66346 | write_lock_bh(&iucv_sk_list.lock); | |
66347 | ||
66348 | - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name)); | |
66349 | + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name)); | |
66350 | while (__iucv_get_sock_by_name(name)) { | |
66351 | sprintf(name, "%08x", | |
66352 | - atomic_inc_return(&iucv_sk_list.autobind_name)); | |
66353 | + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name)); | |
66354 | } | |
66355 | ||
66356 | write_unlock_bh(&iucv_sk_list.lock); | |
66357 | diff -urNp linux-3.0.3/net/key/af_key.c linux-3.0.3/net/key/af_key.c | |
66358 | --- linux-3.0.3/net/key/af_key.c 2011-07-21 22:17:23.000000000 -0400 | |
66359 | +++ linux-3.0.3/net/key/af_key.c 2011-08-23 21:48:14.000000000 -0400 | |
66360 | @@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk | |
66361 | struct xfrm_migrate m[XFRM_MAX_DEPTH]; | |
66362 | struct xfrm_kmaddress k; | |
66363 | ||
66364 | + pax_track_stack(); | |
66365 | + | |
66366 | if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1], | |
66367 | ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) || | |
66368 | !ext_hdrs[SADB_X_EXT_POLICY - 1]) { | |
66369 | @@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru | |
66370 | static u32 get_acqseq(void) | |
66371 | { | |
66372 | u32 res; | |
66373 | - static atomic_t acqseq; | |
66374 | + static atomic_unchecked_t acqseq; | |
66375 | ||
66376 | do { | |
66377 | - res = atomic_inc_return(&acqseq); | |
66378 | + res = atomic_inc_return_unchecked(&acqseq); | |
66379 | } while (!res); | |
66380 | return res; | |
66381 | } | |
66382 | diff -urNp linux-3.0.3/net/lapb/lapb_iface.c linux-3.0.3/net/lapb/lapb_iface.c | |
66383 | --- linux-3.0.3/net/lapb/lapb_iface.c 2011-07-21 22:17:23.000000000 -0400 | |
66384 | +++ linux-3.0.3/net/lapb/lapb_iface.c 2011-08-23 21:47:56.000000000 -0400 | |
66385 | @@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev | |
66386 | goto out; | |
66387 | ||
66388 | lapb->dev = dev; | |
66389 | - lapb->callbacks = *callbacks; | |
66390 | + lapb->callbacks = callbacks; | |
66391 | ||
66392 | __lapb_insert_cb(lapb); | |
66393 | ||
66394 | @@ -380,32 +380,32 @@ int lapb_data_received(struct net_device | |
66395 | ||
66396 | void lapb_connect_confirmation(struct lapb_cb *lapb, int reason) | |
66397 | { | |
66398 | - if (lapb->callbacks.connect_confirmation) | |
66399 | - lapb->callbacks.connect_confirmation(lapb->dev, reason); | |
66400 | + if (lapb->callbacks->connect_confirmation) | |
66401 | + lapb->callbacks->connect_confirmation(lapb->dev, reason); | |
66402 | } | |
66403 | ||
66404 | void lapb_connect_indication(struct lapb_cb *lapb, int reason) | |
66405 | { | |
66406 | - if (lapb->callbacks.connect_indication) | |
66407 | - lapb->callbacks.connect_indication(lapb->dev, reason); | |
66408 | + if (lapb->callbacks->connect_indication) | |
66409 | + lapb->callbacks->connect_indication(lapb->dev, reason); | |
66410 | } | |
66411 | ||
66412 | void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason) | |
66413 | { | |
66414 | - if (lapb->callbacks.disconnect_confirmation) | |
66415 | - lapb->callbacks.disconnect_confirmation(lapb->dev, reason); | |
66416 | + if (lapb->callbacks->disconnect_confirmation) | |
66417 | + lapb->callbacks->disconnect_confirmation(lapb->dev, reason); | |
66418 | } | |
66419 | ||
66420 | void lapb_disconnect_indication(struct lapb_cb *lapb, int reason) | |
66421 | { | |
66422 | - if (lapb->callbacks.disconnect_indication) | |
66423 | - lapb->callbacks.disconnect_indication(lapb->dev, reason); | |
66424 | + if (lapb->callbacks->disconnect_indication) | |
66425 | + lapb->callbacks->disconnect_indication(lapb->dev, reason); | |
66426 | } | |
66427 | ||
66428 | int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb) | |
66429 | { | |
66430 | - if (lapb->callbacks.data_indication) | |
66431 | - return lapb->callbacks.data_indication(lapb->dev, skb); | |
66432 | + if (lapb->callbacks->data_indication) | |
66433 | + return lapb->callbacks->data_indication(lapb->dev, skb); | |
66434 | ||
66435 | kfree_skb(skb); | |
66436 | return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */ | |
66437 | @@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *l | |
66438 | { | |
66439 | int used = 0; | |
66440 | ||
66441 | - if (lapb->callbacks.data_transmit) { | |
66442 | - lapb->callbacks.data_transmit(lapb->dev, skb); | |
66443 | + if (lapb->callbacks->data_transmit) { | |
66444 | + lapb->callbacks->data_transmit(lapb->dev, skb); | |
66445 | used = 1; | |
66446 | } | |
66447 | ||
66448 | diff -urNp linux-3.0.3/net/mac80211/debugfs_sta.c linux-3.0.3/net/mac80211/debugfs_sta.c | |
66449 | --- linux-3.0.3/net/mac80211/debugfs_sta.c 2011-07-21 22:17:23.000000000 -0400 | |
66450 | +++ linux-3.0.3/net/mac80211/debugfs_sta.c 2011-08-23 21:48:14.000000000 -0400 | |
66451 | @@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struc | |
66452 | struct tid_ampdu_rx *tid_rx; | |
66453 | struct tid_ampdu_tx *tid_tx; | |
66454 | ||
66455 | + pax_track_stack(); | |
66456 | + | |
66457 | rcu_read_lock(); | |
66458 | ||
66459 | p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n", | |
66460 | @@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct f | |
66461 | struct sta_info *sta = file->private_data; | |
66462 | struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap; | |
66463 | ||
66464 | + pax_track_stack(); | |
66465 | + | |
66466 | p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n", | |
66467 | htc->ht_supported ? "" : "not "); | |
66468 | if (htc->ht_supported) { | |
66469 | diff -urNp linux-3.0.3/net/mac80211/ieee80211_i.h linux-3.0.3/net/mac80211/ieee80211_i.h | |
66470 | --- linux-3.0.3/net/mac80211/ieee80211_i.h 2011-07-21 22:17:23.000000000 -0400 | |
66471 | +++ linux-3.0.3/net/mac80211/ieee80211_i.h 2011-08-23 21:47:56.000000000 -0400 | |
66472 | @@ -27,6 +27,7 @@ | |
66473 | #include <net/ieee80211_radiotap.h> | |
66474 | #include <net/cfg80211.h> | |
66475 | #include <net/mac80211.h> | |
66476 | +#include <asm/local.h> | |
66477 | #include "key.h" | |
66478 | #include "sta_info.h" | |
66479 | ||
66480 | @@ -721,7 +722,7 @@ struct ieee80211_local { | |
66481 | /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */ | |
66482 | spinlock_t queue_stop_reason_lock; | |
66483 | ||
66484 | - int open_count; | |
66485 | + local_t open_count; | |
66486 | int monitors, cooked_mntrs; | |
66487 | /* number of interfaces with corresponding FIF_ flags */ | |
66488 | int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, | |
66489 | diff -urNp linux-3.0.3/net/mac80211/iface.c linux-3.0.3/net/mac80211/iface.c | |
66490 | --- linux-3.0.3/net/mac80211/iface.c 2011-08-23 21:44:40.000000000 -0400 | |
66491 | +++ linux-3.0.3/net/mac80211/iface.c 2011-08-23 21:47:56.000000000 -0400 | |
66492 | @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_ | |
66493 | break; | |
66494 | } | |
66495 | ||
66496 | - if (local->open_count == 0) { | |
66497 | + if (local_read(&local->open_count) == 0) { | |
66498 | res = drv_start(local); | |
66499 | if (res) | |
66500 | goto err_del_bss; | |
66501 | @@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_ | |
66502 | memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN); | |
66503 | ||
66504 | if (!is_valid_ether_addr(dev->dev_addr)) { | |
66505 | - if (!local->open_count) | |
66506 | + if (!local_read(&local->open_count)) | |
66507 | drv_stop(local); | |
66508 | return -EADDRNOTAVAIL; | |
66509 | } | |
66510 | @@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_ | |
66511 | mutex_unlock(&local->mtx); | |
66512 | ||
66513 | if (coming_up) | |
66514 | - local->open_count++; | |
66515 | + local_inc(&local->open_count); | |
66516 | ||
66517 | if (hw_reconf_flags) { | |
66518 | ieee80211_hw_config(local, hw_reconf_flags); | |
66519 | @@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_ | |
66520 | err_del_interface: | |
66521 | drv_remove_interface(local, &sdata->vif); | |
66522 | err_stop: | |
66523 | - if (!local->open_count) | |
66524 | + if (!local_read(&local->open_count)) | |
66525 | drv_stop(local); | |
66526 | err_del_bss: | |
66527 | sdata->bss = NULL; | |
66528 | @@ -475,7 +475,7 @@ static void ieee80211_do_stop(struct iee | |
66529 | } | |
66530 | ||
66531 | if (going_down) | |
66532 | - local->open_count--; | |
66533 | + local_dec(&local->open_count); | |
66534 | ||
66535 | switch (sdata->vif.type) { | |
66536 | case NL80211_IFTYPE_AP_VLAN: | |
66537 | @@ -534,7 +534,7 @@ static void ieee80211_do_stop(struct iee | |
66538 | ||
66539 | ieee80211_recalc_ps(local, -1); | |
66540 | ||
66541 | - if (local->open_count == 0) { | |
66542 | + if (local_read(&local->open_count) == 0) { | |
66543 | if (local->ops->napi_poll) | |
66544 | napi_disable(&local->napi); | |
66545 | ieee80211_clear_tx_pending(local); | |
66546 | diff -urNp linux-3.0.3/net/mac80211/main.c linux-3.0.3/net/mac80211/main.c | |
66547 | --- linux-3.0.3/net/mac80211/main.c 2011-07-21 22:17:23.000000000 -0400 | |
66548 | +++ linux-3.0.3/net/mac80211/main.c 2011-08-23 21:47:56.000000000 -0400 | |
66549 | @@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211 | |
66550 | local->hw.conf.power_level = power; | |
66551 | } | |
66552 | ||
66553 | - if (changed && local->open_count) { | |
66554 | + if (changed && local_read(&local->open_count)) { | |
66555 | ret = drv_config(local, changed); | |
66556 | /* | |
66557 | * Goal: | |
66558 | diff -urNp linux-3.0.3/net/mac80211/mlme.c linux-3.0.3/net/mac80211/mlme.c | |
66559 | --- linux-3.0.3/net/mac80211/mlme.c 2011-08-23 21:44:40.000000000 -0400 | |
66560 | +++ linux-3.0.3/net/mac80211/mlme.c 2011-08-23 21:48:14.000000000 -0400 | |
66561 | @@ -1444,6 +1444,8 @@ static bool ieee80211_assoc_success(stru | |
66562 | bool have_higher_than_11mbit = false; | |
66563 | u16 ap_ht_cap_flags; | |
66564 | ||
66565 | + pax_track_stack(); | |
66566 | + | |
66567 | /* AssocResp and ReassocResp have identical structure */ | |
66568 | ||
66569 | aid = le16_to_cpu(mgmt->u.assoc_resp.aid); | |
66570 | diff -urNp linux-3.0.3/net/mac80211/pm.c linux-3.0.3/net/mac80211/pm.c | |
66571 | --- linux-3.0.3/net/mac80211/pm.c 2011-07-21 22:17:23.000000000 -0400 | |
66572 | +++ linux-3.0.3/net/mac80211/pm.c 2011-08-23 21:47:56.000000000 -0400 | |
66573 | @@ -47,7 +47,7 @@ int __ieee80211_suspend(struct ieee80211 | |
66574 | cancel_work_sync(&local->dynamic_ps_enable_work); | |
66575 | del_timer_sync(&local->dynamic_ps_timer); | |
66576 | ||
66577 | - local->wowlan = wowlan && local->open_count; | |
66578 | + local->wowlan = wowlan && local_read(&local->open_count); | |
66579 | if (local->wowlan) { | |
66580 | int err = drv_suspend(local, wowlan); | |
66581 | if (err) { | |
66582 | @@ -111,7 +111,7 @@ int __ieee80211_suspend(struct ieee80211 | |
66583 | } | |
66584 | ||
66585 | /* stop hardware - this must stop RX */ | |
66586 | - if (local->open_count) | |
66587 | + if (local_read(&local->open_count)) | |
66588 | ieee80211_stop_device(local); | |
66589 | ||
66590 | suspend: | |
66591 | diff -urNp linux-3.0.3/net/mac80211/rate.c linux-3.0.3/net/mac80211/rate.c | |
66592 | --- linux-3.0.3/net/mac80211/rate.c 2011-07-21 22:17:23.000000000 -0400 | |
66593 | +++ linux-3.0.3/net/mac80211/rate.c 2011-08-23 21:47:56.000000000 -0400 | |
66594 | @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct | |
66595 | ||
66596 | ASSERT_RTNL(); | |
66597 | ||
66598 | - if (local->open_count) | |
66599 | + if (local_read(&local->open_count)) | |
66600 | return -EBUSY; | |
66601 | ||
66602 | if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) { | |
66603 | diff -urNp linux-3.0.3/net/mac80211/rc80211_pid_debugfs.c linux-3.0.3/net/mac80211/rc80211_pid_debugfs.c | |
66604 | --- linux-3.0.3/net/mac80211/rc80211_pid_debugfs.c 2011-07-21 22:17:23.000000000 -0400 | |
66605 | +++ linux-3.0.3/net/mac80211/rc80211_pid_debugfs.c 2011-08-23 21:47:56.000000000 -0400 | |
66606 | @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r | |
66607 | ||
66608 | spin_unlock_irqrestore(&events->lock, status); | |
66609 | ||
66610 | - if (copy_to_user(buf, pb, p)) | |
66611 | + if (p > sizeof(pb) || copy_to_user(buf, pb, p)) | |
66612 | return -EFAULT; | |
66613 | ||
66614 | return p; | |
66615 | diff -urNp linux-3.0.3/net/mac80211/util.c linux-3.0.3/net/mac80211/util.c | |
66616 | --- linux-3.0.3/net/mac80211/util.c 2011-07-21 22:17:23.000000000 -0400 | |
66617 | +++ linux-3.0.3/net/mac80211/util.c 2011-08-23 21:47:56.000000000 -0400 | |
66618 | @@ -1147,7 +1147,7 @@ int ieee80211_reconfig(struct ieee80211_ | |
66619 | #endif | |
66620 | ||
66621 | /* restart hardware */ | |
66622 | - if (local->open_count) { | |
66623 | + if (local_read(&local->open_count)) { | |
66624 | /* | |
66625 | * Upon resume hardware can sometimes be goofy due to | |
66626 | * various platform / driver / bus issues, so restarting | |
66627 | diff -urNp linux-3.0.3/net/netfilter/ipvs/ip_vs_conn.c linux-3.0.3/net/netfilter/ipvs/ip_vs_conn.c | |
66628 | --- linux-3.0.3/net/netfilter/ipvs/ip_vs_conn.c 2011-07-21 22:17:23.000000000 -0400 | |
66629 | +++ linux-3.0.3/net/netfilter/ipvs/ip_vs_conn.c 2011-08-23 21:47:56.000000000 -0400 | |
66630 | @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s | |
66631 | /* Increase the refcnt counter of the dest */ | |
66632 | atomic_inc(&dest->refcnt); | |
66633 | ||
66634 | - conn_flags = atomic_read(&dest->conn_flags); | |
66635 | + conn_flags = atomic_read_unchecked(&dest->conn_flags); | |
66636 | if (cp->protocol != IPPROTO_UDP) | |
66637 | conn_flags &= ~IP_VS_CONN_F_ONE_PACKET; | |
66638 | /* Bind with the destination and its corresponding transmitter */ | |
66639 | @@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p | |
66640 | atomic_set(&cp->refcnt, 1); | |
66641 | ||
66642 | atomic_set(&cp->n_control, 0); | |
66643 | - atomic_set(&cp->in_pkts, 0); | |
66644 | + atomic_set_unchecked(&cp->in_pkts, 0); | |
66645 | ||
66646 | atomic_inc(&ipvs->conn_count); | |
66647 | if (flags & IP_VS_CONN_F_NO_CPORT) | |
66648 | @@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip | |
66649 | ||
66650 | /* Don't drop the entry if its number of incoming packets is not | |
66651 | located in [0, 8] */ | |
66652 | - i = atomic_read(&cp->in_pkts); | |
66653 | + i = atomic_read_unchecked(&cp->in_pkts); | |
66654 | if (i > 8 || i < 0) return 0; | |
66655 | ||
66656 | if (!todrop_rate[i]) return 0; | |
66657 | diff -urNp linux-3.0.3/net/netfilter/ipvs/ip_vs_core.c linux-3.0.3/net/netfilter/ipvs/ip_vs_core.c | |
66658 | --- linux-3.0.3/net/netfilter/ipvs/ip_vs_core.c 2011-07-21 22:17:23.000000000 -0400 | |
66659 | +++ linux-3.0.3/net/netfilter/ipvs/ip_vs_core.c 2011-08-23 21:47:56.000000000 -0400 | |
66660 | @@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv | |
66661 | ret = cp->packet_xmit(skb, cp, pd->pp); | |
66662 | /* do not touch skb anymore */ | |
66663 | ||
66664 | - atomic_inc(&cp->in_pkts); | |
66665 | + atomic_inc_unchecked(&cp->in_pkts); | |
66666 | ip_vs_conn_put(cp); | |
66667 | return ret; | |
66668 | } | |
66669 | @@ -1613,7 +1613,7 @@ ip_vs_in(unsigned int hooknum, struct sk | |
66670 | if (cp->flags & IP_VS_CONN_F_ONE_PACKET) | |
66671 | pkts = sysctl_sync_threshold(ipvs); | |
66672 | else | |
66673 | - pkts = atomic_add_return(1, &cp->in_pkts); | |
66674 | + pkts = atomic_add_return_unchecked(1, &cp->in_pkts); | |
66675 | ||
66676 | if ((ipvs->sync_state & IP_VS_STATE_MASTER) && | |
66677 | cp->protocol == IPPROTO_SCTP) { | |
66678 | diff -urNp linux-3.0.3/net/netfilter/ipvs/ip_vs_ctl.c linux-3.0.3/net/netfilter/ipvs/ip_vs_ctl.c | |
66679 | --- linux-3.0.3/net/netfilter/ipvs/ip_vs_ctl.c 2011-08-23 21:44:40.000000000 -0400 | |
66680 | +++ linux-3.0.3/net/netfilter/ipvs/ip_vs_ctl.c 2011-08-23 21:48:14.000000000 -0400 | |
66681 | @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service | |
66682 | ip_vs_rs_hash(ipvs, dest); | |
66683 | write_unlock_bh(&ipvs->rs_lock); | |
66684 | } | |
66685 | - atomic_set(&dest->conn_flags, conn_flags); | |
66686 | + atomic_set_unchecked(&dest->conn_flags, conn_flags); | |
66687 | ||
66688 | /* bind the service */ | |
66689 | if (!dest->svc) { | |
66690 | @@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se | |
66691 | " %-7s %-6d %-10d %-10d\n", | |
66692 | &dest->addr.in6, | |
66693 | ntohs(dest->port), | |
66694 | - ip_vs_fwd_name(atomic_read(&dest->conn_flags)), | |
66695 | + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)), | |
66696 | atomic_read(&dest->weight), | |
66697 | atomic_read(&dest->activeconns), | |
66698 | atomic_read(&dest->inactconns)); | |
66699 | @@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se | |
66700 | "%-7s %-6d %-10d %-10d\n", | |
66701 | ntohl(dest->addr.ip), | |
66702 | ntohs(dest->port), | |
66703 | - ip_vs_fwd_name(atomic_read(&dest->conn_flags)), | |
66704 | + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)), | |
66705 | atomic_read(&dest->weight), | |
66706 | atomic_read(&dest->activeconns), | |
66707 | atomic_read(&dest->inactconns)); | |
66708 | @@ -2284,6 +2284,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm | |
66709 | struct ip_vs_dest_user *udest_compat; | |
66710 | struct ip_vs_dest_user_kern udest; | |
66711 | ||
66712 | + pax_track_stack(); | |
66713 | + | |
66714 | if (!capable(CAP_NET_ADMIN)) | |
66715 | return -EPERM; | |
66716 | ||
66717 | @@ -2498,7 +2500,7 @@ __ip_vs_get_dest_entries(struct net *net | |
66718 | ||
66719 | entry.addr = dest->addr.ip; | |
66720 | entry.port = dest->port; | |
66721 | - entry.conn_flags = atomic_read(&dest->conn_flags); | |
66722 | + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags); | |
66723 | entry.weight = atomic_read(&dest->weight); | |
66724 | entry.u_threshold = dest->u_threshold; | |
66725 | entry.l_threshold = dest->l_threshold; | |
66726 | @@ -3026,7 +3028,7 @@ static int ip_vs_genl_fill_dest(struct s | |
66727 | NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port); | |
66728 | ||
66729 | NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD, | |
66730 | - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK); | |
66731 | + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK); | |
66732 | NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight)); | |
66733 | NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold); | |
66734 | NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold); | |
66735 | diff -urNp linux-3.0.3/net/netfilter/ipvs/ip_vs_sync.c linux-3.0.3/net/netfilter/ipvs/ip_vs_sync.c | |
66736 | --- linux-3.0.3/net/netfilter/ipvs/ip_vs_sync.c 2011-07-21 22:17:23.000000000 -0400 | |
66737 | +++ linux-3.0.3/net/netfilter/ipvs/ip_vs_sync.c 2011-08-23 21:47:56.000000000 -0400 | |
66738 | @@ -648,7 +648,7 @@ control: | |
66739 | * i.e only increment in_pkts for Templates. | |
66740 | */ | |
66741 | if (cp->flags & IP_VS_CONN_F_TEMPLATE) { | |
66742 | - int pkts = atomic_add_return(1, &cp->in_pkts); | |
66743 | + int pkts = atomic_add_return_unchecked(1, &cp->in_pkts); | |
66744 | ||
66745 | if (pkts % sysctl_sync_period(ipvs) != 1) | |
66746 | return; | |
66747 | @@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net * | |
66748 | ||
66749 | if (opt) | |
66750 | memcpy(&cp->in_seq, opt, sizeof(*opt)); | |
66751 | - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs)); | |
66752 | + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs)); | |
66753 | cp->state = state; | |
66754 | cp->old_state = cp->state; | |
66755 | /* | |
66756 | diff -urNp linux-3.0.3/net/netfilter/ipvs/ip_vs_xmit.c linux-3.0.3/net/netfilter/ipvs/ip_vs_xmit.c | |
66757 | --- linux-3.0.3/net/netfilter/ipvs/ip_vs_xmit.c 2011-07-21 22:17:23.000000000 -0400 | |
66758 | +++ linux-3.0.3/net/netfilter/ipvs/ip_vs_xmit.c 2011-08-23 21:47:56.000000000 -0400 | |
66759 | @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str | |
66760 | else | |
66761 | rc = NF_ACCEPT; | |
66762 | /* do not touch skb anymore */ | |
66763 | - atomic_inc(&cp->in_pkts); | |
66764 | + atomic_inc_unchecked(&cp->in_pkts); | |
66765 | goto out; | |
66766 | } | |
66767 | ||
66768 | @@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, | |
66769 | else | |
66770 | rc = NF_ACCEPT; | |
66771 | /* do not touch skb anymore */ | |
66772 | - atomic_inc(&cp->in_pkts); | |
66773 | + atomic_inc_unchecked(&cp->in_pkts); | |
66774 | goto out; | |
66775 | } | |
66776 | ||
66777 | diff -urNp linux-3.0.3/net/netfilter/Kconfig linux-3.0.3/net/netfilter/Kconfig | |
66778 | --- linux-3.0.3/net/netfilter/Kconfig 2011-07-21 22:17:23.000000000 -0400 | |
66779 | +++ linux-3.0.3/net/netfilter/Kconfig 2011-08-23 21:48:14.000000000 -0400 | |
66780 | @@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP | |
66781 | ||
66782 | To compile it as a module, choose M here. If unsure, say N. | |
66783 | ||
66784 | +config NETFILTER_XT_MATCH_GRADM | |
66785 | + tristate '"gradm" match support' | |
66786 | + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED | |
66787 | + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC | |
66788 | + ---help--- | |
66789 | + The gradm match allows to match on grsecurity RBAC being enabled. | |
66790 | + It is useful when iptables rules are applied early on bootup to | |
66791 | + prevent connections to the machine (except from a trusted host) | |
66792 | + while the RBAC system is disabled. | |
66793 | + | |
66794 | config NETFILTER_XT_MATCH_HASHLIMIT | |
66795 | tristate '"hashlimit" match support' | |
66796 | depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n) | |
66797 | diff -urNp linux-3.0.3/net/netfilter/Makefile linux-3.0.3/net/netfilter/Makefile | |
66798 | --- linux-3.0.3/net/netfilter/Makefile 2011-07-21 22:17:23.000000000 -0400 | |
66799 | +++ linux-3.0.3/net/netfilter/Makefile 2011-08-23 21:48:14.000000000 -0400 | |
66800 | @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += | |
66801 | obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o | |
66802 | obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o | |
66803 | obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o | |
66804 | +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o | |
66805 | obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o | |
66806 | obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o | |
66807 | obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o | |
66808 | diff -urNp linux-3.0.3/net/netfilter/nfnetlink_log.c linux-3.0.3/net/netfilter/nfnetlink_log.c | |
66809 | --- linux-3.0.3/net/netfilter/nfnetlink_log.c 2011-07-21 22:17:23.000000000 -0400 | |
66810 | +++ linux-3.0.3/net/netfilter/nfnetlink_log.c 2011-08-23 21:47:56.000000000 -0400 | |
66811 | @@ -70,7 +70,7 @@ struct nfulnl_instance { | |
66812 | }; | |
66813 | ||
66814 | static DEFINE_SPINLOCK(instances_lock); | |
66815 | -static atomic_t global_seq; | |
66816 | +static atomic_unchecked_t global_seq; | |
66817 | ||
66818 | #define INSTANCE_BUCKETS 16 | |
66819 | static struct hlist_head instance_table[INSTANCE_BUCKETS]; | |
66820 | @@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_ins | |
66821 | /* global sequence number */ | |
66822 | if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) | |
66823 | NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL, | |
66824 | - htonl(atomic_inc_return(&global_seq))); | |
66825 | + htonl(atomic_inc_return_unchecked(&global_seq))); | |
66826 | ||
66827 | if (data_len) { | |
66828 | struct nlattr *nla; | |
66829 | diff -urNp linux-3.0.3/net/netfilter/nfnetlink_queue.c linux-3.0.3/net/netfilter/nfnetlink_queue.c | |
66830 | --- linux-3.0.3/net/netfilter/nfnetlink_queue.c 2011-07-21 22:17:23.000000000 -0400 | |
66831 | +++ linux-3.0.3/net/netfilter/nfnetlink_queue.c 2011-08-23 21:47:56.000000000 -0400 | |
66832 | @@ -58,7 +58,7 @@ struct nfqnl_instance { | |
66833 | */ | |
66834 | spinlock_t lock; | |
66835 | unsigned int queue_total; | |
66836 | - atomic_t id_sequence; /* 'sequence' of pkt ids */ | |
66837 | + atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */ | |
66838 | struct list_head queue_list; /* packets in queue */ | |
66839 | }; | |
66840 | ||
66841 | @@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_ | |
66842 | nfmsg->version = NFNETLINK_V0; | |
66843 | nfmsg->res_id = htons(queue->queue_num); | |
66844 | ||
66845 | - entry->id = atomic_inc_return(&queue->id_sequence); | |
66846 | + entry->id = atomic_inc_return_unchecked(&queue->id_sequence); | |
66847 | pmsg.packet_id = htonl(entry->id); | |
66848 | pmsg.hw_protocol = entskb->protocol; | |
66849 | pmsg.hook = entry->hook; | |
66850 | @@ -870,7 +870,7 @@ static int seq_show(struct seq_file *s, | |
66851 | inst->peer_pid, inst->queue_total, | |
66852 | inst->copy_mode, inst->copy_range, | |
66853 | inst->queue_dropped, inst->queue_user_dropped, | |
66854 | - atomic_read(&inst->id_sequence), 1); | |
66855 | + atomic_read_unchecked(&inst->id_sequence), 1); | |
66856 | } | |
66857 | ||
66858 | static const struct seq_operations nfqnl_seq_ops = { | |
66859 | diff -urNp linux-3.0.3/net/netfilter/xt_gradm.c linux-3.0.3/net/netfilter/xt_gradm.c | |
66860 | --- linux-3.0.3/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500 | |
66861 | +++ linux-3.0.3/net/netfilter/xt_gradm.c 2011-08-23 21:48:14.000000000 -0400 | |
66862 | @@ -0,0 +1,51 @@ | |
66863 | +/* | |
66864 | + * gradm match for netfilter | |
66865 |