]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-3.1.10-201201192026.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-3.1.10-201201192026.patch
CommitLineData
2be49e85
PK		 1diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2index dfa6fc6..0095943 100644
3--- a/Documentation/dontdiff
4+++ b/Documentation/dontdiff
5@@ -5,6 +5,7 @@
6 *.cis
7 *.cpio
8 *.csp
9+*.dbg
10 *.dsp
11 *.dvi
12 *.elf
13@@ -14,6 +15,7 @@
14 *.gcov
15 *.gen.S
16 *.gif
17+*.gmo
18 *.grep
19 *.grp
20 *.gz
21@@ -48,9 +50,11 @@
22 *.tab.h
23 *.tex
24 *.ver
25+*.vim
26 *.xml
27 *.xz
28 *_MODULES
29+*_reg_safe.h
30 *_vga16.c
31 *~
32 \#*#
33@@ -70,6 +74,7 @@ Kerntypes
34 Module.markers
35 Module.symvers
36 PENDING
37+PERF*
38 SCCS
39 System.map*
40 TAGS
41@@ -93,19 +98,24 @@ bounds.h
42 bsetup
43 btfixupprep
44 build
45+builtin-policy.h
46 bvmlinux
47 bzImage*
48 capability_names.h
49 capflags.c
50 classlist.h*
51+clut_vga16.c
52+common-cmds.h
53 comp*.log
54 compile.h*
55 conf
56 config
57 config-*
58 config_data.h*
59+config.c
60 config.mak
61 config.mak.autogen
62+config.tmp
63 conmakehash
64 consolemap_deftbl.c*
65 cpustr.h
66@@ -119,6 +129,7 @@ dslm
67 elf2ecoff
68 elfconfig.h*
69 evergreen_reg_safe.h
70+exception_policy.conf
71 fixdep
72 flask.h
73 fore200e_mkfirm
74@@ -126,12 +137,15 @@ fore200e_pca_fw.c*
75 gconf
76 gconf.glade.h
77 gen-devlist
78+gen-kdb_cmds.c
79 gen_crc32table
80 gen_init_cpio
81 generated
82 genheaders
83 genksyms
84 *_gray256.c
85+hash
86+hid-example
87 hpet_example
88 hugepage-mmap
89 hugepage-shm
90@@ -146,7 +160,7 @@ int32.c
91 int4.c
92 int8.c
93 kallsyms
94-kconfig
95+kern_constants.h
96 keywords.c
97 ksym.c*
98 ksym.h*
99@@ -154,7 +168,6 @@ kxgettext
100 lkc_defs.h
101 lex.c
102 lex.*.c
103-linux
104 logo_*.c
105 logo_*_clut224.c
106 logo_*_mono.c
107@@ -166,14 +179,15 @@ machtypes.h
108 map
109 map_hugetlb
110 maui_boot.h
111-media
112 mconf
113+mdp
114 miboot*
115 mk_elfconfig
116 mkboot
117 mkbugboot
118 mkcpustr
119 mkdep
120+mkpiggy
121 mkprep
122 mkregtable
123 mktables
124@@ -209,6 +223,7 @@ r300_reg_safe.h
125 r420_reg_safe.h
126 r600_reg_safe.h
127 recordmcount
128+regdb.c
129 relocs
130 rlim_names.h
131 rn50_reg_safe.h
132@@ -219,6 +234,7 @@ setup
133 setup.bin
134 setup.elf
135 sImage
136+slabinfo
137 sm_tbl*
138 split-include
139 syscalltab.h
140@@ -229,6 +245,7 @@ tftpboot.img
141 timeconst.h
142 times.h*
143 trix_boot.h
144+user_constants.h
145 utsrelease.h*
146 vdso-syms.lds
147 vdso.lds
148@@ -246,7 +263,9 @@ vmlinux
149 vmlinux-*
150 vmlinux.aout
151 vmlinux.bin.all
152+vmlinux.bin.bz2
153 vmlinux.lds
154+vmlinux.relocs
155 vmlinuz
156 voffset.h
157 vsyscall.lds
158@@ -254,9 +273,11 @@ vsyscall_32.lds
159 wanxlfw.inc
160 uImage
161 unifdef
162+utsrelease.h
163 wakeup.bin
164 wakeup.elf
165 wakeup.lds
166 zImage*
167 zconf.hash.c
168+zconf.lex.c
169 zoffset.h
170diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
171index d6e6724..a024ce8 100644
172--- a/Documentation/kernel-parameters.txt
173+++ b/Documentation/kernel-parameters.txt
174@@ -1898,6 +1898,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
175 the specified number of seconds. This is to be used if
176 your oopses keep scrolling off the screen.
177
178+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
179+ virtualization environments that don't cope well with the
180+ expand down segment used by UDEREF on X86-32 or the frequent
181+ page table updates on X86-64.
182+
183+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
184+
185 pcbit= [HW,ISDN]
186
187 pcd. [PARIDE]
188diff --git a/Makefile b/Makefile
189index 7c8f52a..371cd76 100644
190--- a/Makefile
191+++ b/Makefile
192@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
193
194 HOSTCC = gcc
195 HOSTCXX = g++
196-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
197-HOSTCXXFLAGS = -O2
198+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
199+HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
200+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
201
202 # Decide whether to build built-in, modular, or both.
203 # Normally, just do built-in.
204@@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
205 # Rules shared between *config targets and build targets
206
207 # Basic helpers built in scripts/
208-PHONY += scripts_basic
209-scripts_basic:
210+PHONY += scripts_basic gcc-plugins
211+scripts_basic: gcc-plugins
212 $(Q)$(MAKE) $(build)=scripts/basic
213 $(Q)rm -f .tmp_quiet_recordmcount
214
215@@ -564,6 +565,46 @@ else
216 KBUILD_CFLAGS += -O2
217 endif
218
219+ifndef DISABLE_PAX_PLUGINS
220+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
221+ifndef DISABLE_PAX_CONSTIFY_PLUGIN
222+CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
223+endif
224+ifdef CONFIG_PAX_MEMORY_STACKLEAK
225+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
226+STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
227+endif
228+ifdef CONFIG_KALLOCSTAT_PLUGIN
229+KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
230+endif
231+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
232+KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
233+KERNEXEC_PLUGIN += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD)
234+endif
235+ifdef CONFIG_CHECKER_PLUGIN
236+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
237+CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
238+endif
239+endif
240+GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
241+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
242+ifeq ($(KBUILD_EXTMOD),)
243+gcc-plugins:
244+ $(Q)$(MAKE) $(build)=tools/gcc
245+else
246+gcc-plugins: ;
247+endif
248+else
249+gcc-plugins:
250+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
251+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
252+else
253+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
254+endif
255+ $(Q)echo "PAX_MEMORY_STACKLEAK and other features will be less secure"
256+endif
257+endif
258+
259 include $(srctree)/arch/$(SRCARCH)/Makefile
260
261 ifneq ($(CONFIG_FRAME_WARN),0)
262@@ -708,7 +749,7 @@ export mod_strip_cmd
263
264
265 ifeq ($(KBUILD_EXTMOD),)
266-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
267+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
268
269 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
270 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
271@@ -932,6 +973,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
272
273 # The actual objects are generated when descending,
274 # make sure no implicit rule kicks in
275+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
276 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
277
278 # Handle descending into subdirectories listed in $(vmlinux-dirs)
279@@ -941,7 +983,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
280 # Error messages still appears in the original language
281
282 PHONY += $(vmlinux-dirs)
283-$(vmlinux-dirs): prepare scripts
284+$(vmlinux-dirs): gcc-plugins prepare scripts
285 $(Q)$(MAKE) $(build)=$@
286
287 # Store (new) KERNELRELASE string in include/config/kernel.release
288@@ -986,6 +1028,7 @@ prepare0: archprepare FORCE
289 $(Q)$(MAKE) $(build)=. missing-syscalls
290
291 # All the preparing..
292+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
293 prepare: prepare0
294
295 # Generate some files
296@@ -1087,6 +1130,7 @@ all: modules
297 # using awk while concatenating to the final file.
298
299 PHONY += modules
300+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
301 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
302 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
303 @$(kecho) ' Building modules, stage 2.';
304@@ -1102,7 +1146,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
305
306 # Target to prepare building external modules
307 PHONY += modules_prepare
308-modules_prepare: prepare scripts
309+modules_prepare: gcc-plugins prepare scripts
310
311 # Target to install modules
312 PHONY += modules_install
313@@ -1198,7 +1242,7 @@ distclean: mrproper
314 @find $(srctree) $(RCS_FIND_IGNORE) \
315 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
316 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
317- -o -name '.*.rej' -o -size 0 \
318+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
319 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
320 -type f -print | xargs rm -f
321
322@@ -1360,6 +1404,7 @@ PHONY += $(module-dirs) modules
323 $(module-dirs): crmodverdir $(objtree)/Module.symvers
324 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
325
326+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
327 modules: $(module-dirs)
328 @$(kecho) ' Building modules, stage 2.';
329 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
330@@ -1486,17 +1531,19 @@ else
331 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
332 endif
333
334-%.s: %.c prepare scripts FORCE
335+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
336+%.s: %.c gcc-plugins prepare scripts FORCE
337 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
338 %.i: %.c prepare scripts FORCE
339 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
340-%.o: %.c prepare scripts FORCE
341+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
342+%.o: %.c gcc-plugins prepare scripts FORCE
343 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
344 %.lst: %.c prepare scripts FORCE
345 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
346-%.s: %.S prepare scripts FORCE
347+%.s: %.S gcc-plugins prepare scripts FORCE
348 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
349-%.o: %.S prepare scripts FORCE
350+%.o: %.S gcc-plugins prepare scripts FORCE
351 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
352 %.symtypes: %.c prepare scripts FORCE
353 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
354@@ -1506,11 +1553,13 @@ endif
355 $(cmd_crmodverdir)
356 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
357 $(build)=$(build-dir)
358-%/: prepare scripts FORCE
359+%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
360+%/: gcc-plugins prepare scripts FORCE
361 $(cmd_crmodverdir)
362 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
363 $(build)=$(build-dir)
364-%.ko: prepare scripts FORCE
365+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
366+%.ko: gcc-plugins prepare scripts FORCE
367 $(cmd_crmodverdir)
368 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
369 $(build)=$(build-dir) $(@:.ko=.o)
370diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
371index da5449e..7418343 100644
372--- a/arch/alpha/include/asm/elf.h
373+++ b/arch/alpha/include/asm/elf.h
374@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
375
376 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
377
378+#ifdef CONFIG_PAX_ASLR
379+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
380+
381+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
382+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
383+#endif
384+
385 /* $0 is set by ld.so to a pointer to a function which might be
386 registered using atexit. This provides a mean for the dynamic
387 linker to call DT_FINI functions for shared libraries that have
388diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
389index de98a73..bd4f1f8 100644
390--- a/arch/alpha/include/asm/pgtable.h
391+++ b/arch/alpha/include/asm/pgtable.h
392@@ -101,6 +101,17 @@ struct vm_area_struct;
393 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
394 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
395 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
396+
397+#ifdef CONFIG_PAX_PAGEEXEC
398+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
399+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
400+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
401+#else
402+# define PAGE_SHARED_NOEXEC PAGE_SHARED
403+# define PAGE_COPY_NOEXEC PAGE_COPY
404+# define PAGE_READONLY_NOEXEC PAGE_READONLY
405+#endif
406+
407 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
408
409 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
410diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
411index 2fd00b7..cfd5069 100644
412--- a/arch/alpha/kernel/module.c
413+++ b/arch/alpha/kernel/module.c
414@@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
415
416 /* The small sections were sorted to the end of the segment.
417 The following should definitely cover them. */
418- gp = (u64)me->module_core + me->core_size - 0x8000;
419+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
420 got = sechdrs[me->arch.gotsecindex].sh_addr;
421
422 for (i = 0; i < n; i++) {
423diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
424index 01e8715..be0e80f 100644
425--- a/arch/alpha/kernel/osf_sys.c
426+++ b/arch/alpha/kernel/osf_sys.c
427@@ -1147,7 +1147,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
428 /* At this point: (!vma || addr < vma->vm_end). */
429 if (limit - len < addr)
430 return -ENOMEM;
431- if (!vma || addr + len <= vma->vm_start)
432+ if (check_heap_stack_gap(vma, addr, len))
433 return addr;
434 addr = vma->vm_end;
435 vma = vma->vm_next;
436@@ -1183,6 +1183,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
437 merely specific addresses, but regions of memory -- perhaps
438 this feature should be incorporated into all ports? */
439
440+#ifdef CONFIG_PAX_RANDMMAP
441+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
442+#endif
443+
444 if (addr) {
445 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
446 if (addr != (unsigned long) -ENOMEM)
447@@ -1190,8 +1194,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
448 }
449
450 /* Next, try allocating at TASK_UNMAPPED_BASE. */
451- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
452- len, limit);
453+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
454+
455 if (addr != (unsigned long) -ENOMEM)
456 return addr;
457
458diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
459index fadd5f8..904e73a 100644
460--- a/arch/alpha/mm/fault.c
461+++ b/arch/alpha/mm/fault.c
462@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
463 __reload_thread(pcb);
464 }
465
466+#ifdef CONFIG_PAX_PAGEEXEC
467+/*
468+ * PaX: decide what to do with offenders (regs->pc = fault address)
469+ *
470+ * returns 1 when task should be killed
471+ * 2 when patched PLT trampoline was detected
472+ * 3 when unpatched PLT trampoline was detected
473+ */
474+static int pax_handle_fetch_fault(struct pt_regs *regs)
475+{
476+
477+#ifdef CONFIG_PAX_EMUPLT
478+ int err;
479+
480+ do { /* PaX: patched PLT emulation #1 */
481+ unsigned int ldah, ldq, jmp;
482+
483+ err = get_user(ldah, (unsigned int *)regs->pc);
484+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
485+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
486+
487+ if (err)
488+ break;
489+
490+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
491+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
492+ jmp == 0x6BFB0000U)
493+ {
494+ unsigned long r27, addr;
495+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
496+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
497+
498+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
499+ err = get_user(r27, (unsigned long *)addr);
500+ if (err)
501+ break;
502+
503+ regs->r27 = r27;
504+ regs->pc = r27;
505+ return 2;
506+ }
507+ } while (0);
508+
509+ do { /* PaX: patched PLT emulation #2 */
510+ unsigned int ldah, lda, br;
511+
512+ err = get_user(ldah, (unsigned int *)regs->pc);
513+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
514+ err |= get_user(br, (unsigned int *)(regs->pc+8));
515+
516+ if (err)
517+ break;
518+
519+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
520+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
521+ (br & 0xFFE00000U) == 0xC3E00000U)
522+ {
523+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
524+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
525+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
526+
527+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
528+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
529+ return 2;
530+ }
531+ } while (0);
532+
533+ do { /* PaX: unpatched PLT emulation */
534+ unsigned int br;
535+
536+ err = get_user(br, (unsigned int *)regs->pc);
537+
538+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
539+ unsigned int br2, ldq, nop, jmp;
540+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
541+
542+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
543+ err = get_user(br2, (unsigned int *)addr);
544+ err |= get_user(ldq, (unsigned int *)(addr+4));
545+ err |= get_user(nop, (unsigned int *)(addr+8));
546+ err |= get_user(jmp, (unsigned int *)(addr+12));
547+ err |= get_user(resolver, (unsigned long *)(addr+16));
548+
549+ if (err)
550+ break;
551+
552+ if (br2 == 0xC3600000U &&
553+ ldq == 0xA77B000CU &&
554+ nop == 0x47FF041FU &&
555+ jmp == 0x6B7B0000U)
556+ {
557+ regs->r28 = regs->pc+4;
558+ regs->r27 = addr+16;
559+ regs->pc = resolver;
560+ return 3;
561+ }
562+ }
563+ } while (0);
564+#endif
565+
566+ return 1;
567+}
568+
569+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
570+{
571+ unsigned long i;
572+
573+ printk(KERN_ERR "PAX: bytes at PC: ");
574+ for (i = 0; i < 5; i++) {
575+ unsigned int c;
576+ if (get_user(c, (unsigned int *)pc+i))
577+ printk(KERN_CONT "???????? ");
578+ else
579+ printk(KERN_CONT "%08x ", c);
580+ }
581+ printk("\n");
582+}
583+#endif
584
585 /*
586 * This routine handles page faults. It determines the address,
587@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
588 good_area:
589 si_code = SEGV_ACCERR;
590 if (cause < 0) {
591- if (!(vma->vm_flags & VM_EXEC))
592+ if (!(vma->vm_flags & VM_EXEC)) {
593+
594+#ifdef CONFIG_PAX_PAGEEXEC
595+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
596+ goto bad_area;
597+
598+ up_read(&mm->mmap_sem);
599+ switch (pax_handle_fetch_fault(regs)) {
600+
601+#ifdef CONFIG_PAX_EMUPLT
602+ case 2:
603+ case 3:
604+ return;
605+#endif
606+
607+ }
608+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
609+ do_group_exit(SIGKILL);
610+#else
611 goto bad_area;
612+#endif
613+
614+ }
615 } else if (!cause) {
616 /* Allow reads even for write-only mappings */
617 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
618diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
619index 86976d0..8a57797 100644
620--- a/arch/arm/include/asm/atomic.h
621+++ b/arch/arm/include/asm/atomic.h
622@@ -239,6 +239,14 @@ typedef struct {
623 u64 __aligned(8) counter;
624 } atomic64_t;
625
626+#ifdef CONFIG_PAX_REFCOUNT
627+typedef struct {
628+ u64 __aligned(8) counter;
629+} atomic64_unchecked_t;
630+#else
631+typedef atomic64_t atomic64_unchecked_t;
632+#endif
633+
634 #define ATOMIC64_INIT(i) { (i) }
635
636 static inline u64 atomic64_read(atomic64_t *v)
637diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
638index 0e9ce8d..6ef1e03 100644
639--- a/arch/arm/include/asm/elf.h
640+++ b/arch/arm/include/asm/elf.h
641@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
642 the loader. We need to make sure that it is out of the way of the program
643 that it will "exec", and that there is sufficient room for the brk. */
644
645-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
646+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
647+
648+#ifdef CONFIG_PAX_ASLR
649+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
650+
651+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
652+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
653+#endif
654
655 /* When the program starts, a1 contains a pointer to a function to be
656 registered with atexit, as per the SVR4 ABI. A value of 0 means we
657@@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
658 extern void elf_set_personality(const struct elf32_hdr *);
659 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
660
661-struct mm_struct;
662-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
663-#define arch_randomize_brk arch_randomize_brk
664-
665 extern int vectors_user_mapping(void);
666 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
667 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
668diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
669index e51b1e8..32a3113 100644
670--- a/arch/arm/include/asm/kmap_types.h
671+++ b/arch/arm/include/asm/kmap_types.h
672@@ -21,6 +21,7 @@ enum km_type {
673 KM_L1_CACHE,
674 KM_L2_CACHE,
675 KM_KDB,
676+ KM_CLEARPAGE,
677 KM_TYPE_NR
678 };
679
680diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
681index b293616..96310e5 100644
682--- a/arch/arm/include/asm/uaccess.h
683+++ b/arch/arm/include/asm/uaccess.h
684@@ -22,6 +22,8 @@
685 #define VERIFY_READ 0
686 #define VERIFY_WRITE 1
687
688+extern void check_object_size(const void *ptr, unsigned long n, bool to);
689+
690 /*
691 * The exception table consists of pairs of addresses: the first is the
692 * address of an instruction that is allowed to fault, and the second is
693@@ -387,8 +389,23 @@ do { \
694
695
696 #ifdef CONFIG_MMU
697-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
698-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
699+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
700+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
701+
702+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
703+{
704+ if (!__builtin_constant_p(n))
705+ check_object_size(to, n, false);
706+ return ___copy_from_user(to, from, n);
707+}
708+
709+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
710+{
711+ if (!__builtin_constant_p(n))
712+ check_object_size(from, n, true);
713+ return ___copy_to_user(to, from, n);
714+}
715+
716 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
717 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
718 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
719@@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
720
721 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
722 {
723+ if ((long)n < 0)
724+ return n;
725+
726 if (access_ok(VERIFY_READ, from, n))
727 n = __copy_from_user(to, from, n);
728 else /* security hole - plug it */
729@@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
730
731 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
732 {
733+ if ((long)n < 0)
734+ return n;
735+
736 if (access_ok(VERIFY_WRITE, to, n))
737 n = __copy_to_user(to, from, n);
738 return n;
739diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
740index aeef960..2966009 100644
741--- a/arch/arm/kernel/armksyms.c
742+++ b/arch/arm/kernel/armksyms.c
743@@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
744 #ifdef CONFIG_MMU
745 EXPORT_SYMBOL(copy_page);
746
747-EXPORT_SYMBOL(__copy_from_user);
748-EXPORT_SYMBOL(__copy_to_user);
749+EXPORT_SYMBOL(___copy_from_user);
750+EXPORT_SYMBOL(___copy_to_user);
751 EXPORT_SYMBOL(__clear_user);
752
753 EXPORT_SYMBOL(__get_user_1);
754diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
755index c9d11ea..5078081 100644
756--- a/arch/arm/kernel/process.c
757+++ b/arch/arm/kernel/process.c
758@@ -28,7 +28,6 @@
759 #include <linux/tick.h>
760 #include <linux/utsname.h>
761 #include <linux/uaccess.h>
762-#include <linux/random.h>
763 #include <linux/hw_breakpoint.h>
764 #include <linux/cpuidle.h>
765
766@@ -484,12 +483,6 @@ unsigned long get_wchan(struct task_struct *p)
767 return 0;
768 }
769
770-unsigned long arch_randomize_brk(struct mm_struct *mm)
771-{
772- unsigned long range_end = mm->brk + 0x02000000;
773- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
774-}
775-
776 #ifdef CONFIG_MMU
777 /*
778 * The vectors page is always readable from user space for the
779diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
780index bc9f9da..c75d826 100644
781--- a/arch/arm/kernel/traps.c
782+++ b/arch/arm/kernel/traps.c
783@@ -257,6 +257,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
784
785 static DEFINE_SPINLOCK(die_lock);
786
787+extern void gr_handle_kernel_exploit(void);
788+
789 /*
790 * This function is protected against re-entrancy.
791 */
792@@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs *regs, int err)
793 panic("Fatal exception in interrupt");
794 if (panic_on_oops)
795 panic("Fatal exception");
796+
797+ gr_handle_kernel_exploit();
798+
799 if (ret != NOTIFY_STOP)
800 do_exit(SIGSEGV);
801 }
802diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
803index 66a477a..bee61d3 100644
804--- a/arch/arm/lib/copy_from_user.S
805+++ b/arch/arm/lib/copy_from_user.S
806@@ -16,7 +16,7 @@
807 /*
808 * Prototype:
809 *
810- * size_t __copy_from_user(void *to, const void *from, size_t n)
811+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
812 *
813 * Purpose:
814 *
815@@ -84,11 +84,11 @@
816
817 .text
818
819-ENTRY(__copy_from_user)
820+ENTRY(___copy_from_user)
821
822 #include "copy_template.S"
823
824-ENDPROC(__copy_from_user)
825+ENDPROC(___copy_from_user)
826
827 .pushsection .fixup,"ax"
828 .align 0
829diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
830index d066df6..df28194 100644
831--- a/arch/arm/lib/copy_to_user.S
832+++ b/arch/arm/lib/copy_to_user.S
833@@ -16,7 +16,7 @@
834 /*
835 * Prototype:
836 *
837- * size_t __copy_to_user(void *to, const void *from, size_t n)
838+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
839 *
840 * Purpose:
841 *
842@@ -88,11 +88,11 @@
843 .text
844
845 ENTRY(__copy_to_user_std)
846-WEAK(__copy_to_user)
847+WEAK(___copy_to_user)
848
849 #include "copy_template.S"
850
851-ENDPROC(__copy_to_user)
852+ENDPROC(___copy_to_user)
853 ENDPROC(__copy_to_user_std)
854
855 .pushsection .fixup,"ax"
856diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
857index d0ece2a..5ae2f39 100644
858--- a/arch/arm/lib/uaccess.S
859+++ b/arch/arm/lib/uaccess.S
860@@ -20,7 +20,7 @@
861
862 #define PAGE_SHIFT 12
863
864-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
865+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
866 * Purpose : copy a block to user memory from kernel memory
867 * Params : to - user memory
868 * : from - kernel memory
869@@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May fault
870 sub r2, r2, ip
871 b .Lc2u_dest_aligned
872
873-ENTRY(__copy_to_user)
874+ENTRY(___copy_to_user)
875 stmfd sp!, {r2, r4 - r7, lr}
876 cmp r2, #4
877 blt .Lc2u_not_enough
878@@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May fault
879 ldrgtb r3, [r1], #0
880 USER( T(strgtb) r3, [r0], #1) @ May fault
881 b .Lc2u_finished
882-ENDPROC(__copy_to_user)
883+ENDPROC(___copy_to_user)
884
885 .pushsection .fixup,"ax"
886 .align 0
887 9001: ldmfd sp!, {r0, r4 - r7, pc}
888 .popsection
889
890-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
891+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
892 * Purpose : copy a block from user memory to kernel memory
893 * Params : to - kernel memory
894 * : from - user memory
895@@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May fault
896 sub r2, r2, ip
897 b .Lcfu_dest_aligned
898
899-ENTRY(__copy_from_user)
900+ENTRY(___copy_from_user)
901 stmfd sp!, {r0, r2, r4 - r7, lr}
902 cmp r2, #4
903 blt .Lcfu_not_enough
904@@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May fault
905 USER( T(ldrgtb) r3, [r1], #1) @ May fault
906 strgtb r3, [r0], #1
907 b .Lcfu_finished
908-ENDPROC(__copy_from_user)
909+ENDPROC(___copy_from_user)
910
911 .pushsection .fixup,"ax"
912 .align 0
913diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
914index 8b9b136..70d5100 100644
915--- a/arch/arm/lib/uaccess_with_memcpy.c
916+++ b/arch/arm/lib/uaccess_with_memcpy.c
917@@ -103,7 +103,7 @@ out:
918 }
919
920 unsigned long
921-__copy_to_user(void __user *to, const void *from, unsigned long n)
922+___copy_to_user(void __user *to, const void *from, unsigned long n)
923 {
924 /*
925 * This test is stubbed out of the main function above to keep
926diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
927index 2b2d51c..0127490 100644
928--- a/arch/arm/mach-ux500/mbox-db5500.c
929+++ b/arch/arm/mach-ux500/mbox-db5500.c
930@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct device *dev,
931 return sprintf(buf, "0x%X\n", mbox_value);
932 }
933
934-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
935+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
936
937 static int mbox_show(struct seq_file *s, void *data)
938 {
939diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
940index 3b5ea68..42fc9af 100644
941--- a/arch/arm/mm/fault.c
942+++ b/arch/arm/mm/fault.c
943@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
944 }
945 #endif
946
947+#ifdef CONFIG_PAX_PAGEEXEC
948+ if (fsr & FSR_LNX_PF) {
949+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
950+ do_group_exit(SIGKILL);
951+ }
952+#endif
953+
954 tsk->thread.address = addr;
955 tsk->thread.error_code = fsr;
956 tsk->thread.trap_no = 14;
957@@ -383,6 +390,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
958 }
959 #endif /* CONFIG_MMU */
960
961+#ifdef CONFIG_PAX_PAGEEXEC
962+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
963+{
964+ long i;
965+
966+ printk(KERN_ERR "PAX: bytes at PC: ");
967+ for (i = 0; i < 20; i++) {
968+ unsigned char c;
969+ if (get_user(c, (__force unsigned char __user *)pc+i))
970+ printk(KERN_CONT "?? ");
971+ else
972+ printk(KERN_CONT "%02x ", c);
973+ }
974+ printk("\n");
975+
976+ printk(KERN_ERR "PAX: bytes at SP-4: ");
977+ for (i = -1; i < 20; i++) {
978+ unsigned long c;
979+ if (get_user(c, (__force unsigned long __user *)sp+i))
980+ printk(KERN_CONT "???????? ");
981+ else
982+ printk(KERN_CONT "%08lx ", c);
983+ }
984+ printk("\n");
985+}
986+#endif
987+
988 /*
989 * First Level Translation Fault Handler
990 *
991diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
992index 74be05f..f605b8c 100644
993--- a/arch/arm/mm/mmap.c
994+++ b/arch/arm/mm/mmap.c
995@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
996 if (len > TASK_SIZE)
997 return -ENOMEM;
998
999+#ifdef CONFIG_PAX_RANDMMAP
1000+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1001+#endif
1002+
1003 if (addr) {
1004 if (do_align)
1005 addr = COLOUR_ALIGN(addr, pgoff);
1006@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1007 addr = PAGE_ALIGN(addr);
1008
1009 vma = find_vma(mm, addr);
1010- if (TASK_SIZE - len >= addr &&
1011- (!vma || addr + len <= vma->vm_start))
1012+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1013 return addr;
1014 }
1015 if (len > mm->cached_hole_size) {
1016- start_addr = addr = mm->free_area_cache;
1017+ start_addr = addr = mm->free_area_cache;
1018 } else {
1019- start_addr = addr = TASK_UNMAPPED_BASE;
1020- mm->cached_hole_size = 0;
1021+ start_addr = addr = mm->mmap_base;
1022+ mm->cached_hole_size = 0;
1023 }
1024 /* 8 bits of randomness in 20 address space bits */
1025 if ((current->flags & PF_RANDOMIZE) &&
1026@@ -100,14 +103,14 @@ full_search:
1027 * Start a new search - just in case we missed
1028 * some holes.
1029 */
1030- if (start_addr != TASK_UNMAPPED_BASE) {
1031- start_addr = addr = TASK_UNMAPPED_BASE;
1032+ if (start_addr != mm->mmap_base) {
1033+ start_addr = addr = mm->mmap_base;
1034 mm->cached_hole_size = 0;
1035 goto full_search;
1036 }
1037 return -ENOMEM;
1038 }
1039- if (!vma || addr + len <= vma->vm_start) {
1040+ if (check_heap_stack_gap(vma, addr, len)) {
1041 /*
1042 * Remember the place where we stopped the search:
1043 */
1044diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
1045index 3b3159b..425ea94 100644
1046--- a/arch/avr32/include/asm/elf.h
1047+++ b/arch/avr32/include/asm/elf.h
1048@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
1049 the loader. We need to make sure that it is out of the way of the program
1050 that it will "exec", and that there is sufficient room for the brk. */
1051
1052-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1053+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1054
1055+#ifdef CONFIG_PAX_ASLR
1056+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1057+
1058+#define PAX_DELTA_MMAP_LEN 15
1059+#define PAX_DELTA_STACK_LEN 15
1060+#endif
1061
1062 /* This yields a mask that user programs can use to figure out what
1063 instruction set this CPU supports. This could be done in user space,
1064diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
1065index b7f5c68..556135c 100644
1066--- a/arch/avr32/include/asm/kmap_types.h
1067+++ b/arch/avr32/include/asm/kmap_types.h
1068@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1069 D(11) KM_IRQ1,
1070 D(12) KM_SOFTIRQ0,
1071 D(13) KM_SOFTIRQ1,
1072-D(14) KM_TYPE_NR
1073+D(14) KM_CLEARPAGE,
1074+D(15) KM_TYPE_NR
1075 };
1076
1077 #undef D
1078diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
1079index f7040a1..db9f300 100644
1080--- a/arch/avr32/mm/fault.c
1081+++ b/arch/avr32/mm/fault.c
1082@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
1083
1084 int exception_trace = 1;
1085
1086+#ifdef CONFIG_PAX_PAGEEXEC
1087+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1088+{
1089+ unsigned long i;
1090+
1091+ printk(KERN_ERR "PAX: bytes at PC: ");
1092+ for (i = 0; i < 20; i++) {
1093+ unsigned char c;
1094+ if (get_user(c, (unsigned char *)pc+i))
1095+ printk(KERN_CONT "???????? ");
1096+ else
1097+ printk(KERN_CONT "%02x ", c);
1098+ }
1099+ printk("\n");
1100+}
1101+#endif
1102+
1103 /*
1104 * This routine handles page faults. It determines the address and the
1105 * problem, and then passes it off to one of the appropriate routines.
1106@@ -156,6 +173,16 @@ bad_area:
1107 up_read(&mm->mmap_sem);
1108
1109 if (user_mode(regs)) {
1110+
1111+#ifdef CONFIG_PAX_PAGEEXEC
1112+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1113+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1114+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1115+ do_group_exit(SIGKILL);
1116+ }
1117+ }
1118+#endif
1119+
1120 if (exception_trace && printk_ratelimit())
1121 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1122 "sp %08lx ecr %lu\n",
1123diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
1124index f8e16b2..c73ff79 100644
1125--- a/arch/frv/include/asm/kmap_types.h
1126+++ b/arch/frv/include/asm/kmap_types.h
1127@@ -23,6 +23,7 @@ enum km_type {
1128 KM_IRQ1,
1129 KM_SOFTIRQ0,
1130 KM_SOFTIRQ1,
1131+ KM_CLEARPAGE,
1132 KM_TYPE_NR
1133 };
1134
1135diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
1136index 385fd30..6c3d97e 100644
1137--- a/arch/frv/mm/elf-fdpic.c
1138+++ b/arch/frv/mm/elf-fdpic.c
1139@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1140 if (addr) {
1141 addr = PAGE_ALIGN(addr);
1142 vma = find_vma(current->mm, addr);
1143- if (TASK_SIZE - len >= addr &&
1144- (!vma || addr + len <= vma->vm_start))
1145+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1146 goto success;
1147 }
1148
1149@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1150 for (; vma; vma = vma->vm_next) {
1151 if (addr > limit)
1152 break;
1153- if (addr + len <= vma->vm_start)
1154+ if (check_heap_stack_gap(vma, addr, len))
1155 goto success;
1156 addr = vma->vm_end;
1157 }
1158@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1159 for (; vma; vma = vma->vm_next) {
1160 if (addr > limit)
1161 break;
1162- if (addr + len <= vma->vm_start)
1163+ if (check_heap_stack_gap(vma, addr, len))
1164 goto success;
1165 addr = vma->vm_end;
1166 }
1167diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
1168index b5298eb..67c6e62 100644
1169--- a/arch/ia64/include/asm/elf.h
1170+++ b/arch/ia64/include/asm/elf.h
1171@@ -42,6 +42,13 @@
1172 */
1173 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1174
1175+#ifdef CONFIG_PAX_ASLR
1176+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1177+
1178+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1179+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1180+#endif
1181+
1182 #define PT_IA_64_UNWIND 0x70000001
1183
1184 /* IA-64 relocations: */
1185diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
1186index 1a97af3..7529d31 100644
1187--- a/arch/ia64/include/asm/pgtable.h
1188+++ b/arch/ia64/include/asm/pgtable.h
1189@@ -12,7 +12,7 @@
1190 * David Mosberger-Tang <davidm@hpl.hp.com>
1191 */
1192
1193-
1194+#include <linux/const.h>
1195 #include <asm/mman.h>
1196 #include <asm/page.h>
1197 #include <asm/processor.h>
1198@@ -143,6 +143,17 @@
1199 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1200 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1201 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1202+
1203+#ifdef CONFIG_PAX_PAGEEXEC
1204+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1205+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1206+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1207+#else
1208+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1209+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1210+# define PAGE_COPY_NOEXEC PAGE_COPY
1211+#endif
1212+
1213 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1214 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1215 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1216diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
1217index b77768d..e0795eb 100644
1218--- a/arch/ia64/include/asm/spinlock.h
1219+++ b/arch/ia64/include/asm/spinlock.h
1220@@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
1221 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1222
1223 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1224- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1225+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1226 }
1227
1228 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1229diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
1230index 449c8c0..432a3d2 100644
1231--- a/arch/ia64/include/asm/uaccess.h
1232+++ b/arch/ia64/include/asm/uaccess.h
1233@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1234 const void *__cu_from = (from); \
1235 long __cu_len = (n); \
1236 \
1237- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1238+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1239 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1240 __cu_len; \
1241 })
1242@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1243 long __cu_len = (n); \
1244 \
1245 __chk_user_ptr(__cu_from); \
1246- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1247+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1248 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1249 __cu_len; \
1250 })
1251diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
1252index 24603be..948052d 100644
1253--- a/arch/ia64/kernel/module.c
1254+++ b/arch/ia64/kernel/module.c
1255@@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
1256 void
1257 module_free (struct module *mod, void *module_region)
1258 {
1259- if (mod && mod->arch.init_unw_table &&
1260- module_region == mod->module_init) {
1261+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1262 unw_remove_unwind_table(mod->arch.init_unw_table);
1263 mod->arch.init_unw_table = NULL;
1264 }
1265@@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
1266 }
1267
1268 static inline int
1269+in_init_rx (const struct module *mod, uint64_t addr)
1270+{
1271+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1272+}
1273+
1274+static inline int
1275+in_init_rw (const struct module *mod, uint64_t addr)
1276+{
1277+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1278+}
1279+
1280+static inline int
1281 in_init (const struct module *mod, uint64_t addr)
1282 {
1283- return addr - (uint64_t) mod->module_init < mod->init_size;
1284+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1285+}
1286+
1287+static inline int
1288+in_core_rx (const struct module *mod, uint64_t addr)
1289+{
1290+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1291+}
1292+
1293+static inline int
1294+in_core_rw (const struct module *mod, uint64_t addr)
1295+{
1296+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1297 }
1298
1299 static inline int
1300 in_core (const struct module *mod, uint64_t addr)
1301 {
1302- return addr - (uint64_t) mod->module_core < mod->core_size;
1303+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1304 }
1305
1306 static inline int
1307@@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
1308 break;
1309
1310 case RV_BDREL:
1311- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1312+ if (in_init_rx(mod, val))
1313+ val -= (uint64_t) mod->module_init_rx;
1314+ else if (in_init_rw(mod, val))
1315+ val -= (uint64_t) mod->module_init_rw;
1316+ else if (in_core_rx(mod, val))
1317+ val -= (uint64_t) mod->module_core_rx;
1318+ else if (in_core_rw(mod, val))
1319+ val -= (uint64_t) mod->module_core_rw;
1320 break;
1321
1322 case RV_LTV:
1323@@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
1324 * addresses have been selected...
1325 */
1326 uint64_t gp;
1327- if (mod->core_size > MAX_LTOFF)
1328+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1329 /*
1330 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1331 * at the end of the module.
1332 */
1333- gp = mod->core_size - MAX_LTOFF / 2;
1334+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1335 else
1336- gp = mod->core_size / 2;
1337- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1338+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1339+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1340 mod->arch.gp = gp;
1341 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1342 }
1343diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
1344index 609d500..7dde2a8 100644
1345--- a/arch/ia64/kernel/sys_ia64.c
1346+++ b/arch/ia64/kernel/sys_ia64.c
1347@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1348 if (REGION_NUMBER(addr) == RGN_HPAGE)
1349 addr = 0;
1350 #endif
1351+
1352+#ifdef CONFIG_PAX_RANDMMAP
1353+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1354+ addr = mm->free_area_cache;
1355+ else
1356+#endif
1357+
1358 if (!addr)
1359 addr = mm->free_area_cache;
1360
1361@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1362 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1363 /* At this point: (!vma || addr < vma->vm_end). */
1364 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1365- if (start_addr != TASK_UNMAPPED_BASE) {
1366+ if (start_addr != mm->mmap_base) {
1367 /* Start a new search --- just in case we missed some holes. */
1368- addr = TASK_UNMAPPED_BASE;
1369+ addr = mm->mmap_base;
1370 goto full_search;
1371 }
1372 return -ENOMEM;
1373 }
1374- if (!vma || addr + len <= vma->vm_start) {
1375+ if (check_heap_stack_gap(vma, addr, len)) {
1376 /* Remember the address where we stopped this search: */
1377 mm->free_area_cache = addr + len;
1378 return addr;
1379diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
1380index 53c0ba0..2accdde 100644
1381--- a/arch/ia64/kernel/vmlinux.lds.S
1382+++ b/arch/ia64/kernel/vmlinux.lds.S
1383@@ -199,7 +199,7 @@ SECTIONS {
1384 /* Per-cpu data: */
1385 . = ALIGN(PERCPU_PAGE_SIZE);
1386 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1387- __phys_per_cpu_start = __per_cpu_load;
1388+ __phys_per_cpu_start = per_cpu_load;
1389 /*
1390 * ensure percpu data fits
1391 * into percpu page size
1392diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
1393index 20b3593..1ce77f0 100644
1394--- a/arch/ia64/mm/fault.c
1395+++ b/arch/ia64/mm/fault.c
1396@@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned long address)
1397 return pte_present(pte);
1398 }
1399
1400+#ifdef CONFIG_PAX_PAGEEXEC
1401+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1402+{
1403+ unsigned long i;
1404+
1405+ printk(KERN_ERR "PAX: bytes at PC: ");
1406+ for (i = 0; i < 8; i++) {
1407+ unsigned int c;
1408+ if (get_user(c, (unsigned int *)pc+i))
1409+ printk(KERN_CONT "???????? ");
1410+ else
1411+ printk(KERN_CONT "%08x ", c);
1412+ }
1413+ printk("\n");
1414+}
1415+#endif
1416+
1417 void __kprobes
1418 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1419 {
1420@@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
1421 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1422 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1423
1424- if ((vma->vm_flags & mask) != mask)
1425+ if ((vma->vm_flags & mask) != mask) {
1426+
1427+#ifdef CONFIG_PAX_PAGEEXEC
1428+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1429+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1430+ goto bad_area;
1431+
1432+ up_read(&mm->mmap_sem);
1433+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1434+ do_group_exit(SIGKILL);
1435+ }
1436+#endif
1437+
1438 goto bad_area;
1439
1440+ }
1441+
1442 /*
1443 * If for any reason at all we couldn't handle the fault, make
1444 * sure we exit gracefully rather than endlessly redo the
1445diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
1446index 5ca674b..e0e1b70 100644
1447--- a/arch/ia64/mm/hugetlbpage.c
1448+++ b/arch/ia64/mm/hugetlbpage.c
1449@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
1450 /* At this point: (!vmm || addr < vmm->vm_end). */
1451 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1452 return -ENOMEM;
1453- if (!vmm || (addr + len) <= vmm->vm_start)
1454+ if (check_heap_stack_gap(vmm, addr, len))
1455 return addr;
1456 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1457 }
1458diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
1459index 00cb0e2..2ad8024 100644
1460--- a/arch/ia64/mm/init.c
1461+++ b/arch/ia64/mm/init.c
1462@@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1463 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1464 vma->vm_end = vma->vm_start + PAGE_SIZE;
1465 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1466+
1467+#ifdef CONFIG_PAX_PAGEEXEC
1468+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1469+ vma->vm_flags &= ~VM_EXEC;
1470+
1471+#ifdef CONFIG_PAX_MPROTECT
1472+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1473+ vma->vm_flags &= ~VM_MAYEXEC;
1474+#endif
1475+
1476+ }
1477+#endif
1478+
1479 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1480 down_write(&current->mm->mmap_sem);
1481 if (insert_vm_struct(current->mm, vma)) {
1482diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
1483index 82abd15..d95ae5d 100644
1484--- a/arch/m32r/lib/usercopy.c
1485+++ b/arch/m32r/lib/usercopy.c
1486@@ -14,6 +14,9 @@
1487 unsigned long
1488 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1489 {
1490+ if ((long)n < 0)
1491+ return n;
1492+
1493 prefetch(from);
1494 if (access_ok(VERIFY_WRITE, to, n))
1495 __copy_user(to,from,n);
1496@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1497 unsigned long
1498 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1499 {
1500+ if ((long)n < 0)
1501+ return n;
1502+
1503 prefetchw(to);
1504 if (access_ok(VERIFY_READ, from, n))
1505 __copy_user_zeroing(to,from,n);
1506diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
1507index 455c0ac..ad65fbe 100644
1508--- a/arch/mips/include/asm/elf.h
1509+++ b/arch/mips/include/asm/elf.h
1510@@ -372,13 +372,16 @@ extern const char *__elf_platform;
1511 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1512 #endif
1513
1514+#ifdef CONFIG_PAX_ASLR
1515+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1516+
1517+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1518+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1519+#endif
1520+
1521 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1522 struct linux_binprm;
1523 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1524 int uses_interp);
1525
1526-struct mm_struct;
1527-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1528-#define arch_randomize_brk arch_randomize_brk
1529-
1530 #endif /* _ASM_ELF_H */
1531diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
1532index e59cd1a..8e329d6 100644
1533--- a/arch/mips/include/asm/page.h
1534+++ b/arch/mips/include/asm/page.h
1535@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
1536 #ifdef CONFIG_CPU_MIPS32
1537 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1538 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1539- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1540+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1541 #else
1542 typedef struct { unsigned long long pte; } pte_t;
1543 #define pte_val(x) ((x).pte)
1544diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
1545index 6018c80..7c37203 100644
1546--- a/arch/mips/include/asm/system.h
1547+++ b/arch/mips/include/asm/system.h
1548@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1549 */
1550 #define __ARCH_WANT_UNLOCKED_CTXSW
1551
1552-extern unsigned long arch_align_stack(unsigned long sp);
1553+#define arch_align_stack(x) ((x) & ~0xfUL)
1554
1555 #endif /* _ASM_SYSTEM_H */
1556diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
1557index 9fdd8bc..4bd7f1a 100644
1558--- a/arch/mips/kernel/binfmt_elfn32.c
1559+++ b/arch/mips/kernel/binfmt_elfn32.c
1560@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1561 #undef ELF_ET_DYN_BASE
1562 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1563
1564+#ifdef CONFIG_PAX_ASLR
1565+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1566+
1567+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1568+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1569+#endif
1570+
1571 #include <asm/processor.h>
1572 #include <linux/module.h>
1573 #include <linux/elfcore.h>
1574diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
1575index ff44823..97f8906 100644
1576--- a/arch/mips/kernel/binfmt_elfo32.c
1577+++ b/arch/mips/kernel/binfmt_elfo32.c
1578@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1579 #undef ELF_ET_DYN_BASE
1580 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1581
1582+#ifdef CONFIG_PAX_ASLR
1583+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1584+
1585+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1586+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1587+#endif
1588+
1589 #include <asm/processor.h>
1590
1591 /*
1592diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
1593index b30cb25..454c0a9 100644
1594--- a/arch/mips/kernel/process.c
1595+++ b/arch/mips/kernel/process.c
1596@@ -481,15 +481,3 @@ unsigned long get_wchan(struct task_struct *task)
1597 out:
1598 return pc;
1599 }
1600-
1601-/*
1602- * Don't forget that the stack pointer must be aligned on a 8 bytes
1603- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1604- */
1605-unsigned long arch_align_stack(unsigned long sp)
1606-{
1607- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1608- sp -= get_random_int() & ~PAGE_MASK;
1609-
1610- return sp & ALMASK;
1611-}
1612diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
1613index 937cf33..adb39bb 100644
1614--- a/arch/mips/mm/fault.c
1615+++ b/arch/mips/mm/fault.c
1616@@ -28,6 +28,23 @@
1617 #include <asm/highmem.h> /* For VMALLOC_END */
1618 #include <linux/kdebug.h>
1619
1620+#ifdef CONFIG_PAX_PAGEEXEC
1621+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1622+{
1623+ unsigned long i;
1624+
1625+ printk(KERN_ERR "PAX: bytes at PC: ");
1626+ for (i = 0; i < 5; i++) {
1627+ unsigned int c;
1628+ if (get_user(c, (unsigned int *)pc+i))
1629+ printk(KERN_CONT "???????? ");
1630+ else
1631+ printk(KERN_CONT "%08x ", c);
1632+ }
1633+ printk("\n");
1634+}
1635+#endif
1636+
1637 /*
1638 * This routine handles page faults. It determines the address,
1639 * and the problem, and then passes it off to one of the appropriate
1640diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
1641index 302d779..7d35bf8 100644
1642--- a/arch/mips/mm/mmap.c
1643+++ b/arch/mips/mm/mmap.c
1644@@ -95,6 +95,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1645 do_color_align = 1;
1646
1647 /* requesting a specific address */
1648+
1649+#ifdef CONFIG_PAX_RANDMMAP
1650+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1651+#endif
1652+
1653 if (addr) {
1654 if (do_color_align)
1655 addr = COLOUR_ALIGN(addr, pgoff);
1656@@ -102,8 +107,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1657 addr = PAGE_ALIGN(addr);
1658
1659 vma = find_vma(mm, addr);
1660- if (TASK_SIZE - len >= addr &&
1661- (!vma || addr + len <= vma->vm_start))
1662+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1663 return addr;
1664 }
1665
1666@@ -118,7 +122,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1667 /* At this point: (!vma || addr < vma->vm_end). */
1668 if (TASK_SIZE - len < addr)
1669 return -ENOMEM;
1670- if (!vma || addr + len <= vma->vm_start)
1671+ if (check_heap_stack_gap(vmm, addr, len))
1672 return addr;
1673 addr = vma->vm_end;
1674 if (do_color_align)
1675@@ -145,7 +149,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1676 /* make sure it can fit in the remaining address space */
1677 if (likely(addr > len)) {
1678 vma = find_vma(mm, addr - len);
1679- if (!vma || addr <= vma->vm_start) {
1680+ if (check_heap_stack_gap(vmm, addr - len, len))
1681 /* cache the address as a hint for next time */
1682 return mm->free_area_cache = addr - len;
1683 }
1684@@ -165,7 +169,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1685 * return with success:
1686 */
1687 vma = find_vma(mm, addr);
1688- if (likely(!vma || addr + len <= vma->vm_start)) {
1689+ if (check_heap_stack_gap(vmm, addr, len)) {
1690 /* cache the address as a hint for next time */
1691 return mm->free_area_cache = addr;
1692 }
1693@@ -242,30 +246,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
1694 mm->unmap_area = arch_unmap_area_topdown;
1695 }
1696 }
1697-
1698-static inline unsigned long brk_rnd(void)
1699-{
1700- unsigned long rnd = get_random_int();
1701-
1702- rnd = rnd << PAGE_SHIFT;
1703- /* 8MB for 32bit, 256MB for 64bit */
1704- if (TASK_IS_32BIT_ADDR)
1705- rnd = rnd & 0x7ffffful;
1706- else
1707- rnd = rnd & 0xffffffful;
1708-
1709- return rnd;
1710-}
1711-
1712-unsigned long arch_randomize_brk(struct mm_struct *mm)
1713-{
1714- unsigned long base = mm->brk;
1715- unsigned long ret;
1716-
1717- ret = PAGE_ALIGN(base + brk_rnd());
1718-
1719- if (ret < mm->brk)
1720- return mm->brk;
1721-
1722- return ret;
1723-}
1724diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
1725index 19f6cb1..6c78cf2 100644
1726--- a/arch/parisc/include/asm/elf.h
1727+++ b/arch/parisc/include/asm/elf.h
1728@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
1729
1730 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1731
1732+#ifdef CONFIG_PAX_ASLR
1733+#define PAX_ELF_ET_DYN_BASE 0x10000UL
1734+
1735+#define PAX_DELTA_MMAP_LEN 16
1736+#define PAX_DELTA_STACK_LEN 16
1737+#endif
1738+
1739 /* This yields a mask that user programs can use to figure out what
1740 instruction set this CPU supports. This could be done in user space,
1741 but it's not easy, and we've already done it here. */
1742diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
1743index 22dadeb..f6c2be4 100644
1744--- a/arch/parisc/include/asm/pgtable.h
1745+++ b/arch/parisc/include/asm/pgtable.h
1746@@ -210,6 +210,17 @@ struct vm_area_struct;
1747 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1748 #define PAGE_COPY PAGE_EXECREAD
1749 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1750+
1751+#ifdef CONFIG_PAX_PAGEEXEC
1752+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1753+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1754+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1755+#else
1756+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1757+# define PAGE_COPY_NOEXEC PAGE_COPY
1758+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1759+#endif
1760+
1761 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1762 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1763 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1764diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
1765index 5e34ccf..672bc9c 100644
1766--- a/arch/parisc/kernel/module.c
1767+++ b/arch/parisc/kernel/module.c
1768@@ -98,16 +98,38 @@
1769
1770 /* three functions to determine where in the module core
1771 * or init pieces the location is */
1772+static inline int in_init_rx(struct module *me, void *loc)
1773+{
1774+ return (loc >= me->module_init_rx &&
1775+ loc < (me->module_init_rx + me->init_size_rx));
1776+}
1777+
1778+static inline int in_init_rw(struct module *me, void *loc)
1779+{
1780+ return (loc >= me->module_init_rw &&
1781+ loc < (me->module_init_rw + me->init_size_rw));
1782+}
1783+
1784 static inline int in_init(struct module *me, void *loc)
1785 {
1786- return (loc >= me->module_init &&
1787- loc <= (me->module_init + me->init_size));
1788+ return in_init_rx(me, loc) || in_init_rw(me, loc);
1789+}
1790+
1791+static inline int in_core_rx(struct module *me, void *loc)
1792+{
1793+ return (loc >= me->module_core_rx &&
1794+ loc < (me->module_core_rx + me->core_size_rx));
1795+}
1796+
1797+static inline int in_core_rw(struct module *me, void *loc)
1798+{
1799+ return (loc >= me->module_core_rw &&
1800+ loc < (me->module_core_rw + me->core_size_rw));
1801 }
1802
1803 static inline int in_core(struct module *me, void *loc)
1804 {
1805- return (loc >= me->module_core &&
1806- loc <= (me->module_core + me->core_size));
1807+ return in_core_rx(me, loc) || in_core_rw(me, loc);
1808 }
1809
1810 static inline int in_local(struct module *me, void *loc)
1811@@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
1812 }
1813
1814 /* align things a bit */
1815- me->core_size = ALIGN(me->core_size, 16);
1816- me->arch.got_offset = me->core_size;
1817- me->core_size += gots * sizeof(struct got_entry);
1818+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1819+ me->arch.got_offset = me->core_size_rw;
1820+ me->core_size_rw += gots * sizeof(struct got_entry);
1821
1822- me->core_size = ALIGN(me->core_size, 16);
1823- me->arch.fdesc_offset = me->core_size;
1824- me->core_size += fdescs * sizeof(Elf_Fdesc);
1825+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1826+ me->arch.fdesc_offset = me->core_size_rw;
1827+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1828
1829 me->arch.got_max = gots;
1830 me->arch.fdesc_max = fdescs;
1831@@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1832
1833 BUG_ON(value == 0);
1834
1835- got = me->module_core + me->arch.got_offset;
1836+ got = me->module_core_rw + me->arch.got_offset;
1837 for (i = 0; got[i].addr; i++)
1838 if (got[i].addr == value)
1839 goto out;
1840@@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1841 #ifdef CONFIG_64BIT
1842 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1843 {
1844- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1845+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1846
1847 if (!value) {
1848 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1849@@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1850
1851 /* Create new one */
1852 fdesc->addr = value;
1853- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1854+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1855 return (Elf_Addr)fdesc;
1856 }
1857 #endif /* CONFIG_64BIT */
1858@@ -845,7 +867,7 @@ register_unwind_table(struct module *me,
1859
1860 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1861 end = table + sechdrs[me->arch.unwind_section].sh_size;
1862- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1863+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1864
1865 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1866 me->arch.unwind_section, table, end, gp);
1867diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
1868index c9b9322..02d8940 100644
1869--- a/arch/parisc/kernel/sys_parisc.c
1870+++ b/arch/parisc/kernel/sys_parisc.c
1871@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
1872 /* At this point: (!vma || addr < vma->vm_end). */
1873 if (TASK_SIZE - len < addr)
1874 return -ENOMEM;
1875- if (!vma || addr + len <= vma->vm_start)
1876+ if (check_heap_stack_gap(vma, addr, len))
1877 return addr;
1878 addr = vma->vm_end;
1879 }
1880@@ -79,7 +79,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
1881 /* At this point: (!vma || addr < vma->vm_end). */
1882 if (TASK_SIZE - len < addr)
1883 return -ENOMEM;
1884- if (!vma || addr + len <= vma->vm_start)
1885+ if (check_heap_stack_gap(vma, addr, len))
1886 return addr;
1887 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1888 if (addr < vma->vm_end) /* handle wraparound */
1889@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
1890 if (flags & MAP_FIXED)
1891 return addr;
1892 if (!addr)
1893- addr = TASK_UNMAPPED_BASE;
1894+ addr = current->mm->mmap_base;
1895
1896 if (filp) {
1897 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1898diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
1899index f19e660..414fe24 100644
1900--- a/arch/parisc/kernel/traps.c
1901+++ b/arch/parisc/kernel/traps.c
1902@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
1903
1904 down_read(&current->mm->mmap_sem);
1905 vma = find_vma(current->mm,regs->iaoq[0]);
1906- if (vma && (regs->iaoq[0] >= vma->vm_start)
1907- && (vma->vm_flags & VM_EXEC)) {
1908-
1909+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1910 fault_address = regs->iaoq[0];
1911 fault_space = regs->iasq[0];
1912
1913diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
1914index 18162ce..94de376 100644
1915--- a/arch/parisc/mm/fault.c
1916+++ b/arch/parisc/mm/fault.c
1917@@ -15,6 +15,7 @@
1918 #include <linux/sched.h>
1919 #include <linux/interrupt.h>
1920 #include <linux/module.h>
1921+#include <linux/unistd.h>
1922
1923 #include <asm/uaccess.h>
1924 #include <asm/traps.h>
1925@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
1926 static unsigned long
1927 parisc_acctyp(unsigned long code, unsigned int inst)
1928 {
1929- if (code == 6 || code == 16)
1930+ if (code == 6 || code == 7 || code == 16)
1931 return VM_EXEC;
1932
1933 switch (inst & 0xf0000000) {
1934@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
1935 }
1936 #endif
1937
1938+#ifdef CONFIG_PAX_PAGEEXEC
1939+/*
1940+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1941+ *
1942+ * returns 1 when task should be killed
1943+ * 2 when rt_sigreturn trampoline was detected
1944+ * 3 when unpatched PLT trampoline was detected
1945+ */
1946+static int pax_handle_fetch_fault(struct pt_regs *regs)
1947+{
1948+
1949+#ifdef CONFIG_PAX_EMUPLT
1950+ int err;
1951+
1952+ do { /* PaX: unpatched PLT emulation */
1953+ unsigned int bl, depwi;
1954+
1955+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1956+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1957+
1958+ if (err)
1959+ break;
1960+
1961+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1962+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1963+
1964+ err = get_user(ldw, (unsigned int *)addr);
1965+ err |= get_user(bv, (unsigned int *)(addr+4));
1966+ err |= get_user(ldw2, (unsigned int *)(addr+8));
1967+
1968+ if (err)
1969+ break;
1970+
1971+ if (ldw == 0x0E801096U &&
1972+ bv == 0xEAC0C000U &&
1973+ ldw2 == 0x0E881095U)
1974+ {
1975+ unsigned int resolver, map;
1976+
1977+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1978+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1979+ if (err)
1980+ break;
1981+
1982+ regs->gr[20] = instruction_pointer(regs)+8;
1983+ regs->gr[21] = map;
1984+ regs->gr[22] = resolver;
1985+ regs->iaoq[0] = resolver | 3UL;
1986+ regs->iaoq[1] = regs->iaoq[0] + 4;
1987+ return 3;
1988+ }
1989+ }
1990+ } while (0);
1991+#endif
1992+
1993+#ifdef CONFIG_PAX_EMUTRAMP
1994+
1995+#ifndef CONFIG_PAX_EMUSIGRT
1996+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1997+ return 1;
1998+#endif
1999+
2000+ do { /* PaX: rt_sigreturn emulation */
2001+ unsigned int ldi1, ldi2, bel, nop;
2002+
2003+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
2004+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
2005+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
2006+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
2007+
2008+ if (err)
2009+ break;
2010+
2011+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
2012+ ldi2 == 0x3414015AU &&
2013+ bel == 0xE4008200U &&
2014+ nop == 0x08000240U)
2015+ {
2016+ regs->gr[25] = (ldi1 & 2) >> 1;
2017+ regs->gr[20] = __NR_rt_sigreturn;
2018+ regs->gr[31] = regs->iaoq[1] + 16;
2019+ regs->sr[0] = regs->iasq[1];
2020+ regs->iaoq[0] = 0x100UL;
2021+ regs->iaoq[1] = regs->iaoq[0] + 4;
2022+ regs->iasq[0] = regs->sr[2];
2023+ regs->iasq[1] = regs->sr[2];
2024+ return 2;
2025+ }
2026+ } while (0);
2027+#endif
2028+
2029+ return 1;
2030+}
2031+
2032+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2033+{
2034+ unsigned long i;
2035+
2036+ printk(KERN_ERR "PAX: bytes at PC: ");
2037+ for (i = 0; i < 5; i++) {
2038+ unsigned int c;
2039+ if (get_user(c, (unsigned int *)pc+i))
2040+ printk(KERN_CONT "???????? ");
2041+ else
2042+ printk(KERN_CONT "%08x ", c);
2043+ }
2044+ printk("\n");
2045+}
2046+#endif
2047+
2048 int fixup_exception(struct pt_regs *regs)
2049 {
2050 const struct exception_table_entry *fix;
2051@@ -192,8 +303,33 @@ good_area:
2052
2053 acc_type = parisc_acctyp(code,regs->iir);
2054
2055- if ((vma->vm_flags & acc_type) != acc_type)
2056+ if ((vma->vm_flags & acc_type) != acc_type) {
2057+
2058+#ifdef CONFIG_PAX_PAGEEXEC
2059+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2060+ (address & ~3UL) == instruction_pointer(regs))
2061+ {
2062+ up_read(&mm->mmap_sem);
2063+ switch (pax_handle_fetch_fault(regs)) {
2064+
2065+#ifdef CONFIG_PAX_EMUPLT
2066+ case 3:
2067+ return;
2068+#endif
2069+
2070+#ifdef CONFIG_PAX_EMUTRAMP
2071+ case 2:
2072+ return;
2073+#endif
2074+
2075+ }
2076+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2077+ do_group_exit(SIGKILL);
2078+ }
2079+#endif
2080+
2081 goto bad_area;
2082+ }
2083
2084 /*
2085 * If for any reason at all we couldn't handle the fault, make
2086diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
2087index 3bf9cca..e7457d0 100644
2088--- a/arch/powerpc/include/asm/elf.h
2089+++ b/arch/powerpc/include/asm/elf.h
2090@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
2091 the loader. We need to make sure that it is out of the way of the program
2092 that it will "exec", and that there is sufficient room for the brk. */
2093
2094-extern unsigned long randomize_et_dyn(unsigned long base);
2095-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2096+#define ELF_ET_DYN_BASE (0x20000000)
2097+
2098+#ifdef CONFIG_PAX_ASLR
2099+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2100+
2101+#ifdef __powerpc64__
2102+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
2103+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
2104+#else
2105+#define PAX_DELTA_MMAP_LEN 15
2106+#define PAX_DELTA_STACK_LEN 15
2107+#endif
2108+#endif
2109
2110 /*
2111 * Our registers are always unsigned longs, whether we're a 32 bit
2112@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2113 (0x7ff >> (PAGE_SHIFT - 12)) : \
2114 (0x3ffff >> (PAGE_SHIFT - 12)))
2115
2116-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2117-#define arch_randomize_brk arch_randomize_brk
2118-
2119 #endif /* __KERNEL__ */
2120
2121 /*
2122diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
2123index bca8fdc..61e9580 100644
2124--- a/arch/powerpc/include/asm/kmap_types.h
2125+++ b/arch/powerpc/include/asm/kmap_types.h
2126@@ -27,6 +27,7 @@ enum km_type {
2127 KM_PPC_SYNC_PAGE,
2128 KM_PPC_SYNC_ICACHE,
2129 KM_KDB,
2130+ KM_CLEARPAGE,
2131 KM_TYPE_NR
2132 };
2133
2134diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
2135index d4a7f64..451de1c 100644
2136--- a/arch/powerpc/include/asm/mman.h
2137+++ b/arch/powerpc/include/asm/mman.h
2138@@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
2139 }
2140 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
2141
2142-static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
2143+static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
2144 {
2145 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
2146 }
2147diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
2148index 2cd664e..1d2e8a7 100644
2149--- a/arch/powerpc/include/asm/page.h
2150+++ b/arch/powerpc/include/asm/page.h
2151@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
2152 * and needs to be executable. This means the whole heap ends
2153 * up being executable.
2154 */
2155-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2156- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2157+#define VM_DATA_DEFAULT_FLAGS32 \
2158+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2159+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2160
2161 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2162 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2163@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
2164 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2165 #endif
2166
2167+#define ktla_ktva(addr) (addr)
2168+#define ktva_ktla(addr) (addr)
2169+
2170 #ifndef __ASSEMBLY__
2171
2172 #undef STRICT_MM_TYPECHECKS
2173diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
2174index 9356262..ea96148 100644
2175--- a/arch/powerpc/include/asm/page_64.h
2176+++ b/arch/powerpc/include/asm/page_64.h
2177@@ -155,15 +155,18 @@ do { \
2178 * stack by default, so in the absence of a PT_GNU_STACK program header
2179 * we turn execute permission off.
2180 */
2181-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2182- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2183+#define VM_STACK_DEFAULT_FLAGS32 \
2184+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2185+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2186
2187 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2188 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2189
2190+#ifndef CONFIG_PAX_PAGEEXEC
2191 #define VM_STACK_DEFAULT_FLAGS \
2192 (is_32bit_task() ? \
2193 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2194+#endif
2195
2196 #include <asm-generic/getorder.h>
2197
2198diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
2199index 88b0bd9..e32bc67 100644
2200--- a/arch/powerpc/include/asm/pgtable.h
2201+++ b/arch/powerpc/include/asm/pgtable.h
2202@@ -2,6 +2,7 @@
2203 #define _ASM_POWERPC_PGTABLE_H
2204 #ifdef __KERNEL__
2205
2206+#include <linux/const.h>
2207 #ifndef __ASSEMBLY__
2208 #include <asm/processor.h> /* For TASK_SIZE */
2209 #include <asm/mmu.h>
2210diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
2211index 4aad413..85d86bf 100644
2212--- a/arch/powerpc/include/asm/pte-hash32.h
2213+++ b/arch/powerpc/include/asm/pte-hash32.h
2214@@ -21,6 +21,7 @@
2215 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2216 #define _PAGE_USER 0x004 /* usermode access allowed */
2217 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2218+#define _PAGE_EXEC _PAGE_GUARDED
2219 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2220 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2221 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2222diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
2223index 559da19..7e5835c 100644
2224--- a/arch/powerpc/include/asm/reg.h
2225+++ b/arch/powerpc/include/asm/reg.h
2226@@ -212,6 +212,7 @@
2227 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2228 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2229 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2230+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2231 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2232 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2233 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2234diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
2235index e30a13d..2b7d994 100644
2236--- a/arch/powerpc/include/asm/system.h
2237+++ b/arch/powerpc/include/asm/system.h
2238@@ -530,7 +530,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
2239 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2240 #endif
2241
2242-extern unsigned long arch_align_stack(unsigned long sp);
2243+#define arch_align_stack(x) ((x) & ~0xfUL)
2244
2245 /* Used in very early kernel initialization. */
2246 extern unsigned long reloc_offset(void);
2247diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
2248index bd0fb84..a42a14b 100644
2249--- a/arch/powerpc/include/asm/uaccess.h
2250+++ b/arch/powerpc/include/asm/uaccess.h
2251@@ -13,6 +13,8 @@
2252 #define VERIFY_READ 0
2253 #define VERIFY_WRITE 1
2254
2255+extern void check_object_size(const void *ptr, unsigned long n, bool to);
2256+
2257 /*
2258 * The fs value determines whether argument validity checking should be
2259 * performed or not. If get_fs() == USER_DS, checking is performed, with
2260@@ -327,52 +329,6 @@ do { \
2261 extern unsigned long __copy_tofrom_user(void __user *to,
2262 const void __user *from, unsigned long size);
2263
2264-#ifndef __powerpc64__
2265-
2266-static inline unsigned long copy_from_user(void *to,
2267- const void __user *from, unsigned long n)
2268-{
2269- unsigned long over;
2270-
2271- if (access_ok(VERIFY_READ, from, n))
2272- return __copy_tofrom_user((__force void __user *)to, from, n);
2273- if ((unsigned long)from < TASK_SIZE) {
2274- over = (unsigned long)from + n - TASK_SIZE;
2275- return __copy_tofrom_user((__force void __user *)to, from,
2276- n - over) + over;
2277- }
2278- return n;
2279-}
2280-
2281-static inline unsigned long copy_to_user(void __user *to,
2282- const void *from, unsigned long n)
2283-{
2284- unsigned long over;
2285-
2286- if (access_ok(VERIFY_WRITE, to, n))
2287- return __copy_tofrom_user(to, (__force void __user *)from, n);
2288- if ((unsigned long)to < TASK_SIZE) {
2289- over = (unsigned long)to + n - TASK_SIZE;
2290- return __copy_tofrom_user(to, (__force void __user *)from,
2291- n - over) + over;
2292- }
2293- return n;
2294-}
2295-
2296-#else /* __powerpc64__ */
2297-
2298-#define __copy_in_user(to, from, size) \
2299- __copy_tofrom_user((to), (from), (size))
2300-
2301-extern unsigned long copy_from_user(void *to, const void __user *from,
2302- unsigned long n);
2303-extern unsigned long copy_to_user(void __user *to, const void *from,
2304- unsigned long n);
2305-extern unsigned long copy_in_user(void __user *to, const void __user *from,
2306- unsigned long n);
2307-
2308-#endif /* __powerpc64__ */
2309-
2310 static inline unsigned long __copy_from_user_inatomic(void *to,
2311 const void __user *from, unsigned long n)
2312 {
2313@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
2314 if (ret == 0)
2315 return 0;
2316 }
2317+
2318+ if (!__builtin_constant_p(n))
2319+ check_object_size(to, n, false);
2320+
2321 return __copy_tofrom_user((__force void __user *)to, from, n);
2322 }
2323
2324@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
2325 if (ret == 0)
2326 return 0;
2327 }
2328+
2329+ if (!__builtin_constant_p(n))
2330+ check_object_size(from, n, true);
2331+
2332 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2333 }
2334
2335@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
2336 return __copy_to_user_inatomic(to, from, size);
2337 }
2338
2339+#ifndef __powerpc64__
2340+
2341+static inline unsigned long __must_check copy_from_user(void *to,
2342+ const void __user *from, unsigned long n)
2343+{
2344+ unsigned long over;
2345+
2346+ if ((long)n < 0)
2347+ return n;
2348+
2349+ if (access_ok(VERIFY_READ, from, n)) {
2350+ if (!__builtin_constant_p(n))
2351+ check_object_size(to, n, false);
2352+ return __copy_tofrom_user((__force void __user *)to, from, n);
2353+ }
2354+ if ((unsigned long)from < TASK_SIZE) {
2355+ over = (unsigned long)from + n - TASK_SIZE;
2356+ if (!__builtin_constant_p(n - over))
2357+ check_object_size(to, n - over, false);
2358+ return __copy_tofrom_user((__force void __user *)to, from,
2359+ n - over) + over;
2360+ }
2361+ return n;
2362+}
2363+
2364+static inline unsigned long __must_check copy_to_user(void __user *to,
2365+ const void *from, unsigned long n)
2366+{
2367+ unsigned long over;
2368+
2369+ if ((long)n < 0)
2370+ return n;
2371+
2372+ if (access_ok(VERIFY_WRITE, to, n)) {
2373+ if (!__builtin_constant_p(n))
2374+ check_object_size(from, n, true);
2375+ return __copy_tofrom_user(to, (__force void __user *)from, n);
2376+ }
2377+ if ((unsigned long)to < TASK_SIZE) {
2378+ over = (unsigned long)to + n - TASK_SIZE;
2379+ if (!__builtin_constant_p(n))
2380+ check_object_size(from, n - over, true);
2381+ return __copy_tofrom_user(to, (__force void __user *)from,
2382+ n - over) + over;
2383+ }
2384+ return n;
2385+}
2386+
2387+#else /* __powerpc64__ */
2388+
2389+#define __copy_in_user(to, from, size) \
2390+ __copy_tofrom_user((to), (from), (size))
2391+
2392+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2393+{
2394+ if ((long)n < 0 || n > INT_MAX)
2395+ return n;
2396+
2397+ if (!__builtin_constant_p(n))
2398+ check_object_size(to, n, false);
2399+
2400+ if (likely(access_ok(VERIFY_READ, from, n)))
2401+ n = __copy_from_user(to, from, n);
2402+ else
2403+ memset(to, 0, n);
2404+ return n;
2405+}
2406+
2407+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2408+{
2409+ if ((long)n < 0 || n > INT_MAX)
2410+ return n;
2411+
2412+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
2413+ if (!__builtin_constant_p(n))
2414+ check_object_size(from, n, true);
2415+ n = __copy_to_user(to, from, n);
2416+ }
2417+ return n;
2418+}
2419+
2420+extern unsigned long copy_in_user(void __user *to, const void __user *from,
2421+ unsigned long n);
2422+
2423+#endif /* __powerpc64__ */
2424+
2425 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2426
2427 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2428diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
2429index 429983c..7af363b 100644
2430--- a/arch/powerpc/kernel/exceptions-64e.S
2431+++ b/arch/powerpc/kernel/exceptions-64e.S
2432@@ -587,6 +587,7 @@ storage_fault_common:
2433 std r14,_DAR(r1)
2434 std r15,_DSISR(r1)
2435 addi r3,r1,STACK_FRAME_OVERHEAD
2436+ bl .save_nvgprs
2437 mr r4,r14
2438 mr r5,r15
2439 ld r14,PACA_EXGEN+EX_R14(r13)
2440@@ -596,8 +597,7 @@ storage_fault_common:
2441 cmpdi r3,0
2442 bne- 1f
2443 b .ret_from_except_lite
2444-1: bl .save_nvgprs
2445- mr r5,r3
2446+1: mr r5,r3
2447 addi r3,r1,STACK_FRAME_OVERHEAD
2448 ld r4,_DAR(r1)
2449 bl .bad_page_fault
2450diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
2451index 41b02c7..05e76fb 100644
2452--- a/arch/powerpc/kernel/exceptions-64s.S
2453+++ b/arch/powerpc/kernel/exceptions-64s.S
2454@@ -1014,10 +1014,10 @@ handle_page_fault:
2455 11: ld r4,_DAR(r1)
2456 ld r5,_DSISR(r1)
2457 addi r3,r1,STACK_FRAME_OVERHEAD
2458+ bl .save_nvgprs
2459 bl .do_page_fault
2460 cmpdi r3,0
2461 beq+ 13f
2462- bl .save_nvgprs
2463 mr r5,r3
2464 addi r3,r1,STACK_FRAME_OVERHEAD
2465 lwz r4,_DAR(r1)
2466diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
2467index 0b6d796..d760ddb 100644
2468--- a/arch/powerpc/kernel/module_32.c
2469+++ b/arch/powerpc/kernel/module_32.c
2470@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
2471 me->arch.core_plt_section = i;
2472 }
2473 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2474- printk("Module doesn't contain .plt or .init.plt sections.\n");
2475+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2476 return -ENOEXEC;
2477 }
2478
2479@@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
2480
2481 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2482 /* Init, or core PLT? */
2483- if (location >= mod->module_core
2484- && location < mod->module_core + mod->core_size)
2485+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2486+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2487 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2488- else
2489+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2490+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2491 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2492+ else {
2493+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2494+ return ~0UL;
2495+ }
2496
2497 /* Find this entry, or if that fails, the next avail. entry */
2498 while (entry->jump[0]) {
2499diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
2500index 8f53954..a704ad6 100644
2501--- a/arch/powerpc/kernel/process.c
2502+++ b/arch/powerpc/kernel/process.c
2503@@ -682,8 +682,8 @@ void show_regs(struct pt_regs * regs)
2504 * Lookup NIP late so we have the best change of getting the
2505 * above info out without failing
2506 */
2507- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2508- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2509+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2510+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2511 #endif
2512 show_stack(current, (unsigned long *) regs->gpr[1]);
2513 if (!user_mode(regs))
2514@@ -1187,10 +1187,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2515 newsp = stack[0];
2516 ip = stack[STACK_FRAME_LR_SAVE];
2517 if (!firstframe || ip != lr) {
2518- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2519+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2520 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2521 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2522- printk(" (%pS)",
2523+ printk(" (%pA)",
2524 (void *)current->ret_stack[curr_frame].ret);
2525 curr_frame--;
2526 }
2527@@ -1210,7 +1210,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2528 struct pt_regs *regs = (struct pt_regs *)
2529 (sp + STACK_FRAME_OVERHEAD);
2530 lr = regs->link;
2531- printk("--- Exception: %lx at %pS\n LR = %pS\n",
2532+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
2533 regs->trap, (void *)regs->nip, (void *)lr);
2534 firstframe = 1;
2535 }
2536@@ -1285,58 +1285,3 @@ void thread_info_cache_init(void)
2537 }
2538
2539 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2540-
2541-unsigned long arch_align_stack(unsigned long sp)
2542-{
2543- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2544- sp -= get_random_int() & ~PAGE_MASK;
2545- return sp & ~0xf;
2546-}
2547-
2548-static inline unsigned long brk_rnd(void)
2549-{
2550- unsigned long rnd = 0;
2551-
2552- /* 8MB for 32bit, 1GB for 64bit */
2553- if (is_32bit_task())
2554- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2555- else
2556- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2557-
2558- return rnd << PAGE_SHIFT;
2559-}
2560-
2561-unsigned long arch_randomize_brk(struct mm_struct *mm)
2562-{
2563- unsigned long base = mm->brk;
2564- unsigned long ret;
2565-
2566-#ifdef CONFIG_PPC_STD_MMU_64
2567- /*
2568- * If we are using 1TB segments and we are allowed to randomise
2569- * the heap, we can put it above 1TB so it is backed by a 1TB
2570- * segment. Otherwise the heap will be in the bottom 1TB
2571- * which always uses 256MB segments and this may result in a
2572- * performance penalty.
2573- */
2574- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2575- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2576-#endif
2577-
2578- ret = PAGE_ALIGN(base + brk_rnd());
2579-
2580- if (ret < mm->brk)
2581- return mm->brk;
2582-
2583- return ret;
2584-}
2585-
2586-unsigned long randomize_et_dyn(unsigned long base)
2587-{
2588- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2589-
2590- if (ret < base)
2591- return base;
2592-
2593- return ret;
2594-}
2595diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
2596index 78b76dc..7f232ef 100644
2597--- a/arch/powerpc/kernel/signal_32.c
2598+++ b/arch/powerpc/kernel/signal_32.c
2599@@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
2600 /* Save user registers on the stack */
2601 frame = &rt_sf->uc.uc_mcontext;
2602 addr = frame;
2603- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2604+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2605 if (save_user_regs(regs, frame, 0, 1))
2606 goto badframe;
2607 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2608diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
2609index e91c736..742ec06 100644
2610--- a/arch/powerpc/kernel/signal_64.c
2611+++ b/arch/powerpc/kernel/signal_64.c
2612@@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
2613 current->thread.fpscr.val = 0;
2614
2615 /* Set up to return from userspace. */
2616- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2617+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2618 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2619 } else {
2620 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2621diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
2622index f19d977..8ac286e 100644
2623--- a/arch/powerpc/kernel/traps.c
2624+++ b/arch/powerpc/kernel/traps.c
2625@@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2626 static inline void pmac_backlight_unblank(void) { }
2627 #endif
2628
2629+extern void gr_handle_kernel_exploit(void);
2630+
2631 int die(const char *str, struct pt_regs *regs, long err)
2632 {
2633 static struct {
2634@@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs *regs, long err)
2635 if (panic_on_oops)
2636 panic("Fatal exception");
2637
2638+ gr_handle_kernel_exploit();
2639+
2640 oops_exit();
2641 do_exit(err);
2642
2643diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
2644index 142ab10..236e61a 100644
2645--- a/arch/powerpc/kernel/vdso.c
2646+++ b/arch/powerpc/kernel/vdso.c
2647@@ -36,6 +36,7 @@
2648 #include <asm/firmware.h>
2649 #include <asm/vdso.h>
2650 #include <asm/vdso_datapage.h>
2651+#include <asm/mman.h>
2652
2653 #include "setup.h"
2654
2655@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2656 vdso_base = VDSO32_MBASE;
2657 #endif
2658
2659- current->mm->context.vdso_base = 0;
2660+ current->mm->context.vdso_base = ~0UL;
2661
2662 /* vDSO has a problem and was disabled, just don't "enable" it for the
2663 * process
2664@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2665 vdso_base = get_unmapped_area(NULL, vdso_base,
2666 (vdso_pages << PAGE_SHIFT) +
2667 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2668- 0, 0);
2669+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
2670 if (IS_ERR_VALUE(vdso_base)) {
2671 rc = vdso_base;
2672 goto fail_mmapsem;
2673diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
2674index 5eea6f3..5d10396 100644
2675--- a/arch/powerpc/lib/usercopy_64.c
2676+++ b/arch/powerpc/lib/usercopy_64.c
2677@@ -9,22 +9,6 @@
2678 #include <linux/module.h>
2679 #include <asm/uaccess.h>
2680
2681-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2682-{
2683- if (likely(access_ok(VERIFY_READ, from, n)))
2684- n = __copy_from_user(to, from, n);
2685- else
2686- memset(to, 0, n);
2687- return n;
2688-}
2689-
2690-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2691-{
2692- if (likely(access_ok(VERIFY_WRITE, to, n)))
2693- n = __copy_to_user(to, from, n);
2694- return n;
2695-}
2696-
2697 unsigned long copy_in_user(void __user *to, const void __user *from,
2698 unsigned long n)
2699 {
2700@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
2701 return n;
2702 }
2703
2704-EXPORT_SYMBOL(copy_from_user);
2705-EXPORT_SYMBOL(copy_to_user);
2706 EXPORT_SYMBOL(copy_in_user);
2707
2708diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
2709index 5efe8c9..db9ceef 100644
2710--- a/arch/powerpc/mm/fault.c
2711+++ b/arch/powerpc/mm/fault.c
2712@@ -32,6 +32,10 @@
2713 #include <linux/perf_event.h>
2714 #include <linux/magic.h>
2715 #include <linux/ratelimit.h>
2716+#include <linux/slab.h>
2717+#include <linux/pagemap.h>
2718+#include <linux/compiler.h>
2719+#include <linux/unistd.h>
2720
2721 #include <asm/firmware.h>
2722 #include <asm/page.h>
2723@@ -43,6 +47,7 @@
2724 #include <asm/tlbflush.h>
2725 #include <asm/siginfo.h>
2726 #include <mm/mmu_decl.h>
2727+#include <asm/ptrace.h>
2728
2729 #ifdef CONFIG_KPROBES
2730 static inline int notify_page_fault(struct pt_regs *regs)
2731@@ -66,6 +71,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
2732 }
2733 #endif
2734
2735+#ifdef CONFIG_PAX_PAGEEXEC
2736+/*
2737+ * PaX: decide what to do with offenders (regs->nip = fault address)
2738+ *
2739+ * returns 1 when task should be killed
2740+ */
2741+static int pax_handle_fetch_fault(struct pt_regs *regs)
2742+{
2743+ return 1;
2744+}
2745+
2746+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2747+{
2748+ unsigned long i;
2749+
2750+ printk(KERN_ERR "PAX: bytes at PC: ");
2751+ for (i = 0; i < 5; i++) {
2752+ unsigned int c;
2753+ if (get_user(c, (unsigned int __user *)pc+i))
2754+ printk(KERN_CONT "???????? ");
2755+ else
2756+ printk(KERN_CONT "%08x ", c);
2757+ }
2758+ printk("\n");
2759+}
2760+#endif
2761+
2762 /*
2763 * Check whether the instruction at regs->nip is a store using
2764 * an update addressing form which will update r1.
2765@@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
2766 * indicate errors in DSISR but can validly be set in SRR1.
2767 */
2768 if (trap == 0x400)
2769- error_code &= 0x48200000;
2770+ error_code &= 0x58200000;
2771 else
2772 is_write = error_code & DSISR_ISSTORE;
2773 #else
2774@@ -259,7 +291,7 @@ good_area:
2775 * "undefined". Of those that can be set, this is the only
2776 * one which seems bad.
2777 */
2778- if (error_code & 0x10000000)
2779+ if (error_code & DSISR_GUARDED)
2780 /* Guarded storage error. */
2781 goto bad_area;
2782 #endif /* CONFIG_8xx */
2783@@ -274,7 +306,7 @@ good_area:
2784 * processors use the same I/D cache coherency mechanism
2785 * as embedded.
2786 */
2787- if (error_code & DSISR_PROTFAULT)
2788+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2789 goto bad_area;
2790 #endif /* CONFIG_PPC_STD_MMU */
2791
2792@@ -343,6 +375,23 @@ bad_area:
2793 bad_area_nosemaphore:
2794 /* User mode accesses cause a SIGSEGV */
2795 if (user_mode(regs)) {
2796+
2797+#ifdef CONFIG_PAX_PAGEEXEC
2798+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2799+#ifdef CONFIG_PPC_STD_MMU
2800+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2801+#else
2802+ if (is_exec && regs->nip == address) {
2803+#endif
2804+ switch (pax_handle_fetch_fault(regs)) {
2805+ }
2806+
2807+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2808+ do_group_exit(SIGKILL);
2809+ }
2810+ }
2811+#endif
2812+
2813 _exception(SIGSEGV, regs, code, address);
2814 return 0;
2815 }
2816diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
2817index 5a783d8..c23e14b 100644
2818--- a/arch/powerpc/mm/mmap_64.c
2819+++ b/arch/powerpc/mm/mmap_64.c
2820@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
2821 */
2822 if (mmap_is_legacy()) {
2823 mm->mmap_base = TASK_UNMAPPED_BASE;
2824+
2825+#ifdef CONFIG_PAX_RANDMMAP
2826+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2827+ mm->mmap_base += mm->delta_mmap;
2828+#endif
2829+
2830 mm->get_unmapped_area = arch_get_unmapped_area;
2831 mm->unmap_area = arch_unmap_area;
2832 } else {
2833 mm->mmap_base = mmap_base();
2834+
2835+#ifdef CONFIG_PAX_RANDMMAP
2836+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2837+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2838+#endif
2839+
2840 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2841 mm->unmap_area = arch_unmap_area_topdown;
2842 }
2843diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
2844index ba51948..23009d9 100644
2845--- a/arch/powerpc/mm/slice.c
2846+++ b/arch/powerpc/mm/slice.c
2847@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
2848 if ((mm->task_size - len) < addr)
2849 return 0;
2850 vma = find_vma(mm, addr);
2851- return (!vma || (addr + len) <= vma->vm_start);
2852+ return check_heap_stack_gap(vma, addr, len);
2853 }
2854
2855 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2856@@ -256,7 +256,7 @@ full_search:
2857 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2858 continue;
2859 }
2860- if (!vma || addr + len <= vma->vm_start) {
2861+ if (check_heap_stack_gap(vma, addr, len)) {
2862 /*
2863 * Remember the place where we stopped the search:
2864 */
2865@@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2866 }
2867 }
2868
2869- addr = mm->mmap_base;
2870- while (addr > len) {
2871+ if (mm->mmap_base < len)
2872+ addr = -ENOMEM;
2873+ else
2874+ addr = mm->mmap_base - len;
2875+
2876+ while (!IS_ERR_VALUE(addr)) {
2877 /* Go down by chunk size */
2878- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2879+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
2880
2881 /* Check for hit with different page size */
2882 mask = slice_range_to_mask(addr, len);
2883@@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2884 * return with success:
2885 */
2886 vma = find_vma(mm, addr);
2887- if (!vma || (addr + len) <= vma->vm_start) {
2888+ if (check_heap_stack_gap(vma, addr, len)) {
2889 /* remember the address as a hint for next time */
2890 if (use_cache)
2891 mm->free_area_cache = addr;
2892@@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2893 mm->cached_hole_size = vma->vm_start - addr;
2894
2895 /* try just below the current vma->vm_start */
2896- addr = vma->vm_start;
2897+ addr = skip_heap_stack_gap(vma, len);
2898 }
2899
2900 /*
2901@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
2902 if (fixed && addr > (mm->task_size - len))
2903 return -EINVAL;
2904
2905+#ifdef CONFIG_PAX_RANDMMAP
2906+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2907+ addr = 0;
2908+#endif
2909+
2910 /* If hint, make sure it matches our alignment restrictions */
2911 if (!fixed && addr) {
2912 addr = _ALIGN_UP(addr, 1ul << pshift);
2913diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
2914index 547f1a6..3fff354 100644
2915--- a/arch/s390/include/asm/elf.h
2916+++ b/arch/s390/include/asm/elf.h
2917@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2918 the loader. We need to make sure that it is out of the way of the program
2919 that it will "exec", and that there is sufficient room for the brk. */
2920
2921-extern unsigned long randomize_et_dyn(unsigned long base);
2922-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2923+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2924+
2925+#ifdef CONFIG_PAX_ASLR
2926+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2927+
2928+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2929+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2930+#endif
2931
2932 /* This yields a mask that user programs can use to figure out what
2933 instruction set this CPU supports. */
2934@@ -211,7 +217,4 @@ struct linux_binprm;
2935 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2936 int arch_setup_additional_pages(struct linux_binprm *, int);
2937
2938-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2939-#define arch_randomize_brk arch_randomize_brk
2940-
2941 #endif
2942diff --git a/arch/s390/include/asm/system.h b/arch/s390/include/asm/system.h
2943index 6582f69..b69906f 100644
2944--- a/arch/s390/include/asm/system.h
2945+++ b/arch/s390/include/asm/system.h
2946@@ -256,7 +256,7 @@ extern void (*_machine_restart)(char *command);
2947 extern void (*_machine_halt)(void);
2948 extern void (*_machine_power_off)(void);
2949
2950-extern unsigned long arch_align_stack(unsigned long sp);
2951+#define arch_align_stack(x) ((x) & ~0xfUL)
2952
2953 static inline int tprot(unsigned long addr)
2954 {
2955diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
2956index 2b23885..e136e31 100644
2957--- a/arch/s390/include/asm/uaccess.h
2958+++ b/arch/s390/include/asm/uaccess.h
2959@@ -235,6 +235,10 @@ static inline unsigned long __must_check
2960 copy_to_user(void __user *to, const void *from, unsigned long n)
2961 {
2962 might_fault();
2963+
2964+ if ((long)n < 0)
2965+ return n;
2966+
2967 if (access_ok(VERIFY_WRITE, to, n))
2968 n = __copy_to_user(to, from, n);
2969 return n;
2970@@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
2971 static inline unsigned long __must_check
2972 __copy_from_user(void *to, const void __user *from, unsigned long n)
2973 {
2974+ if ((long)n < 0)
2975+ return n;
2976+
2977 if (__builtin_constant_p(n) && (n <= 256))
2978 return uaccess.copy_from_user_small(n, from, to);
2979 else
2980@@ -294,6 +301,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
2981 unsigned int sz = __compiletime_object_size(to);
2982
2983 might_fault();
2984+
2985+ if ((long)n < 0)
2986+ return n;
2987+
2988 if (unlikely(sz != -1 && sz < n)) {
2989 copy_from_user_overflow();
2990 return n;
2991diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
2992index dfcb343..eda788a 100644
2993--- a/arch/s390/kernel/module.c
2994+++ b/arch/s390/kernel/module.c
2995@@ -161,11 +161,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
2996
2997 /* Increase core size by size of got & plt and set start
2998 offsets for got and plt. */
2999- me->core_size = ALIGN(me->core_size, 4);
3000- me->arch.got_offset = me->core_size;
3001- me->core_size += me->arch.got_size;
3002- me->arch.plt_offset = me->core_size;
3003- me->core_size += me->arch.plt_size;
3004+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
3005+ me->arch.got_offset = me->core_size_rw;
3006+ me->core_size_rw += me->arch.got_size;
3007+ me->arch.plt_offset = me->core_size_rx;
3008+ me->core_size_rx += me->arch.plt_size;
3009 return 0;
3010 }
3011
3012@@ -242,7 +242,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3013 if (info->got_initialized == 0) {
3014 Elf_Addr *gotent;
3015
3016- gotent = me->module_core + me->arch.got_offset +
3017+ gotent = me->module_core_rw + me->arch.got_offset +
3018 info->got_offset;
3019 *gotent = val;
3020 info->got_initialized = 1;
3021@@ -266,7 +266,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3022 else if (r_type == R_390_GOTENT ||
3023 r_type == R_390_GOTPLTENT)
3024 *(unsigned int *) loc =
3025- (val + (Elf_Addr) me->module_core - loc) >> 1;
3026+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3027 else if (r_type == R_390_GOT64 ||
3028 r_type == R_390_GOTPLT64)
3029 *(unsigned long *) loc = val;
3030@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3031 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3032 if (info->plt_initialized == 0) {
3033 unsigned int *ip;
3034- ip = me->module_core + me->arch.plt_offset +
3035+ ip = me->module_core_rx + me->arch.plt_offset +
3036 info->plt_offset;
3037 #ifndef CONFIG_64BIT
3038 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3039@@ -305,7 +305,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3040 val - loc + 0xffffUL < 0x1ffffeUL) ||
3041 (r_type == R_390_PLT32DBL &&
3042 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3043- val = (Elf_Addr) me->module_core +
3044+ val = (Elf_Addr) me->module_core_rx +
3045 me->arch.plt_offset +
3046 info->plt_offset;
3047 val += rela->r_addend - loc;
3048@@ -327,7 +327,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3049 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3050 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3051 val = val + rela->r_addend -
3052- ((Elf_Addr) me->module_core + me->arch.got_offset);
3053+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3054 if (r_type == R_390_GOTOFF16)
3055 *(unsigned short *) loc = val;
3056 else if (r_type == R_390_GOTOFF32)
3057@@ -337,7 +337,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3058 break;
3059 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3060 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3061- val = (Elf_Addr) me->module_core + me->arch.got_offset +
3062+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3063 rela->r_addend - loc;
3064 if (r_type == R_390_GOTPC)
3065 *(unsigned int *) loc = val;
3066diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
3067index 541a750..8739853 100644
3068--- a/arch/s390/kernel/process.c
3069+++ b/arch/s390/kernel/process.c
3070@@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_struct *p)
3071 }
3072 return 0;
3073 }
3074-
3075-unsigned long arch_align_stack(unsigned long sp)
3076-{
3077- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3078- sp -= get_random_int() & ~PAGE_MASK;
3079- return sp & ~0xf;
3080-}
3081-
3082-static inline unsigned long brk_rnd(void)
3083-{
3084- /* 8MB for 32bit, 1GB for 64bit */
3085- if (is_32bit_task())
3086- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
3087- else
3088- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
3089-}
3090-
3091-unsigned long arch_randomize_brk(struct mm_struct *mm)
3092-{
3093- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
3094-
3095- if (ret < mm->brk)
3096- return mm->brk;
3097- return ret;
3098-}
3099-
3100-unsigned long randomize_et_dyn(unsigned long base)
3101-{
3102- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3103-
3104- if (!(current->flags & PF_RANDOMIZE))
3105- return base;
3106- if (ret < base)
3107- return base;
3108- return ret;
3109-}
3110diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
3111index c9a9f7f..60d0315 100644
3112--- a/arch/s390/mm/mmap.c
3113+++ b/arch/s390/mm/mmap.c
3114@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3115 */
3116 if (mmap_is_legacy()) {
3117 mm->mmap_base = TASK_UNMAPPED_BASE;
3118+
3119+#ifdef CONFIG_PAX_RANDMMAP
3120+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3121+ mm->mmap_base += mm->delta_mmap;
3122+#endif
3123+
3124 mm->get_unmapped_area = arch_get_unmapped_area;
3125 mm->unmap_area = arch_unmap_area;
3126 } else {
3127 mm->mmap_base = mmap_base();
3128+
3129+#ifdef CONFIG_PAX_RANDMMAP
3130+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3131+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3132+#endif
3133+
3134 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3135 mm->unmap_area = arch_unmap_area_topdown;
3136 }
3137@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3138 */
3139 if (mmap_is_legacy()) {
3140 mm->mmap_base = TASK_UNMAPPED_BASE;
3141+
3142+#ifdef CONFIG_PAX_RANDMMAP
3143+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3144+ mm->mmap_base += mm->delta_mmap;
3145+#endif
3146+
3147 mm->get_unmapped_area = s390_get_unmapped_area;
3148 mm->unmap_area = arch_unmap_area;
3149 } else {
3150 mm->mmap_base = mmap_base();
3151+
3152+#ifdef CONFIG_PAX_RANDMMAP
3153+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3154+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3155+#endif
3156+
3157 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3158 mm->unmap_area = arch_unmap_area_topdown;
3159 }
3160diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
3161index 589d5c7..669e274 100644
3162--- a/arch/score/include/asm/system.h
3163+++ b/arch/score/include/asm/system.h
3164@@ -17,7 +17,7 @@ do { \
3165 #define finish_arch_switch(prev) do {} while (0)
3166
3167 typedef void (*vi_handler_t)(void);
3168-extern unsigned long arch_align_stack(unsigned long sp);
3169+#define arch_align_stack(x) (x)
3170
3171 #define mb() barrier()
3172 #define rmb() barrier()
3173diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
3174index 25d0803..d6c8e36 100644
3175--- a/arch/score/kernel/process.c
3176+++ b/arch/score/kernel/process.c
3177@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
3178
3179 return task_pt_regs(task)->cp0_epc;
3180 }
3181-
3182-unsigned long arch_align_stack(unsigned long sp)
3183-{
3184- return sp;
3185-}
3186diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
3187index afeb710..d1d1289 100644
3188--- a/arch/sh/mm/mmap.c
3189+++ b/arch/sh/mm/mmap.c
3190@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
3191 addr = PAGE_ALIGN(addr);
3192
3193 vma = find_vma(mm, addr);
3194- if (TASK_SIZE - len >= addr &&
3195- (!vma || addr + len <= vma->vm_start))
3196+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3197 return addr;
3198 }
3199
3200@@ -106,7 +105,7 @@ full_search:
3201 }
3202 return -ENOMEM;
3203 }
3204- if (likely(!vma || addr + len <= vma->vm_start)) {
3205+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3206 /*
3207 * Remember the place where we stopped the search:
3208 */
3209@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3210 addr = PAGE_ALIGN(addr);
3211
3212 vma = find_vma(mm, addr);
3213- if (TASK_SIZE - len >= addr &&
3214- (!vma || addr + len <= vma->vm_start))
3215+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3216 return addr;
3217 }
3218
3219@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3220 /* make sure it can fit in the remaining address space */
3221 if (likely(addr > len)) {
3222 vma = find_vma(mm, addr-len);
3223- if (!vma || addr <= vma->vm_start) {
3224+ if (check_heap_stack_gap(vma, addr - len, len)) {
3225 /* remember the address as a hint for next time */
3226 return (mm->free_area_cache = addr-len);
3227 }
3228@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3229 if (unlikely(mm->mmap_base < len))
3230 goto bottomup;
3231
3232- addr = mm->mmap_base-len;
3233- if (do_colour_align)
3234- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3235+ addr = mm->mmap_base - len;
3236
3237 do {
3238+ if (do_colour_align)
3239+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3240 /*
3241 * Lookup failure means no vma is above this address,
3242 * else if new region fits below vma->vm_start,
3243 * return with success:
3244 */
3245 vma = find_vma(mm, addr);
3246- if (likely(!vma || addr+len <= vma->vm_start)) {
3247+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3248 /* remember the address as a hint for next time */
3249 return (mm->free_area_cache = addr);
3250 }
3251@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3252 mm->cached_hole_size = vma->vm_start - addr;
3253
3254 /* try just below the current vma->vm_start */
3255- addr = vma->vm_start-len;
3256- if (do_colour_align)
3257- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3258- } while (likely(len < vma->vm_start));
3259+ addr = skip_heap_stack_gap(vma, len);
3260+ } while (!IS_ERR_VALUE(addr));
3261
3262 bottomup:
3263 /*
3264diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
3265index ad1fb5d..fc5315b 100644
3266--- a/arch/sparc/Makefile
3267+++ b/arch/sparc/Makefile
3268@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
3269 # Export what is needed by arch/sparc/boot/Makefile
3270 export VMLINUX_INIT VMLINUX_MAIN
3271 VMLINUX_INIT := $(head-y) $(init-y)
3272-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
3273+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
3274 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
3275 VMLINUX_MAIN += $(drivers-y) $(net-y)
3276
3277diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
3278index 9f421df..b81fc12 100644
3279--- a/arch/sparc/include/asm/atomic_64.h
3280+++ b/arch/sparc/include/asm/atomic_64.h
3281@@ -14,18 +14,40 @@
3282 #define ATOMIC64_INIT(i) { (i) }
3283
3284 #define atomic_read(v) (*(volatile int *)&(v)->counter)
3285+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3286+{
3287+ return v->counter;
3288+}
3289 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
3290+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3291+{
3292+ return v->counter;
3293+}
3294
3295 #define atomic_set(v, i) (((v)->counter) = i)
3296+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3297+{
3298+ v->counter = i;
3299+}
3300 #define atomic64_set(v, i) (((v)->counter) = i)
3301+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3302+{
3303+ v->counter = i;
3304+}
3305
3306 extern void atomic_add(int, atomic_t *);
3307+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3308 extern void atomic64_add(long, atomic64_t *);
3309+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3310 extern void atomic_sub(int, atomic_t *);
3311+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3312 extern void atomic64_sub(long, atomic64_t *);
3313+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3314
3315 extern int atomic_add_ret(int, atomic_t *);
3316+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3317 extern long atomic64_add_ret(long, atomic64_t *);
3318+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3319 extern int atomic_sub_ret(int, atomic_t *);
3320 extern long atomic64_sub_ret(long, atomic64_t *);
3321
3322@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3323 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3324
3325 #define atomic_inc_return(v) atomic_add_ret(1, v)
3326+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3327+{
3328+ return atomic_add_ret_unchecked(1, v);
3329+}
3330 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3331+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3332+{
3333+ return atomic64_add_ret_unchecked(1, v);
3334+}
3335
3336 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3337 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3338
3339 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3340+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3341+{
3342+ return atomic_add_ret_unchecked(i, v);
3343+}
3344 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3345+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3346+{
3347+ return atomic64_add_ret_unchecked(i, v);
3348+}
3349
3350 /*
3351 * atomic_inc_and_test - increment and test
3352@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3353 * other cases.
3354 */
3355 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3356+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3357+{
3358+ return atomic_inc_return_unchecked(v) == 0;
3359+}
3360 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3361
3362 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3363@@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3364 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3365
3366 #define atomic_inc(v) atomic_add(1, v)
3367+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3368+{
3369+ atomic_add_unchecked(1, v);
3370+}
3371 #define atomic64_inc(v) atomic64_add(1, v)
3372+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3373+{
3374+ atomic64_add_unchecked(1, v);
3375+}
3376
3377 #define atomic_dec(v) atomic_sub(1, v)
3378+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3379+{
3380+ atomic_sub_unchecked(1, v);
3381+}
3382 #define atomic64_dec(v) atomic64_sub(1, v)
3383+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3384+{
3385+ atomic64_sub_unchecked(1, v);
3386+}
3387
3388 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3389 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3390
3391 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3392+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3393+{
3394+ return cmpxchg(&v->counter, old, new);
3395+}
3396 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3397+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3398+{
3399+ return xchg(&v->counter, new);
3400+}
3401
3402 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3403 {
3404- int c, old;
3405+ int c, old, new;
3406 c = atomic_read(v);
3407 for (;;) {
3408- if (unlikely(c == (u)))
3409+ if (unlikely(c == u))
3410 break;
3411- old = atomic_cmpxchg((v), c, c + (a));
3412+
3413+ asm volatile("addcc %2, %0, %0\n"
3414+
3415+#ifdef CONFIG_PAX_REFCOUNT
3416+ "tvs %%icc, 6\n"
3417+#endif
3418+
3419+ : "=r" (new)
3420+ : "0" (c), "ir" (a)
3421+ : "cc");
3422+
3423+ old = atomic_cmpxchg(v, c, new);
3424 if (likely(old == c))
3425 break;
3426 c = old;
3427@@ -89,20 +166,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3428 #define atomic64_cmpxchg(v, o, n) \
3429 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3430 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3431+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3432+{
3433+ return xchg(&v->counter, new);
3434+}
3435
3436 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3437 {
3438- long c, old;
3439+ long c, old, new;
3440 c = atomic64_read(v);
3441 for (;;) {
3442- if (unlikely(c == (u)))
3443+ if (unlikely(c == u))
3444 break;
3445- old = atomic64_cmpxchg((v), c, c + (a));
3446+
3447+ asm volatile("addcc %2, %0, %0\n"
3448+
3449+#ifdef CONFIG_PAX_REFCOUNT
3450+ "tvs %%xcc, 6\n"
3451+#endif
3452+
3453+ : "=r" (new)
3454+ : "0" (c), "ir" (a)
3455+ : "cc");
3456+
3457+ old = atomic64_cmpxchg(v, c, new);
3458 if (likely(old == c))
3459 break;
3460 c = old;
3461 }
3462- return c != (u);
3463+ return c != u;
3464 }
3465
3466 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3467diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
3468index 69358b5..17b4745 100644
3469--- a/arch/sparc/include/asm/cache.h
3470+++ b/arch/sparc/include/asm/cache.h
3471@@ -10,7 +10,7 @@
3472 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3473
3474 #define L1_CACHE_SHIFT 5
3475-#define L1_CACHE_BYTES 32
3476+#define L1_CACHE_BYTES 32UL
3477
3478 #ifdef CONFIG_SPARC32
3479 #define SMP_CACHE_BYTES_SHIFT 5
3480diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
3481index 4269ca6..e3da77f 100644
3482--- a/arch/sparc/include/asm/elf_32.h
3483+++ b/arch/sparc/include/asm/elf_32.h
3484@@ -114,6 +114,13 @@ typedef struct {
3485
3486 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3487
3488+#ifdef CONFIG_PAX_ASLR
3489+#define PAX_ELF_ET_DYN_BASE 0x10000UL
3490+
3491+#define PAX_DELTA_MMAP_LEN 16
3492+#define PAX_DELTA_STACK_LEN 16
3493+#endif
3494+
3495 /* This yields a mask that user programs can use to figure out what
3496 instruction set this cpu supports. This can NOT be done in userspace
3497 on Sparc. */
3498diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
3499index 7df8b7f..4946269 100644
3500--- a/arch/sparc/include/asm/elf_64.h
3501+++ b/arch/sparc/include/asm/elf_64.h
3502@@ -180,6 +180,13 @@ typedef struct {
3503 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3504 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3505
3506+#ifdef CONFIG_PAX_ASLR
3507+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3508+
3509+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3510+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3511+#endif
3512+
3513 extern unsigned long sparc64_elf_hwcap;
3514 #define ELF_HWCAP sparc64_elf_hwcap
3515
3516diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
3517index a790cc6..091ed94 100644
3518--- a/arch/sparc/include/asm/pgtable_32.h
3519+++ b/arch/sparc/include/asm/pgtable_32.h
3520@@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3521 BTFIXUPDEF_INT(page_none)
3522 BTFIXUPDEF_INT(page_copy)
3523 BTFIXUPDEF_INT(page_readonly)
3524+
3525+#ifdef CONFIG_PAX_PAGEEXEC
3526+BTFIXUPDEF_INT(page_shared_noexec)
3527+BTFIXUPDEF_INT(page_copy_noexec)
3528+BTFIXUPDEF_INT(page_readonly_noexec)
3529+#endif
3530+
3531 BTFIXUPDEF_INT(page_kernel)
3532
3533 #define PMD_SHIFT SUN4C_PMD_SHIFT
3534@@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3535 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3536 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3537
3538+#ifdef CONFIG_PAX_PAGEEXEC
3539+extern pgprot_t PAGE_SHARED_NOEXEC;
3540+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3541+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3542+#else
3543+# define PAGE_SHARED_NOEXEC PAGE_SHARED
3544+# define PAGE_COPY_NOEXEC PAGE_COPY
3545+# define PAGE_READONLY_NOEXEC PAGE_READONLY
3546+#endif
3547+
3548 extern unsigned long page_kernel;
3549
3550 #ifdef MODULE
3551diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
3552index f6ae2b2..b03ffc7 100644
3553--- a/arch/sparc/include/asm/pgtsrmmu.h
3554+++ b/arch/sparc/include/asm/pgtsrmmu.h
3555@@ -115,6 +115,13 @@
3556 SRMMU_EXEC | SRMMU_REF)
3557 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3558 SRMMU_EXEC | SRMMU_REF)
3559+
3560+#ifdef CONFIG_PAX_PAGEEXEC
3561+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3562+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3563+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3564+#endif
3565+
3566 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3567 SRMMU_DIRTY | SRMMU_REF)
3568
3569diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
3570index 9689176..63c18ea 100644
3571--- a/arch/sparc/include/asm/spinlock_64.h
3572+++ b/arch/sparc/include/asm/spinlock_64.h
3573@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
3574
3575 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3576
3577-static void inline arch_read_lock(arch_rwlock_t *lock)
3578+static inline void arch_read_lock(arch_rwlock_t *lock)
3579 {
3580 unsigned long tmp1, tmp2;
3581
3582 __asm__ __volatile__ (
3583 "1: ldsw [%2], %0\n"
3584 " brlz,pn %0, 2f\n"
3585-"4: add %0, 1, %1\n"
3586+"4: addcc %0, 1, %1\n"
3587+
3588+#ifdef CONFIG_PAX_REFCOUNT
3589+" tvs %%icc, 6\n"
3590+#endif
3591+
3592 " cas [%2], %0, %1\n"
3593 " cmp %0, %1\n"
3594 " bne,pn %%icc, 1b\n"
3595@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
3596 " .previous"
3597 : "=&r" (tmp1), "=&r" (tmp2)
3598 : "r" (lock)
3599- : "memory");
3600+ : "memory", "cc");
3601 }
3602
3603-static int inline arch_read_trylock(arch_rwlock_t *lock)
3604+static inline int arch_read_trylock(arch_rwlock_t *lock)
3605 {
3606 int tmp1, tmp2;
3607
3608@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3609 "1: ldsw [%2], %0\n"
3610 " brlz,a,pn %0, 2f\n"
3611 " mov 0, %0\n"
3612-" add %0, 1, %1\n"
3613+" addcc %0, 1, %1\n"
3614+
3615+#ifdef CONFIG_PAX_REFCOUNT
3616+" tvs %%icc, 6\n"
3617+#endif
3618+
3619 " cas [%2], %0, %1\n"
3620 " cmp %0, %1\n"
3621 " bne,pn %%icc, 1b\n"
3622@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3623 return tmp1;
3624 }
3625
3626-static void inline arch_read_unlock(arch_rwlock_t *lock)
3627+static inline void arch_read_unlock(arch_rwlock_t *lock)
3628 {
3629 unsigned long tmp1, tmp2;
3630
3631 __asm__ __volatile__(
3632 "1: lduw [%2], %0\n"
3633-" sub %0, 1, %1\n"
3634+" subcc %0, 1, %1\n"
3635+
3636+#ifdef CONFIG_PAX_REFCOUNT
3637+" tvs %%icc, 6\n"
3638+#endif
3639+
3640 " cas [%2], %0, %1\n"
3641 " cmp %0, %1\n"
3642 " bne,pn %%xcc, 1b\n"
3643@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
3644 : "memory");
3645 }
3646
3647-static void inline arch_write_lock(arch_rwlock_t *lock)
3648+static inline void arch_write_lock(arch_rwlock_t *lock)
3649 {
3650 unsigned long mask, tmp1, tmp2;
3651
3652@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
3653 : "memory");
3654 }
3655
3656-static void inline arch_write_unlock(arch_rwlock_t *lock)
3657+static inline void arch_write_unlock(arch_rwlock_t *lock)
3658 {
3659 __asm__ __volatile__(
3660 " stw %%g0, [%0]"
3661@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
3662 : "memory");
3663 }
3664
3665-static int inline arch_write_trylock(arch_rwlock_t *lock)
3666+static inline int arch_write_trylock(arch_rwlock_t *lock)
3667 {
3668 unsigned long mask, tmp1, tmp2, result;
3669
3670diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
3671index fa57532..e1a4c53 100644
3672--- a/arch/sparc/include/asm/thread_info_32.h
3673+++ b/arch/sparc/include/asm/thread_info_32.h
3674@@ -50,6 +50,8 @@ struct thread_info {
3675 unsigned long w_saved;
3676
3677 struct restart_block restart_block;
3678+
3679+ unsigned long lowest_stack;
3680 };
3681
3682 /*
3683diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
3684index 60d86be..952dea1 100644
3685--- a/arch/sparc/include/asm/thread_info_64.h
3686+++ b/arch/sparc/include/asm/thread_info_64.h
3687@@ -63,6 +63,8 @@ struct thread_info {
3688 struct pt_regs *kern_una_regs;
3689 unsigned int kern_una_insn;
3690
3691+ unsigned long lowest_stack;
3692+
3693 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3694 };
3695
3696diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
3697index e88fbe5..96b0ce5 100644
3698--- a/arch/sparc/include/asm/uaccess.h
3699+++ b/arch/sparc/include/asm/uaccess.h
3700@@ -1,5 +1,13 @@
3701 #ifndef ___ASM_SPARC_UACCESS_H
3702 #define ___ASM_SPARC_UACCESS_H
3703+
3704+#ifdef __KERNEL__
3705+#ifndef __ASSEMBLY__
3706+#include <linux/types.h>
3707+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3708+#endif
3709+#endif
3710+
3711 #if defined(__sparc__) && defined(__arch64__)
3712 #include <asm/uaccess_64.h>
3713 #else
3714diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
3715index 8303ac4..07f333d 100644
3716--- a/arch/sparc/include/asm/uaccess_32.h
3717+++ b/arch/sparc/include/asm/uaccess_32.h
3718@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
3719
3720 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3721 {
3722- if (n && __access_ok((unsigned long) to, n))
3723+ if ((long)n < 0)
3724+ return n;
3725+
3726+ if (n && __access_ok((unsigned long) to, n)) {
3727+ if (!__builtin_constant_p(n))
3728+ check_object_size(from, n, true);
3729 return __copy_user(to, (__force void __user *) from, n);
3730- else
3731+ } else
3732 return n;
3733 }
3734
3735 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3736 {
3737+ if ((long)n < 0)
3738+ return n;
3739+
3740+ if (!__builtin_constant_p(n))
3741+ check_object_size(from, n, true);
3742+
3743 return __copy_user(to, (__force void __user *) from, n);
3744 }
3745
3746 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3747 {
3748- if (n && __access_ok((unsigned long) from, n))
3749+ if ((long)n < 0)
3750+ return n;
3751+
3752+ if (n && __access_ok((unsigned long) from, n)) {
3753+ if (!__builtin_constant_p(n))
3754+ check_object_size(to, n, false);
3755 return __copy_user((__force void __user *) to, from, n);
3756- else
3757+ } else
3758 return n;
3759 }
3760
3761 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3762 {
3763+ if ((long)n < 0)
3764+ return n;
3765+
3766 return __copy_user((__force void __user *) to, from, n);
3767 }
3768
3769diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
3770index 3e1449f..5293a0e 100644
3771--- a/arch/sparc/include/asm/uaccess_64.h
3772+++ b/arch/sparc/include/asm/uaccess_64.h
3773@@ -10,6 +10,7 @@
3774 #include <linux/compiler.h>
3775 #include <linux/string.h>
3776 #include <linux/thread_info.h>
3777+#include <linux/kernel.h>
3778 #include <asm/asi.h>
3779 #include <asm/system.h>
3780 #include <asm/spitfire.h>
3781@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
3782 static inline unsigned long __must_check
3783 copy_from_user(void *to, const void __user *from, unsigned long size)
3784 {
3785- unsigned long ret = ___copy_from_user(to, from, size);
3786+ unsigned long ret;
3787
3788+ if ((long)size < 0 || size > INT_MAX)
3789+ return size;
3790+
3791+ if (!__builtin_constant_p(size))
3792+ check_object_size(to, size, false);
3793+
3794+ ret = ___copy_from_user(to, from, size);
3795 if (unlikely(ret))
3796 ret = copy_from_user_fixup(to, from, size);
3797
3798@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
3799 static inline unsigned long __must_check
3800 copy_to_user(void __user *to, const void *from, unsigned long size)
3801 {
3802- unsigned long ret = ___copy_to_user(to, from, size);
3803+ unsigned long ret;
3804
3805+ if ((long)size < 0 || size > INT_MAX)
3806+ return size;
3807+
3808+ if (!__builtin_constant_p(size))
3809+ check_object_size(from, size, true);
3810+
3811+ ret = ___copy_to_user(to, from, size);
3812 if (unlikely(ret))
3813 ret = copy_to_user_fixup(to, from, size);
3814 return ret;
3815diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
3816index cb85458..e063f17 100644
3817--- a/arch/sparc/kernel/Makefile
3818+++ b/arch/sparc/kernel/Makefile
3819@@ -3,7 +3,7 @@
3820 #
3821
3822 asflags-y := -ansi
3823-ccflags-y := -Werror
3824+#ccflags-y := -Werror
3825
3826 extra-y := head_$(BITS).o
3827 extra-y += init_task.o
3828diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
3829index f793742..4d880af 100644
3830--- a/arch/sparc/kernel/process_32.c
3831+++ b/arch/sparc/kernel/process_32.c
3832@@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3833 rw->ins[4], rw->ins[5],
3834 rw->ins[6],
3835 rw->ins[7]);
3836- printk("%pS\n", (void *) rw->ins[7]);
3837+ printk("%pA\n", (void *) rw->ins[7]);
3838 rw = (struct reg_window32 *) rw->ins[6];
3839 }
3840 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3841@@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3842
3843 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3844 r->psr, r->pc, r->npc, r->y, print_tainted());
3845- printk("PC: <%pS>\n", (void *) r->pc);
3846+ printk("PC: <%pA>\n", (void *) r->pc);
3847 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3848 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3849 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3850 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3851 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3852 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3853- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3854+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3855
3856 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3857 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3858@@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
3859 rw = (struct reg_window32 *) fp;
3860 pc = rw->ins[7];
3861 printk("[%08lx : ", pc);
3862- printk("%pS ] ", (void *) pc);
3863+ printk("%pA ] ", (void *) pc);
3864 fp = rw->ins[6];
3865 } while (++count < 16);
3866 printk("\n");
3867diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
3868index d959cd0..7b42812 100644
3869--- a/arch/sparc/kernel/process_64.c
3870+++ b/arch/sparc/kernel/process_64.c
3871@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
3872 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3873 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3874 if (regs->tstate & TSTATE_PRIV)
3875- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3876+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3877 }
3878
3879 void show_regs(struct pt_regs *regs)
3880 {
3881 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3882 regs->tpc, regs->tnpc, regs->y, print_tainted());
3883- printk("TPC: <%pS>\n", (void *) regs->tpc);
3884+ printk("TPC: <%pA>\n", (void *) regs->tpc);
3885 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3886 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3887 regs->u_regs[3]);
3888@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3889 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3890 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3891 regs->u_regs[15]);
3892- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3893+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3894 show_regwindow(regs);
3895 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3896 }
3897@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void)
3898 ((tp && tp->task) ? tp->task->pid : -1));
3899
3900 if (gp->tstate & TSTATE_PRIV) {
3901- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3902+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3903 (void *) gp->tpc,
3904 (void *) gp->o7,
3905 (void *) gp->i7,
3906diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
3907index 42b282f..28ce9f2 100644
3908--- a/arch/sparc/kernel/sys_sparc_32.c
3909+++ b/arch/sparc/kernel/sys_sparc_32.c
3910@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3911 if (ARCH_SUN4C && len > 0x20000000)
3912 return -ENOMEM;
3913 if (!addr)
3914- addr = TASK_UNMAPPED_BASE;
3915+ addr = current->mm->mmap_base;
3916
3917 if (flags & MAP_SHARED)
3918 addr = COLOUR_ALIGN(addr);
3919@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3920 }
3921 if (TASK_SIZE - PAGE_SIZE - len < addr)
3922 return -ENOMEM;
3923- if (!vmm || addr + len <= vmm->vm_start)
3924+ if (check_heap_stack_gap(vmm, addr, len))
3925 return addr;
3926 addr = vmm->vm_end;
3927 if (flags & MAP_SHARED)
3928diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
3929index 908b47a..aa9e584 100644
3930--- a/arch/sparc/kernel/sys_sparc_64.c
3931+++ b/arch/sparc/kernel/sys_sparc_64.c
3932@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3933 /* We do not accept a shared mapping if it would violate
3934 * cache aliasing constraints.
3935 */
3936- if ((flags & MAP_SHARED) &&
3937+ if ((filp || (flags & MAP_SHARED)) &&
3938 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3939 return -EINVAL;
3940 return addr;
3941@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3942 if (filp || (flags & MAP_SHARED))
3943 do_color_align = 1;
3944
3945+#ifdef CONFIG_PAX_RANDMMAP
3946+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3947+#endif
3948+
3949 if (addr) {
3950 if (do_color_align)
3951 addr = COLOUR_ALIGN(addr, pgoff);
3952@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3953 addr = PAGE_ALIGN(addr);
3954
3955 vma = find_vma(mm, addr);
3956- if (task_size - len >= addr &&
3957- (!vma || addr + len <= vma->vm_start))
3958+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3959 return addr;
3960 }
3961
3962 if (len > mm->cached_hole_size) {
3963- start_addr = addr = mm->free_area_cache;
3964+ start_addr = addr = mm->free_area_cache;
3965 } else {
3966- start_addr = addr = TASK_UNMAPPED_BASE;
3967+ start_addr = addr = mm->mmap_base;
3968 mm->cached_hole_size = 0;
3969 }
3970
3971@@ -174,14 +177,14 @@ full_search:
3972 vma = find_vma(mm, VA_EXCLUDE_END);
3973 }
3974 if (unlikely(task_size < addr)) {
3975- if (start_addr != TASK_UNMAPPED_BASE) {
3976- start_addr = addr = TASK_UNMAPPED_BASE;
3977+ if (start_addr != mm->mmap_base) {
3978+ start_addr = addr = mm->mmap_base;
3979 mm->cached_hole_size = 0;
3980 goto full_search;
3981 }
3982 return -ENOMEM;
3983 }
3984- if (likely(!vma || addr + len <= vma->vm_start)) {
3985+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3986 /*
3987 * Remember the place where we stopped the search:
3988 */
3989@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3990 /* We do not accept a shared mapping if it would violate
3991 * cache aliasing constraints.
3992 */
3993- if ((flags & MAP_SHARED) &&
3994+ if ((filp || (flags & MAP_SHARED)) &&
3995 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3996 return -EINVAL;
3997 return addr;
3998@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3999 addr = PAGE_ALIGN(addr);
4000
4001 vma = find_vma(mm, addr);
4002- if (task_size - len >= addr &&
4003- (!vma || addr + len <= vma->vm_start))
4004+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4005 return addr;
4006 }
4007
4008@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4009 /* make sure it can fit in the remaining address space */
4010 if (likely(addr > len)) {
4011 vma = find_vma(mm, addr-len);
4012- if (!vma || addr <= vma->vm_start) {
4013+ if (check_heap_stack_gap(vma, addr - len, len)) {
4014 /* remember the address as a hint for next time */
4015 return (mm->free_area_cache = addr-len);
4016 }
4017@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4018 if (unlikely(mm->mmap_base < len))
4019 goto bottomup;
4020
4021- addr = mm->mmap_base-len;
4022- if (do_color_align)
4023- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4024+ addr = mm->mmap_base - len;
4025
4026 do {
4027+ if (do_color_align)
4028+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4029 /*
4030 * Lookup failure means no vma is above this address,
4031 * else if new region fits below vma->vm_start,
4032 * return with success:
4033 */
4034 vma = find_vma(mm, addr);
4035- if (likely(!vma || addr+len <= vma->vm_start)) {
4036+ if (likely(check_heap_stack_gap(vma, addr, len))) {
4037 /* remember the address as a hint for next time */
4038 return (mm->free_area_cache = addr);
4039 }
4040@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4041 mm->cached_hole_size = vma->vm_start - addr;
4042
4043 /* try just below the current vma->vm_start */
4044- addr = vma->vm_start-len;
4045- if (do_color_align)
4046- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4047- } while (likely(len < vma->vm_start));
4048+ addr = skip_heap_stack_gap(vma, len);
4049+ } while (!IS_ERR_VALUE(addr));
4050
4051 bottomup:
4052 /*
4053@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4054 gap == RLIM_INFINITY ||
4055 sysctl_legacy_va_layout) {
4056 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4057+
4058+#ifdef CONFIG_PAX_RANDMMAP
4059+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4060+ mm->mmap_base += mm->delta_mmap;
4061+#endif
4062+
4063 mm->get_unmapped_area = arch_get_unmapped_area;
4064 mm->unmap_area = arch_unmap_area;
4065 } else {
4066@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4067 gap = (task_size / 6 * 5);
4068
4069 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4070+
4071+#ifdef CONFIG_PAX_RANDMMAP
4072+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4073+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4074+#endif
4075+
4076 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4077 mm->unmap_area = arch_unmap_area_topdown;
4078 }
4079diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
4080index c0490c7..84959d1 100644
4081--- a/arch/sparc/kernel/traps_32.c
4082+++ b/arch/sparc/kernel/traps_32.c
4083@@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
4084 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4085 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4086
4087+extern void gr_handle_kernel_exploit(void);
4088+
4089 void die_if_kernel(char *str, struct pt_regs *regs)
4090 {
4091 static int die_counter;
4092@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4093 count++ < 30 &&
4094 (((unsigned long) rw) >= PAGE_OFFSET) &&
4095 !(((unsigned long) rw) & 0x7)) {
4096- printk("Caller[%08lx]: %pS\n", rw->ins[7],
4097+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
4098 (void *) rw->ins[7]);
4099 rw = (struct reg_window32 *)rw->ins[6];
4100 }
4101 }
4102 printk("Instruction DUMP:");
4103 instruction_dump ((unsigned long *) regs->pc);
4104- if(regs->psr & PSR_PS)
4105+ if(regs->psr & PSR_PS) {
4106+ gr_handle_kernel_exploit();
4107 do_exit(SIGKILL);
4108+ }
4109 do_exit(SIGSEGV);
4110 }
4111
4112diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
4113index 0cbdaa4..438e4c9 100644
4114--- a/arch/sparc/kernel/traps_64.c
4115+++ b/arch/sparc/kernel/traps_64.c
4116@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
4117 i + 1,
4118 p->trapstack[i].tstate, p->trapstack[i].tpc,
4119 p->trapstack[i].tnpc, p->trapstack[i].tt);
4120- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4121+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4122 }
4123 }
4124
4125@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
4126
4127 lvl -= 0x100;
4128 if (regs->tstate & TSTATE_PRIV) {
4129+
4130+#ifdef CONFIG_PAX_REFCOUNT
4131+ if (lvl == 6)
4132+ pax_report_refcount_overflow(regs);
4133+#endif
4134+
4135 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4136 die_if_kernel(buffer, regs);
4137 }
4138@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
4139 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4140 {
4141 char buffer[32];
4142-
4143+
4144 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4145 0, lvl, SIGTRAP) == NOTIFY_STOP)
4146 return;
4147
4148+#ifdef CONFIG_PAX_REFCOUNT
4149+ if (lvl == 6)
4150+ pax_report_refcount_overflow(regs);
4151+#endif
4152+
4153 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4154
4155 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4156@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
4157 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4158 printk("%s" "ERROR(%d): ",
4159 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4160- printk("TPC<%pS>\n", (void *) regs->tpc);
4161+ printk("TPC<%pA>\n", (void *) regs->tpc);
4162 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4163 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4164 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4165@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4166 smp_processor_id(),
4167 (type & 0x1) ? 'I' : 'D',
4168 regs->tpc);
4169- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4170+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4171 panic("Irrecoverable Cheetah+ parity error.");
4172 }
4173
4174@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4175 smp_processor_id(),
4176 (type & 0x1) ? 'I' : 'D',
4177 regs->tpc);
4178- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4179+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4180 }
4181
4182 struct sun4v_error_entry {
4183@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
4184
4185 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4186 regs->tpc, tl);
4187- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4188+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4189 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4190- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4191+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4192 (void *) regs->u_regs[UREG_I7]);
4193 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4194 "pte[%lx] error[%lx]\n",
4195@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
4196
4197 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4198 regs->tpc, tl);
4199- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4200+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4201 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4202- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4203+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4204 (void *) regs->u_regs[UREG_I7]);
4205 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4206 "pte[%lx] error[%lx]\n",
4207@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
4208 fp = (unsigned long)sf->fp + STACK_BIAS;
4209 }
4210
4211- printk(" [%016lx] %pS\n", pc, (void *) pc);
4212+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4213 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4214 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
4215 int index = tsk->curr_ret_stack;
4216 if (tsk->ret_stack && index >= graph) {
4217 pc = tsk->ret_stack[index - graph].ret;
4218- printk(" [%016lx] %pS\n", pc, (void *) pc);
4219+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4220 graph++;
4221 }
4222 }
4223@@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
4224 return (struct reg_window *) (fp + STACK_BIAS);
4225 }
4226
4227+extern void gr_handle_kernel_exploit(void);
4228+
4229 void die_if_kernel(char *str, struct pt_regs *regs)
4230 {
4231 static int die_counter;
4232@@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4233 while (rw &&
4234 count++ < 30 &&
4235 kstack_valid(tp, (unsigned long) rw)) {
4236- printk("Caller[%016lx]: %pS\n", rw->ins[7],
4237+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
4238 (void *) rw->ins[7]);
4239
4240 rw = kernel_stack_up(rw);
4241@@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4242 }
4243 user_instruction_dump ((unsigned int __user *) regs->tpc);
4244 }
4245- if (regs->tstate & TSTATE_PRIV)
4246+ if (regs->tstate & TSTATE_PRIV) {
4247+ gr_handle_kernel_exploit();
4248 do_exit(SIGKILL);
4249+ }
4250 do_exit(SIGSEGV);
4251 }
4252 EXPORT_SYMBOL(die_if_kernel);
4253diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
4254index 76e4ac1..78f8bb1 100644
4255--- a/arch/sparc/kernel/unaligned_64.c
4256+++ b/arch/sparc/kernel/unaligned_64.c
4257@@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs *regs)
4258 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
4259
4260 if (__ratelimit(&ratelimit)) {
4261- printk("Kernel unaligned access at TPC[%lx] %pS\n",
4262+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
4263 regs->tpc, (void *) regs->tpc);
4264 }
4265 }
4266diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
4267index a3fc437..fea9957 100644
4268--- a/arch/sparc/lib/Makefile
4269+++ b/arch/sparc/lib/Makefile
4270@@ -2,7 +2,7 @@
4271 #
4272
4273 asflags-y := -ansi -DST_DIV0=0x02
4274-ccflags-y := -Werror
4275+#ccflags-y := -Werror
4276
4277 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4278 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4279diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
4280index 59186e0..f747d7a 100644
4281--- a/arch/sparc/lib/atomic_64.S
4282+++ b/arch/sparc/lib/atomic_64.S
4283@@ -18,7 +18,12 @@
4284 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4285 BACKOFF_SETUP(%o2)
4286 1: lduw [%o1], %g1
4287- add %g1, %o0, %g7
4288+ addcc %g1, %o0, %g7
4289+
4290+#ifdef CONFIG_PAX_REFCOUNT
4291+ tvs %icc, 6
4292+#endif
4293+
4294 cas [%o1], %g1, %g7
4295 cmp %g1, %g7
4296 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4297@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4298 2: BACKOFF_SPIN(%o2, %o3, 1b)
4299 .size atomic_add, .-atomic_add
4300
4301+ .globl atomic_add_unchecked
4302+ .type atomic_add_unchecked,#function
4303+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4304+ BACKOFF_SETUP(%o2)
4305+1: lduw [%o1], %g1
4306+ add %g1, %o0, %g7
4307+ cas [%o1], %g1, %g7
4308+ cmp %g1, %g7
4309+ bne,pn %icc, 2f
4310+ nop
4311+ retl
4312+ nop
4313+2: BACKOFF_SPIN(%o2, %o3, 1b)
4314+ .size atomic_add_unchecked, .-atomic_add_unchecked
4315+
4316 .globl atomic_sub
4317 .type atomic_sub,#function
4318 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4319 BACKOFF_SETUP(%o2)
4320 1: lduw [%o1], %g1
4321- sub %g1, %o0, %g7
4322+ subcc %g1, %o0, %g7
4323+
4324+#ifdef CONFIG_PAX_REFCOUNT
4325+ tvs %icc, 6
4326+#endif
4327+
4328 cas [%o1], %g1, %g7
4329 cmp %g1, %g7
4330 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4331@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4332 2: BACKOFF_SPIN(%o2, %o3, 1b)
4333 .size atomic_sub, .-atomic_sub
4334
4335+ .globl atomic_sub_unchecked
4336+ .type atomic_sub_unchecked,#function
4337+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4338+ BACKOFF_SETUP(%o2)
4339+1: lduw [%o1], %g1
4340+ sub %g1, %o0, %g7
4341+ cas [%o1], %g1, %g7
4342+ cmp %g1, %g7
4343+ bne,pn %icc, 2f
4344+ nop
4345+ retl
4346+ nop
4347+2: BACKOFF_SPIN(%o2, %o3, 1b)
4348+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
4349+
4350 .globl atomic_add_ret
4351 .type atomic_add_ret,#function
4352 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4353 BACKOFF_SETUP(%o2)
4354 1: lduw [%o1], %g1
4355- add %g1, %o0, %g7
4356+ addcc %g1, %o0, %g7
4357+
4358+#ifdef CONFIG_PAX_REFCOUNT
4359+ tvs %icc, 6
4360+#endif
4361+
4362 cas [%o1], %g1, %g7
4363 cmp %g1, %g7
4364 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4365@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4366 2: BACKOFF_SPIN(%o2, %o3, 1b)
4367 .size atomic_add_ret, .-atomic_add_ret
4368
4369+ .globl atomic_add_ret_unchecked
4370+ .type atomic_add_ret_unchecked,#function
4371+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4372+ BACKOFF_SETUP(%o2)
4373+1: lduw [%o1], %g1
4374+ addcc %g1, %o0, %g7
4375+ cas [%o1], %g1, %g7
4376+ cmp %g1, %g7
4377+ bne,pn %icc, 2f
4378+ add %g7, %o0, %g7
4379+ sra %g7, 0, %o0
4380+ retl
4381+ nop
4382+2: BACKOFF_SPIN(%o2, %o3, 1b)
4383+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4384+
4385 .globl atomic_sub_ret
4386 .type atomic_sub_ret,#function
4387 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4388 BACKOFF_SETUP(%o2)
4389 1: lduw [%o1], %g1
4390- sub %g1, %o0, %g7
4391+ subcc %g1, %o0, %g7
4392+
4393+#ifdef CONFIG_PAX_REFCOUNT
4394+ tvs %icc, 6
4395+#endif
4396+
4397 cas [%o1], %g1, %g7
4398 cmp %g1, %g7
4399 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4400@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4401 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4402 BACKOFF_SETUP(%o2)
4403 1: ldx [%o1], %g1
4404- add %g1, %o0, %g7
4405+ addcc %g1, %o0, %g7
4406+
4407+#ifdef CONFIG_PAX_REFCOUNT
4408+ tvs %xcc, 6
4409+#endif
4410+
4411 casx [%o1], %g1, %g7
4412 cmp %g1, %g7
4413 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4414@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4415 2: BACKOFF_SPIN(%o2, %o3, 1b)
4416 .size atomic64_add, .-atomic64_add
4417
4418+ .globl atomic64_add_unchecked
4419+ .type atomic64_add_unchecked,#function
4420+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4421+ BACKOFF_SETUP(%o2)
4422+1: ldx [%o1], %g1
4423+ addcc %g1, %o0, %g7
4424+ casx [%o1], %g1, %g7
4425+ cmp %g1, %g7
4426+ bne,pn %xcc, 2f
4427+ nop
4428+ retl
4429+ nop
4430+2: BACKOFF_SPIN(%o2, %o3, 1b)
4431+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
4432+
4433 .globl atomic64_sub
4434 .type atomic64_sub,#function
4435 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4436 BACKOFF_SETUP(%o2)
4437 1: ldx [%o1], %g1
4438- sub %g1, %o0, %g7
4439+ subcc %g1, %o0, %g7
4440+
4441+#ifdef CONFIG_PAX_REFCOUNT
4442+ tvs %xcc, 6
4443+#endif
4444+
4445 casx [%o1], %g1, %g7
4446 cmp %g1, %g7
4447 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4448@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4449 2: BACKOFF_SPIN(%o2, %o3, 1b)
4450 .size atomic64_sub, .-atomic64_sub
4451
4452+ .globl atomic64_sub_unchecked
4453+ .type atomic64_sub_unchecked,#function
4454+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4455+ BACKOFF_SETUP(%o2)
4456+1: ldx [%o1], %g1
4457+ subcc %g1, %o0, %g7
4458+ casx [%o1], %g1, %g7
4459+ cmp %g1, %g7
4460+ bne,pn %xcc, 2f
4461+ nop
4462+ retl
4463+ nop
4464+2: BACKOFF_SPIN(%o2, %o3, 1b)
4465+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
4466+
4467 .globl atomic64_add_ret
4468 .type atomic64_add_ret,#function
4469 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4470 BACKOFF_SETUP(%o2)
4471 1: ldx [%o1], %g1
4472- add %g1, %o0, %g7
4473+ addcc %g1, %o0, %g7
4474+
4475+#ifdef CONFIG_PAX_REFCOUNT
4476+ tvs %xcc, 6
4477+#endif
4478+
4479 casx [%o1], %g1, %g7
4480 cmp %g1, %g7
4481 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4482@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4483 2: BACKOFF_SPIN(%o2, %o3, 1b)
4484 .size atomic64_add_ret, .-atomic64_add_ret
4485
4486+ .globl atomic64_add_ret_unchecked
4487+ .type atomic64_add_ret_unchecked,#function
4488+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4489+ BACKOFF_SETUP(%o2)
4490+1: ldx [%o1], %g1
4491+ addcc %g1, %o0, %g7
4492+ casx [%o1], %g1, %g7
4493+ cmp %g1, %g7
4494+ bne,pn %xcc, 2f
4495+ add %g7, %o0, %g7
4496+ mov %g7, %o0
4497+ retl
4498+ nop
4499+2: BACKOFF_SPIN(%o2, %o3, 1b)
4500+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4501+
4502 .globl atomic64_sub_ret
4503 .type atomic64_sub_ret,#function
4504 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4505 BACKOFF_SETUP(%o2)
4506 1: ldx [%o1], %g1
4507- sub %g1, %o0, %g7
4508+ subcc %g1, %o0, %g7
4509+
4510+#ifdef CONFIG_PAX_REFCOUNT
4511+ tvs %xcc, 6
4512+#endif
4513+
4514 casx [%o1], %g1, %g7
4515 cmp %g1, %g7
4516 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4517diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
4518index 1b30bb3..b4a16c7 100644
4519--- a/arch/sparc/lib/ksyms.c
4520+++ b/arch/sparc/lib/ksyms.c
4521@@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4522
4523 /* Atomic counter implementation. */
4524 EXPORT_SYMBOL(atomic_add);
4525+EXPORT_SYMBOL(atomic_add_unchecked);
4526 EXPORT_SYMBOL(atomic_add_ret);
4527+EXPORT_SYMBOL(atomic_add_ret_unchecked);
4528 EXPORT_SYMBOL(atomic_sub);
4529+EXPORT_SYMBOL(atomic_sub_unchecked);
4530 EXPORT_SYMBOL(atomic_sub_ret);
4531 EXPORT_SYMBOL(atomic64_add);
4532+EXPORT_SYMBOL(atomic64_add_unchecked);
4533 EXPORT_SYMBOL(atomic64_add_ret);
4534+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4535 EXPORT_SYMBOL(atomic64_sub);
4536+EXPORT_SYMBOL(atomic64_sub_unchecked);
4537 EXPORT_SYMBOL(atomic64_sub_ret);
4538
4539 /* Atomic bit operations. */
4540diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
4541index 301421c..e2535d1 100644
4542--- a/arch/sparc/mm/Makefile
4543+++ b/arch/sparc/mm/Makefile
4544@@ -2,7 +2,7 @@
4545 #
4546
4547 asflags-y := -ansi
4548-ccflags-y := -Werror
4549+#ccflags-y := -Werror
4550
4551 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
4552 obj-y += fault_$(BITS).o
4553diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
4554index aa1c1b1..f93e28f 100644
4555--- a/arch/sparc/mm/fault_32.c
4556+++ b/arch/sparc/mm/fault_32.c
4557@@ -22,6 +22,9 @@
4558 #include <linux/interrupt.h>
4559 #include <linux/module.h>
4560 #include <linux/kdebug.h>
4561+#include <linux/slab.h>
4562+#include <linux/pagemap.h>
4563+#include <linux/compiler.h>
4564
4565 #include <asm/system.h>
4566 #include <asm/page.h>
4567@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
4568 return safe_compute_effective_address(regs, insn);
4569 }
4570
4571+#ifdef CONFIG_PAX_PAGEEXEC
4572+#ifdef CONFIG_PAX_DLRESOLVE
4573+static void pax_emuplt_close(struct vm_area_struct *vma)
4574+{
4575+ vma->vm_mm->call_dl_resolve = 0UL;
4576+}
4577+
4578+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4579+{
4580+ unsigned int *kaddr;
4581+
4582+ vmf->page = alloc_page(GFP_HIGHUSER);
4583+ if (!vmf->page)
4584+ return VM_FAULT_OOM;
4585+
4586+ kaddr = kmap(vmf->page);
4587+ memset(kaddr, 0, PAGE_SIZE);
4588+ kaddr[0] = 0x9DE3BFA8U; /* save */
4589+ flush_dcache_page(vmf->page);
4590+ kunmap(vmf->page);
4591+ return VM_FAULT_MAJOR;
4592+}
4593+
4594+static const struct vm_operations_struct pax_vm_ops = {
4595+ .close = pax_emuplt_close,
4596+ .fault = pax_emuplt_fault
4597+};
4598+
4599+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4600+{
4601+ int ret;
4602+
4603+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4604+ vma->vm_mm = current->mm;
4605+ vma->vm_start = addr;
4606+ vma->vm_end = addr + PAGE_SIZE;
4607+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4608+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4609+ vma->vm_ops = &pax_vm_ops;
4610+
4611+ ret = insert_vm_struct(current->mm, vma);
4612+ if (ret)
4613+ return ret;
4614+
4615+ ++current->mm->total_vm;
4616+ return 0;
4617+}
4618+#endif
4619+
4620+/*
4621+ * PaX: decide what to do with offenders (regs->pc = fault address)
4622+ *
4623+ * returns 1 when task should be killed
4624+ * 2 when patched PLT trampoline was detected
4625+ * 3 when unpatched PLT trampoline was detected
4626+ */
4627+static int pax_handle_fetch_fault(struct pt_regs *regs)
4628+{
4629+
4630+#ifdef CONFIG_PAX_EMUPLT
4631+ int err;
4632+
4633+ do { /* PaX: patched PLT emulation #1 */
4634+ unsigned int sethi1, sethi2, jmpl;
4635+
4636+ err = get_user(sethi1, (unsigned int *)regs->pc);
4637+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4638+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4639+
4640+ if (err)
4641+ break;
4642+
4643+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4644+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4645+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4646+ {
4647+ unsigned int addr;
4648+
4649+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4650+ addr = regs->u_regs[UREG_G1];
4651+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4652+ regs->pc = addr;
4653+ regs->npc = addr+4;
4654+ return 2;
4655+ }
4656+ } while (0);
4657+
4658+ { /* PaX: patched PLT emulation #2 */
4659+ unsigned int ba;
4660+
4661+ err = get_user(ba, (unsigned int *)regs->pc);
4662+
4663+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4664+ unsigned int addr;
4665+
4666+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4667+ regs->pc = addr;
4668+ regs->npc = addr+4;
4669+ return 2;
4670+ }
4671+ }
4672+
4673+ do { /* PaX: patched PLT emulation #3 */
4674+ unsigned int sethi, jmpl, nop;
4675+
4676+ err = get_user(sethi, (unsigned int *)regs->pc);
4677+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4678+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4679+
4680+ if (err)
4681+ break;
4682+
4683+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4684+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4685+ nop == 0x01000000U)
4686+ {
4687+ unsigned int addr;
4688+
4689+ addr = (sethi & 0x003FFFFFU) << 10;
4690+ regs->u_regs[UREG_G1] = addr;
4691+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4692+ regs->pc = addr;
4693+ regs->npc = addr+4;
4694+ return 2;
4695+ }
4696+ } while (0);
4697+
4698+ do { /* PaX: unpatched PLT emulation step 1 */
4699+ unsigned int sethi, ba, nop;
4700+
4701+ err = get_user(sethi, (unsigned int *)regs->pc);
4702+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
4703+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4704+
4705+ if (err)
4706+ break;
4707+
4708+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4709+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4710+ nop == 0x01000000U)
4711+ {
4712+ unsigned int addr, save, call;
4713+
4714+ if ((ba & 0xFFC00000U) == 0x30800000U)
4715+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4716+ else
4717+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4718+
4719+ err = get_user(save, (unsigned int *)addr);
4720+ err |= get_user(call, (unsigned int *)(addr+4));
4721+ err |= get_user(nop, (unsigned int *)(addr+8));
4722+ if (err)
4723+ break;
4724+
4725+#ifdef CONFIG_PAX_DLRESOLVE
4726+ if (save == 0x9DE3BFA8U &&
4727+ (call & 0xC0000000U) == 0x40000000U &&
4728+ nop == 0x01000000U)
4729+ {
4730+ struct vm_area_struct *vma;
4731+ unsigned long call_dl_resolve;
4732+
4733+ down_read(&current->mm->mmap_sem);
4734+ call_dl_resolve = current->mm->call_dl_resolve;
4735+ up_read(&current->mm->mmap_sem);
4736+ if (likely(call_dl_resolve))
4737+ goto emulate;
4738+
4739+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4740+
4741+ down_write(&current->mm->mmap_sem);
4742+ if (current->mm->call_dl_resolve) {
4743+ call_dl_resolve = current->mm->call_dl_resolve;
4744+ up_write(&current->mm->mmap_sem);
4745+ if (vma)
4746+ kmem_cache_free(vm_area_cachep, vma);
4747+ goto emulate;
4748+ }
4749+
4750+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4751+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4752+ up_write(&current->mm->mmap_sem);
4753+ if (vma)
4754+ kmem_cache_free(vm_area_cachep, vma);
4755+ return 1;
4756+ }
4757+
4758+ if (pax_insert_vma(vma, call_dl_resolve)) {
4759+ up_write(&current->mm->mmap_sem);
4760+ kmem_cache_free(vm_area_cachep, vma);
4761+ return 1;
4762+ }
4763+
4764+ current->mm->call_dl_resolve = call_dl_resolve;
4765+ up_write(&current->mm->mmap_sem);
4766+
4767+emulate:
4768+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4769+ regs->pc = call_dl_resolve;
4770+ regs->npc = addr+4;
4771+ return 3;
4772+ }
4773+#endif
4774+
4775+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4776+ if ((save & 0xFFC00000U) == 0x05000000U &&
4777+ (call & 0xFFFFE000U) == 0x85C0A000U &&
4778+ nop == 0x01000000U)
4779+ {
4780+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4781+ regs->u_regs[UREG_G2] = addr + 4;
4782+ addr = (save & 0x003FFFFFU) << 10;
4783+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4784+ regs->pc = addr;
4785+ regs->npc = addr+4;
4786+ return 3;
4787+ }
4788+ }
4789+ } while (0);
4790+
4791+ do { /* PaX: unpatched PLT emulation step 2 */
4792+ unsigned int save, call, nop;
4793+
4794+ err = get_user(save, (unsigned int *)(regs->pc-4));
4795+ err |= get_user(call, (unsigned int *)regs->pc);
4796+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
4797+ if (err)
4798+ break;
4799+
4800+ if (save == 0x9DE3BFA8U &&
4801+ (call & 0xC0000000U) == 0x40000000U &&
4802+ nop == 0x01000000U)
4803+ {
4804+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4805+
4806+ regs->u_regs[UREG_RETPC] = regs->pc;
4807+ regs->pc = dl_resolve;
4808+ regs->npc = dl_resolve+4;
4809+ return 3;
4810+ }
4811+ } while (0);
4812+#endif
4813+
4814+ return 1;
4815+}
4816+
4817+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4818+{
4819+ unsigned long i;
4820+
4821+ printk(KERN_ERR "PAX: bytes at PC: ");
4822+ for (i = 0; i < 8; i++) {
4823+ unsigned int c;
4824+ if (get_user(c, (unsigned int *)pc+i))
4825+ printk(KERN_CONT "???????? ");
4826+ else
4827+ printk(KERN_CONT "%08x ", c);
4828+ }
4829+ printk("\n");
4830+}
4831+#endif
4832+
4833 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4834 int text_fault)
4835 {
4836@@ -281,6 +546,24 @@ good_area:
4837 if(!(vma->vm_flags & VM_WRITE))
4838 goto bad_area;
4839 } else {
4840+
4841+#ifdef CONFIG_PAX_PAGEEXEC
4842+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4843+ up_read(&mm->mmap_sem);
4844+ switch (pax_handle_fetch_fault(regs)) {
4845+
4846+#ifdef CONFIG_PAX_EMUPLT
4847+ case 2:
4848+ case 3:
4849+ return;
4850+#endif
4851+
4852+ }
4853+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4854+ do_group_exit(SIGKILL);
4855+ }
4856+#endif
4857+
4858 /* Allow reads even for write-only mappings */
4859 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4860 goto bad_area;
4861diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
4862index 504c062..6fcb9c6 100644
4863--- a/arch/sparc/mm/fault_64.c
4864+++ b/arch/sparc/mm/fault_64.c
4865@@ -21,6 +21,9 @@
4866 #include <linux/kprobes.h>
4867 #include <linux/kdebug.h>
4868 #include <linux/percpu.h>
4869+#include <linux/slab.h>
4870+#include <linux/pagemap.h>
4871+#include <linux/compiler.h>
4872
4873 #include <asm/page.h>
4874 #include <asm/pgtable.h>
4875@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
4876 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4877 regs->tpc);
4878 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4879- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4880+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4881 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4882 dump_stack();
4883 unhandled_fault(regs->tpc, current, regs);
4884@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
4885 show_regs(regs);
4886 }
4887
4888+#ifdef CONFIG_PAX_PAGEEXEC
4889+#ifdef CONFIG_PAX_DLRESOLVE
4890+static void pax_emuplt_close(struct vm_area_struct *vma)
4891+{
4892+ vma->vm_mm->call_dl_resolve = 0UL;
4893+}
4894+
4895+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4896+{
4897+ unsigned int *kaddr;
4898+
4899+ vmf->page = alloc_page(GFP_HIGHUSER);
4900+ if (!vmf->page)
4901+ return VM_FAULT_OOM;
4902+
4903+ kaddr = kmap(vmf->page);
4904+ memset(kaddr, 0, PAGE_SIZE);
4905+ kaddr[0] = 0x9DE3BFA8U; /* save */
4906+ flush_dcache_page(vmf->page);
4907+ kunmap(vmf->page);
4908+ return VM_FAULT_MAJOR;
4909+}
4910+
4911+static const struct vm_operations_struct pax_vm_ops = {
4912+ .close = pax_emuplt_close,
4913+ .fault = pax_emuplt_fault
4914+};
4915+
4916+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4917+{
4918+ int ret;
4919+
4920+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4921+ vma->vm_mm = current->mm;
4922+ vma->vm_start = addr;
4923+ vma->vm_end = addr + PAGE_SIZE;
4924+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4925+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4926+ vma->vm_ops = &pax_vm_ops;
4927+
4928+ ret = insert_vm_struct(current->mm, vma);
4929+ if (ret)
4930+ return ret;
4931+
4932+ ++current->mm->total_vm;
4933+ return 0;
4934+}
4935+#endif
4936+
4937+/*
4938+ * PaX: decide what to do with offenders (regs->tpc = fault address)
4939+ *
4940+ * returns 1 when task should be killed
4941+ * 2 when patched PLT trampoline was detected
4942+ * 3 when unpatched PLT trampoline was detected
4943+ */
4944+static int pax_handle_fetch_fault(struct pt_regs *regs)
4945+{
4946+
4947+#ifdef CONFIG_PAX_EMUPLT
4948+ int err;
4949+
4950+ do { /* PaX: patched PLT emulation #1 */
4951+ unsigned int sethi1, sethi2, jmpl;
4952+
4953+ err = get_user(sethi1, (unsigned int *)regs->tpc);
4954+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4955+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4956+
4957+ if (err)
4958+ break;
4959+
4960+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4961+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4962+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4963+ {
4964+ unsigned long addr;
4965+
4966+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4967+ addr = regs->u_regs[UREG_G1];
4968+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4969+
4970+ if (test_thread_flag(TIF_32BIT))
4971+ addr &= 0xFFFFFFFFUL;
4972+
4973+ regs->tpc = addr;
4974+ regs->tnpc = addr+4;
4975+ return 2;
4976+ }
4977+ } while (0);
4978+
4979+ { /* PaX: patched PLT emulation #2 */
4980+ unsigned int ba;
4981+
4982+ err = get_user(ba, (unsigned int *)regs->tpc);
4983+
4984+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4985+ unsigned long addr;
4986+
4987+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4988+
4989+ if (test_thread_flag(TIF_32BIT))
4990+ addr &= 0xFFFFFFFFUL;
4991+
4992+ regs->tpc = addr;
4993+ regs->tnpc = addr+4;
4994+ return 2;
4995+ }
4996+ }
4997+
4998+ do { /* PaX: patched PLT emulation #3 */
4999+ unsigned int sethi, jmpl, nop;
5000+
5001+ err = get_user(sethi, (unsigned int *)regs->tpc);
5002+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5003+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5004+
5005+ if (err)
5006+ break;
5007+
5008+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5009+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5010+ nop == 0x01000000U)
5011+ {
5012+ unsigned long addr;
5013+
5014+ addr = (sethi & 0x003FFFFFU) << 10;
5015+ regs->u_regs[UREG_G1] = addr;
5016+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5017+
5018+ if (test_thread_flag(TIF_32BIT))
5019+ addr &= 0xFFFFFFFFUL;
5020+
5021+ regs->tpc = addr;
5022+ regs->tnpc = addr+4;
5023+ return 2;
5024+ }
5025+ } while (0);
5026+
5027+ do { /* PaX: patched PLT emulation #4 */
5028+ unsigned int sethi, mov1, call, mov2;
5029+
5030+ err = get_user(sethi, (unsigned int *)regs->tpc);
5031+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5032+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
5033+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5034+
5035+ if (err)
5036+ break;
5037+
5038+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5039+ mov1 == 0x8210000FU &&
5040+ (call & 0xC0000000U) == 0x40000000U &&
5041+ mov2 == 0x9E100001U)
5042+ {
5043+ unsigned long addr;
5044+
5045+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5046+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5047+
5048+ if (test_thread_flag(TIF_32BIT))
5049+ addr &= 0xFFFFFFFFUL;
5050+
5051+ regs->tpc = addr;
5052+ regs->tnpc = addr+4;
5053+ return 2;
5054+ }
5055+ } while (0);
5056+
5057+ do { /* PaX: patched PLT emulation #5 */
5058+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5059+
5060+ err = get_user(sethi, (unsigned int *)regs->tpc);
5061+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5062+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5063+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5064+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5065+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5066+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5067+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5068+
5069+ if (err)
5070+ break;
5071+
5072+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5073+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5074+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5075+ (or1 & 0xFFFFE000U) == 0x82106000U &&
5076+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5077+ sllx == 0x83287020U &&
5078+ jmpl == 0x81C04005U &&
5079+ nop == 0x01000000U)
5080+ {
5081+ unsigned long addr;
5082+
5083+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5084+ regs->u_regs[UREG_G1] <<= 32;
5085+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5086+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5087+ regs->tpc = addr;
5088+ regs->tnpc = addr+4;
5089+ return 2;
5090+ }
5091+ } while (0);
5092+
5093+ do { /* PaX: patched PLT emulation #6 */
5094+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5095+
5096+ err = get_user(sethi, (unsigned int *)regs->tpc);
5097+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5098+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5099+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5100+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
5101+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5102+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5103+
5104+ if (err)
5105+ break;
5106+
5107+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5108+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5109+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5110+ sllx == 0x83287020U &&
5111+ (or & 0xFFFFE000U) == 0x8A116000U &&
5112+ jmpl == 0x81C04005U &&
5113+ nop == 0x01000000U)
5114+ {
5115+ unsigned long addr;
5116+
5117+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5118+ regs->u_regs[UREG_G1] <<= 32;
5119+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5120+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5121+ regs->tpc = addr;
5122+ regs->tnpc = addr+4;
5123+ return 2;
5124+ }
5125+ } while (0);
5126+
5127+ do { /* PaX: unpatched PLT emulation step 1 */
5128+ unsigned int sethi, ba, nop;
5129+
5130+ err = get_user(sethi, (unsigned int *)regs->tpc);
5131+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5132+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5133+
5134+ if (err)
5135+ break;
5136+
5137+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5138+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5139+ nop == 0x01000000U)
5140+ {
5141+ unsigned long addr;
5142+ unsigned int save, call;
5143+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5144+
5145+ if ((ba & 0xFFC00000U) == 0x30800000U)
5146+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5147+ else
5148+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5149+
5150+ if (test_thread_flag(TIF_32BIT))
5151+ addr &= 0xFFFFFFFFUL;
5152+
5153+ err = get_user(save, (unsigned int *)addr);
5154+ err |= get_user(call, (unsigned int *)(addr+4));
5155+ err |= get_user(nop, (unsigned int *)(addr+8));
5156+ if (err)
5157+ break;
5158+
5159+#ifdef CONFIG_PAX_DLRESOLVE
5160+ if (save == 0x9DE3BFA8U &&
5161+ (call & 0xC0000000U) == 0x40000000U &&
5162+ nop == 0x01000000U)
5163+ {
5164+ struct vm_area_struct *vma;
5165+ unsigned long call_dl_resolve;
5166+
5167+ down_read(&current->mm->mmap_sem);
5168+ call_dl_resolve = current->mm->call_dl_resolve;
5169+ up_read(&current->mm->mmap_sem);
5170+ if (likely(call_dl_resolve))
5171+ goto emulate;
5172+
5173+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5174+
5175+ down_write(&current->mm->mmap_sem);
5176+ if (current->mm->call_dl_resolve) {
5177+ call_dl_resolve = current->mm->call_dl_resolve;
5178+ up_write(&current->mm->mmap_sem);
5179+ if (vma)
5180+ kmem_cache_free(vm_area_cachep, vma);
5181+ goto emulate;
5182+ }
5183+
5184+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5185+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5186+ up_write(&current->mm->mmap_sem);
5187+ if (vma)
5188+ kmem_cache_free(vm_area_cachep, vma);
5189+ return 1;
5190+ }
5191+
5192+ if (pax_insert_vma(vma, call_dl_resolve)) {
5193+ up_write(&current->mm->mmap_sem);
5194+ kmem_cache_free(vm_area_cachep, vma);
5195+ return 1;
5196+ }
5197+
5198+ current->mm->call_dl_resolve = call_dl_resolve;
5199+ up_write(&current->mm->mmap_sem);
5200+
5201+emulate:
5202+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5203+ regs->tpc = call_dl_resolve;
5204+ regs->tnpc = addr+4;
5205+ return 3;
5206+ }
5207+#endif
5208+
5209+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5210+ if ((save & 0xFFC00000U) == 0x05000000U &&
5211+ (call & 0xFFFFE000U) == 0x85C0A000U &&
5212+ nop == 0x01000000U)
5213+ {
5214+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5215+ regs->u_regs[UREG_G2] = addr + 4;
5216+ addr = (save & 0x003FFFFFU) << 10;
5217+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5218+
5219+ if (test_thread_flag(TIF_32BIT))
5220+ addr &= 0xFFFFFFFFUL;
5221+
5222+ regs->tpc = addr;
5223+ regs->tnpc = addr+4;
5224+ return 3;
5225+ }
5226+
5227+ /* PaX: 64-bit PLT stub */
5228+ err = get_user(sethi1, (unsigned int *)addr);
5229+ err |= get_user(sethi2, (unsigned int *)(addr+4));
5230+ err |= get_user(or1, (unsigned int *)(addr+8));
5231+ err |= get_user(or2, (unsigned int *)(addr+12));
5232+ err |= get_user(sllx, (unsigned int *)(addr+16));
5233+ err |= get_user(add, (unsigned int *)(addr+20));
5234+ err |= get_user(jmpl, (unsigned int *)(addr+24));
5235+ err |= get_user(nop, (unsigned int *)(addr+28));
5236+ if (err)
5237+ break;
5238+
5239+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5240+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5241+ (or1 & 0xFFFFE000U) == 0x88112000U &&
5242+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5243+ sllx == 0x89293020U &&
5244+ add == 0x8A010005U &&
5245+ jmpl == 0x89C14000U &&
5246+ nop == 0x01000000U)
5247+ {
5248+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5249+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5250+ regs->u_regs[UREG_G4] <<= 32;
5251+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5252+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5253+ regs->u_regs[UREG_G4] = addr + 24;
5254+ addr = regs->u_regs[UREG_G5];
5255+ regs->tpc = addr;
5256+ regs->tnpc = addr+4;
5257+ return 3;
5258+ }
5259+ }
5260+ } while (0);
5261+
5262+#ifdef CONFIG_PAX_DLRESOLVE
5263+ do { /* PaX: unpatched PLT emulation step 2 */
5264+ unsigned int save, call, nop;
5265+
5266+ err = get_user(save, (unsigned int *)(regs->tpc-4));
5267+ err |= get_user(call, (unsigned int *)regs->tpc);
5268+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5269+ if (err)
5270+ break;
5271+
5272+ if (save == 0x9DE3BFA8U &&
5273+ (call & 0xC0000000U) == 0x40000000U &&
5274+ nop == 0x01000000U)
5275+ {
5276+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5277+
5278+ if (test_thread_flag(TIF_32BIT))
5279+ dl_resolve &= 0xFFFFFFFFUL;
5280+
5281+ regs->u_regs[UREG_RETPC] = regs->tpc;
5282+ regs->tpc = dl_resolve;
5283+ regs->tnpc = dl_resolve+4;
5284+ return 3;
5285+ }
5286+ } while (0);
5287+#endif
5288+
5289+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5290+ unsigned int sethi, ba, nop;
5291+
5292+ err = get_user(sethi, (unsigned int *)regs->tpc);
5293+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5294+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5295+
5296+ if (err)
5297+ break;
5298+
5299+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5300+ (ba & 0xFFF00000U) == 0x30600000U &&
5301+ nop == 0x01000000U)
5302+ {
5303+ unsigned long addr;
5304+
5305+ addr = (sethi & 0x003FFFFFU) << 10;
5306+ regs->u_regs[UREG_G1] = addr;
5307+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5308+
5309+ if (test_thread_flag(TIF_32BIT))
5310+ addr &= 0xFFFFFFFFUL;
5311+
5312+ regs->tpc = addr;
5313+ regs->tnpc = addr+4;
5314+ return 2;
5315+ }
5316+ } while (0);
5317+
5318+#endif
5319+
5320+ return 1;
5321+}
5322+
5323+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5324+{
5325+ unsigned long i;
5326+
5327+ printk(KERN_ERR "PAX: bytes at PC: ");
5328+ for (i = 0; i < 8; i++) {
5329+ unsigned int c;
5330+ if (get_user(c, (unsigned int *)pc+i))
5331+ printk(KERN_CONT "???????? ");
5332+ else
5333+ printk(KERN_CONT "%08x ", c);
5334+ }
5335+ printk("\n");
5336+}
5337+#endif
5338+
5339 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5340 {
5341 struct mm_struct *mm = current->mm;
5342@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5343 if (!vma)
5344 goto bad_area;
5345
5346+#ifdef CONFIG_PAX_PAGEEXEC
5347+ /* PaX: detect ITLB misses on non-exec pages */
5348+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5349+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5350+ {
5351+ if (address != regs->tpc)
5352+ goto good_area;
5353+
5354+ up_read(&mm->mmap_sem);
5355+ switch (pax_handle_fetch_fault(regs)) {
5356+
5357+#ifdef CONFIG_PAX_EMUPLT
5358+ case 2:
5359+ case 3:
5360+ return;
5361+#endif
5362+
5363+ }
5364+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
5365+ do_group_exit(SIGKILL);
5366+ }
5367+#endif
5368+
5369 /* Pure DTLB misses do not tell us whether the fault causing
5370 * load/store/atomic was a write or not, it only says that there
5371 * was no match. So in such a case we (carefully) read the
5372diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
5373index f4e9764..5682724 100644
5374--- a/arch/sparc/mm/hugetlbpage.c
5375+++ b/arch/sparc/mm/hugetlbpage.c
5376@@ -68,7 +68,7 @@ full_search:
5377 }
5378 return -ENOMEM;
5379 }
5380- if (likely(!vma || addr + len <= vma->vm_start)) {
5381+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5382 /*
5383 * Remember the place where we stopped the search:
5384 */
5385@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5386 /* make sure it can fit in the remaining address space */
5387 if (likely(addr > len)) {
5388 vma = find_vma(mm, addr-len);
5389- if (!vma || addr <= vma->vm_start) {
5390+ if (check_heap_stack_gap(vma, addr - len, len)) {
5391 /* remember the address as a hint for next time */
5392 return (mm->free_area_cache = addr-len);
5393 }
5394@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5395 if (unlikely(mm->mmap_base < len))
5396 goto bottomup;
5397
5398- addr = (mm->mmap_base-len) & HPAGE_MASK;
5399+ addr = mm->mmap_base - len;
5400
5401 do {
5402+ addr &= HPAGE_MASK;
5403 /*
5404 * Lookup failure means no vma is above this address,
5405 * else if new region fits below vma->vm_start,
5406 * return with success:
5407 */
5408 vma = find_vma(mm, addr);
5409- if (likely(!vma || addr+len <= vma->vm_start)) {
5410+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5411 /* remember the address as a hint for next time */
5412 return (mm->free_area_cache = addr);
5413 }
5414@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5415 mm->cached_hole_size = vma->vm_start - addr;
5416
5417 /* try just below the current vma->vm_start */
5418- addr = (vma->vm_start-len) & HPAGE_MASK;
5419- } while (likely(len < vma->vm_start));
5420+ addr = skip_heap_stack_gap(vma, len);
5421+ } while (!IS_ERR_VALUE(addr));
5422
5423 bottomup:
5424 /*
5425@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
5426 if (addr) {
5427 addr = ALIGN(addr, HPAGE_SIZE);
5428 vma = find_vma(mm, addr);
5429- if (task_size - len >= addr &&
5430- (!vma || addr + len <= vma->vm_start))
5431+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5432 return addr;
5433 }
5434 if (mm->get_unmapped_area == arch_get_unmapped_area)
5435diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
5436index 7b00de6..78239f4 100644
5437--- a/arch/sparc/mm/init_32.c
5438+++ b/arch/sparc/mm/init_32.c
5439@@ -316,6 +316,9 @@ extern void device_scan(void);
5440 pgprot_t PAGE_SHARED __read_mostly;
5441 EXPORT_SYMBOL(PAGE_SHARED);
5442
5443+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
5444+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
5445+
5446 void __init paging_init(void)
5447 {
5448 switch(sparc_cpu_model) {
5449@@ -344,17 +347,17 @@ void __init paging_init(void)
5450
5451 /* Initialize the protection map with non-constant, MMU dependent values. */
5452 protection_map[0] = PAGE_NONE;
5453- protection_map[1] = PAGE_READONLY;
5454- protection_map[2] = PAGE_COPY;
5455- protection_map[3] = PAGE_COPY;
5456+ protection_map[1] = PAGE_READONLY_NOEXEC;
5457+ protection_map[2] = PAGE_COPY_NOEXEC;
5458+ protection_map[3] = PAGE_COPY_NOEXEC;
5459 protection_map[4] = PAGE_READONLY;
5460 protection_map[5] = PAGE_READONLY;
5461 protection_map[6] = PAGE_COPY;
5462 protection_map[7] = PAGE_COPY;
5463 protection_map[8] = PAGE_NONE;
5464- protection_map[9] = PAGE_READONLY;
5465- protection_map[10] = PAGE_SHARED;
5466- protection_map[11] = PAGE_SHARED;
5467+ protection_map[9] = PAGE_READONLY_NOEXEC;
5468+ protection_map[10] = PAGE_SHARED_NOEXEC;
5469+ protection_map[11] = PAGE_SHARED_NOEXEC;
5470 protection_map[12] = PAGE_READONLY;
5471 protection_map[13] = PAGE_READONLY;
5472 protection_map[14] = PAGE_SHARED;
5473diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
5474index cbef74e..c38fead 100644
5475--- a/arch/sparc/mm/srmmu.c
5476+++ b/arch/sparc/mm/srmmu.c
5477@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5478 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5479 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5480 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5481+
5482+#ifdef CONFIG_PAX_PAGEEXEC
5483+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5484+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5485+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5486+#endif
5487+
5488 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5489 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5490
5491diff --git a/arch/um/Makefile b/arch/um/Makefile
5492index c0f712c..3a5c4c9 100644
5493--- a/arch/um/Makefile
5494+++ b/arch/um/Makefile
5495@@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
5496 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5497 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5498
5499+ifdef CONSTIFY_PLUGIN
5500+USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5501+endif
5502+
5503 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5504
5505 #This will adjust *FLAGS accordingly to the platform.
5506diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
5507index 6c03acd..a5e0215 100644
5508--- a/arch/um/include/asm/kmap_types.h
5509+++ b/arch/um/include/asm/kmap_types.h
5510@@ -23,6 +23,7 @@ enum km_type {
5511 KM_IRQ1,
5512 KM_SOFTIRQ0,
5513 KM_SOFTIRQ1,
5514+ KM_CLEARPAGE,
5515 KM_TYPE_NR
5516 };
5517
5518diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
5519index 4cc9b6c..02e5029 100644
5520--- a/arch/um/include/asm/page.h
5521+++ b/arch/um/include/asm/page.h
5522@@ -14,6 +14,9 @@
5523 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5524 #define PAGE_MASK (~(PAGE_SIZE-1))
5525
5526+#define ktla_ktva(addr) (addr)
5527+#define ktva_ktla(addr) (addr)
5528+
5529 #ifndef __ASSEMBLY__
5530
5531 struct page;
5532diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
5533index 21c1ae7..4640aaa 100644
5534--- a/arch/um/kernel/process.c
5535+++ b/arch/um/kernel/process.c
5536@@ -404,22 +404,6 @@ int singlestepping(void * t)
5537 return 2;
5538 }
5539
5540-/*
5541- * Only x86 and x86_64 have an arch_align_stack().
5542- * All other arches have "#define arch_align_stack(x) (x)"
5543- * in their asm/system.h
5544- * As this is included in UML from asm-um/system-generic.h,
5545- * we can use it to behave as the subarch does.
5546- */
5547-#ifndef arch_align_stack
5548-unsigned long arch_align_stack(unsigned long sp)
5549-{
5550- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5551- sp -= get_random_int() % 8192;
5552- return sp & ~0xf;
5553-}
5554-#endif
5555-
5556 unsigned long get_wchan(struct task_struct *p)
5557 {
5558 unsigned long stack_page, sp, ip;
5559diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
5560index d1b93c4..ae1b7fd 100644
5561--- a/arch/um/sys-i386/shared/sysdep/system.h
5562+++ b/arch/um/sys-i386/shared/sysdep/system.h
5563@@ -17,7 +17,7 @@
5564 # define AT_VECTOR_SIZE_ARCH 1
5565 #endif
5566
5567-extern unsigned long arch_align_stack(unsigned long sp);
5568+#define arch_align_stack(x) ((x) & ~0xfUL)
5569
5570 void default_idle(void);
5571
5572diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
5573index 70ca357..728d1cc 100644
5574--- a/arch/um/sys-i386/syscalls.c
5575+++ b/arch/um/sys-i386/syscalls.c
5576@@ -11,6 +11,21 @@
5577 #include "asm/uaccess.h"
5578 #include "asm/unistd.h"
5579
5580+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5581+{
5582+ unsigned long pax_task_size = TASK_SIZE;
5583+
5584+#ifdef CONFIG_PAX_SEGMEXEC
5585+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5586+ pax_task_size = SEGMEXEC_TASK_SIZE;
5587+#endif
5588+
5589+ if (len > pax_task_size || addr > pax_task_size - len)
5590+ return -EINVAL;
5591+
5592+ return 0;
5593+}
5594+
5595 /*
5596 * The prototype on i386 is:
5597 *
5598diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
5599index d1b93c4..ae1b7fd 100644
5600--- a/arch/um/sys-x86_64/shared/sysdep/system.h
5601+++ b/arch/um/sys-x86_64/shared/sysdep/system.h
5602@@ -17,7 +17,7 @@
5603 # define AT_VECTOR_SIZE_ARCH 1
5604 #endif
5605
5606-extern unsigned long arch_align_stack(unsigned long sp);
5607+#define arch_align_stack(x) ((x) & ~0xfUL)
5608
5609 void default_idle(void);
5610
5611diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
5612index 6a47bb2..dc9a868 100644
5613--- a/arch/x86/Kconfig
5614+++ b/arch/x86/Kconfig
5615@@ -236,7 +236,7 @@ config X86_HT
5616
5617 config X86_32_LAZY_GS
5618 def_bool y
5619- depends on X86_32 && !CC_STACKPROTECTOR
5620+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
5621
5622 config ARCH_HWEIGHT_CFLAGS
5623 string
5624@@ -1019,7 +1019,7 @@ choice
5625
5626 config NOHIGHMEM
5627 bool "off"
5628- depends on !X86_NUMAQ
5629+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5630 ---help---
5631 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
5632 However, the address space of 32-bit x86 processors is only 4
5633@@ -1056,7 +1056,7 @@ config NOHIGHMEM
5634
5635 config HIGHMEM4G
5636 bool "4GB"
5637- depends on !X86_NUMAQ
5638+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5639 ---help---
5640 Select this if you have a 32-bit processor and between 1 and 4
5641 gigabytes of physical RAM.
5642@@ -1110,7 +1110,7 @@ config PAGE_OFFSET
5643 hex
5644 default 0xB0000000 if VMSPLIT_3G_OPT
5645 default 0x80000000 if VMSPLIT_2G
5646- default 0x78000000 if VMSPLIT_2G_OPT
5647+ default 0x70000000 if VMSPLIT_2G_OPT
5648 default 0x40000000 if VMSPLIT_1G
5649 default 0xC0000000
5650 depends on X86_32
5651@@ -1484,6 +1484,7 @@ config SECCOMP
5652
5653 config CC_STACKPROTECTOR
5654 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
5655+ depends on X86_64 || !PAX_MEMORY_UDEREF
5656 ---help---
5657 This option turns on the -fstack-protector GCC feature. This
5658 feature puts, at the beginning of functions, a canary value on
5659@@ -1541,6 +1542,7 @@ config KEXEC_JUMP
5660 config PHYSICAL_START
5661 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
5662 default "0x1000000"
5663+ range 0x400000 0x40000000
5664 ---help---
5665 This gives the physical address where the kernel is loaded.
5666
5667@@ -1604,6 +1606,7 @@ config X86_NEED_RELOCS
5668 config PHYSICAL_ALIGN
5669 hex "Alignment value to which kernel should be aligned" if X86_32
5670 default "0x1000000"
5671+ range 0x400000 0x1000000 if PAX_KERNEXEC
5672 range 0x2000 0x1000000
5673 ---help---
5674 This value puts the alignment restrictions on physical address
5675@@ -1635,9 +1638,10 @@ config HOTPLUG_CPU
5676 Say N if you want to disable CPU hotplug.
5677
5678 config COMPAT_VDSO
5679- def_bool y
5680+ def_bool n
5681 prompt "Compat VDSO support"
5682 depends on X86_32 || IA32_EMULATION
5683+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
5684 ---help---
5685 Map the 32-bit VDSO to the predictable old-style address too.
5686
5687diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
5688index e3ca7e0..b30b28a 100644
5689--- a/arch/x86/Kconfig.cpu
5690+++ b/arch/x86/Kconfig.cpu
5691@@ -341,7 +341,7 @@ config X86_PPRO_FENCE
5692
5693 config X86_F00F_BUG
5694 def_bool y
5695- depends on M586MMX || M586TSC || M586 || M486 || M386
5696+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
5697
5698 config X86_INVD_BUG
5699 def_bool y
5700@@ -365,7 +365,7 @@ config X86_POPAD_OK
5701
5702 config X86_ALIGNMENT_16
5703 def_bool y
5704- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5705+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5706
5707 config X86_INTEL_USERCOPY
5708 def_bool y
5709@@ -411,7 +411,7 @@ config X86_CMPXCHG64
5710 # generates cmov.
5711 config X86_CMOV
5712 def_bool y
5713- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5714+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5715
5716 config X86_MINIMUM_CPU_FAMILY
5717 int
5718diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
5719index c0f8a5c..6404f61 100644
5720--- a/arch/x86/Kconfig.debug
5721+++ b/arch/x86/Kconfig.debug
5722@@ -81,7 +81,7 @@ config X86_PTDUMP
5723 config DEBUG_RODATA
5724 bool "Write protect kernel read-only data structures"
5725 default y
5726- depends on DEBUG_KERNEL
5727+ depends on DEBUG_KERNEL && BROKEN
5728 ---help---
5729 Mark the kernel read-only data as write-protected in the pagetables,
5730 in order to catch accidental (and incorrect) writes to such const
5731@@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
5732
5733 config DEBUG_SET_MODULE_RONX
5734 bool "Set loadable kernel module data as NX and text as RO"
5735- depends on MODULES
5736+ depends on MODULES && BROKEN
5737 ---help---
5738 This option helps catch unintended modifications to loadable
5739 kernel module's text and read-only data. It also prevents execution
5740diff --git a/arch/x86/Makefile b/arch/x86/Makefile
5741index b02e509..2631e48 100644
5742--- a/arch/x86/Makefile
5743+++ b/arch/x86/Makefile
5744@@ -46,6 +46,7 @@ else
5745 UTS_MACHINE := x86_64
5746 CHECKFLAGS += -D__x86_64__ -m64
5747
5748+ biarch := $(call cc-option,-m64)
5749 KBUILD_AFLAGS += -m64
5750 KBUILD_CFLAGS += -m64
5751
5752@@ -195,3 +196,12 @@ define archhelp
5753 echo ' FDARGS="..." arguments for the booted kernel'
5754 echo ' FDINITRD=file initrd for the booted kernel'
5755 endef
5756+
5757+define OLD_LD
5758+
5759+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
5760+*** Please upgrade your binutils to 2.18 or newer
5761+endef
5762+
5763+archprepare:
5764+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
5765diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
5766index 95365a8..52f857b 100644
5767--- a/arch/x86/boot/Makefile
5768+++ b/arch/x86/boot/Makefile
5769@@ -63,6 +63,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
5770 $(call cc-option, -fno-stack-protector) \
5771 $(call cc-option, -mpreferred-stack-boundary=2)
5772 KBUILD_CFLAGS += $(call cc-option, -m32)
5773+ifdef CONSTIFY_PLUGIN
5774+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5775+endif
5776 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5777 GCOV_PROFILE := n
5778
5779diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
5780index 878e4b9..20537ab 100644
5781--- a/arch/x86/boot/bitops.h
5782+++ b/arch/x86/boot/bitops.h
5783@@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5784 u8 v;
5785 const u32 *p = (const u32 *)addr;
5786
5787- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5788+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5789 return v;
5790 }
5791
5792@@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5793
5794 static inline void set_bit(int nr, void *addr)
5795 {
5796- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5797+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5798 }
5799
5800 #endif /* BOOT_BITOPS_H */
5801diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
5802index c7093bd..d4247ffe0 100644
5803--- a/arch/x86/boot/boot.h
5804+++ b/arch/x86/boot/boot.h
5805@@ -85,7 +85,7 @@ static inline void io_delay(void)
5806 static inline u16 ds(void)
5807 {
5808 u16 seg;
5809- asm("movw %%ds,%0" : "=rm" (seg));
5810+ asm volatile("movw %%ds,%0" : "=rm" (seg));
5811 return seg;
5812 }
5813
5814@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t addr)
5815 static inline int memcmp(const void *s1, const void *s2, size_t len)
5816 {
5817 u8 diff;
5818- asm("repe; cmpsb; setnz %0"
5819+ asm volatile("repe; cmpsb; setnz %0"
5820 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5821 return diff;
5822 }
5823diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
5824index 09664ef..edc5d03 100644
5825--- a/arch/x86/boot/compressed/Makefile
5826+++ b/arch/x86/boot/compressed/Makefile
5827@@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
5828 KBUILD_CFLAGS += $(cflags-y)
5829 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5830 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5831+ifdef CONSTIFY_PLUGIN
5832+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5833+endif
5834
5835 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5836 GCOV_PROFILE := n
5837diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
5838index 67a655a..b924059 100644
5839--- a/arch/x86/boot/compressed/head_32.S
5840+++ b/arch/x86/boot/compressed/head_32.S
5841@@ -76,7 +76,7 @@ ENTRY(startup_32)
5842 notl %eax
5843 andl %eax, %ebx
5844 #else
5845- movl $LOAD_PHYSICAL_ADDR, %ebx
5846+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5847 #endif
5848
5849 /* Target address to relocate to for decompression */
5850@@ -162,7 +162,7 @@ relocated:
5851 * and where it was actually loaded.
5852 */
5853 movl %ebp, %ebx
5854- subl $LOAD_PHYSICAL_ADDR, %ebx
5855+ subl $____LOAD_PHYSICAL_ADDR, %ebx
5856 jz 2f /* Nothing to be done if loaded at compiled addr. */
5857 /*
5858 * Process relocations.
5859@@ -170,8 +170,7 @@ relocated:
5860
5861 1: subl $4, %edi
5862 movl (%edi), %ecx
5863- testl %ecx, %ecx
5864- jz 2f
5865+ jecxz 2f
5866 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5867 jmp 1b
5868 2:
5869diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
5870index 35af09d..99c9676 100644
5871--- a/arch/x86/boot/compressed/head_64.S
5872+++ b/arch/x86/boot/compressed/head_64.S
5873@@ -91,7 +91,7 @@ ENTRY(startup_32)
5874 notl %eax
5875 andl %eax, %ebx
5876 #else
5877- movl $LOAD_PHYSICAL_ADDR, %ebx
5878+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5879 #endif
5880
5881 /* Target address to relocate to for decompression */
5882@@ -233,7 +233,7 @@ ENTRY(startup_64)
5883 notq %rax
5884 andq %rax, %rbp
5885 #else
5886- movq $LOAD_PHYSICAL_ADDR, %rbp
5887+ movq $____LOAD_PHYSICAL_ADDR, %rbp
5888 #endif
5889
5890 /* Target address to relocate to for decompression */
5891diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
5892index 3a19d04..7c1d55a 100644
5893--- a/arch/x86/boot/compressed/misc.c
5894+++ b/arch/x86/boot/compressed/misc.c
5895@@ -310,7 +310,7 @@ static void parse_elf(void *output)
5896 case PT_LOAD:
5897 #ifdef CONFIG_RELOCATABLE
5898 dest = output;
5899- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5900+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5901 #else
5902 dest = (void *)(phdr->p_paddr);
5903 #endif
5904@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
5905 error("Destination address too large");
5906 #endif
5907 #ifndef CONFIG_RELOCATABLE
5908- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5909+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5910 error("Wrong destination address");
5911 #endif
5912
5913diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
5914index 89bbf4e..869908e 100644
5915--- a/arch/x86/boot/compressed/relocs.c
5916+++ b/arch/x86/boot/compressed/relocs.c
5917@@ -13,8 +13,11 @@
5918
5919 static void die(char *fmt, ...);
5920
5921+#include "../../../../include/generated/autoconf.h"
5922+
5923 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5924 static Elf32_Ehdr ehdr;
5925+static Elf32_Phdr *phdr;
5926 static unsigned long reloc_count, reloc_idx;
5927 static unsigned long *relocs;
5928
5929@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5930 }
5931 }
5932
5933+static void read_phdrs(FILE *fp)
5934+{
5935+ unsigned int i;
5936+
5937+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5938+ if (!phdr) {
5939+ die("Unable to allocate %d program headers\n",
5940+ ehdr.e_phnum);
5941+ }
5942+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5943+ die("Seek to %d failed: %s\n",
5944+ ehdr.e_phoff, strerror(errno));
5945+ }
5946+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5947+ die("Cannot read ELF program headers: %s\n",
5948+ strerror(errno));
5949+ }
5950+ for(i = 0; i < ehdr.e_phnum; i++) {
5951+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5952+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5953+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5954+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5955+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5956+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5957+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5958+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5959+ }
5960+
5961+}
5962+
5963 static void read_shdrs(FILE *fp)
5964 {
5965- int i;
5966+ unsigned int i;
5967 Elf32_Shdr shdr;
5968
5969 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5970@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5971
5972 static void read_strtabs(FILE *fp)
5973 {
5974- int i;
5975+ unsigned int i;
5976 for (i = 0; i < ehdr.e_shnum; i++) {
5977 struct section *sec = &secs[i];
5978 if (sec->shdr.sh_type != SHT_STRTAB) {
5979@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5980
5981 static void read_symtabs(FILE *fp)
5982 {
5983- int i,j;
5984+ unsigned int i,j;
5985 for (i = 0; i < ehdr.e_shnum; i++) {
5986 struct section *sec = &secs[i];
5987 if (sec->shdr.sh_type != SHT_SYMTAB) {
5988@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5989
5990 static void read_relocs(FILE *fp)
5991 {
5992- int i,j;
5993+ unsigned int i,j;
5994+ uint32_t base;
5995+
5996 for (i = 0; i < ehdr.e_shnum; i++) {
5997 struct section *sec = &secs[i];
5998 if (sec->shdr.sh_type != SHT_REL) {
5999@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
6000 die("Cannot read symbol table: %s\n",
6001 strerror(errno));
6002 }
6003+ base = 0;
6004+ for (j = 0; j < ehdr.e_phnum; j++) {
6005+ if (phdr[j].p_type != PT_LOAD )
6006+ continue;
6007+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6008+ continue;
6009+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6010+ break;
6011+ }
6012 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6013 Elf32_Rel *rel = &sec->reltab[j];
6014- rel->r_offset = elf32_to_cpu(rel->r_offset);
6015+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6016 rel->r_info = elf32_to_cpu(rel->r_info);
6017 }
6018 }
6019@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
6020
6021 static void print_absolute_symbols(void)
6022 {
6023- int i;
6024+ unsigned int i;
6025 printf("Absolute symbols\n");
6026 printf(" Num: Value Size Type Bind Visibility Name\n");
6027 for (i = 0; i < ehdr.e_shnum; i++) {
6028 struct section *sec = &secs[i];
6029 char *sym_strtab;
6030 Elf32_Sym *sh_symtab;
6031- int j;
6032+ unsigned int j;
6033
6034 if (sec->shdr.sh_type != SHT_SYMTAB) {
6035 continue;
6036@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
6037
6038 static void print_absolute_relocs(void)
6039 {
6040- int i, printed = 0;
6041+ unsigned int i, printed = 0;
6042
6043 for (i = 0; i < ehdr.e_shnum; i++) {
6044 struct section *sec = &secs[i];
6045 struct section *sec_applies, *sec_symtab;
6046 char *sym_strtab;
6047 Elf32_Sym *sh_symtab;
6048- int j;
6049+ unsigned int j;
6050 if (sec->shdr.sh_type != SHT_REL) {
6051 continue;
6052 }
6053@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
6054
6055 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6056 {
6057- int i;
6058+ unsigned int i;
6059 /* Walk through the relocations */
6060 for (i = 0; i < ehdr.e_shnum; i++) {
6061 char *sym_strtab;
6062 Elf32_Sym *sh_symtab;
6063 struct section *sec_applies, *sec_symtab;
6064- int j;
6065+ unsigned int j;
6066 struct section *sec = &secs[i];
6067
6068 if (sec->shdr.sh_type != SHT_REL) {
6069@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6070 !is_rel_reloc(sym_name(sym_strtab, sym))) {
6071 continue;
6072 }
6073+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6074+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6075+ continue;
6076+
6077+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6078+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6079+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6080+ continue;
6081+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6082+ continue;
6083+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6084+ continue;
6085+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6086+ continue;
6087+#endif
6088+
6089 switch (r_type) {
6090 case R_386_NONE:
6091 case R_386_PC32:
6092@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, const void *vb)
6093
6094 static void emit_relocs(int as_text)
6095 {
6096- int i;
6097+ unsigned int i;
6098 /* Count how many relocations I have and allocate space for them. */
6099 reloc_count = 0;
6100 walk_relocs(count_reloc);
6101@@ -665,6 +725,7 @@ int main(int argc, char **argv)
6102 fname, strerror(errno));
6103 }
6104 read_ehdr(fp);
6105+ read_phdrs(fp);
6106 read_shdrs(fp);
6107 read_strtabs(fp);
6108 read_symtabs(fp);
6109diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
6110index 4d3ff03..e4972ff 100644
6111--- a/arch/x86/boot/cpucheck.c
6112+++ b/arch/x86/boot/cpucheck.c
6113@@ -74,7 +74,7 @@ static int has_fpu(void)
6114 u16 fcw = -1, fsw = -1;
6115 u32 cr0;
6116
6117- asm("movl %%cr0,%0" : "=r" (cr0));
6118+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
6119 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6120 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6121 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6122@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6123 {
6124 u32 f0, f1;
6125
6126- asm("pushfl ; "
6127+ asm volatile("pushfl ; "
6128 "pushfl ; "
6129 "popl %0 ; "
6130 "movl %0,%1 ; "
6131@@ -115,7 +115,7 @@ static void get_flags(void)
6132 set_bit(X86_FEATURE_FPU, cpu.flags);
6133
6134 if (has_eflag(X86_EFLAGS_ID)) {
6135- asm("cpuid"
6136+ asm volatile("cpuid"
6137 : "=a" (max_intel_level),
6138 "=b" (cpu_vendor[0]),
6139 "=d" (cpu_vendor[1]),
6140@@ -124,7 +124,7 @@ static void get_flags(void)
6141
6142 if (max_intel_level >= 0x00000001 &&
6143 max_intel_level <= 0x0000ffff) {
6144- asm("cpuid"
6145+ asm volatile("cpuid"
6146 : "=a" (tfms),
6147 "=c" (cpu.flags[4]),
6148 "=d" (cpu.flags[0])
6149@@ -136,7 +136,7 @@ static void get_flags(void)
6150 cpu.model += ((tfms >> 16) & 0xf) << 4;
6151 }
6152
6153- asm("cpuid"
6154+ asm volatile("cpuid"
6155 : "=a" (max_amd_level)
6156 : "a" (0x80000000)
6157 : "ebx", "ecx", "edx");
6158@@ -144,7 +144,7 @@ static void get_flags(void)
6159 if (max_amd_level >= 0x80000001 &&
6160 max_amd_level <= 0x8000ffff) {
6161 u32 eax = 0x80000001;
6162- asm("cpuid"
6163+ asm volatile("cpuid"
6164 : "+a" (eax),
6165 "=c" (cpu.flags[6]),
6166 "=d" (cpu.flags[1])
6167@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6168 u32 ecx = MSR_K7_HWCR;
6169 u32 eax, edx;
6170
6171- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6172+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6173 eax &= ~(1 << 15);
6174- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6175+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6176
6177 get_flags(); /* Make sure it really did something */
6178 err = check_flags();
6179@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6180 u32 ecx = MSR_VIA_FCR;
6181 u32 eax, edx;
6182
6183- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6184+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6185 eax |= (1<<1)|(1<<7);
6186- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6187+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6188
6189 set_bit(X86_FEATURE_CX8, cpu.flags);
6190 err = check_flags();
6191@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6192 u32 eax, edx;
6193 u32 level = 1;
6194
6195- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6196- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6197- asm("cpuid"
6198+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6199+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6200+ asm volatile("cpuid"
6201 : "+a" (level), "=d" (cpu.flags[0])
6202 : : "ecx", "ebx");
6203- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6204+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6205
6206 err = check_flags();
6207 }
6208diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
6209index 93e689f..504ba09 100644
6210--- a/arch/x86/boot/header.S
6211+++ b/arch/x86/boot/header.S
6212@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to
6213 # single linked list of
6214 # struct setup_data
6215
6216-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6217+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6218
6219 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6220 #define VO_INIT_SIZE (VO__end - VO__text)
6221diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
6222index db75d07..8e6d0af 100644
6223--- a/arch/x86/boot/memory.c
6224+++ b/arch/x86/boot/memory.c
6225@@ -19,7 +19,7 @@
6226
6227 static int detect_memory_e820(void)
6228 {
6229- int count = 0;
6230+ unsigned int count = 0;
6231 struct biosregs ireg, oreg;
6232 struct e820entry *desc = boot_params.e820_map;
6233 static struct e820entry buf; /* static so it is zeroed */
6234diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
6235index 11e8c6e..fdbb1ed 100644
6236--- a/arch/x86/boot/video-vesa.c
6237+++ b/arch/x86/boot/video-vesa.c
6238@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6239
6240 boot_params.screen_info.vesapm_seg = oreg.es;
6241 boot_params.screen_info.vesapm_off = oreg.di;
6242+ boot_params.screen_info.vesapm_size = oreg.cx;
6243 }
6244
6245 /*
6246diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
6247index 43eda28..5ab5fdb 100644
6248--- a/arch/x86/boot/video.c
6249+++ b/arch/x86/boot/video.c
6250@@ -96,7 +96,7 @@ static void store_mode_params(void)
6251 static unsigned int get_entry(void)
6252 {
6253 char entry_buf[4];
6254- int i, len = 0;
6255+ unsigned int i, len = 0;
6256 int key;
6257 unsigned int v;
6258
6259diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
6260index 5b577d5..3c1fed4 100644
6261--- a/arch/x86/crypto/aes-x86_64-asm_64.S
6262+++ b/arch/x86/crypto/aes-x86_64-asm_64.S
6263@@ -8,6 +8,8 @@
6264 * including this sentence is retained in full.
6265 */
6266
6267+#include <asm/alternative-asm.h>
6268+
6269 .extern crypto_ft_tab
6270 .extern crypto_it_tab
6271 .extern crypto_fl_tab
6272@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6273 je B192; \
6274 leaq 32(r9),r9;
6275
6276+#define ret pax_force_retaddr 0, 1; ret
6277+
6278 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6279 movq r1,r2; \
6280 movq r3,r4; \
6281diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
6282index be6d9e3..21fbbca 100644
6283--- a/arch/x86/crypto/aesni-intel_asm.S
6284+++ b/arch/x86/crypto/aesni-intel_asm.S
6285@@ -31,6 +31,7 @@
6286
6287 #include <linux/linkage.h>
6288 #include <asm/inst.h>
6289+#include <asm/alternative-asm.h>
6290
6291 #ifdef __x86_64__
6292 .data
6293@@ -1436,7 +1437,9 @@ _return_T_done_decrypt:
6294 pop %r14
6295 pop %r13
6296 pop %r12
6297+ pax_force_retaddr 0, 1
6298 ret
6299+ENDPROC(aesni_gcm_dec)
6300
6301
6302 /*****************************************************************************
6303@@ -1699,7 +1702,9 @@ _return_T_done_encrypt:
6304 pop %r14
6305 pop %r13
6306 pop %r12
6307+ pax_force_retaddr 0, 1
6308 ret
6309+ENDPROC(aesni_gcm_enc)
6310
6311 #endif
6312
6313@@ -1714,6 +1719,7 @@ _key_expansion_256a:
6314 pxor %xmm1, %xmm0
6315 movaps %xmm0, (TKEYP)
6316 add $0x10, TKEYP
6317+ pax_force_retaddr_bts
6318 ret
6319
6320 .align 4
6321@@ -1738,6 +1744,7 @@ _key_expansion_192a:
6322 shufps $0b01001110, %xmm2, %xmm1
6323 movaps %xmm1, 0x10(TKEYP)
6324 add $0x20, TKEYP
6325+ pax_force_retaddr_bts
6326 ret
6327
6328 .align 4
6329@@ -1757,6 +1764,7 @@ _key_expansion_192b:
6330
6331 movaps %xmm0, (TKEYP)
6332 add $0x10, TKEYP
6333+ pax_force_retaddr_bts
6334 ret
6335
6336 .align 4
6337@@ -1769,6 +1777,7 @@ _key_expansion_256b:
6338 pxor %xmm1, %xmm2
6339 movaps %xmm2, (TKEYP)
6340 add $0x10, TKEYP
6341+ pax_force_retaddr_bts
6342 ret
6343
6344 /*
6345@@ -1881,7 +1890,9 @@ ENTRY(aesni_set_key)
6346 #ifndef __x86_64__
6347 popl KEYP
6348 #endif
6349+ pax_force_retaddr 0, 1
6350 ret
6351+ENDPROC(aesni_set_key)
6352
6353 /*
6354 * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
6355@@ -1902,7 +1913,9 @@ ENTRY(aesni_enc)
6356 popl KLEN
6357 popl KEYP
6358 #endif
6359+ pax_force_retaddr 0, 1
6360 ret
6361+ENDPROC(aesni_enc)
6362
6363 /*
6364 * _aesni_enc1: internal ABI
6365@@ -1959,6 +1972,7 @@ _aesni_enc1:
6366 AESENC KEY STATE
6367 movaps 0x70(TKEYP), KEY
6368 AESENCLAST KEY STATE
6369+ pax_force_retaddr_bts
6370 ret
6371
6372 /*
6373@@ -2067,6 +2081,7 @@ _aesni_enc4:
6374 AESENCLAST KEY STATE2
6375 AESENCLAST KEY STATE3
6376 AESENCLAST KEY STATE4
6377+ pax_force_retaddr_bts
6378 ret
6379
6380 /*
6381@@ -2089,7 +2104,9 @@ ENTRY(aesni_dec)
6382 popl KLEN
6383 popl KEYP
6384 #endif
6385+ pax_force_retaddr 0, 1
6386 ret
6387+ENDPROC(aesni_dec)
6388
6389 /*
6390 * _aesni_dec1: internal ABI
6391@@ -2146,6 +2163,7 @@ _aesni_dec1:
6392 AESDEC KEY STATE
6393 movaps 0x70(TKEYP), KEY
6394 AESDECLAST KEY STATE
6395+ pax_force_retaddr_bts
6396 ret
6397
6398 /*
6399@@ -2254,6 +2272,7 @@ _aesni_dec4:
6400 AESDECLAST KEY STATE2
6401 AESDECLAST KEY STATE3
6402 AESDECLAST KEY STATE4
6403+ pax_force_retaddr_bts
6404 ret
6405
6406 /*
6407@@ -2311,7 +2330,9 @@ ENTRY(aesni_ecb_enc)
6408 popl KEYP
6409 popl LEN
6410 #endif
6411+ pax_force_retaddr 0, 1
6412 ret
6413+ENDPROC(aesni_ecb_enc)
6414
6415 /*
6416 * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6417@@ -2369,7 +2390,9 @@ ENTRY(aesni_ecb_dec)
6418 popl KEYP
6419 popl LEN
6420 #endif
6421+ pax_force_retaddr 0, 1
6422 ret
6423+ENDPROC(aesni_ecb_dec)
6424
6425 /*
6426 * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6427@@ -2410,7 +2433,9 @@ ENTRY(aesni_cbc_enc)
6428 popl LEN
6429 popl IVP
6430 #endif
6431+ pax_force_retaddr 0, 1
6432 ret
6433+ENDPROC(aesni_cbc_enc)
6434
6435 /*
6436 * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6437@@ -2498,7 +2523,9 @@ ENTRY(aesni_cbc_dec)
6438 popl LEN
6439 popl IVP
6440 #endif
6441+ pax_force_retaddr 0, 1
6442 ret
6443+ENDPROC(aesni_cbc_dec)
6444
6445 #ifdef __x86_64__
6446 .align 16
6447@@ -2524,6 +2551,7 @@ _aesni_inc_init:
6448 mov $1, TCTR_LOW
6449 MOVQ_R64_XMM TCTR_LOW INC
6450 MOVQ_R64_XMM CTR TCTR_LOW
6451+ pax_force_retaddr_bts
6452 ret
6453
6454 /*
6455@@ -2552,6 +2580,7 @@ _aesni_inc:
6456 .Linc_low:
6457 movaps CTR, IV
6458 PSHUFB_XMM BSWAP_MASK IV
6459+ pax_force_retaddr_bts
6460 ret
6461
6462 /*
6463@@ -2612,5 +2641,7 @@ ENTRY(aesni_ctr_enc)
6464 .Lctr_enc_ret:
6465 movups IV, (IVP)
6466 .Lctr_enc_just_ret:
6467+ pax_force_retaddr 0, 1
6468 ret
6469+ENDPROC(aesni_ctr_enc)
6470 #endif
6471diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6472index 6214a9b..1f4fc9a 100644
6473--- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
6474+++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6475@@ -1,3 +1,5 @@
6476+#include <asm/alternative-asm.h>
6477+
6478 # enter ECRYPT_encrypt_bytes
6479 .text
6480 .p2align 5
6481@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6482 add %r11,%rsp
6483 mov %rdi,%rax
6484 mov %rsi,%rdx
6485+ pax_force_retaddr 0, 1
6486 ret
6487 # bytesatleast65:
6488 ._bytesatleast65:
6489@@ -891,6 +894,7 @@ ECRYPT_keysetup:
6490 add %r11,%rsp
6491 mov %rdi,%rax
6492 mov %rsi,%rdx
6493+ pax_force_retaddr
6494 ret
6495 # enter ECRYPT_ivsetup
6496 .text
6497@@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6498 add %r11,%rsp
6499 mov %rdi,%rax
6500 mov %rsi,%rdx
6501+ pax_force_retaddr
6502 ret
6503diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
6504index 573aa10..b73ad89 100644
6505--- a/arch/x86/crypto/twofish-x86_64-asm_64.S
6506+++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
6507@@ -21,6 +21,7 @@
6508 .text
6509
6510 #include <asm/asm-offsets.h>
6511+#include <asm/alternative-asm.h>
6512
6513 #define a_offset 0
6514 #define b_offset 4
6515@@ -269,6 +270,7 @@ twofish_enc_blk:
6516
6517 popq R1
6518 movq $1,%rax
6519+ pax_force_retaddr 0, 1
6520 ret
6521
6522 twofish_dec_blk:
6523@@ -321,4 +323,5 @@ twofish_dec_blk:
6524
6525 popq R1
6526 movq $1,%rax
6527+ pax_force_retaddr 0, 1
6528 ret
6529diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
6530index fd84387..0b4af7d 100644
6531--- a/arch/x86/ia32/ia32_aout.c
6532+++ b/arch/x86/ia32/ia32_aout.c
6533@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
6534 unsigned long dump_start, dump_size;
6535 struct user32 dump;
6536
6537+ memset(&dump, 0, sizeof(dump));
6538+
6539 fs = get_fs();
6540 set_fs(KERNEL_DS);
6541 has_dumped = 1;
6542diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
6543index 6557769..ef6ae89 100644
6544--- a/arch/x86/ia32/ia32_signal.c
6545+++ b/arch/x86/ia32/ia32_signal.c
6546@@ -169,7 +169,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
6547 }
6548 seg = get_fs();
6549 set_fs(KERNEL_DS);
6550- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
6551+ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
6552 set_fs(seg);
6553 if (ret >= 0 && uoss_ptr) {
6554 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
6555@@ -370,7 +370,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
6556 */
6557 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6558 size_t frame_size,
6559- void **fpstate)
6560+ void __user **fpstate)
6561 {
6562 unsigned long sp;
6563
6564@@ -391,7 +391,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6565
6566 if (used_math()) {
6567 sp = sp - sig_xstate_ia32_size;
6568- *fpstate = (struct _fpstate_ia32 *) sp;
6569+ *fpstate = (struct _fpstate_ia32 __user *) sp;
6570 if (save_i387_xstate_ia32(*fpstate) < 0)
6571 return (void __user *) -1L;
6572 }
6573@@ -399,7 +399,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6574 sp -= frame_size;
6575 /* Align the stack pointer according to the i386 ABI,
6576 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
6577- sp = ((sp + 4) & -16ul) - 4;
6578+ sp = ((sp - 12) & -16ul) - 4;
6579 return (void __user *) sp;
6580 }
6581
6582@@ -457,7 +457,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
6583 * These are actually not used anymore, but left because some
6584 * gdb versions depend on them as a marker.
6585 */
6586- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6587+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6588 } put_user_catch(err);
6589
6590 if (err)
6591@@ -499,7 +499,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6592 0xb8,
6593 __NR_ia32_rt_sigreturn,
6594 0x80cd,
6595- 0,
6596+ 0
6597 };
6598
6599 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
6600@@ -529,16 +529,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6601
6602 if (ka->sa.sa_flags & SA_RESTORER)
6603 restorer = ka->sa.sa_restorer;
6604+ else if (current->mm->context.vdso)
6605+ /* Return stub is in 32bit vsyscall page */
6606+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6607 else
6608- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
6609- rt_sigreturn);
6610+ restorer = &frame->retcode;
6611 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
6612
6613 /*
6614 * Not actually used anymore, but left because some gdb
6615 * versions need it.
6616 */
6617- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6618+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6619 } put_user_catch(err);
6620
6621 if (err)
6622diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
6623index 54edb207..f5101b9 100644
6624--- a/arch/x86/ia32/ia32entry.S
6625+++ b/arch/x86/ia32/ia32entry.S
6626@@ -13,7 +13,9 @@
6627 #include <asm/thread_info.h>
6628 #include <asm/segment.h>
6629 #include <asm/irqflags.h>
6630+#include <asm/pgtable.h>
6631 #include <linux/linkage.h>
6632+#include <asm/alternative-asm.h>
6633
6634 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6635 #include <linux/elf-em.h>
6636@@ -95,6 +97,32 @@ ENTRY(native_irq_enable_sysexit)
6637 ENDPROC(native_irq_enable_sysexit)
6638 #endif
6639
6640+ .macro pax_enter_kernel_user
6641+ pax_set_fptr_mask
6642+#ifdef CONFIG_PAX_MEMORY_UDEREF
6643+ call pax_enter_kernel_user
6644+#endif
6645+ .endm
6646+
6647+ .macro pax_exit_kernel_user
6648+#ifdef CONFIG_PAX_MEMORY_UDEREF
6649+ call pax_exit_kernel_user
6650+#endif
6651+#ifdef CONFIG_PAX_RANDKSTACK
6652+ pushq %rax
6653+ pushq %r11
6654+ call pax_randomize_kstack
6655+ popq %r11
6656+ popq %rax
6657+#endif
6658+ .endm
6659+
6660+.macro pax_erase_kstack
6661+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6662+ call pax_erase_kstack
6663+#endif
6664+.endm
6665+
6666 /*
6667 * 32bit SYSENTER instruction entry.
6668 *
6669@@ -121,12 +149,6 @@ ENTRY(ia32_sysenter_target)
6670 CFI_REGISTER rsp,rbp
6671 SWAPGS_UNSAFE_STACK
6672 movq PER_CPU_VAR(kernel_stack), %rsp
6673- addq $(KERNEL_STACK_OFFSET),%rsp
6674- /*
6675- * No need to follow this irqs on/off section: the syscall
6676- * disabled irqs, here we enable it straight after entry:
6677- */
6678- ENABLE_INTERRUPTS(CLBR_NONE)
6679 movl %ebp,%ebp /* zero extension */
6680 pushq_cfi $__USER32_DS
6681 /*CFI_REL_OFFSET ss,0*/
6682@@ -134,25 +156,38 @@ ENTRY(ia32_sysenter_target)
6683 CFI_REL_OFFSET rsp,0
6684 pushfq_cfi
6685 /*CFI_REL_OFFSET rflags,0*/
6686- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6687- CFI_REGISTER rip,r10
6688+ GET_THREAD_INFO(%r11)
6689+ movl TI_sysenter_return(%r11), %r11d
6690+ CFI_REGISTER rip,r11
6691 pushq_cfi $__USER32_CS
6692 /*CFI_REL_OFFSET cs,0*/
6693 movl %eax, %eax
6694- pushq_cfi %r10
6695+ pushq_cfi %r11
6696 CFI_REL_OFFSET rip,0
6697 pushq_cfi %rax
6698 cld
6699 SAVE_ARGS 0,1,0
6700+ pax_enter_kernel_user
6701+ /*
6702+ * No need to follow this irqs on/off section: the syscall
6703+ * disabled irqs, here we enable it straight after entry:
6704+ */
6705+ ENABLE_INTERRUPTS(CLBR_NONE)
6706 /* no need to do an access_ok check here because rbp has been
6707 32bit zero extended */
6708+
6709+#ifdef CONFIG_PAX_MEMORY_UDEREF
6710+ mov $PAX_USER_SHADOW_BASE,%r11
6711+ add %r11,%rbp
6712+#endif
6713+
6714 1: movl (%rbp),%ebp
6715 .section __ex_table,"a"
6716 .quad 1b,ia32_badarg
6717 .previous
6718- GET_THREAD_INFO(%r10)
6719- orl $TS_COMPAT,TI_status(%r10)
6720- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6721+ GET_THREAD_INFO(%r11)
6722+ orl $TS_COMPAT,TI_status(%r11)
6723+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6724 CFI_REMEMBER_STATE
6725 jnz sysenter_tracesys
6726 cmpq $(IA32_NR_syscalls-1),%rax
6727@@ -162,13 +197,15 @@ sysenter_do_call:
6728 sysenter_dispatch:
6729 call *ia32_sys_call_table(,%rax,8)
6730 movq %rax,RAX-ARGOFFSET(%rsp)
6731- GET_THREAD_INFO(%r10)
6732+ GET_THREAD_INFO(%r11)
6733 DISABLE_INTERRUPTS(CLBR_NONE)
6734 TRACE_IRQS_OFF
6735- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6736+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6737 jnz sysexit_audit
6738 sysexit_from_sys_call:
6739- andl $~TS_COMPAT,TI_status(%r10)
6740+ pax_exit_kernel_user
6741+ pax_erase_kstack
6742+ andl $~TS_COMPAT,TI_status(%r11)
6743 /* clear IF, that popfq doesn't enable interrupts early */
6744 andl $~0x200,EFLAGS-R11(%rsp)
6745 movl RIP-R11(%rsp),%edx /* User %eip */
6746@@ -194,6 +231,9 @@ sysexit_from_sys_call:
6747 movl %eax,%esi /* 2nd arg: syscall number */
6748 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6749 call audit_syscall_entry
6750+
6751+ pax_erase_kstack
6752+
6753 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6754 cmpq $(IA32_NR_syscalls-1),%rax
6755 ja ia32_badsys
6756@@ -205,7 +245,7 @@ sysexit_from_sys_call:
6757 .endm
6758
6759 .macro auditsys_exit exit
6760- testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6761+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6762 jnz ia32_ret_from_sys_call
6763 TRACE_IRQS_ON
6764 sti
6765@@ -215,12 +255,12 @@ sysexit_from_sys_call:
6766 movzbl %al,%edi /* zero-extend that into %edi */
6767 inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
6768 call audit_syscall_exit
6769- GET_THREAD_INFO(%r10)
6770+ GET_THREAD_INFO(%r11)
6771 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
6772 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
6773 cli
6774 TRACE_IRQS_OFF
6775- testl %edi,TI_flags(%r10)
6776+ testl %edi,TI_flags(%r11)
6777 jz \exit
6778 CLEAR_RREGS -ARGOFFSET
6779 jmp int_with_check
6780@@ -238,7 +278,7 @@ sysexit_audit:
6781
6782 sysenter_tracesys:
6783 #ifdef CONFIG_AUDITSYSCALL
6784- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6785+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6786 jz sysenter_auditsys
6787 #endif
6788 SAVE_REST
6789@@ -246,6 +286,9 @@ sysenter_tracesys:
6790 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6791 movq %rsp,%rdi /* &pt_regs -> arg1 */
6792 call syscall_trace_enter
6793+
6794+ pax_erase_kstack
6795+
6796 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6797 RESTORE_REST
6798 cmpq $(IA32_NR_syscalls-1),%rax
6799@@ -277,19 +320,20 @@ ENDPROC(ia32_sysenter_target)
6800 ENTRY(ia32_cstar_target)
6801 CFI_STARTPROC32 simple
6802 CFI_SIGNAL_FRAME
6803- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6804+ CFI_DEF_CFA rsp,0
6805 CFI_REGISTER rip,rcx
6806 /*CFI_REGISTER rflags,r11*/
6807 SWAPGS_UNSAFE_STACK
6808 movl %esp,%r8d
6809 CFI_REGISTER rsp,r8
6810 movq PER_CPU_VAR(kernel_stack),%rsp
6811+ SAVE_ARGS 8*6,0,0
6812+ pax_enter_kernel_user
6813 /*
6814 * No need to follow this irqs on/off section: the syscall
6815 * disabled irqs and here we enable it straight after entry:
6816 */
6817 ENABLE_INTERRUPTS(CLBR_NONE)
6818- SAVE_ARGS 8,0,0
6819 movl %eax,%eax /* zero extension */
6820 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6821 movq %rcx,RIP-ARGOFFSET(%rsp)
6822@@ -305,13 +349,19 @@ ENTRY(ia32_cstar_target)
6823 /* no need to do an access_ok check here because r8 has been
6824 32bit zero extended */
6825 /* hardware stack frame is complete now */
6826+
6827+#ifdef CONFIG_PAX_MEMORY_UDEREF
6828+ mov $PAX_USER_SHADOW_BASE,%r11
6829+ add %r11,%r8
6830+#endif
6831+
6832 1: movl (%r8),%r9d
6833 .section __ex_table,"a"
6834 .quad 1b,ia32_badarg
6835 .previous
6836- GET_THREAD_INFO(%r10)
6837- orl $TS_COMPAT,TI_status(%r10)
6838- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6839+ GET_THREAD_INFO(%r11)
6840+ orl $TS_COMPAT,TI_status(%r11)
6841+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6842 CFI_REMEMBER_STATE
6843 jnz cstar_tracesys
6844 cmpq $IA32_NR_syscalls-1,%rax
6845@@ -321,13 +371,15 @@ cstar_do_call:
6846 cstar_dispatch:
6847 call *ia32_sys_call_table(,%rax,8)
6848 movq %rax,RAX-ARGOFFSET(%rsp)
6849- GET_THREAD_INFO(%r10)
6850+ GET_THREAD_INFO(%r11)
6851 DISABLE_INTERRUPTS(CLBR_NONE)
6852 TRACE_IRQS_OFF
6853- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6854+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6855 jnz sysretl_audit
6856 sysretl_from_sys_call:
6857- andl $~TS_COMPAT,TI_status(%r10)
6858+ pax_exit_kernel_user
6859+ pax_erase_kstack
6860+ andl $~TS_COMPAT,TI_status(%r11)
6861 RESTORE_ARGS 0,-ARG_SKIP,0,0,0
6862 movl RIP-ARGOFFSET(%rsp),%ecx
6863 CFI_REGISTER rip,rcx
6864@@ -355,7 +407,7 @@ sysretl_audit:
6865
6866 cstar_tracesys:
6867 #ifdef CONFIG_AUDITSYSCALL
6868- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6869+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6870 jz cstar_auditsys
6871 #endif
6872 xchgl %r9d,%ebp
6873@@ -364,6 +416,9 @@ cstar_tracesys:
6874 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6875 movq %rsp,%rdi /* &pt_regs -> arg1 */
6876 call syscall_trace_enter
6877+
6878+ pax_erase_kstack
6879+
6880 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6881 RESTORE_REST
6882 xchgl %ebp,%r9d
6883@@ -409,20 +464,21 @@ ENTRY(ia32_syscall)
6884 CFI_REL_OFFSET rip,RIP-RIP
6885 PARAVIRT_ADJUST_EXCEPTION_FRAME
6886 SWAPGS
6887- /*
6888- * No need to follow this irqs on/off section: the syscall
6889- * disabled irqs and here we enable it straight after entry:
6890- */
6891- ENABLE_INTERRUPTS(CLBR_NONE)
6892 movl %eax,%eax
6893 pushq_cfi %rax
6894 cld
6895 /* note the registers are not zero extended to the sf.
6896 this could be a problem. */
6897 SAVE_ARGS 0,1,0
6898- GET_THREAD_INFO(%r10)
6899- orl $TS_COMPAT,TI_status(%r10)
6900- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6901+ pax_enter_kernel_user
6902+ /*
6903+ * No need to follow this irqs on/off section: the syscall
6904+ * disabled irqs and here we enable it straight after entry:
6905+ */
6906+ ENABLE_INTERRUPTS(CLBR_NONE)
6907+ GET_THREAD_INFO(%r11)
6908+ orl $TS_COMPAT,TI_status(%r11)
6909+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6910 jnz ia32_tracesys
6911 cmpq $(IA32_NR_syscalls-1),%rax
6912 ja ia32_badsys
6913@@ -441,6 +497,9 @@ ia32_tracesys:
6914 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6915 movq %rsp,%rdi /* &pt_regs -> arg1 */
6916 call syscall_trace_enter
6917+
6918+ pax_erase_kstack
6919+
6920 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6921 RESTORE_REST
6922 cmpq $(IA32_NR_syscalls-1),%rax
6923@@ -455,6 +514,7 @@ ia32_badsys:
6924
6925 quiet_ni_syscall:
6926 movq $-ENOSYS,%rax
6927+ pax_force_retaddr
6928 ret
6929 CFI_ENDPROC
6930
6931diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
6932index f6f5c53..b358b28 100644
6933--- a/arch/x86/ia32/sys_ia32.c
6934+++ b/arch/x86/ia32/sys_ia32.c
6935@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
6936 */
6937 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
6938 {
6939- typeof(ubuf->st_uid) uid = 0;
6940- typeof(ubuf->st_gid) gid = 0;
6941+ typeof(((struct stat64 *)0)->st_uid) uid = 0;
6942+ typeof(((struct stat64 *)0)->st_gid) gid = 0;
6943 SET_UID(uid, stat->uid);
6944 SET_GID(gid, stat->gid);
6945 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6946@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
6947 }
6948 set_fs(KERNEL_DS);
6949 ret = sys_rt_sigprocmask(how,
6950- set ? (sigset_t __user *)&s : NULL,
6951- oset ? (sigset_t __user *)&s : NULL,
6952+ set ? (sigset_t __force_user *)&s : NULL,
6953+ oset ? (sigset_t __force_user *)&s : NULL,
6954 sigsetsize);
6955 set_fs(old_fs);
6956 if (ret)
6957@@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int seconds)
6958 return alarm_setitimer(seconds);
6959 }
6960
6961-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6962+asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6963 int options)
6964 {
6965 return compat_sys_wait4(pid, stat_addr, options, NULL);
6966@@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
6967 mm_segment_t old_fs = get_fs();
6968
6969 set_fs(KERNEL_DS);
6970- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6971+ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6972 set_fs(old_fs);
6973 if (put_compat_timespec(&t, interval))
6974 return -EFAULT;
6975@@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
6976 mm_segment_t old_fs = get_fs();
6977
6978 set_fs(KERNEL_DS);
6979- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6980+ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6981 set_fs(old_fs);
6982 if (!ret) {
6983 switch (_NSIG_WORDS) {
6984@@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
6985 if (copy_siginfo_from_user32(&info, uinfo))
6986 return -EFAULT;
6987 set_fs(KERNEL_DS);
6988- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6989+ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
6990 set_fs(old_fs);
6991 return ret;
6992 }
6993@@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
6994 return -EFAULT;
6995
6996 set_fs(KERNEL_DS);
6997- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
6998+ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
6999 count);
7000 set_fs(old_fs);
7001
7002diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
7003index 091508b..e245ff2 100644
7004--- a/arch/x86/include/asm/alternative-asm.h
7005+++ b/arch/x86/include/asm/alternative-asm.h
7006@@ -4,10 +4,10 @@
7007
7008 #ifdef CONFIG_SMP
7009 .macro LOCK_PREFIX
7010-1: lock
7011+672: lock
7012 .section .smp_locks,"a"
7013 .balign 4
7014- .long 1b - .
7015+ .long 672b - .
7016 .previous
7017 .endm
7018 #else
7019@@ -15,6 +15,45 @@
7020 .endm
7021 #endif
7022
7023+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7024+ .macro pax_force_retaddr_bts rip=0
7025+ btsq $63,\rip(%rsp)
7026+ .endm
7027+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
7028+ .macro pax_force_retaddr rip=0, reload=0
7029+ btsq $63,\rip(%rsp)
7030+ .endm
7031+ .macro pax_force_fptr ptr
7032+ btsq $63,\ptr
7033+ .endm
7034+ .macro pax_set_fptr_mask
7035+ .endm
7036+#endif
7037+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
7038+ .macro pax_force_retaddr rip=0, reload=0
7039+ .if \reload
7040+ pax_set_fptr_mask
7041+ .endif
7042+ orq %r10,\rip(%rsp)
7043+ .endm
7044+ .macro pax_force_fptr ptr
7045+ orq %r10,\ptr
7046+ .endm
7047+ .macro pax_set_fptr_mask
7048+ movabs $0x8000000000000000,%r10
7049+ .endm
7050+#endif
7051+#else
7052+ .macro pax_force_retaddr rip=0, reload=0
7053+ .endm
7054+ .macro pax_force_fptr ptr
7055+ .endm
7056+ .macro pax_force_retaddr_bts rip=0
7057+ .endm
7058+ .macro pax_set_fptr_mask
7059+ .endm
7060+#endif
7061+
7062 .macro altinstruction_entry orig alt feature orig_len alt_len
7063 .long \orig - .
7064 .long \alt - .
7065diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
7066index 37ad100..7d47faa 100644
7067--- a/arch/x86/include/asm/alternative.h
7068+++ b/arch/x86/include/asm/alternative.h
7069@@ -89,7 +89,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
7070 ".section .discard,\"aw\",@progbits\n" \
7071 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
7072 ".previous\n" \
7073- ".section .altinstr_replacement, \"ax\"\n" \
7074+ ".section .altinstr_replacement, \"a\"\n" \
7075 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7076 ".previous"
7077
7078diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
7079index 9b7273c..e9fcc24 100644
7080--- a/arch/x86/include/asm/apic.h
7081+++ b/arch/x86/include/asm/apic.h
7082@@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
7083
7084 #ifdef CONFIG_X86_LOCAL_APIC
7085
7086-extern unsigned int apic_verbosity;
7087+extern int apic_verbosity;
7088 extern int local_apic_timer_c2_ok;
7089
7090 extern int disable_apic;
7091diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
7092index 20370c6..a2eb9b0 100644
7093--- a/arch/x86/include/asm/apm.h
7094+++ b/arch/x86/include/asm/apm.h
7095@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
7096 __asm__ __volatile__(APM_DO_ZERO_SEGS
7097 "pushl %%edi\n\t"
7098 "pushl %%ebp\n\t"
7099- "lcall *%%cs:apm_bios_entry\n\t"
7100+ "lcall *%%ss:apm_bios_entry\n\t"
7101 "setc %%al\n\t"
7102 "popl %%ebp\n\t"
7103 "popl %%edi\n\t"
7104@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
7105 __asm__ __volatile__(APM_DO_ZERO_SEGS
7106 "pushl %%edi\n\t"
7107 "pushl %%ebp\n\t"
7108- "lcall *%%cs:apm_bios_entry\n\t"
7109+ "lcall *%%ss:apm_bios_entry\n\t"
7110 "setc %%bl\n\t"
7111 "popl %%ebp\n\t"
7112 "popl %%edi\n\t"
7113diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
7114index 10572e3..392d0bc 100644
7115--- a/arch/x86/include/asm/atomic.h
7116+++ b/arch/x86/include/asm/atomic.h
7117@@ -22,7 +22,18 @@
7118 */
7119 static inline int atomic_read(const atomic_t *v)
7120 {
7121- return (*(volatile int *)&(v)->counter);
7122+ return (*(volatile const int *)&(v)->counter);
7123+}
7124+
7125+/**
7126+ * atomic_read_unchecked - read atomic variable
7127+ * @v: pointer of type atomic_unchecked_t
7128+ *
7129+ * Atomically reads the value of @v.
7130+ */
7131+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7132+{
7133+ return (*(volatile const int *)&(v)->counter);
7134 }
7135
7136 /**
7137@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *v, int i)
7138 }
7139
7140 /**
7141+ * atomic_set_unchecked - set atomic variable
7142+ * @v: pointer of type atomic_unchecked_t
7143+ * @i: required value
7144+ *
7145+ * Atomically sets the value of @v to @i.
7146+ */
7147+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7148+{
7149+ v->counter = i;
7150+}
7151+
7152+/**
7153 * atomic_add - add integer to atomic variable
7154 * @i: integer value to add
7155 * @v: pointer of type atomic_t
7156@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *v, int i)
7157 */
7158 static inline void atomic_add(int i, atomic_t *v)
7159 {
7160- asm volatile(LOCK_PREFIX "addl %1,%0"
7161+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7162+
7163+#ifdef CONFIG_PAX_REFCOUNT
7164+ "jno 0f\n"
7165+ LOCK_PREFIX "subl %1,%0\n"
7166+ "int $4\n0:\n"
7167+ _ASM_EXTABLE(0b, 0b)
7168+#endif
7169+
7170+ : "+m" (v->counter)
7171+ : "ir" (i));
7172+}
7173+
7174+/**
7175+ * atomic_add_unchecked - add integer to atomic variable
7176+ * @i: integer value to add
7177+ * @v: pointer of type atomic_unchecked_t
7178+ *
7179+ * Atomically adds @i to @v.
7180+ */
7181+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7182+{
7183+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7184 : "+m" (v->counter)
7185 : "ir" (i));
7186 }
7187@@ -60,7 +105,29 @@ static inline void atomic_add(int i, atomic_t *v)
7188 */
7189 static inline void atomic_sub(int i, atomic_t *v)
7190 {
7191- asm volatile(LOCK_PREFIX "subl %1,%0"
7192+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7193+
7194+#ifdef CONFIG_PAX_REFCOUNT
7195+ "jno 0f\n"
7196+ LOCK_PREFIX "addl %1,%0\n"
7197+ "int $4\n0:\n"
7198+ _ASM_EXTABLE(0b, 0b)
7199+#endif
7200+
7201+ : "+m" (v->counter)
7202+ : "ir" (i));
7203+}
7204+
7205+/**
7206+ * atomic_sub_unchecked - subtract integer from atomic variable
7207+ * @i: integer value to subtract
7208+ * @v: pointer of type atomic_unchecked_t
7209+ *
7210+ * Atomically subtracts @i from @v.
7211+ */
7212+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7213+{
7214+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7215 : "+m" (v->counter)
7216 : "ir" (i));
7217 }
7218@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7219 {
7220 unsigned char c;
7221
7222- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7223+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
7224+
7225+#ifdef CONFIG_PAX_REFCOUNT
7226+ "jno 0f\n"
7227+ LOCK_PREFIX "addl %2,%0\n"
7228+ "int $4\n0:\n"
7229+ _ASM_EXTABLE(0b, 0b)
7230+#endif
7231+
7232+ "sete %1\n"
7233 : "+m" (v->counter), "=qm" (c)
7234 : "ir" (i) : "memory");
7235 return c;
7236@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7237 */
7238 static inline void atomic_inc(atomic_t *v)
7239 {
7240- asm volatile(LOCK_PREFIX "incl %0"
7241+ asm volatile(LOCK_PREFIX "incl %0\n"
7242+
7243+#ifdef CONFIG_PAX_REFCOUNT
7244+ "jno 0f\n"
7245+ LOCK_PREFIX "decl %0\n"
7246+ "int $4\n0:\n"
7247+ _ASM_EXTABLE(0b, 0b)
7248+#endif
7249+
7250+ : "+m" (v->counter));
7251+}
7252+
7253+/**
7254+ * atomic_inc_unchecked - increment atomic variable
7255+ * @v: pointer of type atomic_unchecked_t
7256+ *
7257+ * Atomically increments @v by 1.
7258+ */
7259+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7260+{
7261+ asm volatile(LOCK_PREFIX "incl %0\n"
7262 : "+m" (v->counter));
7263 }
7264
7265@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *v)
7266 */
7267 static inline void atomic_dec(atomic_t *v)
7268 {
7269- asm volatile(LOCK_PREFIX "decl %0"
7270+ asm volatile(LOCK_PREFIX "decl %0\n"
7271+
7272+#ifdef CONFIG_PAX_REFCOUNT
7273+ "jno 0f\n"
7274+ LOCK_PREFIX "incl %0\n"
7275+ "int $4\n0:\n"
7276+ _ASM_EXTABLE(0b, 0b)
7277+#endif
7278+
7279+ : "+m" (v->counter));
7280+}
7281+
7282+/**
7283+ * atomic_dec_unchecked - decrement atomic variable
7284+ * @v: pointer of type atomic_unchecked_t
7285+ *
7286+ * Atomically decrements @v by 1.
7287+ */
7288+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7289+{
7290+ asm volatile(LOCK_PREFIX "decl %0\n"
7291 : "+m" (v->counter));
7292 }
7293
7294@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
7295 {
7296 unsigned char c;
7297
7298- asm volatile(LOCK_PREFIX "decl %0; sete %1"
7299+ asm volatile(LOCK_PREFIX "decl %0\n"
7300+
7301+#ifdef CONFIG_PAX_REFCOUNT
7302+ "jno 0f\n"
7303+ LOCK_PREFIX "incl %0\n"
7304+ "int $4\n0:\n"
7305+ _ASM_EXTABLE(0b, 0b)
7306+#endif
7307+
7308+ "sete %1\n"
7309 : "+m" (v->counter), "=qm" (c)
7310 : : "memory");
7311 return c != 0;
7312@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
7313 {
7314 unsigned char c;
7315
7316- asm volatile(LOCK_PREFIX "incl %0; sete %1"
7317+ asm volatile(LOCK_PREFIX "incl %0\n"
7318+
7319+#ifdef CONFIG_PAX_REFCOUNT
7320+ "jno 0f\n"
7321+ LOCK_PREFIX "decl %0\n"
7322+ "int $4\n0:\n"
7323+ _ASM_EXTABLE(0b, 0b)
7324+#endif
7325+
7326+ "sete %1\n"
7327+ : "+m" (v->counter), "=qm" (c)
7328+ : : "memory");
7329+ return c != 0;
7330+}
7331+
7332+/**
7333+ * atomic_inc_and_test_unchecked - increment and test
7334+ * @v: pointer of type atomic_unchecked_t
7335+ *
7336+ * Atomically increments @v by 1
7337+ * and returns true if the result is zero, or false for all
7338+ * other cases.
7339+ */
7340+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7341+{
7342+ unsigned char c;
7343+
7344+ asm volatile(LOCK_PREFIX "incl %0\n"
7345+ "sete %1\n"
7346 : "+m" (v->counter), "=qm" (c)
7347 : : "memory");
7348 return c != 0;
7349@@ -157,7 +310,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
7350 {
7351 unsigned char c;
7352
7353- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7354+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
7355+
7356+#ifdef CONFIG_PAX_REFCOUNT
7357+ "jno 0f\n"
7358+ LOCK_PREFIX "subl %2,%0\n"
7359+ "int $4\n0:\n"
7360+ _ASM_EXTABLE(0b, 0b)
7361+#endif
7362+
7363+ "sets %1\n"
7364 : "+m" (v->counter), "=qm" (c)
7365 : "ir" (i) : "memory");
7366 return c;
7367@@ -180,16 +342,56 @@ static inline int atomic_add_return(int i, atomic_t *v)
7368 #endif
7369 /* Modern 486+ processor */
7370 __i = i;
7371- asm volatile(LOCK_PREFIX "xaddl %0, %1"
7372+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7373+
7374+#ifdef CONFIG_PAX_REFCOUNT
7375+ "jno 0f\n"
7376+ "movl %0, %1\n"
7377+ "int $4\n0:\n"
7378+ _ASM_EXTABLE(0b, 0b)
7379+#endif
7380+
7381 : "+r" (i), "+m" (v->counter)
7382 : : "memory");
7383 return i + __i;
7384
7385 #ifdef CONFIG_M386
7386 no_xadd: /* Legacy 386 processor */
7387- raw_local_irq_save(flags);
7388+ local_irq_save(flags);
7389 __i = atomic_read(v);
7390 atomic_set(v, i + __i);
7391+ local_irq_restore(flags);
7392+ return i + __i;
7393+#endif
7394+}
7395+
7396+/**
7397+ * atomic_add_return_unchecked - add integer and return
7398+ * @v: pointer of type atomic_unchecked_t
7399+ * @i: integer value to add
7400+ *
7401+ * Atomically adds @i to @v and returns @i + @v
7402+ */
7403+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7404+{
7405+ int __i;
7406+#ifdef CONFIG_M386
7407+ unsigned long flags;
7408+ if (unlikely(boot_cpu_data.x86 <= 3))
7409+ goto no_xadd;
7410+#endif
7411+ /* Modern 486+ processor */
7412+ __i = i;
7413+ asm volatile(LOCK_PREFIX "xaddl %0, %1"
7414+ : "+r" (i), "+m" (v->counter)
7415+ : : "memory");
7416+ return i + __i;
7417+
7418+#ifdef CONFIG_M386
7419+no_xadd: /* Legacy 386 processor */
7420+ raw_local_irq_save(flags);
7421+ __i = atomic_read_unchecked(v);
7422+ atomic_set_unchecked(v, i + __i);
7423 raw_local_irq_restore(flags);
7424 return i + __i;
7425 #endif
7426@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
7427 }
7428
7429 #define atomic_inc_return(v) (atomic_add_return(1, v))
7430+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7431+{
7432+ return atomic_add_return_unchecked(1, v);
7433+}
7434 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7435
7436 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7437@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7438 return cmpxchg(&v->counter, old, new);
7439 }
7440
7441+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7442+{
7443+ return cmpxchg(&v->counter, old, new);
7444+}
7445+
7446 static inline int atomic_xchg(atomic_t *v, int new)
7447 {
7448 return xchg(&v->counter, new);
7449 }
7450
7451+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7452+{
7453+ return xchg(&v->counter, new);
7454+}
7455+
7456 /**
7457 * __atomic_add_unless - add unless the number is already a given value
7458 * @v: pointer of type atomic_t
7459@@ -231,12 +447,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
7460 */
7461 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7462 {
7463- int c, old;
7464+ int c, old, new;
7465 c = atomic_read(v);
7466 for (;;) {
7467- if (unlikely(c == (u)))
7468+ if (unlikely(c == u))
7469 break;
7470- old = atomic_cmpxchg((v), c, c + (a));
7471+
7472+ asm volatile("addl %2,%0\n"
7473+
7474+#ifdef CONFIG_PAX_REFCOUNT
7475+ "jno 0f\n"
7476+ "subl %2,%0\n"
7477+ "int $4\n0:\n"
7478+ _ASM_EXTABLE(0b, 0b)
7479+#endif
7480+
7481+ : "=r" (new)
7482+ : "0" (c), "ir" (a));
7483+
7484+ old = atomic_cmpxchg(v, c, new);
7485 if (likely(old == c))
7486 break;
7487 c = old;
7488@@ -244,6 +473,48 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7489 return c;
7490 }
7491
7492+/**
7493+ * atomic_inc_not_zero_hint - increment if not null
7494+ * @v: pointer of type atomic_t
7495+ * @hint: probable value of the atomic before the increment
7496+ *
7497+ * This version of atomic_inc_not_zero() gives a hint of probable
7498+ * value of the atomic. This helps processor to not read the memory
7499+ * before doing the atomic read/modify/write cycle, lowering
7500+ * number of bus transactions on some arches.
7501+ *
7502+ * Returns: 0 if increment was not done, 1 otherwise.
7503+ */
7504+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
7505+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
7506+{
7507+ int val, c = hint, new;
7508+
7509+ /* sanity test, should be removed by compiler if hint is a constant */
7510+ if (!hint)
7511+ return __atomic_add_unless(v, 1, 0);
7512+
7513+ do {
7514+ asm volatile("incl %0\n"
7515+
7516+#ifdef CONFIG_PAX_REFCOUNT
7517+ "jno 0f\n"
7518+ "decl %0\n"
7519+ "int $4\n0:\n"
7520+ _ASM_EXTABLE(0b, 0b)
7521+#endif
7522+
7523+ : "=r" (new)
7524+ : "0" (c));
7525+
7526+ val = atomic_cmpxchg(v, c, new);
7527+ if (val == c)
7528+ return 1;
7529+ c = val;
7530+ } while (c);
7531+
7532+ return 0;
7533+}
7534
7535 /*
7536 * atomic_dec_if_positive - decrement by 1 if old value positive
7537diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
7538index 24098aa..1e37723 100644
7539--- a/arch/x86/include/asm/atomic64_32.h
7540+++ b/arch/x86/include/asm/atomic64_32.h
7541@@ -12,6 +12,14 @@ typedef struct {
7542 u64 __aligned(8) counter;
7543 } atomic64_t;
7544
7545+#ifdef CONFIG_PAX_REFCOUNT
7546+typedef struct {
7547+ u64 __aligned(8) counter;
7548+} atomic64_unchecked_t;
7549+#else
7550+typedef atomic64_t atomic64_unchecked_t;
7551+#endif
7552+
7553 #define ATOMIC64_INIT(val) { (val) }
7554
7555 #ifdef CONFIG_X86_CMPXCHG64
7556@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
7557 }
7558
7559 /**
7560+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
7561+ * @p: pointer to type atomic64_unchecked_t
7562+ * @o: expected value
7563+ * @n: new value
7564+ *
7565+ * Atomically sets @v to @n if it was equal to @o and returns
7566+ * the old value.
7567+ */
7568+
7569+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
7570+{
7571+ return cmpxchg64(&v->counter, o, n);
7572+}
7573+
7574+/**
7575 * atomic64_xchg - xchg atomic64 variable
7576 * @v: pointer to type atomic64_t
7577 * @n: value to assign
7578@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64_t *v, long long i)
7579 }
7580
7581 /**
7582+ * atomic64_set_unchecked - set atomic64 variable
7583+ * @v: pointer to type atomic64_unchecked_t
7584+ * @n: value to assign
7585+ *
7586+ * Atomically sets the value of @v to @n.
7587+ */
7588+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
7589+{
7590+ unsigned high = (unsigned)(i >> 32);
7591+ unsigned low = (unsigned)i;
7592+ asm volatile(ATOMIC64_ALTERNATIVE(set)
7593+ : "+b" (low), "+c" (high)
7594+ : "S" (v)
7595+ : "eax", "edx", "memory"
7596+ );
7597+}
7598+
7599+/**
7600 * atomic64_read - read atomic64 variable
7601 * @v: pointer to type atomic64_t
7602 *
7603@@ -93,6 +134,22 @@ static inline long long atomic64_read(atomic64_t *v)
7604 }
7605
7606 /**
7607+ * atomic64_read_unchecked - read atomic64 variable
7608+ * @v: pointer to type atomic64_unchecked_t
7609+ *
7610+ * Atomically reads the value of @v and returns it.
7611+ */
7612+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
7613+{
7614+ long long r;
7615+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
7616+ : "=A" (r), "+c" (v)
7617+ : : "memory"
7618+ );
7619+ return r;
7620+ }
7621+
7622+/**
7623 * atomic64_add_return - add and return
7624 * @i: integer value to add
7625 * @v: pointer to type atomic64_t
7626@@ -108,6 +165,22 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
7627 return i;
7628 }
7629
7630+/**
7631+ * atomic64_add_return_unchecked - add and return
7632+ * @i: integer value to add
7633+ * @v: pointer to type atomic64_unchecked_t
7634+ *
7635+ * Atomically adds @i to @v and returns @i + *@v
7636+ */
7637+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
7638+{
7639+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
7640+ : "+A" (i), "+c" (v)
7641+ : : "memory"
7642+ );
7643+ return i;
7644+}
7645+
7646 /*
7647 * Other variants with different arithmetic operators:
7648 */
7649@@ -131,6 +204,17 @@ static inline long long atomic64_inc_return(atomic64_t *v)
7650 return a;
7651 }
7652
7653+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7654+{
7655+ long long a;
7656+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
7657+ : "=A" (a)
7658+ : "S" (v)
7659+ : "memory", "ecx"
7660+ );
7661+ return a;
7662+}
7663+
7664 static inline long long atomic64_dec_return(atomic64_t *v)
7665 {
7666 long long a;
7667@@ -159,6 +243,22 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
7668 }
7669
7670 /**
7671+ * atomic64_add_unchecked - add integer to atomic64 variable
7672+ * @i: integer value to add
7673+ * @v: pointer to type atomic64_unchecked_t
7674+ *
7675+ * Atomically adds @i to @v.
7676+ */
7677+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
7678+{
7679+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
7680+ : "+A" (i), "+c" (v)
7681+ : : "memory"
7682+ );
7683+ return i;
7684+}
7685+
7686+/**
7687 * atomic64_sub - subtract the atomic64 variable
7688 * @i: integer value to subtract
7689 * @v: pointer to type atomic64_t
7690diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
7691index 017594d..d3fcf72 100644
7692--- a/arch/x86/include/asm/atomic64_64.h
7693+++ b/arch/x86/include/asm/atomic64_64.h
7694@@ -18,7 +18,19 @@
7695 */
7696 static inline long atomic64_read(const atomic64_t *v)
7697 {
7698- return (*(volatile long *)&(v)->counter);
7699+ return (*(volatile const long *)&(v)->counter);
7700+}
7701+
7702+/**
7703+ * atomic64_read_unchecked - read atomic64 variable
7704+ * @v: pointer of type atomic64_unchecked_t
7705+ *
7706+ * Atomically reads the value of @v.
7707+ * Doesn't imply a read memory barrier.
7708+ */
7709+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
7710+{
7711+ return (*(volatile const long *)&(v)->counter);
7712 }
7713
7714 /**
7715@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
7716 }
7717
7718 /**
7719+ * atomic64_set_unchecked - set atomic64 variable
7720+ * @v: pointer to type atomic64_unchecked_t
7721+ * @i: required value
7722+ *
7723+ * Atomically sets the value of @v to @i.
7724+ */
7725+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
7726+{
7727+ v->counter = i;
7728+}
7729+
7730+/**
7731 * atomic64_add - add integer to atomic64 variable
7732 * @i: integer value to add
7733 * @v: pointer to type atomic64_t
7734@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
7735 */
7736 static inline void atomic64_add(long i, atomic64_t *v)
7737 {
7738+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
7739+
7740+#ifdef CONFIG_PAX_REFCOUNT
7741+ "jno 0f\n"
7742+ LOCK_PREFIX "subq %1,%0\n"
7743+ "int $4\n0:\n"
7744+ _ASM_EXTABLE(0b, 0b)
7745+#endif
7746+
7747+ : "=m" (v->counter)
7748+ : "er" (i), "m" (v->counter));
7749+}
7750+
7751+/**
7752+ * atomic64_add_unchecked - add integer to atomic64 variable
7753+ * @i: integer value to add
7754+ * @v: pointer to type atomic64_unchecked_t
7755+ *
7756+ * Atomically adds @i to @v.
7757+ */
7758+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
7759+{
7760 asm volatile(LOCK_PREFIX "addq %1,%0"
7761 : "=m" (v->counter)
7762 : "er" (i), "m" (v->counter));
7763@@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
7764 */
7765 static inline void atomic64_sub(long i, atomic64_t *v)
7766 {
7767- asm volatile(LOCK_PREFIX "subq %1,%0"
7768+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7769+
7770+#ifdef CONFIG_PAX_REFCOUNT
7771+ "jno 0f\n"
7772+ LOCK_PREFIX "addq %1,%0\n"
7773+ "int $4\n0:\n"
7774+ _ASM_EXTABLE(0b, 0b)
7775+#endif
7776+
7777+ : "=m" (v->counter)
7778+ : "er" (i), "m" (v->counter));
7779+}
7780+
7781+/**
7782+ * atomic64_sub_unchecked - subtract the atomic64 variable
7783+ * @i: integer value to subtract
7784+ * @v: pointer to type atomic64_unchecked_t
7785+ *
7786+ * Atomically subtracts @i from @v.
7787+ */
7788+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
7789+{
7790+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7791 : "=m" (v->counter)
7792 : "er" (i), "m" (v->counter));
7793 }
7794@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7795 {
7796 unsigned char c;
7797
7798- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
7799+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
7800+
7801+#ifdef CONFIG_PAX_REFCOUNT
7802+ "jno 0f\n"
7803+ LOCK_PREFIX "addq %2,%0\n"
7804+ "int $4\n0:\n"
7805+ _ASM_EXTABLE(0b, 0b)
7806+#endif
7807+
7808+ "sete %1\n"
7809 : "=m" (v->counter), "=qm" (c)
7810 : "er" (i), "m" (v->counter) : "memory");
7811 return c;
7812@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7813 */
7814 static inline void atomic64_inc(atomic64_t *v)
7815 {
7816+ asm volatile(LOCK_PREFIX "incq %0\n"
7817+
7818+#ifdef CONFIG_PAX_REFCOUNT
7819+ "jno 0f\n"
7820+ LOCK_PREFIX "decq %0\n"
7821+ "int $4\n0:\n"
7822+ _ASM_EXTABLE(0b, 0b)
7823+#endif
7824+
7825+ : "=m" (v->counter)
7826+ : "m" (v->counter));
7827+}
7828+
7829+/**
7830+ * atomic64_inc_unchecked - increment atomic64 variable
7831+ * @v: pointer to type atomic64_unchecked_t
7832+ *
7833+ * Atomically increments @v by 1.
7834+ */
7835+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
7836+{
7837 asm volatile(LOCK_PREFIX "incq %0"
7838 : "=m" (v->counter)
7839 : "m" (v->counter));
7840@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64_t *v)
7841 */
7842 static inline void atomic64_dec(atomic64_t *v)
7843 {
7844- asm volatile(LOCK_PREFIX "decq %0"
7845+ asm volatile(LOCK_PREFIX "decq %0\n"
7846+
7847+#ifdef CONFIG_PAX_REFCOUNT
7848+ "jno 0f\n"
7849+ LOCK_PREFIX "incq %0\n"
7850+ "int $4\n0:\n"
7851+ _ASM_EXTABLE(0b, 0b)
7852+#endif
7853+
7854+ : "=m" (v->counter)
7855+ : "m" (v->counter));
7856+}
7857+
7858+/**
7859+ * atomic64_dec_unchecked - decrement atomic64 variable
7860+ * @v: pointer to type atomic64_t
7861+ *
7862+ * Atomically decrements @v by 1.
7863+ */
7864+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
7865+{
7866+ asm volatile(LOCK_PREFIX "decq %0\n"
7867 : "=m" (v->counter)
7868 : "m" (v->counter));
7869 }
7870@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
7871 {
7872 unsigned char c;
7873
7874- asm volatile(LOCK_PREFIX "decq %0; sete %1"
7875+ asm volatile(LOCK_PREFIX "decq %0\n"
7876+
7877+#ifdef CONFIG_PAX_REFCOUNT
7878+ "jno 0f\n"
7879+ LOCK_PREFIX "incq %0\n"
7880+ "int $4\n0:\n"
7881+ _ASM_EXTABLE(0b, 0b)
7882+#endif
7883+
7884+ "sete %1\n"
7885 : "=m" (v->counter), "=qm" (c)
7886 : "m" (v->counter) : "memory");
7887 return c != 0;
7888@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
7889 {
7890 unsigned char c;
7891
7892- asm volatile(LOCK_PREFIX "incq %0; sete %1"
7893+ asm volatile(LOCK_PREFIX "incq %0\n"
7894+
7895+#ifdef CONFIG_PAX_REFCOUNT
7896+ "jno 0f\n"
7897+ LOCK_PREFIX "decq %0\n"
7898+ "int $4\n0:\n"
7899+ _ASM_EXTABLE(0b, 0b)
7900+#endif
7901+
7902+ "sete %1\n"
7903 : "=m" (v->counter), "=qm" (c)
7904 : "m" (v->counter) : "memory");
7905 return c != 0;
7906@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7907 {
7908 unsigned char c;
7909
7910- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
7911+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
7912+
7913+#ifdef CONFIG_PAX_REFCOUNT
7914+ "jno 0f\n"
7915+ LOCK_PREFIX "subq %2,%0\n"
7916+ "int $4\n0:\n"
7917+ _ASM_EXTABLE(0b, 0b)
7918+#endif
7919+
7920+ "sets %1\n"
7921 : "=m" (v->counter), "=qm" (c)
7922 : "er" (i), "m" (v->counter) : "memory");
7923 return c;
7924@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7925 static inline long atomic64_add_return(long i, atomic64_t *v)
7926 {
7927 long __i = i;
7928- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
7929+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
7930+
7931+#ifdef CONFIG_PAX_REFCOUNT
7932+ "jno 0f\n"
7933+ "movq %0, %1\n"
7934+ "int $4\n0:\n"
7935+ _ASM_EXTABLE(0b, 0b)
7936+#endif
7937+
7938+ : "+r" (i), "+m" (v->counter)
7939+ : : "memory");
7940+ return i + __i;
7941+}
7942+
7943+/**
7944+ * atomic64_add_return_unchecked - add and return
7945+ * @i: integer value to add
7946+ * @v: pointer to type atomic64_unchecked_t
7947+ *
7948+ * Atomically adds @i to @v and returns @i + @v
7949+ */
7950+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
7951+{
7952+ long __i = i;
7953+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
7954 : "+r" (i), "+m" (v->counter)
7955 : : "memory");
7956 return i + __i;
7957@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
7958 }
7959
7960 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
7961+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7962+{
7963+ return atomic64_add_return_unchecked(1, v);
7964+}
7965 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
7966
7967 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7968@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7969 return cmpxchg(&v->counter, old, new);
7970 }
7971
7972+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
7973+{
7974+ return cmpxchg(&v->counter, old, new);
7975+}
7976+
7977 static inline long atomic64_xchg(atomic64_t *v, long new)
7978 {
7979 return xchg(&v->counter, new);
7980@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
7981 */
7982 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
7983 {
7984- long c, old;
7985+ long c, old, new;
7986 c = atomic64_read(v);
7987 for (;;) {
7988- if (unlikely(c == (u)))
7989+ if (unlikely(c == u))
7990 break;
7991- old = atomic64_cmpxchg((v), c, c + (a));
7992+
7993+ asm volatile("add %2,%0\n"
7994+
7995+#ifdef CONFIG_PAX_REFCOUNT
7996+ "jno 0f\n"
7997+ "sub %2,%0\n"
7998+ "int $4\n0:\n"
7999+ _ASM_EXTABLE(0b, 0b)
8000+#endif
8001+
8002+ : "=r" (new)
8003+ : "0" (c), "ir" (a));
8004+
8005+ old = atomic64_cmpxchg(v, c, new);
8006 if (likely(old == c))
8007 break;
8008 c = old;
8009 }
8010- return c != (u);
8011+ return c != u;
8012 }
8013
8014 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
8015diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
8016index 1775d6e..b65017f 100644
8017--- a/arch/x86/include/asm/bitops.h
8018+++ b/arch/x86/include/asm/bitops.h
8019@@ -38,7 +38,7 @@
8020 * a mask operation on a byte.
8021 */
8022 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8023-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8024+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8025 #define CONST_MASK(nr) (1 << ((nr) & 7))
8026
8027 /**
8028diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
8029index 5e1a2ee..c9f9533 100644
8030--- a/arch/x86/include/asm/boot.h
8031+++ b/arch/x86/include/asm/boot.h
8032@@ -11,10 +11,15 @@
8033 #include <asm/pgtable_types.h>
8034
8035 /* Physical address where kernel should be loaded. */
8036-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8037+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8038 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8039 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8040
8041+#ifndef __ASSEMBLY__
8042+extern unsigned char __LOAD_PHYSICAL_ADDR[];
8043+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8044+#endif
8045+
8046 /* Minimum kernel alignment, as a power of two */
8047 #ifdef CONFIG_X86_64
8048 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8049diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
8050index 48f99f1..d78ebf9 100644
8051--- a/arch/x86/include/asm/cache.h
8052+++ b/arch/x86/include/asm/cache.h
8053@@ -5,12 +5,13 @@
8054
8055 /* L1 cache line size */
8056 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8057-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8058+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8059
8060 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
8061+#define __read_only __attribute__((__section__(".data..read_only")))
8062
8063 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
8064-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
8065+#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
8066
8067 #ifdef CONFIG_X86_VSMP
8068 #ifdef CONFIG_SMP
8069diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
8070index 4e12668..501d239 100644
8071--- a/arch/x86/include/asm/cacheflush.h
8072+++ b/arch/x86/include/asm/cacheflush.h
8073@@ -26,7 +26,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
8074 unsigned long pg_flags = pg->flags & _PGMT_MASK;
8075
8076 if (pg_flags == _PGMT_DEFAULT)
8077- return -1;
8078+ return ~0UL;
8079 else if (pg_flags == _PGMT_WC)
8080 return _PAGE_CACHE_WC;
8081 else if (pg_flags == _PGMT_UC_MINUS)
8082diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
8083index 46fc474..b02b0f9 100644
8084--- a/arch/x86/include/asm/checksum_32.h
8085+++ b/arch/x86/include/asm/checksum_32.h
8086@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
8087 int len, __wsum sum,
8088 int *src_err_ptr, int *dst_err_ptr);
8089
8090+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8091+ int len, __wsum sum,
8092+ int *src_err_ptr, int *dst_err_ptr);
8093+
8094+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8095+ int len, __wsum sum,
8096+ int *src_err_ptr, int *dst_err_ptr);
8097+
8098 /*
8099 * Note: when you get a NULL pointer exception here this means someone
8100 * passed in an incorrect kernel address to one of these functions.
8101@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
8102 int *err_ptr)
8103 {
8104 might_sleep();
8105- return csum_partial_copy_generic((__force void *)src, dst,
8106+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
8107 len, sum, err_ptr, NULL);
8108 }
8109
8110@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
8111 {
8112 might_sleep();
8113 if (access_ok(VERIFY_WRITE, dst, len))
8114- return csum_partial_copy_generic(src, (__force void *)dst,
8115+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8116 len, sum, NULL, err_ptr);
8117
8118 if (len)
8119diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
8120index 88b23a4..d2e5f9f 100644
8121--- a/arch/x86/include/asm/cpufeature.h
8122+++ b/arch/x86/include/asm/cpufeature.h
8123@@ -358,7 +358,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
8124 ".section .discard,\"aw\",@progbits\n"
8125 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
8126 ".previous\n"
8127- ".section .altinstr_replacement,\"ax\"\n"
8128+ ".section .altinstr_replacement,\"a\"\n"
8129 "3: movb $1,%0\n"
8130 "4:\n"
8131 ".previous\n"
8132diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
8133index 41935fa..3b40db8 100644
8134--- a/arch/x86/include/asm/desc.h
8135+++ b/arch/x86/include/asm/desc.h
8136@@ -4,6 +4,7 @@
8137 #include <asm/desc_defs.h>
8138 #include <asm/ldt.h>
8139 #include <asm/mmu.h>
8140+#include <asm/pgtable.h>
8141
8142 #include <linux/smp.h>
8143
8144@@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8145
8146 desc->type = (info->read_exec_only ^ 1) << 1;
8147 desc->type |= info->contents << 2;
8148+ desc->type |= info->seg_not_present ^ 1;
8149
8150 desc->s = 1;
8151 desc->dpl = 0x3;
8152@@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8153 }
8154
8155 extern struct desc_ptr idt_descr;
8156-extern gate_desc idt_table[];
8157-
8158-struct gdt_page {
8159- struct desc_struct gdt[GDT_ENTRIES];
8160-} __attribute__((aligned(PAGE_SIZE)));
8161-
8162-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8163+extern gate_desc idt_table[256];
8164
8165+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8166 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8167 {
8168- return per_cpu(gdt_page, cpu).gdt;
8169+ return cpu_gdt_table[cpu];
8170 }
8171
8172 #ifdef CONFIG_X86_64
8173@@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
8174 unsigned long base, unsigned dpl, unsigned flags,
8175 unsigned short seg)
8176 {
8177- gate->a = (seg << 16) | (base & 0xffff);
8178- gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8179+ gate->gate.offset_low = base;
8180+ gate->gate.seg = seg;
8181+ gate->gate.reserved = 0;
8182+ gate->gate.type = type;
8183+ gate->gate.s = 0;
8184+ gate->gate.dpl = dpl;
8185+ gate->gate.p = 1;
8186+ gate->gate.offset_high = base >> 16;
8187 }
8188
8189 #endif
8190@@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
8191
8192 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
8193 {
8194+ pax_open_kernel();
8195 memcpy(&idt[entry], gate, sizeof(*gate));
8196+ pax_close_kernel();
8197 }
8198
8199 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
8200 {
8201+ pax_open_kernel();
8202 memcpy(&ldt[entry], desc, 8);
8203+ pax_close_kernel();
8204 }
8205
8206 static inline void
8207@@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
8208 default: size = sizeof(*gdt); break;
8209 }
8210
8211+ pax_open_kernel();
8212 memcpy(&gdt[entry], desc, size);
8213+ pax_close_kernel();
8214 }
8215
8216 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8217@@ -207,7 +216,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
8218
8219 static inline void native_load_tr_desc(void)
8220 {
8221+ pax_open_kernel();
8222 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8223+ pax_close_kernel();
8224 }
8225
8226 static inline void native_load_gdt(const struct desc_ptr *dtr)
8227@@ -244,8 +255,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
8228 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8229 unsigned int i;
8230
8231+ pax_open_kernel();
8232 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8233 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8234+ pax_close_kernel();
8235 }
8236
8237 #define _LDT_empty(info) \
8238@@ -307,7 +320,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
8239 desc->limit = (limit >> 16) & 0xf;
8240 }
8241
8242-static inline void _set_gate(int gate, unsigned type, void *addr,
8243+static inline void _set_gate(int gate, unsigned type, const void *addr,
8244 unsigned dpl, unsigned ist, unsigned seg)
8245 {
8246 gate_desc s;
8247@@ -326,7 +339,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
8248 * Pentium F0 0F bugfix can have resulted in the mapped
8249 * IDT being write-protected.
8250 */
8251-static inline void set_intr_gate(unsigned int n, void *addr)
8252+static inline void set_intr_gate(unsigned int n, const void *addr)
8253 {
8254 BUG_ON((unsigned)n > 0xFF);
8255 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8256@@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
8257 /*
8258 * This routine sets up an interrupt gate at directory privilege level 3.
8259 */
8260-static inline void set_system_intr_gate(unsigned int n, void *addr)
8261+static inline void set_system_intr_gate(unsigned int n, const void *addr)
8262 {
8263 BUG_ON((unsigned)n > 0xFF);
8264 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8265 }
8266
8267-static inline void set_system_trap_gate(unsigned int n, void *addr)
8268+static inline void set_system_trap_gate(unsigned int n, const void *addr)
8269 {
8270 BUG_ON((unsigned)n > 0xFF);
8271 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8272 }
8273
8274-static inline void set_trap_gate(unsigned int n, void *addr)
8275+static inline void set_trap_gate(unsigned int n, const void *addr)
8276 {
8277 BUG_ON((unsigned)n > 0xFF);
8278 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8279@@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
8280 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8281 {
8282 BUG_ON((unsigned)n > 0xFF);
8283- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8284+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8285 }
8286
8287-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8288+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8289 {
8290 BUG_ON((unsigned)n > 0xFF);
8291 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8292 }
8293
8294-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8295+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8296 {
8297 BUG_ON((unsigned)n > 0xFF);
8298 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8299 }
8300
8301+#ifdef CONFIG_X86_32
8302+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8303+{
8304+ struct desc_struct d;
8305+
8306+ if (likely(limit))
8307+ limit = (limit - 1UL) >> PAGE_SHIFT;
8308+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
8309+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8310+}
8311+#endif
8312+
8313 #endif /* _ASM_X86_DESC_H */
8314diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
8315index 278441f..b95a174 100644
8316--- a/arch/x86/include/asm/desc_defs.h
8317+++ b/arch/x86/include/asm/desc_defs.h
8318@@ -31,6 +31,12 @@ struct desc_struct {
8319 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8320 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8321 };
8322+ struct {
8323+ u16 offset_low;
8324+ u16 seg;
8325+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8326+ unsigned offset_high: 16;
8327+ } gate;
8328 };
8329 } __attribute__((packed));
8330
8331diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
8332index 908b969..a1f4eb4 100644
8333--- a/arch/x86/include/asm/e820.h
8334+++ b/arch/x86/include/asm/e820.h
8335@@ -69,7 +69,7 @@ struct e820map {
8336 #define ISA_START_ADDRESS 0xa0000
8337 #define ISA_END_ADDRESS 0x100000
8338
8339-#define BIOS_BEGIN 0x000a0000
8340+#define BIOS_BEGIN 0x000c0000
8341 #define BIOS_END 0x00100000
8342
8343 #define BIOS_ROM_BASE 0xffe00000
8344diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
8345index f2ad216..eb24c96 100644
8346--- a/arch/x86/include/asm/elf.h
8347+++ b/arch/x86/include/asm/elf.h
8348@@ -237,7 +237,25 @@ extern int force_personality32;
8349 the loader. We need to make sure that it is out of the way of the program
8350 that it will "exec", and that there is sufficient room for the brk. */
8351
8352+#ifdef CONFIG_PAX_SEGMEXEC
8353+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8354+#else
8355 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8356+#endif
8357+
8358+#ifdef CONFIG_PAX_ASLR
8359+#ifdef CONFIG_X86_32
8360+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8361+
8362+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8363+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8364+#else
8365+#define PAX_ELF_ET_DYN_BASE 0x400000UL
8366+
8367+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8368+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8369+#endif
8370+#endif
8371
8372 /* This yields a mask that user programs can use to figure out what
8373 instruction set this CPU supports. This could be done in user space,
8374@@ -290,9 +308,7 @@ do { \
8375
8376 #define ARCH_DLINFO \
8377 do { \
8378- if (vdso_enabled) \
8379- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8380- (unsigned long)current->mm->context.vdso); \
8381+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8382 } while (0)
8383
8384 #define AT_SYSINFO 32
8385@@ -303,7 +319,7 @@ do { \
8386
8387 #endif /* !CONFIG_X86_32 */
8388
8389-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8390+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8391
8392 #define VDSO_ENTRY \
8393 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8394@@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
8395 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8396 #define compat_arch_setup_additional_pages syscall32_setup_pages
8397
8398-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8399-#define arch_randomize_brk arch_randomize_brk
8400-
8401 #endif /* _ASM_X86_ELF_H */
8402diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
8403index cc70c1c..d96d011 100644
8404--- a/arch/x86/include/asm/emergency-restart.h
8405+++ b/arch/x86/include/asm/emergency-restart.h
8406@@ -15,6 +15,6 @@ enum reboot_type {
8407
8408 extern enum reboot_type reboot_type;
8409
8410-extern void machine_emergency_restart(void);
8411+extern void machine_emergency_restart(void) __noreturn;
8412
8413 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8414diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
8415index d09bb03..4ea4194 100644
8416--- a/arch/x86/include/asm/futex.h
8417+++ b/arch/x86/include/asm/futex.h
8418@@ -12,16 +12,18 @@
8419 #include <asm/system.h>
8420
8421 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8422+ typecheck(u32 __user *, uaddr); \
8423 asm volatile("1:\t" insn "\n" \
8424 "2:\t.section .fixup,\"ax\"\n" \
8425 "3:\tmov\t%3, %1\n" \
8426 "\tjmp\t2b\n" \
8427 "\t.previous\n" \
8428 _ASM_EXTABLE(1b, 3b) \
8429- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8430+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8431 : "i" (-EFAULT), "0" (oparg), "1" (0))
8432
8433 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8434+ typecheck(u32 __user *, uaddr); \
8435 asm volatile("1:\tmovl %2, %0\n" \
8436 "\tmovl\t%0, %3\n" \
8437 "\t" insn "\n" \
8438@@ -34,7 +36,7 @@
8439 _ASM_EXTABLE(1b, 4b) \
8440 _ASM_EXTABLE(2b, 4b) \
8441 : "=&a" (oldval), "=&r" (ret), \
8442- "+m" (*uaddr), "=&r" (tem) \
8443+ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8444 : "r" (oparg), "i" (-EFAULT), "1" (0))
8445
8446 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8447@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8448
8449 switch (op) {
8450 case FUTEX_OP_SET:
8451- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8452+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8453 break;
8454 case FUTEX_OP_ADD:
8455- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8456+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8457 uaddr, oparg);
8458 break;
8459 case FUTEX_OP_OR:
8460@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
8461 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8462 return -EFAULT;
8463
8464- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
8465+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
8466 "2:\t.section .fixup, \"ax\"\n"
8467 "3:\tmov %3, %0\n"
8468 "\tjmp 2b\n"
8469 "\t.previous\n"
8470 _ASM_EXTABLE(1b, 3b)
8471- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
8472+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
8473 : "i" (-EFAULT), "r" (newval), "1" (oldval)
8474 : "memory"
8475 );
8476diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
8477index 0919905..2cf38d6 100644
8478--- a/arch/x86/include/asm/hw_irq.h
8479+++ b/arch/x86/include/asm/hw_irq.h
8480@@ -136,8 +136,8 @@ extern void setup_ioapic_dest(void);
8481 extern void enable_IO_APIC(void);
8482
8483 /* Statistics */
8484-extern atomic_t irq_err_count;
8485-extern atomic_t irq_mis_count;
8486+extern atomic_unchecked_t irq_err_count;
8487+extern atomic_unchecked_t irq_mis_count;
8488
8489 /* EISA */
8490 extern void eisa_set_level_irq(unsigned int irq);
8491diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
8492index c9e09ea..73888df 100644
8493--- a/arch/x86/include/asm/i387.h
8494+++ b/arch/x86/include/asm/i387.h
8495@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
8496 {
8497 int err;
8498
8499+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8500+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8501+ fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
8502+#endif
8503+
8504 /* See comment in fxsave() below. */
8505 #ifdef CONFIG_AS_FXSAVEQ
8506 asm volatile("1: fxrstorq %[fx]\n\t"
8507@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
8508 {
8509 int err;
8510
8511+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8512+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8513+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
8514+#endif
8515+
8516 /*
8517 * Clear the bytes not touched by the fxsave and reserved
8518 * for the SW usage.
8519@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu *fpu)
8520 #endif /* CONFIG_X86_64 */
8521
8522 /* We need a safe address that is cheap to find and that is already
8523- in L1 during context switch. The best choices are unfortunately
8524- different for UP and SMP */
8525-#ifdef CONFIG_SMP
8526-#define safe_address (__per_cpu_offset[0])
8527-#else
8528-#define safe_address (kstat_cpu(0).cpustat.user)
8529-#endif
8530+ in L1 during context switch. */
8531+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
8532
8533 /*
8534 * These must be called with preempt disabled
8535@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void)
8536 struct thread_info *me = current_thread_info();
8537 preempt_disable();
8538 if (me->status & TS_USEDFPU)
8539- __save_init_fpu(me->task);
8540+ __save_init_fpu(current);
8541 else
8542 clts();
8543 }
8544diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
8545index d8e8eef..99f81ae 100644
8546--- a/arch/x86/include/asm/io.h
8547+++ b/arch/x86/include/asm/io.h
8548@@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
8549
8550 #include <linux/vmalloc.h>
8551
8552+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8553+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8554+{
8555+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8556+}
8557+
8558+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8559+{
8560+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8561+}
8562+
8563 /*
8564 * Convert a virtual cached pointer to an uncached pointer
8565 */
8566diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
8567index bba3cf8..06bc8da 100644
8568--- a/arch/x86/include/asm/irqflags.h
8569+++ b/arch/x86/include/asm/irqflags.h
8570@@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
8571 sti; \
8572 sysexit
8573
8574+#define GET_CR0_INTO_RDI mov %cr0, %rdi
8575+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
8576+#define GET_CR3_INTO_RDI mov %cr3, %rdi
8577+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
8578+
8579 #else
8580 #define INTERRUPT_RETURN iret
8581 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
8582diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
8583index 5478825..839e88c 100644
8584--- a/arch/x86/include/asm/kprobes.h
8585+++ b/arch/x86/include/asm/kprobes.h
8586@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
8587 #define RELATIVEJUMP_SIZE 5
8588 #define RELATIVECALL_OPCODE 0xe8
8589 #define RELATIVE_ADDR_SIZE 4
8590-#define MAX_STACK_SIZE 64
8591-#define MIN_STACK_SIZE(ADDR) \
8592- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
8593- THREAD_SIZE - (unsigned long)(ADDR))) \
8594- ? (MAX_STACK_SIZE) \
8595- : (((unsigned long)current_thread_info()) + \
8596- THREAD_SIZE - (unsigned long)(ADDR)))
8597+#define MAX_STACK_SIZE 64UL
8598+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
8599
8600 #define flush_insn_slot(p) do { } while (0)
8601
8602diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
8603index dd51c83..66cbfac 100644
8604--- a/arch/x86/include/asm/kvm_host.h
8605+++ b/arch/x86/include/asm/kvm_host.h
8606@@ -456,7 +456,7 @@ struct kvm_arch {
8607 unsigned int n_requested_mmu_pages;
8608 unsigned int n_max_mmu_pages;
8609 unsigned int indirect_shadow_pages;
8610- atomic_t invlpg_counter;
8611+ atomic_unchecked_t invlpg_counter;
8612 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
8613 /*
8614 * Hash table of struct kvm_mmu_page.
8615@@ -636,7 +636,7 @@ struct kvm_x86_ops {
8616 enum x86_intercept_stage stage);
8617
8618 const struct trace_print_flags *exit_reasons_str;
8619-};
8620+} __do_const;
8621
8622 struct kvm_arch_async_pf {
8623 u32 token;
8624diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
8625index 9cdae5d..300d20f 100644
8626--- a/arch/x86/include/asm/local.h
8627+++ b/arch/x86/include/asm/local.h
8628@@ -18,26 +18,58 @@ typedef struct {
8629
8630 static inline void local_inc(local_t *l)
8631 {
8632- asm volatile(_ASM_INC "%0"
8633+ asm volatile(_ASM_INC "%0\n"
8634+
8635+#ifdef CONFIG_PAX_REFCOUNT
8636+ "jno 0f\n"
8637+ _ASM_DEC "%0\n"
8638+ "int $4\n0:\n"
8639+ _ASM_EXTABLE(0b, 0b)
8640+#endif
8641+
8642 : "+m" (l->a.counter));
8643 }
8644
8645 static inline void local_dec(local_t *l)
8646 {
8647- asm volatile(_ASM_DEC "%0"
8648+ asm volatile(_ASM_DEC "%0\n"
8649+
8650+#ifdef CONFIG_PAX_REFCOUNT
8651+ "jno 0f\n"
8652+ _ASM_INC "%0\n"
8653+ "int $4\n0:\n"
8654+ _ASM_EXTABLE(0b, 0b)
8655+#endif
8656+
8657 : "+m" (l->a.counter));
8658 }
8659
8660 static inline void local_add(long i, local_t *l)
8661 {
8662- asm volatile(_ASM_ADD "%1,%0"
8663+ asm volatile(_ASM_ADD "%1,%0\n"
8664+
8665+#ifdef CONFIG_PAX_REFCOUNT
8666+ "jno 0f\n"
8667+ _ASM_SUB "%1,%0\n"
8668+ "int $4\n0:\n"
8669+ _ASM_EXTABLE(0b, 0b)
8670+#endif
8671+
8672 : "+m" (l->a.counter)
8673 : "ir" (i));
8674 }
8675
8676 static inline void local_sub(long i, local_t *l)
8677 {
8678- asm volatile(_ASM_SUB "%1,%0"
8679+ asm volatile(_ASM_SUB "%1,%0\n"
8680+
8681+#ifdef CONFIG_PAX_REFCOUNT
8682+ "jno 0f\n"
8683+ _ASM_ADD "%1,%0\n"
8684+ "int $4\n0:\n"
8685+ _ASM_EXTABLE(0b, 0b)
8686+#endif
8687+
8688 : "+m" (l->a.counter)
8689 : "ir" (i));
8690 }
8691@@ -55,7 +87,16 @@ static inline int local_sub_and_test(long i, local_t *l)
8692 {
8693 unsigned char c;
8694
8695- asm volatile(_ASM_SUB "%2,%0; sete %1"
8696+ asm volatile(_ASM_SUB "%2,%0\n"
8697+
8698+#ifdef CONFIG_PAX_REFCOUNT
8699+ "jno 0f\n"
8700+ _ASM_ADD "%2,%0\n"
8701+ "int $4\n0:\n"
8702+ _ASM_EXTABLE(0b, 0b)
8703+#endif
8704+
8705+ "sete %1\n"
8706 : "+m" (l->a.counter), "=qm" (c)
8707 : "ir" (i) : "memory");
8708 return c;
8709@@ -73,7 +114,16 @@ static inline int local_dec_and_test(local_t *l)
8710 {
8711 unsigned char c;
8712
8713- asm volatile(_ASM_DEC "%0; sete %1"
8714+ asm volatile(_ASM_DEC "%0\n"
8715+
8716+#ifdef CONFIG_PAX_REFCOUNT
8717+ "jno 0f\n"
8718+ _ASM_INC "%0\n"
8719+ "int $4\n0:\n"
8720+ _ASM_EXTABLE(0b, 0b)
8721+#endif
8722+
8723+ "sete %1\n"
8724 : "+m" (l->a.counter), "=qm" (c)
8725 : : "memory");
8726 return c != 0;
8727@@ -91,7 +141,16 @@ static inline int local_inc_and_test(local_t *l)
8728 {
8729 unsigned char c;
8730
8731- asm volatile(_ASM_INC "%0; sete %1"
8732+ asm volatile(_ASM_INC "%0\n"
8733+
8734+#ifdef CONFIG_PAX_REFCOUNT
8735+ "jno 0f\n"
8736+ _ASM_DEC "%0\n"
8737+ "int $4\n0:\n"
8738+ _ASM_EXTABLE(0b, 0b)
8739+#endif
8740+
8741+ "sete %1\n"
8742 : "+m" (l->a.counter), "=qm" (c)
8743 : : "memory");
8744 return c != 0;
8745@@ -110,7 +169,16 @@ static inline int local_add_negative(long i, local_t *l)
8746 {
8747 unsigned char c;
8748
8749- asm volatile(_ASM_ADD "%2,%0; sets %1"
8750+ asm volatile(_ASM_ADD "%2,%0\n"
8751+
8752+#ifdef CONFIG_PAX_REFCOUNT
8753+ "jno 0f\n"
8754+ _ASM_SUB "%2,%0\n"
8755+ "int $4\n0:\n"
8756+ _ASM_EXTABLE(0b, 0b)
8757+#endif
8758+
8759+ "sets %1\n"
8760 : "+m" (l->a.counter), "=qm" (c)
8761 : "ir" (i) : "memory");
8762 return c;
8763@@ -133,7 +201,15 @@ static inline long local_add_return(long i, local_t *l)
8764 #endif
8765 /* Modern 486+ processor */
8766 __i = i;
8767- asm volatile(_ASM_XADD "%0, %1;"
8768+ asm volatile(_ASM_XADD "%0, %1\n"
8769+
8770+#ifdef CONFIG_PAX_REFCOUNT
8771+ "jno 0f\n"
8772+ _ASM_MOV "%0,%1\n"
8773+ "int $4\n0:\n"
8774+ _ASM_EXTABLE(0b, 0b)
8775+#endif
8776+
8777 : "+r" (i), "+m" (l->a.counter)
8778 : : "memory");
8779 return i + __i;
8780diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
8781index 593e51d..fa69c9a 100644
8782--- a/arch/x86/include/asm/mman.h
8783+++ b/arch/x86/include/asm/mman.h
8784@@ -5,4 +5,14 @@
8785
8786 #include <asm-generic/mman.h>
8787
8788+#ifdef __KERNEL__
8789+#ifndef __ASSEMBLY__
8790+#ifdef CONFIG_X86_32
8791+#define arch_mmap_check i386_mmap_check
8792+int i386_mmap_check(unsigned long addr, unsigned long len,
8793+ unsigned long flags);
8794+#endif
8795+#endif
8796+#endif
8797+
8798 #endif /* _ASM_X86_MMAN_H */
8799diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
8800index 5f55e69..e20bfb1 100644
8801--- a/arch/x86/include/asm/mmu.h
8802+++ b/arch/x86/include/asm/mmu.h
8803@@ -9,7 +9,7 @@
8804 * we put the segment information here.
8805 */
8806 typedef struct {
8807- void *ldt;
8808+ struct desc_struct *ldt;
8809 int size;
8810
8811 #ifdef CONFIG_X86_64
8812@@ -18,7 +18,19 @@ typedef struct {
8813 #endif
8814
8815 struct mutex lock;
8816- void *vdso;
8817+ unsigned long vdso;
8818+
8819+#ifdef CONFIG_X86_32
8820+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
8821+ unsigned long user_cs_base;
8822+ unsigned long user_cs_limit;
8823+
8824+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8825+ cpumask_t cpu_user_cs_mask;
8826+#endif
8827+
8828+#endif
8829+#endif
8830 } mm_context_t;
8831
8832 #ifdef CONFIG_SMP
8833diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
8834index 6902152..399f3a2 100644
8835--- a/arch/x86/include/asm/mmu_context.h
8836+++ b/arch/x86/include/asm/mmu_context.h
8837@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
8838
8839 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
8840 {
8841+
8842+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8843+ unsigned int i;
8844+ pgd_t *pgd;
8845+
8846+ pax_open_kernel();
8847+ pgd = get_cpu_pgd(smp_processor_id());
8848+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
8849+ set_pgd_batched(pgd+i, native_make_pgd(0));
8850+ pax_close_kernel();
8851+#endif
8852+
8853 #ifdef CONFIG_SMP
8854 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
8855 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
8856@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8857 struct task_struct *tsk)
8858 {
8859 unsigned cpu = smp_processor_id();
8860+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8861+ int tlbstate = TLBSTATE_OK;
8862+#endif
8863
8864 if (likely(prev != next)) {
8865 #ifdef CONFIG_SMP
8866+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8867+ tlbstate = percpu_read(cpu_tlbstate.state);
8868+#endif
8869 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8870 percpu_write(cpu_tlbstate.active_mm, next);
8871 #endif
8872 cpumask_set_cpu(cpu, mm_cpumask(next));
8873
8874 /* Re-load page tables */
8875+#ifdef CONFIG_PAX_PER_CPU_PGD
8876+ pax_open_kernel();
8877+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8878+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8879+ pax_close_kernel();
8880+ load_cr3(get_cpu_pgd(cpu));
8881+#else
8882 load_cr3(next->pgd);
8883+#endif
8884
8885 /* stop flush ipis for the previous mm */
8886 cpumask_clear_cpu(cpu, mm_cpumask(prev));
8887@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8888 */
8889 if (unlikely(prev->context.ldt != next->context.ldt))
8890 load_LDT_nolock(&next->context);
8891- }
8892+
8893+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8894+ if (!(__supported_pte_mask & _PAGE_NX)) {
8895+ smp_mb__before_clear_bit();
8896+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
8897+ smp_mb__after_clear_bit();
8898+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8899+ }
8900+#endif
8901+
8902+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8903+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
8904+ prev->context.user_cs_limit != next->context.user_cs_limit))
8905+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8906 #ifdef CONFIG_SMP
8907+ else if (unlikely(tlbstate != TLBSTATE_OK))
8908+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8909+#endif
8910+#endif
8911+
8912+ }
8913 else {
8914+
8915+#ifdef CONFIG_PAX_PER_CPU_PGD
8916+ pax_open_kernel();
8917+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8918+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8919+ pax_close_kernel();
8920+ load_cr3(get_cpu_pgd(cpu));
8921+#endif
8922+
8923+#ifdef CONFIG_SMP
8924 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8925 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
8926
8927@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8928 * tlb flush IPI delivery. We must reload CR3
8929 * to make sure to use no freed page tables.
8930 */
8931+
8932+#ifndef CONFIG_PAX_PER_CPU_PGD
8933 load_cr3(next->pgd);
8934+#endif
8935+
8936 load_LDT_nolock(&next->context);
8937+
8938+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
8939+ if (!(__supported_pte_mask & _PAGE_NX))
8940+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8941+#endif
8942+
8943+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8944+#ifdef CONFIG_PAX_PAGEEXEC
8945+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
8946+#endif
8947+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8948+#endif
8949+
8950 }
8951+#endif
8952 }
8953-#endif
8954 }
8955
8956 #define activate_mm(prev, next) \
8957diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
8958index 9eae775..c914fea 100644
8959--- a/arch/x86/include/asm/module.h
8960+++ b/arch/x86/include/asm/module.h
8961@@ -5,6 +5,7 @@
8962
8963 #ifdef CONFIG_X86_64
8964 /* X86_64 does not define MODULE_PROC_FAMILY */
8965+#define MODULE_PROC_FAMILY ""
8966 #elif defined CONFIG_M386
8967 #define MODULE_PROC_FAMILY "386 "
8968 #elif defined CONFIG_M486
8969@@ -59,8 +60,20 @@
8970 #error unknown processor family
8971 #endif
8972
8973-#ifdef CONFIG_X86_32
8974-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
8975+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
8976+#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
8977+#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
8978+#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
8979+#else
8980+#define MODULE_PAX_KERNEXEC ""
8981 #endif
8982
8983+#ifdef CONFIG_PAX_MEMORY_UDEREF
8984+#define MODULE_PAX_UDEREF "UDEREF "
8985+#else
8986+#define MODULE_PAX_UDEREF ""
8987+#endif
8988+
8989+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
8990+
8991 #endif /* _ASM_X86_MODULE_H */
8992diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
8993index 7639dbf..e08a58c 100644
8994--- a/arch/x86/include/asm/page_64_types.h
8995+++ b/arch/x86/include/asm/page_64_types.h
8996@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
8997
8998 /* duplicated to the one in bootmem.h */
8999 extern unsigned long max_pfn;
9000-extern unsigned long phys_base;
9001+extern const unsigned long phys_base;
9002
9003 extern unsigned long __phys_addr(unsigned long);
9004 #define __phys_reloc_hide(x) (x)
9005diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
9006index a7d2db9..edb023e 100644
9007--- a/arch/x86/include/asm/paravirt.h
9008+++ b/arch/x86/include/asm/paravirt.h
9009@@ -667,6 +667,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
9010 val);
9011 }
9012
9013+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9014+{
9015+ pgdval_t val = native_pgd_val(pgd);
9016+
9017+ if (sizeof(pgdval_t) > sizeof(long))
9018+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9019+ val, (u64)val >> 32);
9020+ else
9021+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9022+ val);
9023+}
9024+
9025 static inline void pgd_clear(pgd_t *pgdp)
9026 {
9027 set_pgd(pgdp, __pgd(0));
9028@@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
9029 pv_mmu_ops.set_fixmap(idx, phys, flags);
9030 }
9031
9032+#ifdef CONFIG_PAX_KERNEXEC
9033+static inline unsigned long pax_open_kernel(void)
9034+{
9035+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9036+}
9037+
9038+static inline unsigned long pax_close_kernel(void)
9039+{
9040+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9041+}
9042+#else
9043+static inline unsigned long pax_open_kernel(void) { return 0; }
9044+static inline unsigned long pax_close_kernel(void) { return 0; }
9045+#endif
9046+
9047 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9048
9049 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
9050@@ -964,7 +991,7 @@ extern void default_banner(void);
9051
9052 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9053 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9054-#define PARA_INDIRECT(addr) *%cs:addr
9055+#define PARA_INDIRECT(addr) *%ss:addr
9056 #endif
9057
9058 #define INTERRUPT_RETURN \
9059@@ -1041,6 +1068,21 @@ extern void default_banner(void);
9060 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9061 CLBR_NONE, \
9062 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9063+
9064+#define GET_CR0_INTO_RDI \
9065+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9066+ mov %rax,%rdi
9067+
9068+#define SET_RDI_INTO_CR0 \
9069+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9070+
9071+#define GET_CR3_INTO_RDI \
9072+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9073+ mov %rax,%rdi
9074+
9075+#define SET_RDI_INTO_CR3 \
9076+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9077+
9078 #endif /* CONFIG_X86_32 */
9079
9080 #endif /* __ASSEMBLY__ */
9081diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
9082index 8e8b9a4..f07d725 100644
9083--- a/arch/x86/include/asm/paravirt_types.h
9084+++ b/arch/x86/include/asm/paravirt_types.h
9085@@ -84,20 +84,20 @@ struct pv_init_ops {
9086 */
9087 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9088 unsigned long addr, unsigned len);
9089-};
9090+} __no_const;
9091
9092
9093 struct pv_lazy_ops {
9094 /* Set deferred update mode, used for batching operations. */
9095 void (*enter)(void);
9096 void (*leave)(void);
9097-};
9098+} __no_const;
9099
9100 struct pv_time_ops {
9101 unsigned long long (*sched_clock)(void);
9102 unsigned long long (*steal_clock)(int cpu);
9103 unsigned long (*get_tsc_khz)(void);
9104-};
9105+} __no_const;
9106
9107 struct pv_cpu_ops {
9108 /* hooks for various privileged instructions */
9109@@ -193,7 +193,7 @@ struct pv_cpu_ops {
9110
9111 void (*start_context_switch)(struct task_struct *prev);
9112 void (*end_context_switch)(struct task_struct *next);
9113-};
9114+} __no_const;
9115
9116 struct pv_irq_ops {
9117 /*
9118@@ -224,7 +224,7 @@ struct pv_apic_ops {
9119 unsigned long start_eip,
9120 unsigned long start_esp);
9121 #endif
9122-};
9123+} __no_const;
9124
9125 struct pv_mmu_ops {
9126 unsigned long (*read_cr2)(void);
9127@@ -313,6 +313,7 @@ struct pv_mmu_ops {
9128 struct paravirt_callee_save make_pud;
9129
9130 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9131+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9132 #endif /* PAGETABLE_LEVELS == 4 */
9133 #endif /* PAGETABLE_LEVELS >= 3 */
9134
9135@@ -324,6 +325,12 @@ struct pv_mmu_ops {
9136 an mfn. We can tell which is which from the index. */
9137 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9138 phys_addr_t phys, pgprot_t flags);
9139+
9140+#ifdef CONFIG_PAX_KERNEXEC
9141+ unsigned long (*pax_open_kernel)(void);
9142+ unsigned long (*pax_close_kernel)(void);
9143+#endif
9144+
9145 };
9146
9147 struct arch_spinlock;
9148@@ -334,7 +341,7 @@ struct pv_lock_ops {
9149 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
9150 int (*spin_trylock)(struct arch_spinlock *lock);
9151 void (*spin_unlock)(struct arch_spinlock *lock);
9152-};
9153+} __no_const;
9154
9155 /* This contains all the paravirt structures: we get a convenient
9156 * number for each function using the offset which we use to indicate
9157diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
9158index b4389a4..b7ff22c 100644
9159--- a/arch/x86/include/asm/pgalloc.h
9160+++ b/arch/x86/include/asm/pgalloc.h
9161@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
9162 pmd_t *pmd, pte_t *pte)
9163 {
9164 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9165+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9166+}
9167+
9168+static inline void pmd_populate_user(struct mm_struct *mm,
9169+ pmd_t *pmd, pte_t *pte)
9170+{
9171+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9172 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9173 }
9174
9175diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
9176index 98391db..8f6984e 100644
9177--- a/arch/x86/include/asm/pgtable-2level.h
9178+++ b/arch/x86/include/asm/pgtable-2level.h
9179@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
9180
9181 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9182 {
9183+ pax_open_kernel();
9184 *pmdp = pmd;
9185+ pax_close_kernel();
9186 }
9187
9188 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9189diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
9190index effff47..f9e4035 100644
9191--- a/arch/x86/include/asm/pgtable-3level.h
9192+++ b/arch/x86/include/asm/pgtable-3level.h
9193@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9194
9195 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9196 {
9197+ pax_open_kernel();
9198 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9199+ pax_close_kernel();
9200 }
9201
9202 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9203 {
9204+ pax_open_kernel();
9205 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9206+ pax_close_kernel();
9207 }
9208
9209 /*
9210diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
9211index 18601c8..3d716d1 100644
9212--- a/arch/x86/include/asm/pgtable.h
9213+++ b/arch/x86/include/asm/pgtable.h
9214@@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9215
9216 #ifndef __PAGETABLE_PUD_FOLDED
9217 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9218+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9219 #define pgd_clear(pgd) native_pgd_clear(pgd)
9220 #endif
9221
9222@@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9223
9224 #define arch_end_context_switch(prev) do {} while(0)
9225
9226+#define pax_open_kernel() native_pax_open_kernel()
9227+#define pax_close_kernel() native_pax_close_kernel()
9228 #endif /* CONFIG_PARAVIRT */
9229
9230+#define __HAVE_ARCH_PAX_OPEN_KERNEL
9231+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9232+
9233+#ifdef CONFIG_PAX_KERNEXEC
9234+static inline unsigned long native_pax_open_kernel(void)
9235+{
9236+ unsigned long cr0;
9237+
9238+ preempt_disable();
9239+ barrier();
9240+ cr0 = read_cr0() ^ X86_CR0_WP;
9241+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
9242+ write_cr0(cr0);
9243+ return cr0 ^ X86_CR0_WP;
9244+}
9245+
9246+static inline unsigned long native_pax_close_kernel(void)
9247+{
9248+ unsigned long cr0;
9249+
9250+ cr0 = read_cr0() ^ X86_CR0_WP;
9251+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9252+ write_cr0(cr0);
9253+ barrier();
9254+ preempt_enable_no_resched();
9255+ return cr0 ^ X86_CR0_WP;
9256+}
9257+#else
9258+static inline unsigned long native_pax_open_kernel(void) { return 0; }
9259+static inline unsigned long native_pax_close_kernel(void) { return 0; }
9260+#endif
9261+
9262 /*
9263 * The following only work if pte_present() is true.
9264 * Undefined behaviour if not..
9265 */
9266+static inline int pte_user(pte_t pte)
9267+{
9268+ return pte_val(pte) & _PAGE_USER;
9269+}
9270+
9271 static inline int pte_dirty(pte_t pte)
9272 {
9273 return pte_flags(pte) & _PAGE_DIRTY;
9274@@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
9275 return pte_clear_flags(pte, _PAGE_RW);
9276 }
9277
9278+static inline pte_t pte_mkread(pte_t pte)
9279+{
9280+ return __pte(pte_val(pte) | _PAGE_USER);
9281+}
9282+
9283 static inline pte_t pte_mkexec(pte_t pte)
9284 {
9285- return pte_clear_flags(pte, _PAGE_NX);
9286+#ifdef CONFIG_X86_PAE
9287+ if (__supported_pte_mask & _PAGE_NX)
9288+ return pte_clear_flags(pte, _PAGE_NX);
9289+ else
9290+#endif
9291+ return pte_set_flags(pte, _PAGE_USER);
9292+}
9293+
9294+static inline pte_t pte_exprotect(pte_t pte)
9295+{
9296+#ifdef CONFIG_X86_PAE
9297+ if (__supported_pte_mask & _PAGE_NX)
9298+ return pte_set_flags(pte, _PAGE_NX);
9299+ else
9300+#endif
9301+ return pte_clear_flags(pte, _PAGE_USER);
9302 }
9303
9304 static inline pte_t pte_mkdirty(pte_t pte)
9305@@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
9306 #endif
9307
9308 #ifndef __ASSEMBLY__
9309+
9310+#ifdef CONFIG_PAX_PER_CPU_PGD
9311+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
9312+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
9313+{
9314+ return cpu_pgd[cpu];
9315+}
9316+#endif
9317+
9318 #include <linux/mm_types.h>
9319
9320 static inline int pte_none(pte_t pte)
9321@@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
9322
9323 static inline int pgd_bad(pgd_t pgd)
9324 {
9325- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
9326+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
9327 }
9328
9329 static inline int pgd_none(pgd_t pgd)
9330@@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
9331 * pgd_offset() returns a (pgd_t *)
9332 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
9333 */
9334-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
9335+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
9336+
9337+#ifdef CONFIG_PAX_PER_CPU_PGD
9338+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
9339+#endif
9340+
9341 /*
9342 * a shortcut which implies the use of the kernel's pgd, instead
9343 * of a process's
9344@@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
9345 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
9346 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
9347
9348+#ifdef CONFIG_X86_32
9349+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
9350+#else
9351+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
9352+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
9353+
9354+#ifdef CONFIG_PAX_MEMORY_UDEREF
9355+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
9356+#else
9357+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
9358+#endif
9359+
9360+#endif
9361+
9362 #ifndef __ASSEMBLY__
9363
9364 extern int direct_gbpages;
9365@@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
9366 * dst and src can be on the same page, but the range must not overlap,
9367 * and must not cross a page boundary.
9368 */
9369-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
9370+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
9371 {
9372- memcpy(dst, src, count * sizeof(pgd_t));
9373+ pax_open_kernel();
9374+ while (count--)
9375+ *dst++ = *src++;
9376+ pax_close_kernel();
9377 }
9378
9379+#ifdef CONFIG_PAX_PER_CPU_PGD
9380+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9381+#endif
9382+
9383+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9384+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9385+#else
9386+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
9387+#endif
9388
9389 #include <asm-generic/pgtable.h>
9390 #endif /* __ASSEMBLY__ */
9391diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
9392index 0c92113..34a77c6 100644
9393--- a/arch/x86/include/asm/pgtable_32.h
9394+++ b/arch/x86/include/asm/pgtable_32.h
9395@@ -25,9 +25,6 @@
9396 struct mm_struct;
9397 struct vm_area_struct;
9398
9399-extern pgd_t swapper_pg_dir[1024];
9400-extern pgd_t initial_page_table[1024];
9401-
9402 static inline void pgtable_cache_init(void) { }
9403 static inline void check_pgt_cache(void) { }
9404 void paging_init(void);
9405@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9406 # include <asm/pgtable-2level.h>
9407 #endif
9408
9409+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9410+extern pgd_t initial_page_table[PTRS_PER_PGD];
9411+#ifdef CONFIG_X86_PAE
9412+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9413+#endif
9414+
9415 #if defined(CONFIG_HIGHPTE)
9416 #define pte_offset_map(dir, address) \
9417 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
9418@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9419 /* Clear a kernel PTE and flush it from the TLB */
9420 #define kpte_clear_flush(ptep, vaddr) \
9421 do { \
9422+ pax_open_kernel(); \
9423 pte_clear(&init_mm, (vaddr), (ptep)); \
9424+ pax_close_kernel(); \
9425 __flush_tlb_one((vaddr)); \
9426 } while (0)
9427
9428@@ -74,6 +79,9 @@ do { \
9429
9430 #endif /* !__ASSEMBLY__ */
9431
9432+#define HAVE_ARCH_UNMAPPED_AREA
9433+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9434+
9435 /*
9436 * kern_addr_valid() is (1) for FLATMEM and (0) for
9437 * SPARSEMEM and DISCONTIGMEM
9438diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
9439index ed5903b..c7fe163 100644
9440--- a/arch/x86/include/asm/pgtable_32_types.h
9441+++ b/arch/x86/include/asm/pgtable_32_types.h
9442@@ -8,7 +8,7 @@
9443 */
9444 #ifdef CONFIG_X86_PAE
9445 # include <asm/pgtable-3level_types.h>
9446-# define PMD_SIZE (1UL << PMD_SHIFT)
9447+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9448 # define PMD_MASK (~(PMD_SIZE - 1))
9449 #else
9450 # include <asm/pgtable-2level_types.h>
9451@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
9452 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9453 #endif
9454
9455+#ifdef CONFIG_PAX_KERNEXEC
9456+#ifndef __ASSEMBLY__
9457+extern unsigned char MODULES_EXEC_VADDR[];
9458+extern unsigned char MODULES_EXEC_END[];
9459+#endif
9460+#include <asm/boot.h>
9461+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9462+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9463+#else
9464+#define ktla_ktva(addr) (addr)
9465+#define ktva_ktla(addr) (addr)
9466+#endif
9467+
9468 #define MODULES_VADDR VMALLOC_START
9469 #define MODULES_END VMALLOC_END
9470 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9471diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
9472index 975f709..107976d 100644
9473--- a/arch/x86/include/asm/pgtable_64.h
9474+++ b/arch/x86/include/asm/pgtable_64.h
9475@@ -16,10 +16,14 @@
9476
9477 extern pud_t level3_kernel_pgt[512];
9478 extern pud_t level3_ident_pgt[512];
9479+extern pud_t level3_vmalloc_start_pgt[512];
9480+extern pud_t level3_vmalloc_end_pgt[512];
9481+extern pud_t level3_vmemmap_pgt[512];
9482+extern pud_t level2_vmemmap_pgt[512];
9483 extern pmd_t level2_kernel_pgt[512];
9484 extern pmd_t level2_fixmap_pgt[512];
9485-extern pmd_t level2_ident_pgt[512];
9486-extern pgd_t init_level4_pgt[];
9487+extern pmd_t level2_ident_pgt[512*2];
9488+extern pgd_t init_level4_pgt[512];
9489
9490 #define swapper_pg_dir init_level4_pgt
9491
9492@@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9493
9494 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9495 {
9496+ pax_open_kernel();
9497 *pmdp = pmd;
9498+ pax_close_kernel();
9499 }
9500
9501 static inline void native_pmd_clear(pmd_t *pmd)
9502@@ -107,6 +113,13 @@ static inline void native_pud_clear(pud_t *pud)
9503
9504 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9505 {
9506+ pax_open_kernel();
9507+ *pgdp = pgd;
9508+ pax_close_kernel();
9509+}
9510+
9511+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9512+{
9513 *pgdp = pgd;
9514 }
9515
9516diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
9517index 766ea16..5b96cb3 100644
9518--- a/arch/x86/include/asm/pgtable_64_types.h
9519+++ b/arch/x86/include/asm/pgtable_64_types.h
9520@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9521 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9522 #define MODULES_END _AC(0xffffffffff000000, UL)
9523 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9524+#define MODULES_EXEC_VADDR MODULES_VADDR
9525+#define MODULES_EXEC_END MODULES_END
9526+
9527+#define ktla_ktva(addr) (addr)
9528+#define ktva_ktla(addr) (addr)
9529
9530 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9531diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
9532index 013286a..8b42f4f 100644
9533--- a/arch/x86/include/asm/pgtable_types.h
9534+++ b/arch/x86/include/asm/pgtable_types.h
9535@@ -16,13 +16,12 @@
9536 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
9537 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
9538 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
9539-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
9540+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
9541 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
9542 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
9543 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
9544-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
9545-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
9546-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
9547+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
9548+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
9549 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
9550
9551 /* If _PAGE_BIT_PRESENT is clear, we use these: */
9552@@ -40,7 +39,6 @@
9553 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
9554 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
9555 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
9556-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
9557 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
9558 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
9559 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
9560@@ -57,8 +55,10 @@
9561
9562 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
9563 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
9564-#else
9565+#elif defined(CONFIG_KMEMCHECK)
9566 #define _PAGE_NX (_AT(pteval_t, 0))
9567+#else
9568+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
9569 #endif
9570
9571 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
9572@@ -96,6 +96,9 @@
9573 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
9574 _PAGE_ACCESSED)
9575
9576+#define PAGE_READONLY_NOEXEC PAGE_READONLY
9577+#define PAGE_SHARED_NOEXEC PAGE_SHARED
9578+
9579 #define __PAGE_KERNEL_EXEC \
9580 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
9581 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
9582@@ -106,7 +109,7 @@
9583 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
9584 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
9585 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
9586-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
9587+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
9588 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
9589 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
9590 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
9591@@ -168,8 +171,8 @@
9592 * bits are combined, this will alow user to access the high address mapped
9593 * VDSO in the presence of CONFIG_COMPAT_VDSO
9594 */
9595-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
9596-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
9597+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9598+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9599 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
9600 #endif
9601
9602@@ -207,7 +210,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
9603 {
9604 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
9605 }
9606+#endif
9607
9608+#if PAGETABLE_LEVELS == 3
9609+#include <asm-generic/pgtable-nopud.h>
9610+#endif
9611+
9612+#if PAGETABLE_LEVELS == 2
9613+#include <asm-generic/pgtable-nopmd.h>
9614+#endif
9615+
9616+#ifndef __ASSEMBLY__
9617 #if PAGETABLE_LEVELS > 3
9618 typedef struct { pudval_t pud; } pud_t;
9619
9620@@ -221,8 +234,6 @@ static inline pudval_t native_pud_val(pud_t pud)
9621 return pud.pud;
9622 }
9623 #else
9624-#include <asm-generic/pgtable-nopud.h>
9625-
9626 static inline pudval_t native_pud_val(pud_t pud)
9627 {
9628 return native_pgd_val(pud.pgd);
9629@@ -242,8 +253,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
9630 return pmd.pmd;
9631 }
9632 #else
9633-#include <asm-generic/pgtable-nopmd.h>
9634-
9635 static inline pmdval_t native_pmd_val(pmd_t pmd)
9636 {
9637 return native_pgd_val(pmd.pud.pgd);
9638@@ -283,7 +292,6 @@ typedef struct page *pgtable_t;
9639
9640 extern pteval_t __supported_pte_mask;
9641 extern void set_nx(void);
9642-extern int nx_enabled;
9643
9644 #define pgprot_writecombine pgprot_writecombine
9645 extern pgprot_t pgprot_writecombine(pgprot_t prot);
9646diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
9647index 0d1171c..36571a9 100644
9648--- a/arch/x86/include/asm/processor.h
9649+++ b/arch/x86/include/asm/processor.h
9650@@ -266,7 +266,7 @@ struct tss_struct {
9651
9652 } ____cacheline_aligned;
9653
9654-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
9655+extern struct tss_struct init_tss[NR_CPUS];
9656
9657 /*
9658 * Save the original ist values for checking stack pointers during debugging
9659@@ -858,11 +858,18 @@ static inline void spin_lock_prefetch(const void *x)
9660 */
9661 #define TASK_SIZE PAGE_OFFSET
9662 #define TASK_SIZE_MAX TASK_SIZE
9663+
9664+#ifdef CONFIG_PAX_SEGMEXEC
9665+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
9666+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
9667+#else
9668 #define STACK_TOP TASK_SIZE
9669-#define STACK_TOP_MAX STACK_TOP
9670+#endif
9671+
9672+#define STACK_TOP_MAX TASK_SIZE
9673
9674 #define INIT_THREAD { \
9675- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9676+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9677 .vm86_info = NULL, \
9678 .sysenter_cs = __KERNEL_CS, \
9679 .io_bitmap_ptr = NULL, \
9680@@ -876,7 +883,7 @@ static inline void spin_lock_prefetch(const void *x)
9681 */
9682 #define INIT_TSS { \
9683 .x86_tss = { \
9684- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9685+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9686 .ss0 = __KERNEL_DS, \
9687 .ss1 = __KERNEL_CS, \
9688 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
9689@@ -887,11 +894,7 @@ static inline void spin_lock_prefetch(const void *x)
9690 extern unsigned long thread_saved_pc(struct task_struct *tsk);
9691
9692 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
9693-#define KSTK_TOP(info) \
9694-({ \
9695- unsigned long *__ptr = (unsigned long *)(info); \
9696- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
9697-})
9698+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
9699
9700 /*
9701 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
9702@@ -906,7 +909,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9703 #define task_pt_regs(task) \
9704 ({ \
9705 struct pt_regs *__regs__; \
9706- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
9707+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
9708 __regs__ - 1; \
9709 })
9710
9711@@ -916,13 +919,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9712 /*
9713 * User space process size. 47bits minus one guard page.
9714 */
9715-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
9716+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
9717
9718 /* This decides where the kernel will search for a free chunk of vm
9719 * space during mmap's.
9720 */
9721 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
9722- 0xc0000000 : 0xFFFFe000)
9723+ 0xc0000000 : 0xFFFFf000)
9724
9725 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
9726 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
9727@@ -933,11 +936,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9728 #define STACK_TOP_MAX TASK_SIZE_MAX
9729
9730 #define INIT_THREAD { \
9731- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9732+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9733 }
9734
9735 #define INIT_TSS { \
9736- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9737+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9738 }
9739
9740 /*
9741@@ -959,6 +962,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
9742 */
9743 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
9744
9745+#ifdef CONFIG_PAX_SEGMEXEC
9746+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
9747+#endif
9748+
9749 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
9750
9751 /* Get/set a process' ability to use the timestamp counter instruction */
9752diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
9753index 3566454..4bdfb8c 100644
9754--- a/arch/x86/include/asm/ptrace.h
9755+++ b/arch/x86/include/asm/ptrace.h
9756@@ -156,28 +156,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
9757 }
9758
9759 /*
9760- * user_mode_vm(regs) determines whether a register set came from user mode.
9761+ * user_mode(regs) determines whether a register set came from user mode.
9762 * This is true if V8086 mode was enabled OR if the register set was from
9763 * protected mode with RPL-3 CS value. This tricky test checks that with
9764 * one comparison. Many places in the kernel can bypass this full check
9765- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
9766+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
9767+ * be used.
9768 */
9769-static inline int user_mode(struct pt_regs *regs)
9770+static inline int user_mode_novm(struct pt_regs *regs)
9771 {
9772 #ifdef CONFIG_X86_32
9773 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
9774 #else
9775- return !!(regs->cs & 3);
9776+ return !!(regs->cs & SEGMENT_RPL_MASK);
9777 #endif
9778 }
9779
9780-static inline int user_mode_vm(struct pt_regs *regs)
9781+static inline int user_mode(struct pt_regs *regs)
9782 {
9783 #ifdef CONFIG_X86_32
9784 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
9785 USER_RPL;
9786 #else
9787- return user_mode(regs);
9788+ return user_mode_novm(regs);
9789 #endif
9790 }
9791
9792@@ -193,15 +194,16 @@ static inline int v8086_mode(struct pt_regs *regs)
9793 #ifdef CONFIG_X86_64
9794 static inline bool user_64bit_mode(struct pt_regs *regs)
9795 {
9796+ unsigned long cs = regs->cs & 0xffff;
9797 #ifndef CONFIG_PARAVIRT
9798 /*
9799 * On non-paravirt systems, this is the only long mode CPL 3
9800 * selector. We do not allow long mode selectors in the LDT.
9801 */
9802- return regs->cs == __USER_CS;
9803+ return cs == __USER_CS;
9804 #else
9805 /* Headers are too twisted for this to go in paravirt.h. */
9806- return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
9807+ return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
9808 #endif
9809 }
9810 #endif
9811diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
9812index 3250e3d..20db631 100644
9813--- a/arch/x86/include/asm/reboot.h
9814+++ b/arch/x86/include/asm/reboot.h
9815@@ -6,19 +6,19 @@
9816 struct pt_regs;
9817
9818 struct machine_ops {
9819- void (*restart)(char *cmd);
9820- void (*halt)(void);
9821- void (*power_off)(void);
9822+ void (* __noreturn restart)(char *cmd);
9823+ void (* __noreturn halt)(void);
9824+ void (* __noreturn power_off)(void);
9825 void (*shutdown)(void);
9826 void (*crash_shutdown)(struct pt_regs *);
9827- void (*emergency_restart)(void);
9828-};
9829+ void (* __noreturn emergency_restart)(void);
9830+} __no_const;
9831
9832 extern struct machine_ops machine_ops;
9833
9834 void native_machine_crash_shutdown(struct pt_regs *regs);
9835 void native_machine_shutdown(void);
9836-void machine_real_restart(unsigned int type);
9837+void machine_real_restart(unsigned int type) __noreturn;
9838 /* These must match dispatch_table in reboot_32.S */
9839 #define MRR_BIOS 0
9840 #define MRR_APM 1
9841diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
9842index df4cd32..27ae072 100644
9843--- a/arch/x86/include/asm/rwsem.h
9844+++ b/arch/x86/include/asm/rwsem.h
9845@@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
9846 {
9847 asm volatile("# beginning down_read\n\t"
9848 LOCK_PREFIX _ASM_INC "(%1)\n\t"
9849+
9850+#ifdef CONFIG_PAX_REFCOUNT
9851+ "jno 0f\n"
9852+ LOCK_PREFIX _ASM_DEC "(%1)\n"
9853+ "int $4\n0:\n"
9854+ _ASM_EXTABLE(0b, 0b)
9855+#endif
9856+
9857 /* adds 0x00000001 */
9858 " jns 1f\n"
9859 " call call_rwsem_down_read_failed\n"
9860@@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
9861 "1:\n\t"
9862 " mov %1,%2\n\t"
9863 " add %3,%2\n\t"
9864+
9865+#ifdef CONFIG_PAX_REFCOUNT
9866+ "jno 0f\n"
9867+ "sub %3,%2\n"
9868+ "int $4\n0:\n"
9869+ _ASM_EXTABLE(0b, 0b)
9870+#endif
9871+
9872 " jle 2f\n\t"
9873 LOCK_PREFIX " cmpxchg %2,%0\n\t"
9874 " jnz 1b\n\t"
9875@@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
9876 long tmp;
9877 asm volatile("# beginning down_write\n\t"
9878 LOCK_PREFIX " xadd %1,(%2)\n\t"
9879+
9880+#ifdef CONFIG_PAX_REFCOUNT
9881+ "jno 0f\n"
9882+ "mov %1,(%2)\n"
9883+ "int $4\n0:\n"
9884+ _ASM_EXTABLE(0b, 0b)
9885+#endif
9886+
9887 /* adds 0xffff0001, returns the old value */
9888 " test %1,%1\n\t"
9889 /* was the count 0 before? */
9890@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_semaphore *sem)
9891 long tmp;
9892 asm volatile("# beginning __up_read\n\t"
9893 LOCK_PREFIX " xadd %1,(%2)\n\t"
9894+
9895+#ifdef CONFIG_PAX_REFCOUNT
9896+ "jno 0f\n"
9897+ "mov %1,(%2)\n"
9898+ "int $4\n0:\n"
9899+ _ASM_EXTABLE(0b, 0b)
9900+#endif
9901+
9902 /* subtracts 1, returns the old value */
9903 " jns 1f\n\t"
9904 " call call_rwsem_wake\n" /* expects old value in %edx */
9905@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_semaphore *sem)
9906 long tmp;
9907 asm volatile("# beginning __up_write\n\t"
9908 LOCK_PREFIX " xadd %1,(%2)\n\t"
9909+
9910+#ifdef CONFIG_PAX_REFCOUNT
9911+ "jno 0f\n"
9912+ "mov %1,(%2)\n"
9913+ "int $4\n0:\n"
9914+ _ASM_EXTABLE(0b, 0b)
9915+#endif
9916+
9917 /* subtracts 0xffff0001, returns the old value */
9918 " jns 1f\n\t"
9919 " call call_rwsem_wake\n" /* expects old value in %edx */
9920@@ -176,6 +216,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9921 {
9922 asm volatile("# beginning __downgrade_write\n\t"
9923 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
9924+
9925+#ifdef CONFIG_PAX_REFCOUNT
9926+ "jno 0f\n"
9927+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
9928+ "int $4\n0:\n"
9929+ _ASM_EXTABLE(0b, 0b)
9930+#endif
9931+
9932 /*
9933 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
9934 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
9935@@ -194,7 +242,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9936 */
9937 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
9938 {
9939- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
9940+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
9941+
9942+#ifdef CONFIG_PAX_REFCOUNT
9943+ "jno 0f\n"
9944+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
9945+ "int $4\n0:\n"
9946+ _ASM_EXTABLE(0b, 0b)
9947+#endif
9948+
9949 : "+m" (sem->count)
9950 : "er" (delta));
9951 }
9952@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
9953 {
9954 long tmp = delta;
9955
9956- asm volatile(LOCK_PREFIX "xadd %0,%1"
9957+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
9958+
9959+#ifdef CONFIG_PAX_REFCOUNT
9960+ "jno 0f\n"
9961+ "mov %0,%1\n"
9962+ "int $4\n0:\n"
9963+ _ASM_EXTABLE(0b, 0b)
9964+#endif
9965+
9966 : "+r" (tmp), "+m" (sem->count)
9967 : : "memory");
9968
9969diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
9970index 5e64171..f58957e 100644
9971--- a/arch/x86/include/asm/segment.h
9972+++ b/arch/x86/include/asm/segment.h
9973@@ -64,10 +64,15 @@
9974 * 26 - ESPFIX small SS
9975 * 27 - per-cpu [ offset to per-cpu data area ]
9976 * 28 - stack_canary-20 [ for stack protector ]
9977- * 29 - unused
9978- * 30 - unused
9979+ * 29 - PCI BIOS CS
9980+ * 30 - PCI BIOS DS
9981 * 31 - TSS for double fault handler
9982 */
9983+#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
9984+#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
9985+#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
9986+#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
9987+
9988 #define GDT_ENTRY_TLS_MIN 6
9989 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
9990
9991@@ -79,6 +84,8 @@
9992
9993 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
9994
9995+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
9996+
9997 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
9998
9999 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
10000@@ -104,6 +111,12 @@
10001 #define __KERNEL_STACK_CANARY 0
10002 #endif
10003
10004+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
10005+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
10006+
10007+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
10008+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
10009+
10010 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
10011
10012 /*
10013@@ -141,7 +154,7 @@
10014 */
10015
10016 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
10017-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10018+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10019
10020
10021 #else
10022@@ -165,6 +178,8 @@
10023 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
10024 #define __USER32_DS __USER_DS
10025
10026+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10027+
10028 #define GDT_ENTRY_TSS 8 /* needs two entries */
10029 #define GDT_ENTRY_LDT 10 /* needs two entries */
10030 #define GDT_ENTRY_TLS_MIN 12
10031@@ -185,6 +200,7 @@
10032 #endif
10033
10034 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
10035+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
10036 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
10037 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
10038 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
10039diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
10040index 73b11bc..d4a3b63 100644
10041--- a/arch/x86/include/asm/smp.h
10042+++ b/arch/x86/include/asm/smp.h
10043@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10044 /* cpus sharing the last level cache: */
10045 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
10046 DECLARE_PER_CPU(u16, cpu_llc_id);
10047-DECLARE_PER_CPU(int, cpu_number);
10048+DECLARE_PER_CPU(unsigned int, cpu_number);
10049
10050 static inline struct cpumask *cpu_sibling_mask(int cpu)
10051 {
10052@@ -77,7 +77,7 @@ struct smp_ops {
10053
10054 void (*send_call_func_ipi)(const struct cpumask *mask);
10055 void (*send_call_func_single_ipi)(int cpu);
10056-};
10057+} __no_const;
10058
10059 /* Globals due to paravirt */
10060 extern void set_cpu_sibling_map(int cpu);
10061@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata;
10062 extern int safe_smp_processor_id(void);
10063
10064 #elif defined(CONFIG_X86_64_SMP)
10065-#define raw_smp_processor_id() (percpu_read(cpu_number))
10066-
10067-#define stack_smp_processor_id() \
10068-({ \
10069- struct thread_info *ti; \
10070- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10071- ti->cpu; \
10072-})
10073+#define raw_smp_processor_id() (percpu_read(cpu_number))
10074+#define stack_smp_processor_id() raw_smp_processor_id()
10075 #define safe_smp_processor_id() smp_processor_id()
10076
10077 #endif
10078diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
10079index ee67edf..49c796b 100644
10080--- a/arch/x86/include/asm/spinlock.h
10081+++ b/arch/x86/include/asm/spinlock.h
10082@@ -248,6 +248,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
10083 static inline void arch_read_lock(arch_rwlock_t *rw)
10084 {
10085 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
10086+
10087+#ifdef CONFIG_PAX_REFCOUNT
10088+ "jno 0f\n"
10089+ LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
10090+ "int $4\n0:\n"
10091+ _ASM_EXTABLE(0b, 0b)
10092+#endif
10093+
10094 "jns 1f\n"
10095 "call __read_lock_failed\n\t"
10096 "1:\n"
10097@@ -257,6 +265,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
10098 static inline void arch_write_lock(arch_rwlock_t *rw)
10099 {
10100 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
10101+
10102+#ifdef CONFIG_PAX_REFCOUNT
10103+ "jno 0f\n"
10104+ LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
10105+ "int $4\n0:\n"
10106+ _ASM_EXTABLE(0b, 0b)
10107+#endif
10108+
10109 "jz 1f\n"
10110 "call __write_lock_failed\n\t"
10111 "1:\n"
10112@@ -286,13 +302,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
10113
10114 static inline void arch_read_unlock(arch_rwlock_t *rw)
10115 {
10116- asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
10117+ asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
10118+
10119+#ifdef CONFIG_PAX_REFCOUNT
10120+ "jno 0f\n"
10121+ LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
10122+ "int $4\n0:\n"
10123+ _ASM_EXTABLE(0b, 0b)
10124+#endif
10125+
10126 :"+m" (rw->lock) : : "memory");
10127 }
10128
10129 static inline void arch_write_unlock(arch_rwlock_t *rw)
10130 {
10131- asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
10132+ asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
10133+
10134+#ifdef CONFIG_PAX_REFCOUNT
10135+ "jno 0f\n"
10136+ LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
10137+ "int $4\n0:\n"
10138+ _ASM_EXTABLE(0b, 0b)
10139+#endif
10140+
10141 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
10142 }
10143
10144diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
10145index 1575177..cb23f52 100644
10146--- a/arch/x86/include/asm/stackprotector.h
10147+++ b/arch/x86/include/asm/stackprotector.h
10148@@ -48,7 +48,7 @@
10149 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10150 */
10151 #define GDT_STACK_CANARY_INIT \
10152- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10153+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10154
10155 /*
10156 * Initialize the stackprotector canary value.
10157@@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
10158
10159 static inline void load_stack_canary_segment(void)
10160 {
10161-#ifdef CONFIG_X86_32
10162+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10163 asm volatile ("mov %0, %%gs" : : "r" (0));
10164 #endif
10165 }
10166diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
10167index 70bbe39..4ae2bd4 100644
10168--- a/arch/x86/include/asm/stacktrace.h
10169+++ b/arch/x86/include/asm/stacktrace.h
10170@@ -11,28 +11,20 @@
10171
10172 extern int kstack_depth_to_print;
10173
10174-struct thread_info;
10175+struct task_struct;
10176 struct stacktrace_ops;
10177
10178-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
10179- unsigned long *stack,
10180- unsigned long bp,
10181- const struct stacktrace_ops *ops,
10182- void *data,
10183- unsigned long *end,
10184- int *graph);
10185+typedef unsigned long walk_stack_t(struct task_struct *task,
10186+ void *stack_start,
10187+ unsigned long *stack,
10188+ unsigned long bp,
10189+ const struct stacktrace_ops *ops,
10190+ void *data,
10191+ unsigned long *end,
10192+ int *graph);
10193
10194-extern unsigned long
10195-print_context_stack(struct thread_info *tinfo,
10196- unsigned long *stack, unsigned long bp,
10197- const struct stacktrace_ops *ops, void *data,
10198- unsigned long *end, int *graph);
10199-
10200-extern unsigned long
10201-print_context_stack_bp(struct thread_info *tinfo,
10202- unsigned long *stack, unsigned long bp,
10203- const struct stacktrace_ops *ops, void *data,
10204- unsigned long *end, int *graph);
10205+extern walk_stack_t print_context_stack;
10206+extern walk_stack_t print_context_stack_bp;
10207
10208 /* Generic stack tracer with callbacks */
10209
10210@@ -40,7 +32,7 @@ struct stacktrace_ops {
10211 void (*address)(void *data, unsigned long address, int reliable);
10212 /* On negative return stop dumping */
10213 int (*stack)(void *data, char *name);
10214- walk_stack_t walk_stack;
10215+ walk_stack_t *walk_stack;
10216 };
10217
10218 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
10219diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
10220index cb23852..2dde194 100644
10221--- a/arch/x86/include/asm/sys_ia32.h
10222+++ b/arch/x86/include/asm/sys_ia32.h
10223@@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int, compat_sigset_t __user *,
10224 compat_sigset_t __user *, unsigned int);
10225 asmlinkage long sys32_alarm(unsigned int);
10226
10227-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
10228+asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
10229 asmlinkage long sys32_sysfs(int, u32, u32);
10230
10231 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
10232diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
10233index 2d2f01c..f985723 100644
10234--- a/arch/x86/include/asm/system.h
10235+++ b/arch/x86/include/asm/system.h
10236@@ -129,7 +129,7 @@ do { \
10237 "call __switch_to\n\t" \
10238 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10239 __switch_canary \
10240- "movq %P[thread_info](%%rsi),%%r8\n\t" \
10241+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10242 "movq %%rax,%%rdi\n\t" \
10243 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10244 "jnz ret_from_fork\n\t" \
10245@@ -140,7 +140,7 @@ do { \
10246 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10247 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10248 [_tif_fork] "i" (_TIF_FORK), \
10249- [thread_info] "i" (offsetof(struct task_struct, stack)), \
10250+ [thread_info] "m" (current_tinfo), \
10251 [current_task] "m" (current_task) \
10252 __switch_canary_iparam \
10253 : "memory", "cc" __EXTRA_CLOBBER)
10254@@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
10255 {
10256 unsigned long __limit;
10257 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10258- return __limit + 1;
10259+ return __limit;
10260 }
10261
10262 static inline void native_clts(void)
10263@@ -397,13 +397,13 @@ void enable_hlt(void);
10264
10265 void cpu_idle_wait(void);
10266
10267-extern unsigned long arch_align_stack(unsigned long sp);
10268+#define arch_align_stack(x) ((x) & ~0xfUL)
10269 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10270
10271 void default_idle(void);
10272 bool set_pm_idle_to_default(void);
10273
10274-void stop_this_cpu(void *dummy);
10275+void stop_this_cpu(void *dummy) __noreturn;
10276
10277 /*
10278 * Force strict CPU ordering.
10279diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
10280index a1fe5c1..ee326d8 100644
10281--- a/arch/x86/include/asm/thread_info.h
10282+++ b/arch/x86/include/asm/thread_info.h
10283@@ -10,6 +10,7 @@
10284 #include <linux/compiler.h>
10285 #include <asm/page.h>
10286 #include <asm/types.h>
10287+#include <asm/percpu.h>
10288
10289 /*
10290 * low level task data that entry.S needs immediate access to
10291@@ -24,7 +25,6 @@ struct exec_domain;
10292 #include <linux/atomic.h>
10293
10294 struct thread_info {
10295- struct task_struct *task; /* main task structure */
10296 struct exec_domain *exec_domain; /* execution domain */
10297 __u32 flags; /* low level flags */
10298 __u32 status; /* thread synchronous flags */
10299@@ -34,18 +34,12 @@ struct thread_info {
10300 mm_segment_t addr_limit;
10301 struct restart_block restart_block;
10302 void __user *sysenter_return;
10303-#ifdef CONFIG_X86_32
10304- unsigned long previous_esp; /* ESP of the previous stack in
10305- case of nested (IRQ) stacks
10306- */
10307- __u8 supervisor_stack[0];
10308-#endif
10309+ unsigned long lowest_stack;
10310 int uaccess_err;
10311 };
10312
10313-#define INIT_THREAD_INFO(tsk) \
10314+#define INIT_THREAD_INFO \
10315 { \
10316- .task = &tsk, \
10317 .exec_domain = &default_exec_domain, \
10318 .flags = 0, \
10319 .cpu = 0, \
10320@@ -56,7 +50,7 @@ struct thread_info {
10321 }, \
10322 }
10323
10324-#define init_thread_info (init_thread_union.thread_info)
10325+#define init_thread_info (init_thread_union.stack)
10326 #define init_stack (init_thread_union.stack)
10327
10328 #else /* !__ASSEMBLY__ */
10329@@ -170,45 +164,40 @@ struct thread_info {
10330 ret; \
10331 })
10332
10333-#ifdef CONFIG_X86_32
10334-
10335-#define STACK_WARN (THREAD_SIZE/8)
10336-/*
10337- * macros/functions for gaining access to the thread information structure
10338- *
10339- * preempt_count needs to be 1 initially, until the scheduler is functional.
10340- */
10341-#ifndef __ASSEMBLY__
10342-
10343-
10344-/* how to get the current stack pointer from C */
10345-register unsigned long current_stack_pointer asm("esp") __used;
10346-
10347-/* how to get the thread information struct from C */
10348-static inline struct thread_info *current_thread_info(void)
10349-{
10350- return (struct thread_info *)
10351- (current_stack_pointer & ~(THREAD_SIZE - 1));
10352-}
10353-
10354-#else /* !__ASSEMBLY__ */
10355-
10356+#ifdef __ASSEMBLY__
10357 /* how to get the thread information struct from ASM */
10358 #define GET_THREAD_INFO(reg) \
10359- movl $-THREAD_SIZE, reg; \
10360- andl %esp, reg
10361+ mov PER_CPU_VAR(current_tinfo), reg
10362
10363 /* use this one if reg already contains %esp */
10364-#define GET_THREAD_INFO_WITH_ESP(reg) \
10365- andl $-THREAD_SIZE, reg
10366+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10367+#else
10368+/* how to get the thread information struct from C */
10369+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10370+
10371+static __always_inline struct thread_info *current_thread_info(void)
10372+{
10373+ return percpu_read_stable(current_tinfo);
10374+}
10375+#endif
10376+
10377+#ifdef CONFIG_X86_32
10378+
10379+#define STACK_WARN (THREAD_SIZE/8)
10380+/*
10381+ * macros/functions for gaining access to the thread information structure
10382+ *
10383+ * preempt_count needs to be 1 initially, until the scheduler is functional.
10384+ */
10385+#ifndef __ASSEMBLY__
10386+
10387+/* how to get the current stack pointer from C */
10388+register unsigned long current_stack_pointer asm("esp") __used;
10389
10390 #endif
10391
10392 #else /* X86_32 */
10393
10394-#include <asm/percpu.h>
10395-#define KERNEL_STACK_OFFSET (5*8)
10396-
10397 /*
10398 * macros/functions for gaining access to the thread information structure
10399 * preempt_count needs to be 1 initially, until the scheduler is functional.
10400@@ -216,21 +205,8 @@ static inline struct thread_info *current_thread_info(void)
10401 #ifndef __ASSEMBLY__
10402 DECLARE_PER_CPU(unsigned long, kernel_stack);
10403
10404-static inline struct thread_info *current_thread_info(void)
10405-{
10406- struct thread_info *ti;
10407- ti = (void *)(percpu_read_stable(kernel_stack) +
10408- KERNEL_STACK_OFFSET - THREAD_SIZE);
10409- return ti;
10410-}
10411-
10412-#else /* !__ASSEMBLY__ */
10413-
10414-/* how to get the thread information struct from ASM */
10415-#define GET_THREAD_INFO(reg) \
10416- movq PER_CPU_VAR(kernel_stack),reg ; \
10417- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10418-
10419+/* how to get the current stack pointer from C */
10420+register unsigned long current_stack_pointer asm("rsp") __used;
10421 #endif
10422
10423 #endif /* !X86_32 */
10424@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
10425 extern void free_thread_info(struct thread_info *ti);
10426 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10427 #define arch_task_cache_init arch_task_cache_init
10428+
10429+#define __HAVE_THREAD_FUNCTIONS
10430+#define task_thread_info(task) (&(task)->tinfo)
10431+#define task_stack_page(task) ((task)->stack)
10432+#define setup_thread_stack(p, org) do {} while (0)
10433+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10434+
10435+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10436+extern struct task_struct *alloc_task_struct_node(int node);
10437+extern void free_task_struct(struct task_struct *);
10438+
10439 #endif
10440 #endif /* _ASM_X86_THREAD_INFO_H */
10441diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
10442index 36361bf..324f262 100644
10443--- a/arch/x86/include/asm/uaccess.h
10444+++ b/arch/x86/include/asm/uaccess.h
10445@@ -7,12 +7,15 @@
10446 #include <linux/compiler.h>
10447 #include <linux/thread_info.h>
10448 #include <linux/string.h>
10449+#include <linux/sched.h>
10450 #include <asm/asm.h>
10451 #include <asm/page.h>
10452
10453 #define VERIFY_READ 0
10454 #define VERIFY_WRITE 1
10455
10456+extern void check_object_size(const void *ptr, unsigned long n, bool to);
10457+
10458 /*
10459 * The fs value determines whether argument validity checking should be
10460 * performed or not. If get_fs() == USER_DS, checking is performed, with
10461@@ -28,7 +31,12 @@
10462
10463 #define get_ds() (KERNEL_DS)
10464 #define get_fs() (current_thread_info()->addr_limit)
10465+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10466+void __set_fs(mm_segment_t x);
10467+void set_fs(mm_segment_t x);
10468+#else
10469 #define set_fs(x) (current_thread_info()->addr_limit = (x))
10470+#endif
10471
10472 #define segment_eq(a, b) ((a).seg == (b).seg)
10473
10474@@ -76,7 +84,33 @@
10475 * checks that the pointer is in the user space range - after calling
10476 * this function, memory access functions may still return -EFAULT.
10477 */
10478-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10479+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10480+#define access_ok(type, addr, size) \
10481+({ \
10482+ long __size = size; \
10483+ unsigned long __addr = (unsigned long)addr; \
10484+ unsigned long __addr_ao = __addr & PAGE_MASK; \
10485+ unsigned long __end_ao = __addr + __size - 1; \
10486+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
10487+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
10488+ while(__addr_ao <= __end_ao) { \
10489+ char __c_ao; \
10490+ __addr_ao += PAGE_SIZE; \
10491+ if (__size > PAGE_SIZE) \
10492+ cond_resched(); \
10493+ if (__get_user(__c_ao, (char __user *)__addr)) \
10494+ break; \
10495+ if (type != VERIFY_WRITE) { \
10496+ __addr = __addr_ao; \
10497+ continue; \
10498+ } \
10499+ if (__put_user(__c_ao, (char __user *)__addr)) \
10500+ break; \
10501+ __addr = __addr_ao; \
10502+ } \
10503+ } \
10504+ __ret_ao; \
10505+})
10506
10507 /*
10508 * The exception table consists of pairs of addresses: the first is the
10509@@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10510 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10511 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10512
10513-
10514+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10515+#define __copyuser_seg "gs;"
10516+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10517+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10518+#else
10519+#define __copyuser_seg
10520+#define __COPYUSER_SET_ES
10521+#define __COPYUSER_RESTORE_ES
10522+#endif
10523
10524 #ifdef CONFIG_X86_32
10525 #define __put_user_asm_u64(x, addr, err, errret) \
10526- asm volatile("1: movl %%eax,0(%2)\n" \
10527- "2: movl %%edx,4(%2)\n" \
10528+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10529+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10530 "3:\n" \
10531 ".section .fixup,\"ax\"\n" \
10532 "4: movl %3,%0\n" \
10533@@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10534 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10535
10536 #define __put_user_asm_ex_u64(x, addr) \
10537- asm volatile("1: movl %%eax,0(%1)\n" \
10538- "2: movl %%edx,4(%1)\n" \
10539+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10540+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10541 "3:\n" \
10542 _ASM_EXTABLE(1b, 2b - 1b) \
10543 _ASM_EXTABLE(2b, 3b - 2b) \
10544@@ -252,7 +294,7 @@ extern void __put_user_8(void);
10545 __typeof__(*(ptr)) __pu_val; \
10546 __chk_user_ptr(ptr); \
10547 might_fault(); \
10548- __pu_val = x; \
10549+ __pu_val = (x); \
10550 switch (sizeof(*(ptr))) { \
10551 case 1: \
10552 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10553@@ -373,7 +415,7 @@ do { \
10554 } while (0)
10555
10556 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10557- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10558+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10559 "2:\n" \
10560 ".section .fixup,\"ax\"\n" \
10561 "3: mov %3,%0\n" \
10562@@ -381,7 +423,7 @@ do { \
10563 " jmp 2b\n" \
10564 ".previous\n" \
10565 _ASM_EXTABLE(1b, 3b) \
10566- : "=r" (err), ltype(x) \
10567+ : "=r" (err), ltype (x) \
10568 : "m" (__m(addr)), "i" (errret), "0" (err))
10569
10570 #define __get_user_size_ex(x, ptr, size) \
10571@@ -406,7 +448,7 @@ do { \
10572 } while (0)
10573
10574 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10575- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10576+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10577 "2:\n" \
10578 _ASM_EXTABLE(1b, 2b - 1b) \
10579 : ltype(x) : "m" (__m(addr)))
10580@@ -423,13 +465,24 @@ do { \
10581 int __gu_err; \
10582 unsigned long __gu_val; \
10583 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10584- (x) = (__force __typeof__(*(ptr)))__gu_val; \
10585+ (x) = (__typeof__(*(ptr)))__gu_val; \
10586 __gu_err; \
10587 })
10588
10589 /* FIXME: this hack is definitely wrong -AK */
10590 struct __large_struct { unsigned long buf[100]; };
10591-#define __m(x) (*(struct __large_struct __user *)(x))
10592+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10593+#define ____m(x) \
10594+({ \
10595+ unsigned long ____x = (unsigned long)(x); \
10596+ if (____x < PAX_USER_SHADOW_BASE) \
10597+ ____x += PAX_USER_SHADOW_BASE; \
10598+ (void __user *)____x; \
10599+})
10600+#else
10601+#define ____m(x) (x)
10602+#endif
10603+#define __m(x) (*(struct __large_struct __user *)____m(x))
10604
10605 /*
10606 * Tell gcc we read from memory instead of writing: this is because
10607@@ -437,7 +490,7 @@ struct __large_struct { unsigned long buf[100]; };
10608 * aliasing issues.
10609 */
10610 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10611- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10612+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10613 "2:\n" \
10614 ".section .fixup,\"ax\"\n" \
10615 "3: mov %3,%0\n" \
10616@@ -445,10 +498,10 @@ struct __large_struct { unsigned long buf[100]; };
10617 ".previous\n" \
10618 _ASM_EXTABLE(1b, 3b) \
10619 : "=r"(err) \
10620- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10621+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10622
10623 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10624- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10625+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10626 "2:\n" \
10627 _ASM_EXTABLE(1b, 2b - 1b) \
10628 : : ltype(x), "m" (__m(addr)))
10629@@ -487,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
10630 * On error, the variable @x is set to zero.
10631 */
10632
10633+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10634+#define __get_user(x, ptr) get_user((x), (ptr))
10635+#else
10636 #define __get_user(x, ptr) \
10637 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10638+#endif
10639
10640 /**
10641 * __put_user: - Write a simple value into user space, with less checking.
10642@@ -510,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
10643 * Returns zero on success, or -EFAULT on error.
10644 */
10645
10646+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10647+#define __put_user(x, ptr) put_user((x), (ptr))
10648+#else
10649 #define __put_user(x, ptr) \
10650 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10651+#endif
10652
10653 #define __get_user_unaligned __get_user
10654 #define __put_user_unaligned __put_user
10655@@ -529,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
10656 #define get_user_ex(x, ptr) do { \
10657 unsigned long __gue_val; \
10658 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10659- (x) = (__force __typeof__(*(ptr)))__gue_val; \
10660+ (x) = (__typeof__(*(ptr)))__gue_val; \
10661 } while (0)
10662
10663 #ifdef CONFIG_X86_WP_WORKS_OK
10664diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
10665index 566e803..89f1e60 100644
10666--- a/arch/x86/include/asm/uaccess_32.h
10667+++ b/arch/x86/include/asm/uaccess_32.h
10668@@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
10669 static __always_inline unsigned long __must_check
10670 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10671 {
10672+ pax_track_stack();
10673+
10674+ if ((long)n < 0)
10675+ return n;
10676+
10677 if (__builtin_constant_p(n)) {
10678 unsigned long ret;
10679
10680@@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10681 return ret;
10682 }
10683 }
10684+ if (!__builtin_constant_p(n))
10685+ check_object_size(from, n, true);
10686 return __copy_to_user_ll(to, from, n);
10687 }
10688
10689@@ -82,12 +89,16 @@ static __always_inline unsigned long __must_check
10690 __copy_to_user(void __user *to, const void *from, unsigned long n)
10691 {
10692 might_fault();
10693+
10694 return __copy_to_user_inatomic(to, from, n);
10695 }
10696
10697 static __always_inline unsigned long
10698 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10699 {
10700+ if ((long)n < 0)
10701+ return n;
10702+
10703 /* Avoid zeroing the tail if the copy fails..
10704 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10705 * but as the zeroing behaviour is only significant when n is not
10706@@ -137,6 +148,12 @@ static __always_inline unsigned long
10707 __copy_from_user(void *to, const void __user *from, unsigned long n)
10708 {
10709 might_fault();
10710+
10711+ pax_track_stack();
10712+
10713+ if ((long)n < 0)
10714+ return n;
10715+
10716 if (__builtin_constant_p(n)) {
10717 unsigned long ret;
10718
10719@@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
10720 return ret;
10721 }
10722 }
10723+ if (!__builtin_constant_p(n))
10724+ check_object_size(to, n, false);
10725 return __copy_from_user_ll(to, from, n);
10726 }
10727
10728@@ -159,6 +178,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
10729 const void __user *from, unsigned long n)
10730 {
10731 might_fault();
10732+
10733+ if ((long)n < 0)
10734+ return n;
10735+
10736 if (__builtin_constant_p(n)) {
10737 unsigned long ret;
10738
10739@@ -181,15 +204,19 @@ static __always_inline unsigned long
10740 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
10741 unsigned long n)
10742 {
10743- return __copy_from_user_ll_nocache_nozero(to, from, n);
10744+ if ((long)n < 0)
10745+ return n;
10746+
10747+ return __copy_from_user_ll_nocache_nozero(to, from, n);
10748 }
10749
10750-unsigned long __must_check copy_to_user(void __user *to,
10751- const void *from, unsigned long n);
10752-unsigned long __must_check _copy_from_user(void *to,
10753- const void __user *from,
10754- unsigned long n);
10755-
10756+extern void copy_to_user_overflow(void)
10757+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10758+ __compiletime_error("copy_to_user() buffer size is not provably correct")
10759+#else
10760+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
10761+#endif
10762+;
10763
10764 extern void copy_from_user_overflow(void)
10765 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10766@@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void)
10767 #endif
10768 ;
10769
10770-static inline unsigned long __must_check copy_from_user(void *to,
10771- const void __user *from,
10772- unsigned long n)
10773+/**
10774+ * copy_to_user: - Copy a block of data into user space.
10775+ * @to: Destination address, in user space.
10776+ * @from: Source address, in kernel space.
10777+ * @n: Number of bytes to copy.
10778+ *
10779+ * Context: User context only. This function may sleep.
10780+ *
10781+ * Copy data from kernel space to user space.
10782+ *
10783+ * Returns number of bytes that could not be copied.
10784+ * On success, this will be zero.
10785+ */
10786+static inline unsigned long __must_check
10787+copy_to_user(void __user *to, const void *from, unsigned long n)
10788+{
10789+ int sz = __compiletime_object_size(from);
10790+
10791+ if (unlikely(sz != -1 && sz < n))
10792+ copy_to_user_overflow();
10793+ else if (access_ok(VERIFY_WRITE, to, n))
10794+ n = __copy_to_user(to, from, n);
10795+ return n;
10796+}
10797+
10798+/**
10799+ * copy_from_user: - Copy a block of data from user space.
10800+ * @to: Destination address, in kernel space.
10801+ * @from: Source address, in user space.
10802+ * @n: Number of bytes to copy.
10803+ *
10804+ * Context: User context only. This function may sleep.
10805+ *
10806+ * Copy data from user space to kernel space.
10807+ *
10808+ * Returns number of bytes that could not be copied.
10809+ * On success, this will be zero.
10810+ *
10811+ * If some data could not be copied, this function will pad the copied
10812+ * data to the requested size using zero bytes.
10813+ */
10814+static inline unsigned long __must_check
10815+copy_from_user(void *to, const void __user *from, unsigned long n)
10816 {
10817 int sz = __compiletime_object_size(to);
10818
10819- if (likely(sz == -1 || sz >= n))
10820- n = _copy_from_user(to, from, n);
10821- else
10822+ if (unlikely(sz != -1 && sz < n))
10823 copy_from_user_overflow();
10824-
10825+ else if (access_ok(VERIFY_READ, from, n))
10826+ n = __copy_from_user(to, from, n);
10827+ else if ((long)n > 0) {
10828+ if (!__builtin_constant_p(n))
10829+ check_object_size(to, n, false);
10830+ memset(to, 0, n);
10831+ }
10832 return n;
10833 }
10834
10835diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
10836index 1c66d30..59bd7d4 100644
10837--- a/arch/x86/include/asm/uaccess_64.h
10838+++ b/arch/x86/include/asm/uaccess_64.h
10839@@ -10,6 +10,9 @@
10840 #include <asm/alternative.h>
10841 #include <asm/cpufeature.h>
10842 #include <asm/page.h>
10843+#include <asm/pgtable.h>
10844+
10845+#define set_fs(x) (current_thread_info()->addr_limit = (x))
10846
10847 /*
10848 * Copy To/From Userspace
10849@@ -17,12 +20,12 @@
10850
10851 /* Handles exceptions in both to and from, but doesn't do access_ok */
10852 __must_check unsigned long
10853-copy_user_generic_string(void *to, const void *from, unsigned len);
10854+copy_user_generic_string(void *to, const void *from, unsigned long len);
10855 __must_check unsigned long
10856-copy_user_generic_unrolled(void *to, const void *from, unsigned len);
10857+copy_user_generic_unrolled(void *to, const void *from, unsigned long len);
10858
10859 static __always_inline __must_check unsigned long
10860-copy_user_generic(void *to, const void *from, unsigned len)
10861+copy_user_generic(void *to, const void *from, unsigned long len)
10862 {
10863 unsigned ret;
10864
10865@@ -36,138 +39,226 @@ copy_user_generic(void *to, const void *from, unsigned len)
10866 return ret;
10867 }
10868
10869+static __always_inline __must_check unsigned long
10870+__copy_to_user(void __user *to, const void *from, unsigned long len);
10871+static __always_inline __must_check unsigned long
10872+__copy_from_user(void *to, const void __user *from, unsigned long len);
10873 __must_check unsigned long
10874-_copy_to_user(void __user *to, const void *from, unsigned len);
10875-__must_check unsigned long
10876-_copy_from_user(void *to, const void __user *from, unsigned len);
10877-__must_check unsigned long
10878-copy_in_user(void __user *to, const void __user *from, unsigned len);
10879+copy_in_user(void __user *to, const void __user *from, unsigned long len);
10880
10881 static inline unsigned long __must_check copy_from_user(void *to,
10882 const void __user *from,
10883- unsigned long n)
10884+ unsigned n)
10885 {
10886- int sz = __compiletime_object_size(to);
10887-
10888 might_fault();
10889- if (likely(sz == -1 || sz >= n))
10890- n = _copy_from_user(to, from, n);
10891-#ifdef CONFIG_DEBUG_VM
10892- else
10893- WARN(1, "Buffer overflow detected!\n");
10894-#endif
10895+
10896+ if (access_ok(VERIFY_READ, from, n))
10897+ n = __copy_from_user(to, from, n);
10898+ else if (n < INT_MAX) {
10899+ if (!__builtin_constant_p(n))
10900+ check_object_size(to, n, false);
10901+ memset(to, 0, n);
10902+ }
10903 return n;
10904 }
10905
10906 static __always_inline __must_check
10907-int copy_to_user(void __user *dst, const void *src, unsigned size)
10908+int copy_to_user(void __user *dst, const void *src, unsigned long size)
10909 {
10910 might_fault();
10911
10912- return _copy_to_user(dst, src, size);
10913+ if (access_ok(VERIFY_WRITE, dst, size))
10914+ size = __copy_to_user(dst, src, size);
10915+ return size;
10916 }
10917
10918 static __always_inline __must_check
10919-int __copy_from_user(void *dst, const void __user *src, unsigned size)
10920+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
10921 {
10922- int ret = 0;
10923+ int sz = __compiletime_object_size(dst);
10924+ unsigned ret = 0;
10925
10926 might_fault();
10927- if (!__builtin_constant_p(size))
10928- return copy_user_generic(dst, (__force void *)src, size);
10929+
10930+ pax_track_stack();
10931+
10932+ if (size > INT_MAX)
10933+ return size;
10934+
10935+#ifdef CONFIG_PAX_MEMORY_UDEREF
10936+ if (!__access_ok(VERIFY_READ, src, size))
10937+ return size;
10938+#endif
10939+
10940+ if (unlikely(sz != -1 && sz < size)) {
10941+#ifdef CONFIG_DEBUG_VM
10942+ WARN(1, "Buffer overflow detected!\n");
10943+#endif
10944+ return size;
10945+ }
10946+
10947+ if (!__builtin_constant_p(size)) {
10948+ check_object_size(dst, size, false);
10949+
10950+#ifdef CONFIG_PAX_MEMORY_UDEREF
10951+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10952+ src += PAX_USER_SHADOW_BASE;
10953+#endif
10954+
10955+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
10956+ }
10957 switch (size) {
10958- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
10959+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
10960 ret, "b", "b", "=q", 1);
10961 return ret;
10962- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
10963+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
10964 ret, "w", "w", "=r", 2);
10965 return ret;
10966- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
10967+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
10968 ret, "l", "k", "=r", 4);
10969 return ret;
10970- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
10971+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10972 ret, "q", "", "=r", 8);
10973 return ret;
10974 case 10:
10975- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10976+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10977 ret, "q", "", "=r", 10);
10978 if (unlikely(ret))
10979 return ret;
10980 __get_user_asm(*(u16 *)(8 + (char *)dst),
10981- (u16 __user *)(8 + (char __user *)src),
10982+ (const u16 __user *)(8 + (const char __user *)src),
10983 ret, "w", "w", "=r", 2);
10984 return ret;
10985 case 16:
10986- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10987+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10988 ret, "q", "", "=r", 16);
10989 if (unlikely(ret))
10990 return ret;
10991 __get_user_asm(*(u64 *)(8 + (char *)dst),
10992- (u64 __user *)(8 + (char __user *)src),
10993+ (const u64 __user *)(8 + (const char __user *)src),
10994 ret, "q", "", "=r", 8);
10995 return ret;
10996 default:
10997- return copy_user_generic(dst, (__force void *)src, size);
10998+
10999+#ifdef CONFIG_PAX_MEMORY_UDEREF
11000+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11001+ src += PAX_USER_SHADOW_BASE;
11002+#endif
11003+
11004+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
11005 }
11006 }
11007
11008 static __always_inline __must_check
11009-int __copy_to_user(void __user *dst, const void *src, unsigned size)
11010+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
11011 {
11012- int ret = 0;
11013+ int sz = __compiletime_object_size(src);
11014+ unsigned ret = 0;
11015
11016 might_fault();
11017- if (!__builtin_constant_p(size))
11018- return copy_user_generic((__force void *)dst, src, size);
11019+
11020+ pax_track_stack();
11021+
11022+ if (size > INT_MAX)
11023+ return size;
11024+
11025+#ifdef CONFIG_PAX_MEMORY_UDEREF
11026+ if (!__access_ok(VERIFY_WRITE, dst, size))
11027+ return size;
11028+#endif
11029+
11030+ if (unlikely(sz != -1 && sz < size)) {
11031+#ifdef CONFIG_DEBUG_VM
11032+ WARN(1, "Buffer overflow detected!\n");
11033+#endif
11034+ return size;
11035+ }
11036+
11037+ if (!__builtin_constant_p(size)) {
11038+ check_object_size(src, size, true);
11039+
11040+#ifdef CONFIG_PAX_MEMORY_UDEREF
11041+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11042+ dst += PAX_USER_SHADOW_BASE;
11043+#endif
11044+
11045+ return copy_user_generic((__force_kernel void *)dst, src, size);
11046+ }
11047 switch (size) {
11048- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11049+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11050 ret, "b", "b", "iq", 1);
11051 return ret;
11052- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11053+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11054 ret, "w", "w", "ir", 2);
11055 return ret;
11056- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11057+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11058 ret, "l", "k", "ir", 4);
11059 return ret;
11060- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11061+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11062 ret, "q", "", "er", 8);
11063 return ret;
11064 case 10:
11065- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11066+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11067 ret, "q", "", "er", 10);
11068 if (unlikely(ret))
11069 return ret;
11070 asm("":::"memory");
11071- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11072+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11073 ret, "w", "w", "ir", 2);
11074 return ret;
11075 case 16:
11076- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11077+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11078 ret, "q", "", "er", 16);
11079 if (unlikely(ret))
11080 return ret;
11081 asm("":::"memory");
11082- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11083+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11084 ret, "q", "", "er", 8);
11085 return ret;
11086 default:
11087- return copy_user_generic((__force void *)dst, src, size);
11088+
11089+#ifdef CONFIG_PAX_MEMORY_UDEREF
11090+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11091+ dst += PAX_USER_SHADOW_BASE;
11092+#endif
11093+
11094+ return copy_user_generic((__force_kernel void *)dst, src, size);
11095 }
11096 }
11097
11098 static __always_inline __must_check
11099-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11100+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
11101 {
11102- int ret = 0;
11103+ unsigned ret = 0;
11104
11105 might_fault();
11106- if (!__builtin_constant_p(size))
11107- return copy_user_generic((__force void *)dst,
11108- (__force void *)src, size);
11109+
11110+ if (size > INT_MAX)
11111+ return size;
11112+
11113+#ifdef CONFIG_PAX_MEMORY_UDEREF
11114+ if (!__access_ok(VERIFY_READ, src, size))
11115+ return size;
11116+ if (!__access_ok(VERIFY_WRITE, dst, size))
11117+ return size;
11118+#endif
11119+
11120+ if (!__builtin_constant_p(size)) {
11121+
11122+#ifdef CONFIG_PAX_MEMORY_UDEREF
11123+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11124+ src += PAX_USER_SHADOW_BASE;
11125+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11126+ dst += PAX_USER_SHADOW_BASE;
11127+#endif
11128+
11129+ return copy_user_generic((__force_kernel void *)dst,
11130+ (__force_kernel const void *)src, size);
11131+ }
11132 switch (size) {
11133 case 1: {
11134 u8 tmp;
11135- __get_user_asm(tmp, (u8 __user *)src,
11136+ __get_user_asm(tmp, (const u8 __user *)src,
11137 ret, "b", "b", "=q", 1);
11138 if (likely(!ret))
11139 __put_user_asm(tmp, (u8 __user *)dst,
11140@@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11141 }
11142 case 2: {
11143 u16 tmp;
11144- __get_user_asm(tmp, (u16 __user *)src,
11145+ __get_user_asm(tmp, (const u16 __user *)src,
11146 ret, "w", "w", "=r", 2);
11147 if (likely(!ret))
11148 __put_user_asm(tmp, (u16 __user *)dst,
11149@@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11150
11151 case 4: {
11152 u32 tmp;
11153- __get_user_asm(tmp, (u32 __user *)src,
11154+ __get_user_asm(tmp, (const u32 __user *)src,
11155 ret, "l", "k", "=r", 4);
11156 if (likely(!ret))
11157 __put_user_asm(tmp, (u32 __user *)dst,
11158@@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11159 }
11160 case 8: {
11161 u64 tmp;
11162- __get_user_asm(tmp, (u64 __user *)src,
11163+ __get_user_asm(tmp, (const u64 __user *)src,
11164 ret, "q", "", "=r", 8);
11165 if (likely(!ret))
11166 __put_user_asm(tmp, (u64 __user *)dst,
11167@@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11168 return ret;
11169 }
11170 default:
11171- return copy_user_generic((__force void *)dst,
11172- (__force void *)src, size);
11173+
11174+#ifdef CONFIG_PAX_MEMORY_UDEREF
11175+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11176+ src += PAX_USER_SHADOW_BASE;
11177+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11178+ dst += PAX_USER_SHADOW_BASE;
11179+#endif
11180+
11181+ return copy_user_generic((__force_kernel void *)dst,
11182+ (__force_kernel const void *)src, size);
11183 }
11184 }
11185
11186@@ -219,35 +318,74 @@ __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11187 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11188
11189 static __must_check __always_inline int
11190-__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11191+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
11192 {
11193- return copy_user_generic(dst, (__force const void *)src, size);
11194+ pax_track_stack();
11195+
11196+ if (size > INT_MAX)
11197+ return size;
11198+
11199+#ifdef CONFIG_PAX_MEMORY_UDEREF
11200+ if (!__access_ok(VERIFY_READ, src, size))
11201+ return size;
11202+
11203+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11204+ src += PAX_USER_SHADOW_BASE;
11205+#endif
11206+
11207+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
11208 }
11209
11210-static __must_check __always_inline int
11211-__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11212+static __must_check __always_inline unsigned long
11213+__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
11214 {
11215- return copy_user_generic((__force void *)dst, src, size);
11216+ if (size > INT_MAX)
11217+ return size;
11218+
11219+#ifdef CONFIG_PAX_MEMORY_UDEREF
11220+ if (!__access_ok(VERIFY_WRITE, dst, size))
11221+ return size;
11222+
11223+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11224+ dst += PAX_USER_SHADOW_BASE;
11225+#endif
11226+
11227+ return copy_user_generic((__force_kernel void *)dst, src, size);
11228 }
11229
11230-extern long __copy_user_nocache(void *dst, const void __user *src,
11231- unsigned size, int zerorest);
11232+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11233+ unsigned long size, int zerorest);
11234
11235-static inline int
11236-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11237+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
11238 {
11239 might_sleep();
11240+
11241+ if (size > INT_MAX)
11242+ return size;
11243+
11244+#ifdef CONFIG_PAX_MEMORY_UDEREF
11245+ if (!__access_ok(VERIFY_READ, src, size))
11246+ return size;
11247+#endif
11248+
11249 return __copy_user_nocache(dst, src, size, 1);
11250 }
11251
11252-static inline int
11253-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11254- unsigned size)
11255+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11256+ unsigned long size)
11257 {
11258+ if (size > INT_MAX)
11259+ return size;
11260+
11261+#ifdef CONFIG_PAX_MEMORY_UDEREF
11262+ if (!__access_ok(VERIFY_READ, src, size))
11263+ return size;
11264+#endif
11265+
11266 return __copy_user_nocache(dst, src, size, 0);
11267 }
11268
11269-unsigned long
11270-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11271+extern unsigned long
11272+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest);
11273
11274 #endif /* _ASM_X86_UACCESS_64_H */
11275diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
11276index bb05228..d763d5b 100644
11277--- a/arch/x86/include/asm/vdso.h
11278+++ b/arch/x86/include/asm/vdso.h
11279@@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
11280 #define VDSO32_SYMBOL(base, name) \
11281 ({ \
11282 extern const char VDSO32_##name[]; \
11283- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11284+ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11285 })
11286 #endif
11287
11288diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
11289index d3d8590..d296b5f 100644
11290--- a/arch/x86/include/asm/x86_init.h
11291+++ b/arch/x86/include/asm/x86_init.h
11292@@ -28,7 +28,7 @@ struct x86_init_mpparse {
11293 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11294 void (*find_smp_config)(void);
11295 void (*get_smp_config)(unsigned int early);
11296-};
11297+} __no_const;
11298
11299 /**
11300 * struct x86_init_resources - platform specific resource related ops
11301@@ -42,7 +42,7 @@ struct x86_init_resources {
11302 void (*probe_roms)(void);
11303 void (*reserve_resources)(void);
11304 char *(*memory_setup)(void);
11305-};
11306+} __no_const;
11307
11308 /**
11309 * struct x86_init_irqs - platform specific interrupt setup
11310@@ -55,7 +55,7 @@ struct x86_init_irqs {
11311 void (*pre_vector_init)(void);
11312 void (*intr_init)(void);
11313 void (*trap_init)(void);
11314-};
11315+} __no_const;
11316
11317 /**
11318 * struct x86_init_oem - oem platform specific customizing functions
11319@@ -65,7 +65,7 @@ struct x86_init_irqs {
11320 struct x86_init_oem {
11321 void (*arch_setup)(void);
11322 void (*banner)(void);
11323-};
11324+} __no_const;
11325
11326 /**
11327 * struct x86_init_mapping - platform specific initial kernel pagetable setup
11328@@ -76,7 +76,7 @@ struct x86_init_oem {
11329 */
11330 struct x86_init_mapping {
11331 void (*pagetable_reserve)(u64 start, u64 end);
11332-};
11333+} __no_const;
11334
11335 /**
11336 * struct x86_init_paging - platform specific paging functions
11337@@ -86,7 +86,7 @@ struct x86_init_mapping {
11338 struct x86_init_paging {
11339 void (*pagetable_setup_start)(pgd_t *base);
11340 void (*pagetable_setup_done)(pgd_t *base);
11341-};
11342+} __no_const;
11343
11344 /**
11345 * struct x86_init_timers - platform specific timer setup
11346@@ -101,7 +101,7 @@ struct x86_init_timers {
11347 void (*tsc_pre_init)(void);
11348 void (*timer_init)(void);
11349 void (*wallclock_init)(void);
11350-};
11351+} __no_const;
11352
11353 /**
11354 * struct x86_init_iommu - platform specific iommu setup
11355@@ -109,7 +109,7 @@ struct x86_init_timers {
11356 */
11357 struct x86_init_iommu {
11358 int (*iommu_init)(void);
11359-};
11360+} __no_const;
11361
11362 /**
11363 * struct x86_init_pci - platform specific pci init functions
11364@@ -123,7 +123,7 @@ struct x86_init_pci {
11365 int (*init)(void);
11366 void (*init_irq)(void);
11367 void (*fixup_irqs)(void);
11368-};
11369+} __no_const;
11370
11371 /**
11372 * struct x86_init_ops - functions for platform specific setup
11373@@ -139,7 +139,7 @@ struct x86_init_ops {
11374 struct x86_init_timers timers;
11375 struct x86_init_iommu iommu;
11376 struct x86_init_pci pci;
11377-};
11378+} __no_const;
11379
11380 /**
11381 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11382@@ -147,7 +147,7 @@ struct x86_init_ops {
11383 */
11384 struct x86_cpuinit_ops {
11385 void (*setup_percpu_clockev)(void);
11386-};
11387+} __no_const;
11388
11389 /**
11390 * struct x86_platform_ops - platform specific runtime functions
11391@@ -166,7 +166,7 @@ struct x86_platform_ops {
11392 bool (*is_untracked_pat_range)(u64 start, u64 end);
11393 void (*nmi_init)(void);
11394 int (*i8042_detect)(void);
11395-};
11396+} __no_const;
11397
11398 struct pci_dev;
11399
11400@@ -174,7 +174,7 @@ struct x86_msi_ops {
11401 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
11402 void (*teardown_msi_irq)(unsigned int irq);
11403 void (*teardown_msi_irqs)(struct pci_dev *dev);
11404-};
11405+} __no_const;
11406
11407 extern struct x86_init_ops x86_init;
11408 extern struct x86_cpuinit_ops x86_cpuinit;
11409diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
11410index c6ce245..ffbdab7 100644
11411--- a/arch/x86/include/asm/xsave.h
11412+++ b/arch/x86/include/asm/xsave.h
11413@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11414 {
11415 int err;
11416
11417+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11418+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11419+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11420+#endif
11421+
11422 /*
11423 * Clear the xsave header first, so that reserved fields are
11424 * initialized to zero.
11425@@ -96,10 +101,15 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11426 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11427 {
11428 int err;
11429- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11430+ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11431 u32 lmask = mask;
11432 u32 hmask = mask >> 32;
11433
11434+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11435+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11436+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11437+#endif
11438+
11439 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11440 "2:\n"
11441 ".section .fixup,\"ax\"\n"
11442diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
11443index 6a564ac..9b1340c 100644
11444--- a/arch/x86/kernel/acpi/realmode/Makefile
11445+++ b/arch/x86/kernel/acpi/realmode/Makefile
11446@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
11447 $(call cc-option, -fno-stack-protector) \
11448 $(call cc-option, -mpreferred-stack-boundary=2)
11449 KBUILD_CFLAGS += $(call cc-option, -m32)
11450+ifdef CONSTIFY_PLUGIN
11451+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
11452+endif
11453 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
11454 GCOV_PROFILE := n
11455
11456diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
11457index b4fd836..4358fe3 100644
11458--- a/arch/x86/kernel/acpi/realmode/wakeup.S
11459+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
11460@@ -108,6 +108,9 @@ wakeup_code:
11461 /* Do any other stuff... */
11462
11463 #ifndef CONFIG_64BIT
11464+ /* Recheck NX bit overrides (64bit path does this in trampoline */
11465+ call verify_cpu
11466+
11467 /* This could also be done in C code... */
11468 movl pmode_cr3, %eax
11469 movl %eax, %cr3
11470@@ -131,6 +134,7 @@ wakeup_code:
11471 movl pmode_cr0, %eax
11472 movl %eax, %cr0
11473 jmp pmode_return
11474+# include "../../verify_cpu.S"
11475 #else
11476 pushw $0
11477 pushw trampoline_segment
11478diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
11479index 103b6ab..2004d0a 100644
11480--- a/arch/x86/kernel/acpi/sleep.c
11481+++ b/arch/x86/kernel/acpi/sleep.c
11482@@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
11483 header->trampoline_segment = trampoline_address() >> 4;
11484 #ifdef CONFIG_SMP
11485 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
11486+
11487+ pax_open_kernel();
11488 early_gdt_descr.address =
11489 (unsigned long)get_cpu_gdt_table(smp_processor_id());
11490+ pax_close_kernel();
11491+
11492 initial_gs = per_cpu_offset(smp_processor_id());
11493 #endif
11494 initial_code = (unsigned long)wakeup_long64;
11495diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
11496index 13ab720..95d5442 100644
11497--- a/arch/x86/kernel/acpi/wakeup_32.S
11498+++ b/arch/x86/kernel/acpi/wakeup_32.S
11499@@ -30,13 +30,11 @@ wakeup_pmode_return:
11500 # and restore the stack ... but you need gdt for this to work
11501 movl saved_context_esp, %esp
11502
11503- movl %cs:saved_magic, %eax
11504- cmpl $0x12345678, %eax
11505+ cmpl $0x12345678, saved_magic
11506 jne bogus_magic
11507
11508 # jump to place where we left off
11509- movl saved_eip, %eax
11510- jmp *%eax
11511+ jmp *(saved_eip)
11512
11513 bogus_magic:
11514 jmp bogus_magic
11515diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
11516index c638228..16dfa8d 100644
11517--- a/arch/x86/kernel/alternative.c
11518+++ b/arch/x86/kernel/alternative.c
11519@@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
11520 */
11521 for (a = start; a < end; a++) {
11522 instr = (u8 *)&a->instr_offset + a->instr_offset;
11523+
11524+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11525+ instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11526+ if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
11527+ instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11528+#endif
11529+
11530 replacement = (u8 *)&a->repl_offset + a->repl_offset;
11531 BUG_ON(a->replacementlen > a->instrlen);
11532 BUG_ON(a->instrlen > sizeof(insnbuf));
11533@@ -307,10 +314,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
11534 for (poff = start; poff < end; poff++) {
11535 u8 *ptr = (u8 *)poff + *poff;
11536
11537+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11538+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11539+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11540+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11541+#endif
11542+
11543 if (!*poff || ptr < text || ptr >= text_end)
11544 continue;
11545 /* turn DS segment override prefix into lock prefix */
11546- if (*ptr == 0x3e)
11547+ if (*ktla_ktva(ptr) == 0x3e)
11548 text_poke(ptr, ((unsigned char []){0xf0}), 1);
11549 };
11550 mutex_unlock(&text_mutex);
11551@@ -328,10 +341,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
11552 for (poff = start; poff < end; poff++) {
11553 u8 *ptr = (u8 *)poff + *poff;
11554
11555+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11556+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11557+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11558+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11559+#endif
11560+
11561 if (!*poff || ptr < text || ptr >= text_end)
11562 continue;
11563 /* turn lock prefix into DS segment override prefix */
11564- if (*ptr == 0xf0)
11565+ if (*ktla_ktva(ptr) == 0xf0)
11566 text_poke(ptr, ((unsigned char []){0x3E}), 1);
11567 };
11568 mutex_unlock(&text_mutex);
11569@@ -500,7 +519,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
11570
11571 BUG_ON(p->len > MAX_PATCH_LEN);
11572 /* prep the buffer with the original instructions */
11573- memcpy(insnbuf, p->instr, p->len);
11574+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
11575 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
11576 (unsigned long)p->instr, p->len);
11577
11578@@ -568,7 +587,7 @@ void __init alternative_instructions(void)
11579 if (smp_alt_once)
11580 free_init_pages("SMP alternatives",
11581 (unsigned long)__smp_locks,
11582- (unsigned long)__smp_locks_end);
11583+ PAGE_ALIGN((unsigned long)__smp_locks_end));
11584
11585 restart_nmi();
11586 }
11587@@ -585,13 +604,17 @@ void __init alternative_instructions(void)
11588 * instructions. And on the local CPU you need to be protected again NMI or MCE
11589 * handlers seeing an inconsistent instruction while you patch.
11590 */
11591-void *__init_or_module text_poke_early(void *addr, const void *opcode,
11592+void *__kprobes text_poke_early(void *addr, const void *opcode,
11593 size_t len)
11594 {
11595 unsigned long flags;
11596 local_irq_save(flags);
11597- memcpy(addr, opcode, len);
11598+
11599+ pax_open_kernel();
11600+ memcpy(ktla_ktva(addr), opcode, len);
11601 sync_core();
11602+ pax_close_kernel();
11603+
11604 local_irq_restore(flags);
11605 /* Could also do a CLFLUSH here to speed up CPU recovery; but
11606 that causes hangs on some VIA CPUs. */
11607@@ -613,36 +636,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
11608 */
11609 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
11610 {
11611- unsigned long flags;
11612- char *vaddr;
11613+ unsigned char *vaddr = ktla_ktva(addr);
11614 struct page *pages[2];
11615- int i;
11616+ size_t i;
11617
11618 if (!core_kernel_text((unsigned long)addr)) {
11619- pages[0] = vmalloc_to_page(addr);
11620- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
11621+ pages[0] = vmalloc_to_page(vaddr);
11622+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
11623 } else {
11624- pages[0] = virt_to_page(addr);
11625+ pages[0] = virt_to_page(vaddr);
11626 WARN_ON(!PageReserved(pages[0]));
11627- pages[1] = virt_to_page(addr + PAGE_SIZE);
11628+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
11629 }
11630 BUG_ON(!pages[0]);
11631- local_irq_save(flags);
11632- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
11633- if (pages[1])
11634- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
11635- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
11636- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
11637- clear_fixmap(FIX_TEXT_POKE0);
11638- if (pages[1])
11639- clear_fixmap(FIX_TEXT_POKE1);
11640- local_flush_tlb();
11641- sync_core();
11642- /* Could also do a CLFLUSH here to speed up CPU recovery; but
11643- that causes hangs on some VIA CPUs. */
11644+ text_poke_early(addr, opcode, len);
11645 for (i = 0; i < len; i++)
11646- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
11647- local_irq_restore(flags);
11648+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
11649 return addr;
11650 }
11651
11652diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
11653index 52fa563..5de9d9c 100644
11654--- a/arch/x86/kernel/apic/apic.c
11655+++ b/arch/x86/kernel/apic/apic.c
11656@@ -174,7 +174,7 @@ int first_system_vector = 0xfe;
11657 /*
11658 * Debug level, exported for io_apic.c
11659 */
11660-unsigned int apic_verbosity;
11661+int apic_verbosity;
11662
11663 int pic_mode;
11664
11665@@ -1835,7 +1835,7 @@ void smp_error_interrupt(struct pt_regs *regs)
11666 apic_write(APIC_ESR, 0);
11667 v1 = apic_read(APIC_ESR);
11668 ack_APIC_irq();
11669- atomic_inc(&irq_err_count);
11670+ atomic_inc_unchecked(&irq_err_count);
11671
11672 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
11673 smp_processor_id(), v0 , v1);
11674@@ -2209,6 +2209,8 @@ static int __cpuinit apic_cluster_num(void)
11675 u16 *bios_cpu_apicid;
11676 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
11677
11678+ pax_track_stack();
11679+
11680 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
11681 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
11682
11683diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
11684index 8eb863e..32e6934 100644
11685--- a/arch/x86/kernel/apic/io_apic.c
11686+++ b/arch/x86/kernel/apic/io_apic.c
11687@@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
11688 }
11689 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
11690
11691-void lock_vector_lock(void)
11692+void lock_vector_lock(void) __acquires(vector_lock)
11693 {
11694 /* Used to the online set of cpus does not change
11695 * during assign_irq_vector.
11696@@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
11697 raw_spin_lock(&vector_lock);
11698 }
11699
11700-void unlock_vector_lock(void)
11701+void unlock_vector_lock(void) __releases(vector_lock)
11702 {
11703 raw_spin_unlock(&vector_lock);
11704 }
11705@@ -2405,7 +2405,7 @@ static void ack_apic_edge(struct irq_data *data)
11706 ack_APIC_irq();
11707 }
11708
11709-atomic_t irq_mis_count;
11710+atomic_unchecked_t irq_mis_count;
11711
11712 /*
11713 * IO-APIC versions below 0x20 don't support EOI register.
11714@@ -2513,7 +2513,7 @@ static void ack_apic_level(struct irq_data *data)
11715 * at the cpu.
11716 */
11717 if (!(v & (1 << (i & 0x1f)))) {
11718- atomic_inc(&irq_mis_count);
11719+ atomic_inc_unchecked(&irq_mis_count);
11720
11721 eoi_ioapic_irq(irq, cfg);
11722 }
11723diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
11724index 0371c48..54cdf63 100644
11725--- a/arch/x86/kernel/apm_32.c
11726+++ b/arch/x86/kernel/apm_32.c
11727@@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
11728 * This is for buggy BIOS's that refer to (real mode) segment 0x40
11729 * even though they are called in protected mode.
11730 */
11731-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
11732+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
11733 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
11734
11735 static const char driver_version[] = "1.16ac"; /* no spaces */
11736@@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
11737 BUG_ON(cpu != 0);
11738 gdt = get_cpu_gdt_table(cpu);
11739 save_desc_40 = gdt[0x40 / 8];
11740+
11741+ pax_open_kernel();
11742 gdt[0x40 / 8] = bad_bios_desc;
11743+ pax_close_kernel();
11744
11745 apm_irq_save(flags);
11746 APM_DO_SAVE_SEGS;
11747@@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
11748 &call->esi);
11749 APM_DO_RESTORE_SEGS;
11750 apm_irq_restore(flags);
11751+
11752+ pax_open_kernel();
11753 gdt[0x40 / 8] = save_desc_40;
11754+ pax_close_kernel();
11755+
11756 put_cpu();
11757
11758 return call->eax & 0xff;
11759@@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void *_call)
11760 BUG_ON(cpu != 0);
11761 gdt = get_cpu_gdt_table(cpu);
11762 save_desc_40 = gdt[0x40 / 8];
11763+
11764+ pax_open_kernel();
11765 gdt[0x40 / 8] = bad_bios_desc;
11766+ pax_close_kernel();
11767
11768 apm_irq_save(flags);
11769 APM_DO_SAVE_SEGS;
11770@@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void *_call)
11771 &call->eax);
11772 APM_DO_RESTORE_SEGS;
11773 apm_irq_restore(flags);
11774+
11775+ pax_open_kernel();
11776 gdt[0x40 / 8] = save_desc_40;
11777+ pax_close_kernel();
11778+
11779 put_cpu();
11780 return error;
11781 }
11782@@ -2349,12 +2363,15 @@ static int __init apm_init(void)
11783 * code to that CPU.
11784 */
11785 gdt = get_cpu_gdt_table(0);
11786+
11787+ pax_open_kernel();
11788 set_desc_base(&gdt[APM_CS >> 3],
11789 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
11790 set_desc_base(&gdt[APM_CS_16 >> 3],
11791 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
11792 set_desc_base(&gdt[APM_DS >> 3],
11793 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
11794+ pax_close_kernel();
11795
11796 proc_create("apm", 0, NULL, &apm_file_ops);
11797
11798diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
11799index 4f13faf..87db5d2 100644
11800--- a/arch/x86/kernel/asm-offsets.c
11801+++ b/arch/x86/kernel/asm-offsets.c
11802@@ -33,6 +33,8 @@ void common(void) {
11803 OFFSET(TI_status, thread_info, status);
11804 OFFSET(TI_addr_limit, thread_info, addr_limit);
11805 OFFSET(TI_preempt_count, thread_info, preempt_count);
11806+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
11807+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
11808
11809 BLANK();
11810 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
11811@@ -53,8 +55,26 @@ void common(void) {
11812 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
11813 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
11814 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
11815+
11816+#ifdef CONFIG_PAX_KERNEXEC
11817+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
11818 #endif
11819
11820+#ifdef CONFIG_PAX_MEMORY_UDEREF
11821+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
11822+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
11823+#ifdef CONFIG_X86_64
11824+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
11825+#endif
11826+#endif
11827+
11828+#endif
11829+
11830+ BLANK();
11831+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
11832+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
11833+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
11834+
11835 #ifdef CONFIG_XEN
11836 BLANK();
11837 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
11838diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
11839index e72a119..6e2955d 100644
11840--- a/arch/x86/kernel/asm-offsets_64.c
11841+++ b/arch/x86/kernel/asm-offsets_64.c
11842@@ -69,6 +69,7 @@ int main(void)
11843 BLANK();
11844 #undef ENTRY
11845
11846+ DEFINE(TSS_size, sizeof(struct tss_struct));
11847 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
11848 BLANK();
11849
11850diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
11851index 6042981..e638266 100644
11852--- a/arch/x86/kernel/cpu/Makefile
11853+++ b/arch/x86/kernel/cpu/Makefile
11854@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11855 CFLAGS_REMOVE_perf_event.o = -pg
11856 endif
11857
11858-# Make sure load_percpu_segment has no stackprotector
11859-nostackp := $(call cc-option, -fno-stack-protector)
11860-CFLAGS_common.o := $(nostackp)
11861-
11862 obj-y := intel_cacheinfo.o scattered.o topology.o
11863 obj-y += proc.o capflags.o powerflags.o common.o
11864 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11865diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
11866index b13ed39..603286c 100644
11867--- a/arch/x86/kernel/cpu/amd.c
11868+++ b/arch/x86/kernel/cpu/amd.c
11869@@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
11870 unsigned int size)
11871 {
11872 /* AMD errata T13 (order #21922) */
11873- if ((c->x86 == 6)) {
11874+ if (c->x86 == 6) {
11875 /* Duron Rev A0 */
11876 if (c->x86_model == 3 && c->x86_mask == 0)
11877 size = 64;
11878diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
11879index 6218439..ab2e4ab 100644
11880--- a/arch/x86/kernel/cpu/common.c
11881+++ b/arch/x86/kernel/cpu/common.c
11882@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
11883
11884 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
11885
11886-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
11887-#ifdef CONFIG_X86_64
11888- /*
11889- * We need valid kernel segments for data and code in long mode too
11890- * IRET will check the segment types kkeil 2000/10/28
11891- * Also sysret mandates a special GDT layout
11892- *
11893- * TLS descriptors are currently at a different place compared to i386.
11894- * Hopefully nobody expects them at a fixed place (Wine?)
11895- */
11896- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
11897- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
11898- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
11899- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
11900- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
11901- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
11902-#else
11903- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
11904- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11905- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
11906- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
11907- /*
11908- * Segments used for calling PnP BIOS have byte granularity.
11909- * They code segments and data segments have fixed 64k limits,
11910- * the transfer segment sizes are set at run time.
11911- */
11912- /* 32-bit code */
11913- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11914- /* 16-bit code */
11915- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11916- /* 16-bit data */
11917- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
11918- /* 16-bit data */
11919- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
11920- /* 16-bit data */
11921- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
11922- /*
11923- * The APM segments have byte granularity and their bases
11924- * are set at run time. All have 64k limits.
11925- */
11926- /* 32-bit code */
11927- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11928- /* 16-bit code */
11929- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11930- /* data */
11931- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
11932-
11933- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11934- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11935- GDT_STACK_CANARY_INIT
11936-#endif
11937-} };
11938-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
11939-
11940 static int __init x86_xsave_setup(char *s)
11941 {
11942 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
11943@@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
11944 {
11945 struct desc_ptr gdt_descr;
11946
11947- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
11948+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
11949 gdt_descr.size = GDT_SIZE - 1;
11950 load_gdt(&gdt_descr);
11951 /* Reload the per-cpu base */
11952@@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
11953 /* Filter out anything that depends on CPUID levels we don't have */
11954 filter_cpuid_features(c, true);
11955
11956+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
11957+ setup_clear_cpu_cap(X86_FEATURE_SEP);
11958+#endif
11959+
11960 /* If the model name is still unset, do table lookup. */
11961 if (!c->x86_model_id[0]) {
11962 const char *p;
11963@@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(char *arg)
11964 }
11965 __setup("clearcpuid=", setup_disablecpuid);
11966
11967+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
11968+EXPORT_PER_CPU_SYMBOL(current_tinfo);
11969+
11970 #ifdef CONFIG_X86_64
11971 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
11972
11973@@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
11974 EXPORT_PER_CPU_SYMBOL(current_task);
11975
11976 DEFINE_PER_CPU(unsigned long, kernel_stack) =
11977- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
11978+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
11979 EXPORT_PER_CPU_SYMBOL(kernel_stack);
11980
11981 DEFINE_PER_CPU(char *, irq_stack_ptr) =
11982@@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
11983 {
11984 memset(regs, 0, sizeof(struct pt_regs));
11985 regs->fs = __KERNEL_PERCPU;
11986- regs->gs = __KERNEL_STACK_CANARY;
11987+ savesegment(gs, regs->gs);
11988
11989 return regs;
11990 }
11991@@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
11992 int i;
11993
11994 cpu = stack_smp_processor_id();
11995- t = &per_cpu(init_tss, cpu);
11996+ t = init_tss + cpu;
11997 oist = &per_cpu(orig_ist, cpu);
11998
11999 #ifdef CONFIG_NUMA
12000@@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
12001 switch_to_new_gdt(cpu);
12002 loadsegment(fs, 0);
12003
12004- load_idt((const struct desc_ptr *)&idt_descr);
12005+ load_idt(&idt_descr);
12006
12007 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
12008 syscall_init();
12009@@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
12010 wrmsrl(MSR_KERNEL_GS_BASE, 0);
12011 barrier();
12012
12013- x86_configure_nx();
12014 if (cpu != 0)
12015 enable_x2apic();
12016
12017@@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
12018 {
12019 int cpu = smp_processor_id();
12020 struct task_struct *curr = current;
12021- struct tss_struct *t = &per_cpu(init_tss, cpu);
12022+ struct tss_struct *t = init_tss + cpu;
12023 struct thread_struct *thread = &curr->thread;
12024
12025 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12026diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
12027index ed6086e..a1dcf29 100644
12028--- a/arch/x86/kernel/cpu/intel.c
12029+++ b/arch/x86/kernel/cpu/intel.c
12030@@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug(void)
12031 * Update the IDT descriptor and reload the IDT so that
12032 * it uses the read-only mapped virtual address.
12033 */
12034- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12035+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12036 load_idt(&idt_descr);
12037 }
12038 #endif
12039diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12040index 0ed633c..82cef2a 100644
12041--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
12042+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12043@@ -215,7 +215,9 @@ static int inject_init(void)
12044 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
12045 return -ENOMEM;
12046 printk(KERN_INFO "Machine check injector initialized\n");
12047- mce_chrdev_ops.write = mce_write;
12048+ pax_open_kernel();
12049+ *(void **)&mce_chrdev_ops.write = mce_write;
12050+ pax_close_kernel();
12051 register_die_notifier(&mce_raise_nb);
12052 return 0;
12053 }
12054diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
12055index 08363b0..ee26113 100644
12056--- a/arch/x86/kernel/cpu/mcheck/mce.c
12057+++ b/arch/x86/kernel/cpu/mcheck/mce.c
12058@@ -42,6 +42,7 @@
12059 #include <asm/processor.h>
12060 #include <asm/mce.h>
12061 #include <asm/msr.h>
12062+#include <asm/local.h>
12063
12064 #include "mce-internal.h"
12065
12066@@ -205,7 +206,7 @@ static void print_mce(struct mce *m)
12067 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12068 m->cs, m->ip);
12069
12070- if (m->cs == __KERNEL_CS)
12071+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12072 print_symbol("{%s}", m->ip);
12073 pr_cont("\n");
12074 }
12075@@ -233,10 +234,10 @@ static void print_mce(struct mce *m)
12076
12077 #define PANIC_TIMEOUT 5 /* 5 seconds */
12078
12079-static atomic_t mce_paniced;
12080+static atomic_unchecked_t mce_paniced;
12081
12082 static int fake_panic;
12083-static atomic_t mce_fake_paniced;
12084+static atomic_unchecked_t mce_fake_paniced;
12085
12086 /* Panic in progress. Enable interrupts and wait for final IPI */
12087 static void wait_for_panic(void)
12088@@ -260,7 +261,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12089 /*
12090 * Make sure only one CPU runs in machine check panic
12091 */
12092- if (atomic_inc_return(&mce_paniced) > 1)
12093+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12094 wait_for_panic();
12095 barrier();
12096
12097@@ -268,7 +269,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12098 console_verbose();
12099 } else {
12100 /* Don't log too much for fake panic */
12101- if (atomic_inc_return(&mce_fake_paniced) > 1)
12102+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12103 return;
12104 }
12105 /* First print corrected ones that are still unlogged */
12106@@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t)
12107 * might have been modified by someone else.
12108 */
12109 rmb();
12110- if (atomic_read(&mce_paniced))
12111+ if (atomic_read_unchecked(&mce_paniced))
12112 wait_for_panic();
12113 if (!monarch_timeout)
12114 goto out;
12115@@ -1392,7 +1393,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
12116 }
12117
12118 /* Call the installed machine check handler for this CPU setup. */
12119-void (*machine_check_vector)(struct pt_regs *, long error_code) =
12120+void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
12121 unexpected_machine_check;
12122
12123 /*
12124@@ -1415,7 +1416,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12125 return;
12126 }
12127
12128+ pax_open_kernel();
12129 machine_check_vector = do_machine_check;
12130+ pax_close_kernel();
12131
12132 __mcheck_cpu_init_generic();
12133 __mcheck_cpu_init_vendor(c);
12134@@ -1429,7 +1432,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12135 */
12136
12137 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
12138-static int mce_chrdev_open_count; /* #times opened */
12139+static local_t mce_chrdev_open_count; /* #times opened */
12140 static int mce_chrdev_open_exclu; /* already open exclusive? */
12141
12142 static int mce_chrdev_open(struct inode *inode, struct file *file)
12143@@ -1437,7 +1440,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12144 spin_lock(&mce_chrdev_state_lock);
12145
12146 if (mce_chrdev_open_exclu ||
12147- (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
12148+ (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
12149 spin_unlock(&mce_chrdev_state_lock);
12150
12151 return -EBUSY;
12152@@ -1445,7 +1448,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12153
12154 if (file->f_flags & O_EXCL)
12155 mce_chrdev_open_exclu = 1;
12156- mce_chrdev_open_count++;
12157+ local_inc(&mce_chrdev_open_count);
12158
12159 spin_unlock(&mce_chrdev_state_lock);
12160
12161@@ -1456,7 +1459,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
12162 {
12163 spin_lock(&mce_chrdev_state_lock);
12164
12165- mce_chrdev_open_count--;
12166+ local_dec(&mce_chrdev_open_count);
12167 mce_chrdev_open_exclu = 0;
12168
12169 spin_unlock(&mce_chrdev_state_lock);
12170@@ -2147,7 +2150,7 @@ struct dentry *mce_get_debugfs_dir(void)
12171 static void mce_reset(void)
12172 {
12173 cpu_missing = 0;
12174- atomic_set(&mce_fake_paniced, 0);
12175+ atomic_set_unchecked(&mce_fake_paniced, 0);
12176 atomic_set(&mce_executing, 0);
12177 atomic_set(&mce_callin, 0);
12178 atomic_set(&global_nwo, 0);
12179diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
12180index 5c0e653..1e82c7c 100644
12181--- a/arch/x86/kernel/cpu/mcheck/p5.c
12182+++ b/arch/x86/kernel/cpu/mcheck/p5.c
12183@@ -50,7 +50,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
12184 if (!cpu_has(c, X86_FEATURE_MCE))
12185 return;
12186
12187+ pax_open_kernel();
12188 machine_check_vector = pentium_machine_check;
12189+ pax_close_kernel();
12190 /* Make sure the vector pointer is visible before we enable MCEs: */
12191 wmb();
12192
12193diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
12194index 54060f5..e6ba93d 100644
12195--- a/arch/x86/kernel/cpu/mcheck/winchip.c
12196+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
12197@@ -24,7 +24,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
12198 {
12199 u32 lo, hi;
12200
12201+ pax_open_kernel();
12202 machine_check_vector = winchip_machine_check;
12203+ pax_close_kernel();
12204 /* Make sure the vector pointer is visible before we enable MCEs: */
12205 wmb();
12206
12207diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
12208index 6b96110..0da73eb 100644
12209--- a/arch/x86/kernel/cpu/mtrr/main.c
12210+++ b/arch/x86/kernel/cpu/mtrr/main.c
12211@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
12212 u64 size_or_mask, size_and_mask;
12213 static bool mtrr_aps_delayed_init;
12214
12215-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12216+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12217
12218 const struct mtrr_ops *mtrr_if;
12219
12220diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
12221index df5e41f..816c719 100644
12222--- a/arch/x86/kernel/cpu/mtrr/mtrr.h
12223+++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
12224@@ -25,7 +25,7 @@ struct mtrr_ops {
12225 int (*validate_add_page)(unsigned long base, unsigned long size,
12226 unsigned int type);
12227 int (*have_wrcomb)(void);
12228-};
12229+} __do_const;
12230
12231 extern int generic_get_free_region(unsigned long base, unsigned long size,
12232 int replace_reg);
12233diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
12234index cfa62ec..9250dd7 100644
12235--- a/arch/x86/kernel/cpu/perf_event.c
12236+++ b/arch/x86/kernel/cpu/perf_event.c
12237@@ -795,6 +795,8 @@ static int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
12238 int i, j, w, wmax, num = 0;
12239 struct hw_perf_event *hwc;
12240
12241+ pax_track_stack();
12242+
12243 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
12244
12245 for (i = 0; i < n; i++) {
12246@@ -1919,7 +1921,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
12247 break;
12248
12249 perf_callchain_store(entry, frame.return_address);
12250- fp = frame.next_frame;
12251+ fp = (const void __force_user *)frame.next_frame;
12252 }
12253 }
12254
12255diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
12256index 764c7c2..c5d9c7b 100644
12257--- a/arch/x86/kernel/crash.c
12258+++ b/arch/x86/kernel/crash.c
12259@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
12260 regs = args->regs;
12261
12262 #ifdef CONFIG_X86_32
12263- if (!user_mode_vm(regs)) {
12264+ if (!user_mode(regs)) {
12265 crash_fixup_ss_esp(&fixed_regs, regs);
12266 regs = &fixed_regs;
12267 }
12268diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
12269index 37250fe..bf2ec74 100644
12270--- a/arch/x86/kernel/doublefault_32.c
12271+++ b/arch/x86/kernel/doublefault_32.c
12272@@ -11,7 +11,7 @@
12273
12274 #define DOUBLEFAULT_STACKSIZE (1024)
12275 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
12276-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
12277+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
12278
12279 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
12280
12281@@ -21,7 +21,7 @@ static void doublefault_fn(void)
12282 unsigned long gdt, tss;
12283
12284 store_gdt(&gdt_desc);
12285- gdt = gdt_desc.address;
12286+ gdt = (unsigned long)gdt_desc.address;
12287
12288 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
12289
12290@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
12291 /* 0x2 bit is always set */
12292 .flags = X86_EFLAGS_SF | 0x2,
12293 .sp = STACK_START,
12294- .es = __USER_DS,
12295+ .es = __KERNEL_DS,
12296 .cs = __KERNEL_CS,
12297 .ss = __KERNEL_DS,
12298- .ds = __USER_DS,
12299+ .ds = __KERNEL_DS,
12300 .fs = __KERNEL_PERCPU,
12301
12302 .__cr3 = __pa_nodebug(swapper_pg_dir),
12303diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
12304index 1aae78f..aab3a3d 100644
12305--- a/arch/x86/kernel/dumpstack.c
12306+++ b/arch/x86/kernel/dumpstack.c
12307@@ -2,6 +2,9 @@
12308 * Copyright (C) 1991, 1992 Linus Torvalds
12309 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
12310 */
12311+#ifdef CONFIG_GRKERNSEC_HIDESYM
12312+#define __INCLUDED_BY_HIDESYM 1
12313+#endif
12314 #include <linux/kallsyms.h>
12315 #include <linux/kprobes.h>
12316 #include <linux/uaccess.h>
12317@@ -35,9 +38,8 @@ void printk_address(unsigned long address, int reliable)
12318 static void
12319 print_ftrace_graph_addr(unsigned long addr, void *data,
12320 const struct stacktrace_ops *ops,
12321- struct thread_info *tinfo, int *graph)
12322+ struct task_struct *task, int *graph)
12323 {
12324- struct task_struct *task = tinfo->task;
12325 unsigned long ret_addr;
12326 int index = task->curr_ret_stack;
12327
12328@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12329 static inline void
12330 print_ftrace_graph_addr(unsigned long addr, void *data,
12331 const struct stacktrace_ops *ops,
12332- struct thread_info *tinfo, int *graph)
12333+ struct task_struct *task, int *graph)
12334 { }
12335 #endif
12336
12337@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12338 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
12339 */
12340
12341-static inline int valid_stack_ptr(struct thread_info *tinfo,
12342- void *p, unsigned int size, void *end)
12343+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
12344 {
12345- void *t = tinfo;
12346 if (end) {
12347 if (p < end && p >= (end-THREAD_SIZE))
12348 return 1;
12349@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
12350 }
12351
12352 unsigned long
12353-print_context_stack(struct thread_info *tinfo,
12354+print_context_stack(struct task_struct *task, void *stack_start,
12355 unsigned long *stack, unsigned long bp,
12356 const struct stacktrace_ops *ops, void *data,
12357 unsigned long *end, int *graph)
12358 {
12359 struct stack_frame *frame = (struct stack_frame *)bp;
12360
12361- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
12362+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
12363 unsigned long addr;
12364
12365 addr = *stack;
12366@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *tinfo,
12367 } else {
12368 ops->address(data, addr, 0);
12369 }
12370- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12371+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12372 }
12373 stack++;
12374 }
12375@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *tinfo,
12376 EXPORT_SYMBOL_GPL(print_context_stack);
12377
12378 unsigned long
12379-print_context_stack_bp(struct thread_info *tinfo,
12380+print_context_stack_bp(struct task_struct *task, void *stack_start,
12381 unsigned long *stack, unsigned long bp,
12382 const struct stacktrace_ops *ops, void *data,
12383 unsigned long *end, int *graph)
12384@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12385 struct stack_frame *frame = (struct stack_frame *)bp;
12386 unsigned long *ret_addr = &frame->return_address;
12387
12388- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
12389+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
12390 unsigned long addr = *ret_addr;
12391
12392 if (!__kernel_text_address(addr))
12393@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12394 ops->address(data, addr, 1);
12395 frame = frame->next_frame;
12396 ret_addr = &frame->return_address;
12397- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12398+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12399 }
12400
12401 return (unsigned long)frame;
12402@@ -186,7 +186,7 @@ void dump_stack(void)
12403
12404 bp = stack_frame(current, NULL);
12405 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
12406- current->pid, current->comm, print_tainted(),
12407+ task_pid_nr(current), current->comm, print_tainted(),
12408 init_utsname()->release,
12409 (int)strcspn(init_utsname()->version, " "),
12410 init_utsname()->version);
12411@@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
12412 }
12413 EXPORT_SYMBOL_GPL(oops_begin);
12414
12415+extern void gr_handle_kernel_exploit(void);
12416+
12417 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12418 {
12419 if (regs && kexec_should_crash(current))
12420@@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12421 panic("Fatal exception in interrupt");
12422 if (panic_on_oops)
12423 panic("Fatal exception");
12424- do_exit(signr);
12425+
12426+ gr_handle_kernel_exploit();
12427+
12428+ do_group_exit(signr);
12429 }
12430
12431 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12432@@ -269,7 +274,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12433
12434 show_registers(regs);
12435 #ifdef CONFIG_X86_32
12436- if (user_mode_vm(regs)) {
12437+ if (user_mode(regs)) {
12438 sp = regs->sp;
12439 ss = regs->ss & 0xffff;
12440 } else {
12441@@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs *regs, long err)
12442 unsigned long flags = oops_begin();
12443 int sig = SIGSEGV;
12444
12445- if (!user_mode_vm(regs))
12446+ if (!user_mode(regs))
12447 report_bug(regs->ip, regs);
12448
12449 if (__die(str, regs, err))
12450diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
12451index 3b97a80..667ce7a 100644
12452--- a/arch/x86/kernel/dumpstack_32.c
12453+++ b/arch/x86/kernel/dumpstack_32.c
12454@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12455 bp = stack_frame(task, regs);
12456
12457 for (;;) {
12458- struct thread_info *context;
12459+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12460
12461- context = (struct thread_info *)
12462- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
12463- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
12464+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12465
12466- stack = (unsigned long *)context->previous_esp;
12467- if (!stack)
12468+ if (stack_start == task_stack_page(task))
12469 break;
12470+ stack = *(unsigned long **)stack_start;
12471 if (ops->stack(data, "IRQ") < 0)
12472 break;
12473 touch_nmi_watchdog();
12474@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs)
12475 * When in-kernel, we also print out the stack and code at the
12476 * time of the fault..
12477 */
12478- if (!user_mode_vm(regs)) {
12479+ if (!user_mode(regs)) {
12480 unsigned int code_prologue = code_bytes * 43 / 64;
12481 unsigned int code_len = code_bytes;
12482 unsigned char c;
12483 u8 *ip;
12484+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
12485
12486 printk(KERN_EMERG "Stack:\n");
12487 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
12488
12489 printk(KERN_EMERG "Code: ");
12490
12491- ip = (u8 *)regs->ip - code_prologue;
12492+ ip = (u8 *)regs->ip - code_prologue + cs_base;
12493 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
12494 /* try starting at IP */
12495- ip = (u8 *)regs->ip;
12496+ ip = (u8 *)regs->ip + cs_base;
12497 code_len = code_len - code_prologue + 1;
12498 }
12499 for (i = 0; i < code_len; i++, ip++) {
12500@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs)
12501 printk(" Bad EIP value.");
12502 break;
12503 }
12504- if (ip == (u8 *)regs->ip)
12505+ if (ip == (u8 *)regs->ip + cs_base)
12506 printk("<%02x> ", c);
12507 else
12508 printk("%02x ", c);
12509@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
12510 {
12511 unsigned short ud2;
12512
12513+ ip = ktla_ktva(ip);
12514 if (ip < PAGE_OFFSET)
12515 return 0;
12516 if (probe_kernel_address((unsigned short *)ip, ud2))
12517@@ -139,3 +139,15 @@ int is_valid_bugaddr(unsigned long ip)
12518
12519 return ud2 == 0x0b0f;
12520 }
12521+
12522+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12523+void pax_check_alloca(unsigned long size)
12524+{
12525+ unsigned long sp = (unsigned long)&sp, stack_left;
12526+
12527+ /* all kernel stacks are of the same size */
12528+ stack_left = sp & (THREAD_SIZE - 1);
12529+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12530+}
12531+EXPORT_SYMBOL(pax_check_alloca);
12532+#endif
12533diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
12534index 19853ad..508ca79 100644
12535--- a/arch/x86/kernel/dumpstack_64.c
12536+++ b/arch/x86/kernel/dumpstack_64.c
12537@@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12538 unsigned long *irq_stack_end =
12539 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
12540 unsigned used = 0;
12541- struct thread_info *tinfo;
12542 int graph = 0;
12543 unsigned long dummy;
12544+ void *stack_start;
12545
12546 if (!task)
12547 task = current;
12548@@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12549 * current stack address. If the stacks consist of nested
12550 * exceptions
12551 */
12552- tinfo = task_thread_info(task);
12553 for (;;) {
12554 char *id;
12555 unsigned long *estack_end;
12556+
12557 estack_end = in_exception_stack(cpu, (unsigned long)stack,
12558 &used, &id);
12559
12560@@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12561 if (ops->stack(data, id) < 0)
12562 break;
12563
12564- bp = ops->walk_stack(tinfo, stack, bp, ops,
12565+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
12566 data, estack_end, &graph);
12567 ops->stack(data, "<EOE>");
12568 /*
12569@@ -172,7 +172,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12570 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
12571 if (ops->stack(data, "IRQ") < 0)
12572 break;
12573- bp = ops->walk_stack(tinfo, stack, bp,
12574+ bp = ops->walk_stack(task, irq_stack, stack, bp,
12575 ops, data, irq_stack_end, &graph);
12576 /*
12577 * We link to the next stack (which would be
12578@@ -191,7 +191,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12579 /*
12580 * This handles the process stack:
12581 */
12582- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
12583+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12584+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12585 put_cpu();
12586 }
12587 EXPORT_SYMBOL(dump_trace);
12588@@ -305,3 +306,50 @@ int is_valid_bugaddr(unsigned long ip)
12589
12590 return ud2 == 0x0b0f;
12591 }
12592+
12593+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12594+void pax_check_alloca(unsigned long size)
12595+{
12596+ unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
12597+ unsigned cpu, used;
12598+ char *id;
12599+
12600+ /* check the process stack first */
12601+ stack_start = (unsigned long)task_stack_page(current);
12602+ stack_end = stack_start + THREAD_SIZE;
12603+ if (likely(stack_start <= sp && sp < stack_end)) {
12604+ unsigned long stack_left = sp & (THREAD_SIZE - 1);
12605+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12606+ return;
12607+ }
12608+
12609+ cpu = get_cpu();
12610+
12611+ /* check the irq stacks */
12612+ stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
12613+ stack_start = stack_end - IRQ_STACK_SIZE;
12614+ if (stack_start <= sp && sp < stack_end) {
12615+ unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
12616+ put_cpu();
12617+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12618+ return;
12619+ }
12620+
12621+ /* check the exception stacks */
12622+ used = 0;
12623+ stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
12624+ stack_start = stack_end - EXCEPTION_STKSZ;
12625+ if (stack_end && stack_start <= sp && sp < stack_end) {
12626+ unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
12627+ put_cpu();
12628+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12629+ return;
12630+ }
12631+
12632+ put_cpu();
12633+
12634+ /* unknown stack */
12635+ BUG();
12636+}
12637+EXPORT_SYMBOL(pax_check_alloca);
12638+#endif
12639diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
12640index cd28a35..2601699 100644
12641--- a/arch/x86/kernel/early_printk.c
12642+++ b/arch/x86/kernel/early_printk.c
12643@@ -7,6 +7,7 @@
12644 #include <linux/pci_regs.h>
12645 #include <linux/pci_ids.h>
12646 #include <linux/errno.h>
12647+#include <linux/sched.h>
12648 #include <asm/io.h>
12649 #include <asm/processor.h>
12650 #include <asm/fcntl.h>
12651@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char *fmt, ...)
12652 int n;
12653 va_list ap;
12654
12655+ pax_track_stack();
12656+
12657 va_start(ap, fmt);
12658 n = vscnprintf(buf, sizeof(buf), fmt, ap);
12659 early_console->write(early_console, buf, n);
12660diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
12661index f3f6f53..0841b66 100644
12662--- a/arch/x86/kernel/entry_32.S
12663+++ b/arch/x86/kernel/entry_32.S
12664@@ -186,13 +186,146 @@
12665 /*CFI_REL_OFFSET gs, PT_GS*/
12666 .endm
12667 .macro SET_KERNEL_GS reg
12668+
12669+#ifdef CONFIG_CC_STACKPROTECTOR
12670 movl $(__KERNEL_STACK_CANARY), \reg
12671+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
12672+ movl $(__USER_DS), \reg
12673+#else
12674+ xorl \reg, \reg
12675+#endif
12676+
12677 movl \reg, %gs
12678 .endm
12679
12680 #endif /* CONFIG_X86_32_LAZY_GS */
12681
12682-.macro SAVE_ALL
12683+.macro pax_enter_kernel
12684+#ifdef CONFIG_PAX_KERNEXEC
12685+ call pax_enter_kernel
12686+#endif
12687+.endm
12688+
12689+.macro pax_exit_kernel
12690+#ifdef CONFIG_PAX_KERNEXEC
12691+ call pax_exit_kernel
12692+#endif
12693+.endm
12694+
12695+#ifdef CONFIG_PAX_KERNEXEC
12696+ENTRY(pax_enter_kernel)
12697+#ifdef CONFIG_PARAVIRT
12698+ pushl %eax
12699+ pushl %ecx
12700+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
12701+ mov %eax, %esi
12702+#else
12703+ mov %cr0, %esi
12704+#endif
12705+ bts $16, %esi
12706+ jnc 1f
12707+ mov %cs, %esi
12708+ cmp $__KERNEL_CS, %esi
12709+ jz 3f
12710+ ljmp $__KERNEL_CS, $3f
12711+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
12712+2:
12713+#ifdef CONFIG_PARAVIRT
12714+ mov %esi, %eax
12715+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
12716+#else
12717+ mov %esi, %cr0
12718+#endif
12719+3:
12720+#ifdef CONFIG_PARAVIRT
12721+ popl %ecx
12722+ popl %eax
12723+#endif
12724+ ret
12725+ENDPROC(pax_enter_kernel)
12726+
12727+ENTRY(pax_exit_kernel)
12728+#ifdef CONFIG_PARAVIRT
12729+ pushl %eax
12730+ pushl %ecx
12731+#endif
12732+ mov %cs, %esi
12733+ cmp $__KERNEXEC_KERNEL_CS, %esi
12734+ jnz 2f
12735+#ifdef CONFIG_PARAVIRT
12736+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
12737+ mov %eax, %esi
12738+#else
12739+ mov %cr0, %esi
12740+#endif
12741+ btr $16, %esi
12742+ ljmp $__KERNEL_CS, $1f
12743+1:
12744+#ifdef CONFIG_PARAVIRT
12745+ mov %esi, %eax
12746+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
12747+#else
12748+ mov %esi, %cr0
12749+#endif
12750+2:
12751+#ifdef CONFIG_PARAVIRT
12752+ popl %ecx
12753+ popl %eax
12754+#endif
12755+ ret
12756+ENDPROC(pax_exit_kernel)
12757+#endif
12758+
12759+.macro pax_erase_kstack
12760+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12761+ call pax_erase_kstack
12762+#endif
12763+.endm
12764+
12765+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12766+/*
12767+ * ebp: thread_info
12768+ * ecx, edx: can be clobbered
12769+ */
12770+ENTRY(pax_erase_kstack)
12771+ pushl %edi
12772+ pushl %eax
12773+
12774+ mov TI_lowest_stack(%ebp), %edi
12775+ mov $-0xBEEF, %eax
12776+ std
12777+
12778+1: mov %edi, %ecx
12779+ and $THREAD_SIZE_asm - 1, %ecx
12780+ shr $2, %ecx
12781+ repne scasl
12782+ jecxz 2f
12783+
12784+ cmp $2*16, %ecx
12785+ jc 2f
12786+
12787+ mov $2*16, %ecx
12788+ repe scasl
12789+ jecxz 2f
12790+ jne 1b
12791+
12792+2: cld
12793+ mov %esp, %ecx
12794+ sub %edi, %ecx
12795+ shr $2, %ecx
12796+ rep stosl
12797+
12798+ mov TI_task_thread_sp0(%ebp), %edi
12799+ sub $128, %edi
12800+ mov %edi, TI_lowest_stack(%ebp)
12801+
12802+ popl %eax
12803+ popl %edi
12804+ ret
12805+ENDPROC(pax_erase_kstack)
12806+#endif
12807+
12808+.macro __SAVE_ALL _DS
12809 cld
12810 PUSH_GS
12811 pushl_cfi %fs
12812@@ -215,7 +348,7 @@
12813 CFI_REL_OFFSET ecx, 0
12814 pushl_cfi %ebx
12815 CFI_REL_OFFSET ebx, 0
12816- movl $(__USER_DS), %edx
12817+ movl $\_DS, %edx
12818 movl %edx, %ds
12819 movl %edx, %es
12820 movl $(__KERNEL_PERCPU), %edx
12821@@ -223,6 +356,15 @@
12822 SET_KERNEL_GS %edx
12823 .endm
12824
12825+.macro SAVE_ALL
12826+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
12827+ __SAVE_ALL __KERNEL_DS
12828+ pax_enter_kernel
12829+#else
12830+ __SAVE_ALL __USER_DS
12831+#endif
12832+.endm
12833+
12834 .macro RESTORE_INT_REGS
12835 popl_cfi %ebx
12836 CFI_RESTORE ebx
12837@@ -308,7 +450,7 @@ ENTRY(ret_from_fork)
12838 popfl_cfi
12839 jmp syscall_exit
12840 CFI_ENDPROC
12841-END(ret_from_fork)
12842+ENDPROC(ret_from_fork)
12843
12844 /*
12845 * Interrupt exit functions should be protected against kprobes
12846@@ -333,7 +475,15 @@ check_userspace:
12847 movb PT_CS(%esp), %al
12848 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
12849 cmpl $USER_RPL, %eax
12850+
12851+#ifdef CONFIG_PAX_KERNEXEC
12852+ jae resume_userspace
12853+
12854+ PAX_EXIT_KERNEL
12855+ jmp resume_kernel
12856+#else
12857 jb resume_kernel # not returning to v8086 or userspace
12858+#endif
12859
12860 ENTRY(resume_userspace)
12861 LOCKDEP_SYS_EXIT
12862@@ -345,8 +495,8 @@ ENTRY(resume_userspace)
12863 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
12864 # int/exception return?
12865 jne work_pending
12866- jmp restore_all
12867-END(ret_from_exception)
12868+ jmp restore_all_pax
12869+ENDPROC(ret_from_exception)
12870
12871 #ifdef CONFIG_PREEMPT
12872 ENTRY(resume_kernel)
12873@@ -361,7 +511,7 @@ need_resched:
12874 jz restore_all
12875 call preempt_schedule_irq
12876 jmp need_resched
12877-END(resume_kernel)
12878+ENDPROC(resume_kernel)
12879 #endif
12880 CFI_ENDPROC
12881 /*
12882@@ -395,23 +545,34 @@ sysenter_past_esp:
12883 /*CFI_REL_OFFSET cs, 0*/
12884 /*
12885 * Push current_thread_info()->sysenter_return to the stack.
12886- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
12887- * pushed above; +8 corresponds to copy_thread's esp0 setting.
12888 */
12889- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
12890+ pushl_cfi $0
12891 CFI_REL_OFFSET eip, 0
12892
12893 pushl_cfi %eax
12894 SAVE_ALL
12895+ GET_THREAD_INFO(%ebp)
12896+ movl TI_sysenter_return(%ebp),%ebp
12897+ movl %ebp,PT_EIP(%esp)
12898 ENABLE_INTERRUPTS(CLBR_NONE)
12899
12900 /*
12901 * Load the potential sixth argument from user stack.
12902 * Careful about security.
12903 */
12904+ movl PT_OLDESP(%esp),%ebp
12905+
12906+#ifdef CONFIG_PAX_MEMORY_UDEREF
12907+ mov PT_OLDSS(%esp),%ds
12908+1: movl %ds:(%ebp),%ebp
12909+ push %ss
12910+ pop %ds
12911+#else
12912 cmpl $__PAGE_OFFSET-3,%ebp
12913 jae syscall_fault
12914 1: movl (%ebp),%ebp
12915+#endif
12916+
12917 movl %ebp,PT_EBP(%esp)
12918 .section __ex_table,"a"
12919 .align 4
12920@@ -434,12 +595,24 @@ sysenter_do_call:
12921 testl $_TIF_ALLWORK_MASK, %ecx
12922 jne sysexit_audit
12923 sysenter_exit:
12924+
12925+#ifdef CONFIG_PAX_RANDKSTACK
12926+ pushl_cfi %eax
12927+ movl %esp, %eax
12928+ call pax_randomize_kstack
12929+ popl_cfi %eax
12930+#endif
12931+
12932+ pax_erase_kstack
12933+
12934 /* if something modifies registers it must also disable sysexit */
12935 movl PT_EIP(%esp), %edx
12936 movl PT_OLDESP(%esp), %ecx
12937 xorl %ebp,%ebp
12938 TRACE_IRQS_ON
12939 1: mov PT_FS(%esp), %fs
12940+2: mov PT_DS(%esp), %ds
12941+3: mov PT_ES(%esp), %es
12942 PTGS_TO_GS
12943 ENABLE_INTERRUPTS_SYSEXIT
12944
12945@@ -456,6 +629,9 @@ sysenter_audit:
12946 movl %eax,%edx /* 2nd arg: syscall number */
12947 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
12948 call audit_syscall_entry
12949+
12950+ pax_erase_kstack
12951+
12952 pushl_cfi %ebx
12953 movl PT_EAX(%esp),%eax /* reload syscall number */
12954 jmp sysenter_do_call
12955@@ -482,11 +658,17 @@ sysexit_audit:
12956
12957 CFI_ENDPROC
12958 .pushsection .fixup,"ax"
12959-2: movl $0,PT_FS(%esp)
12960+4: movl $0,PT_FS(%esp)
12961+ jmp 1b
12962+5: movl $0,PT_DS(%esp)
12963+ jmp 1b
12964+6: movl $0,PT_ES(%esp)
12965 jmp 1b
12966 .section __ex_table,"a"
12967 .align 4
12968- .long 1b,2b
12969+ .long 1b,4b
12970+ .long 2b,5b
12971+ .long 3b,6b
12972 .popsection
12973 PTGS_TO_GS_EX
12974 ENDPROC(ia32_sysenter_target)
12975@@ -519,6 +701,15 @@ syscall_exit:
12976 testl $_TIF_ALLWORK_MASK, %ecx # current->work
12977 jne syscall_exit_work
12978
12979+restore_all_pax:
12980+
12981+#ifdef CONFIG_PAX_RANDKSTACK
12982+ movl %esp, %eax
12983+ call pax_randomize_kstack
12984+#endif
12985+
12986+ pax_erase_kstack
12987+
12988 restore_all:
12989 TRACE_IRQS_IRET
12990 restore_all_notrace:
12991@@ -578,14 +769,34 @@ ldt_ss:
12992 * compensating for the offset by changing to the ESPFIX segment with
12993 * a base address that matches for the difference.
12994 */
12995-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
12996+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
12997 mov %esp, %edx /* load kernel esp */
12998 mov PT_OLDESP(%esp), %eax /* load userspace esp */
12999 mov %dx, %ax /* eax: new kernel esp */
13000 sub %eax, %edx /* offset (low word is 0) */
13001+#ifdef CONFIG_SMP
13002+ movl PER_CPU_VAR(cpu_number), %ebx
13003+ shll $PAGE_SHIFT_asm, %ebx
13004+ addl $cpu_gdt_table, %ebx
13005+#else
13006+ movl $cpu_gdt_table, %ebx
13007+#endif
13008 shr $16, %edx
13009- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
13010- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
13011+
13012+#ifdef CONFIG_PAX_KERNEXEC
13013+ mov %cr0, %esi
13014+ btr $16, %esi
13015+ mov %esi, %cr0
13016+#endif
13017+
13018+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13019+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13020+
13021+#ifdef CONFIG_PAX_KERNEXEC
13022+ bts $16, %esi
13023+ mov %esi, %cr0
13024+#endif
13025+
13026 pushl_cfi $__ESPFIX_SS
13027 pushl_cfi %eax /* new kernel esp */
13028 /* Disable interrupts, but do not irqtrace this section: we
13029@@ -614,34 +825,28 @@ work_resched:
13030 movl TI_flags(%ebp), %ecx
13031 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13032 # than syscall tracing?
13033- jz restore_all
13034+ jz restore_all_pax
13035 testb $_TIF_NEED_RESCHED, %cl
13036 jnz work_resched
13037
13038 work_notifysig: # deal with pending signals and
13039 # notify-resume requests
13040+ movl %esp, %eax
13041 #ifdef CONFIG_VM86
13042 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13043- movl %esp, %eax
13044- jne work_notifysig_v86 # returning to kernel-space or
13045+ jz 1f # returning to kernel-space or
13046 # vm86-space
13047- xorl %edx, %edx
13048- call do_notify_resume
13049- jmp resume_userspace_sig
13050
13051- ALIGN
13052-work_notifysig_v86:
13053 pushl_cfi %ecx # save ti_flags for do_notify_resume
13054 call save_v86_state # %eax contains pt_regs pointer
13055 popl_cfi %ecx
13056 movl %eax, %esp
13057-#else
13058- movl %esp, %eax
13059+1:
13060 #endif
13061 xorl %edx, %edx
13062 call do_notify_resume
13063 jmp resume_userspace_sig
13064-END(work_pending)
13065+ENDPROC(work_pending)
13066
13067 # perform syscall exit tracing
13068 ALIGN
13069@@ -649,11 +854,14 @@ syscall_trace_entry:
13070 movl $-ENOSYS,PT_EAX(%esp)
13071 movl %esp, %eax
13072 call syscall_trace_enter
13073+
13074+ pax_erase_kstack
13075+
13076 /* What it returned is what we'll actually use. */
13077 cmpl $(nr_syscalls), %eax
13078 jnae syscall_call
13079 jmp syscall_exit
13080-END(syscall_trace_entry)
13081+ENDPROC(syscall_trace_entry)
13082
13083 # perform syscall exit tracing
13084 ALIGN
13085@@ -666,20 +874,24 @@ syscall_exit_work:
13086 movl %esp, %eax
13087 call syscall_trace_leave
13088 jmp resume_userspace
13089-END(syscall_exit_work)
13090+ENDPROC(syscall_exit_work)
13091 CFI_ENDPROC
13092
13093 RING0_INT_FRAME # can't unwind into user space anyway
13094 syscall_fault:
13095+#ifdef CONFIG_PAX_MEMORY_UDEREF
13096+ push %ss
13097+ pop %ds
13098+#endif
13099 GET_THREAD_INFO(%ebp)
13100 movl $-EFAULT,PT_EAX(%esp)
13101 jmp resume_userspace
13102-END(syscall_fault)
13103+ENDPROC(syscall_fault)
13104
13105 syscall_badsys:
13106 movl $-ENOSYS,PT_EAX(%esp)
13107 jmp resume_userspace
13108-END(syscall_badsys)
13109+ENDPROC(syscall_badsys)
13110 CFI_ENDPROC
13111 /*
13112 * End of kprobes section
13113@@ -753,6 +965,36 @@ ptregs_clone:
13114 CFI_ENDPROC
13115 ENDPROC(ptregs_clone)
13116
13117+ ALIGN;
13118+ENTRY(kernel_execve)
13119+ CFI_STARTPROC
13120+ pushl_cfi %ebp
13121+ sub $PT_OLDSS+4,%esp
13122+ pushl_cfi %edi
13123+ pushl_cfi %ecx
13124+ pushl_cfi %eax
13125+ lea 3*4(%esp),%edi
13126+ mov $PT_OLDSS/4+1,%ecx
13127+ xorl %eax,%eax
13128+ rep stosl
13129+ popl_cfi %eax
13130+ popl_cfi %ecx
13131+ popl_cfi %edi
13132+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13133+ pushl_cfi %esp
13134+ call sys_execve
13135+ add $4,%esp
13136+ CFI_ADJUST_CFA_OFFSET -4
13137+ GET_THREAD_INFO(%ebp)
13138+ test %eax,%eax
13139+ jz syscall_exit
13140+ add $PT_OLDSS+4,%esp
13141+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13142+ popl_cfi %ebp
13143+ ret
13144+ CFI_ENDPROC
13145+ENDPROC(kernel_execve)
13146+
13147 .macro FIXUP_ESPFIX_STACK
13148 /*
13149 * Switch back for ESPFIX stack to the normal zerobased stack
13150@@ -762,8 +1004,15 @@ ENDPROC(ptregs_clone)
13151 * normal stack and adjusts ESP with the matching offset.
13152 */
13153 /* fixup the stack */
13154- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13155- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13156+#ifdef CONFIG_SMP
13157+ movl PER_CPU_VAR(cpu_number), %ebx
13158+ shll $PAGE_SHIFT_asm, %ebx
13159+ addl $cpu_gdt_table, %ebx
13160+#else
13161+ movl $cpu_gdt_table, %ebx
13162+#endif
13163+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13164+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
13165 shl $16, %eax
13166 addl %esp, %eax /* the adjusted stack pointer */
13167 pushl_cfi $__KERNEL_DS
13168@@ -816,7 +1065,7 @@ vector=vector+1
13169 .endr
13170 2: jmp common_interrupt
13171 .endr
13172-END(irq_entries_start)
13173+ENDPROC(irq_entries_start)
13174
13175 .previous
13176 END(interrupt)
13177@@ -864,7 +1113,7 @@ ENTRY(coprocessor_error)
13178 pushl_cfi $do_coprocessor_error
13179 jmp error_code
13180 CFI_ENDPROC
13181-END(coprocessor_error)
13182+ENDPROC(coprocessor_error)
13183
13184 ENTRY(simd_coprocessor_error)
13185 RING0_INT_FRAME
13186@@ -885,7 +1134,7 @@ ENTRY(simd_coprocessor_error)
13187 #endif
13188 jmp error_code
13189 CFI_ENDPROC
13190-END(simd_coprocessor_error)
13191+ENDPROC(simd_coprocessor_error)
13192
13193 ENTRY(device_not_available)
13194 RING0_INT_FRAME
13195@@ -893,7 +1142,7 @@ ENTRY(device_not_available)
13196 pushl_cfi $do_device_not_available
13197 jmp error_code
13198 CFI_ENDPROC
13199-END(device_not_available)
13200+ENDPROC(device_not_available)
13201
13202 #ifdef CONFIG_PARAVIRT
13203 ENTRY(native_iret)
13204@@ -902,12 +1151,12 @@ ENTRY(native_iret)
13205 .align 4
13206 .long native_iret, iret_exc
13207 .previous
13208-END(native_iret)
13209+ENDPROC(native_iret)
13210
13211 ENTRY(native_irq_enable_sysexit)
13212 sti
13213 sysexit
13214-END(native_irq_enable_sysexit)
13215+ENDPROC(native_irq_enable_sysexit)
13216 #endif
13217
13218 ENTRY(overflow)
13219@@ -916,7 +1165,7 @@ ENTRY(overflow)
13220 pushl_cfi $do_overflow
13221 jmp error_code
13222 CFI_ENDPROC
13223-END(overflow)
13224+ENDPROC(overflow)
13225
13226 ENTRY(bounds)
13227 RING0_INT_FRAME
13228@@ -924,7 +1173,7 @@ ENTRY(bounds)
13229 pushl_cfi $do_bounds
13230 jmp error_code
13231 CFI_ENDPROC
13232-END(bounds)
13233+ENDPROC(bounds)
13234
13235 ENTRY(invalid_op)
13236 RING0_INT_FRAME
13237@@ -932,7 +1181,7 @@ ENTRY(invalid_op)
13238 pushl_cfi $do_invalid_op
13239 jmp error_code
13240 CFI_ENDPROC
13241-END(invalid_op)
13242+ENDPROC(invalid_op)
13243
13244 ENTRY(coprocessor_segment_overrun)
13245 RING0_INT_FRAME
13246@@ -940,35 +1189,35 @@ ENTRY(coprocessor_segment_overrun)
13247 pushl_cfi $do_coprocessor_segment_overrun
13248 jmp error_code
13249 CFI_ENDPROC
13250-END(coprocessor_segment_overrun)
13251+ENDPROC(coprocessor_segment_overrun)
13252
13253 ENTRY(invalid_TSS)
13254 RING0_EC_FRAME
13255 pushl_cfi $do_invalid_TSS
13256 jmp error_code
13257 CFI_ENDPROC
13258-END(invalid_TSS)
13259+ENDPROC(invalid_TSS)
13260
13261 ENTRY(segment_not_present)
13262 RING0_EC_FRAME
13263 pushl_cfi $do_segment_not_present
13264 jmp error_code
13265 CFI_ENDPROC
13266-END(segment_not_present)
13267+ENDPROC(segment_not_present)
13268
13269 ENTRY(stack_segment)
13270 RING0_EC_FRAME
13271 pushl_cfi $do_stack_segment
13272 jmp error_code
13273 CFI_ENDPROC
13274-END(stack_segment)
13275+ENDPROC(stack_segment)
13276
13277 ENTRY(alignment_check)
13278 RING0_EC_FRAME
13279 pushl_cfi $do_alignment_check
13280 jmp error_code
13281 CFI_ENDPROC
13282-END(alignment_check)
13283+ENDPROC(alignment_check)
13284
13285 ENTRY(divide_error)
13286 RING0_INT_FRAME
13287@@ -976,7 +1225,7 @@ ENTRY(divide_error)
13288 pushl_cfi $do_divide_error
13289 jmp error_code
13290 CFI_ENDPROC
13291-END(divide_error)
13292+ENDPROC(divide_error)
13293
13294 #ifdef CONFIG_X86_MCE
13295 ENTRY(machine_check)
13296@@ -985,7 +1234,7 @@ ENTRY(machine_check)
13297 pushl_cfi machine_check_vector
13298 jmp error_code
13299 CFI_ENDPROC
13300-END(machine_check)
13301+ENDPROC(machine_check)
13302 #endif
13303
13304 ENTRY(spurious_interrupt_bug)
13305@@ -994,7 +1243,7 @@ ENTRY(spurious_interrupt_bug)
13306 pushl_cfi $do_spurious_interrupt_bug
13307 jmp error_code
13308 CFI_ENDPROC
13309-END(spurious_interrupt_bug)
13310+ENDPROC(spurious_interrupt_bug)
13311 /*
13312 * End of kprobes section
13313 */
13314@@ -1109,7 +1358,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
13315
13316 ENTRY(mcount)
13317 ret
13318-END(mcount)
13319+ENDPROC(mcount)
13320
13321 ENTRY(ftrace_caller)
13322 cmpl $0, function_trace_stop
13323@@ -1138,7 +1387,7 @@ ftrace_graph_call:
13324 .globl ftrace_stub
13325 ftrace_stub:
13326 ret
13327-END(ftrace_caller)
13328+ENDPROC(ftrace_caller)
13329
13330 #else /* ! CONFIG_DYNAMIC_FTRACE */
13331
13332@@ -1174,7 +1423,7 @@ trace:
13333 popl %ecx
13334 popl %eax
13335 jmp ftrace_stub
13336-END(mcount)
13337+ENDPROC(mcount)
13338 #endif /* CONFIG_DYNAMIC_FTRACE */
13339 #endif /* CONFIG_FUNCTION_TRACER */
13340
13341@@ -1195,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
13342 popl %ecx
13343 popl %eax
13344 ret
13345-END(ftrace_graph_caller)
13346+ENDPROC(ftrace_graph_caller)
13347
13348 .globl return_to_handler
13349 return_to_handler:
13350@@ -1209,7 +1458,6 @@ return_to_handler:
13351 jmp *%ecx
13352 #endif
13353
13354-.section .rodata,"a"
13355 #include "syscall_table_32.S"
13356
13357 syscall_table_size=(.-sys_call_table)
13358@@ -1255,15 +1503,18 @@ error_code:
13359 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13360 REG_TO_PTGS %ecx
13361 SET_KERNEL_GS %ecx
13362- movl $(__USER_DS), %ecx
13363+ movl $(__KERNEL_DS), %ecx
13364 movl %ecx, %ds
13365 movl %ecx, %es
13366+
13367+ pax_enter_kernel
13368+
13369 TRACE_IRQS_OFF
13370 movl %esp,%eax # pt_regs pointer
13371 call *%edi
13372 jmp ret_from_exception
13373 CFI_ENDPROC
13374-END(page_fault)
13375+ENDPROC(page_fault)
13376
13377 /*
13378 * Debug traps and NMI can happen at the one SYSENTER instruction
13379@@ -1305,7 +1556,7 @@ debug_stack_correct:
13380 call do_debug
13381 jmp ret_from_exception
13382 CFI_ENDPROC
13383-END(debug)
13384+ENDPROC(debug)
13385
13386 /*
13387 * NMI is doubly nasty. It can happen _while_ we're handling
13388@@ -1342,6 +1593,9 @@ nmi_stack_correct:
13389 xorl %edx,%edx # zero error code
13390 movl %esp,%eax # pt_regs pointer
13391 call do_nmi
13392+
13393+ pax_exit_kernel
13394+
13395 jmp restore_all_notrace
13396 CFI_ENDPROC
13397
13398@@ -1378,12 +1632,15 @@ nmi_espfix_stack:
13399 FIXUP_ESPFIX_STACK # %eax == %esp
13400 xorl %edx,%edx # zero error code
13401 call do_nmi
13402+
13403+ pax_exit_kernel
13404+
13405 RESTORE_REGS
13406 lss 12+4(%esp), %esp # back to espfix stack
13407 CFI_ADJUST_CFA_OFFSET -24
13408 jmp irq_return
13409 CFI_ENDPROC
13410-END(nmi)
13411+ENDPROC(nmi)
13412
13413 ENTRY(int3)
13414 RING0_INT_FRAME
13415@@ -1395,14 +1652,14 @@ ENTRY(int3)
13416 call do_int3
13417 jmp ret_from_exception
13418 CFI_ENDPROC
13419-END(int3)
13420+ENDPROC(int3)
13421
13422 ENTRY(general_protection)
13423 RING0_EC_FRAME
13424 pushl_cfi $do_general_protection
13425 jmp error_code
13426 CFI_ENDPROC
13427-END(general_protection)
13428+ENDPROC(general_protection)
13429
13430 #ifdef CONFIG_KVM_GUEST
13431 ENTRY(async_page_fault)
13432@@ -1410,7 +1667,7 @@ ENTRY(async_page_fault)
13433 pushl_cfi $do_async_page_fault
13434 jmp error_code
13435 CFI_ENDPROC
13436-END(async_page_fault)
13437+ENDPROC(async_page_fault)
13438 #endif
13439
13440 /*
13441diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
13442index 6419bb0..bb59ca4 100644
13443--- a/arch/x86/kernel/entry_64.S
13444+++ b/arch/x86/kernel/entry_64.S
13445@@ -55,6 +55,8 @@
13446 #include <asm/paravirt.h>
13447 #include <asm/ftrace.h>
13448 #include <asm/percpu.h>
13449+#include <asm/pgtable.h>
13450+#include <asm/alternative-asm.h>
13451
13452 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
13453 #include <linux/elf-em.h>
13454@@ -68,8 +70,9 @@
13455 #ifdef CONFIG_FUNCTION_TRACER
13456 #ifdef CONFIG_DYNAMIC_FTRACE
13457 ENTRY(mcount)
13458+ pax_force_retaddr
13459 retq
13460-END(mcount)
13461+ENDPROC(mcount)
13462
13463 ENTRY(ftrace_caller)
13464 cmpl $0, function_trace_stop
13465@@ -92,8 +95,9 @@ GLOBAL(ftrace_graph_call)
13466 #endif
13467
13468 GLOBAL(ftrace_stub)
13469+ pax_force_retaddr
13470 retq
13471-END(ftrace_caller)
13472+ENDPROC(ftrace_caller)
13473
13474 #else /* ! CONFIG_DYNAMIC_FTRACE */
13475 ENTRY(mcount)
13476@@ -112,6 +116,7 @@ ENTRY(mcount)
13477 #endif
13478
13479 GLOBAL(ftrace_stub)
13480+ pax_force_retaddr
13481 retq
13482
13483 trace:
13484@@ -121,12 +126,13 @@ trace:
13485 movq 8(%rbp), %rsi
13486 subq $MCOUNT_INSN_SIZE, %rdi
13487
13488+ pax_force_fptr ftrace_trace_function
13489 call *ftrace_trace_function
13490
13491 MCOUNT_RESTORE_FRAME
13492
13493 jmp ftrace_stub
13494-END(mcount)
13495+ENDPROC(mcount)
13496 #endif /* CONFIG_DYNAMIC_FTRACE */
13497 #endif /* CONFIG_FUNCTION_TRACER */
13498
13499@@ -146,8 +152,9 @@ ENTRY(ftrace_graph_caller)
13500
13501 MCOUNT_RESTORE_FRAME
13502
13503+ pax_force_retaddr
13504 retq
13505-END(ftrace_graph_caller)
13506+ENDPROC(ftrace_graph_caller)
13507
13508 GLOBAL(return_to_handler)
13509 subq $24, %rsp
13510@@ -163,6 +170,7 @@ GLOBAL(return_to_handler)
13511 movq 8(%rsp), %rdx
13512 movq (%rsp), %rax
13513 addq $24, %rsp
13514+ pax_force_fptr %rdi
13515 jmp *%rdi
13516 #endif
13517
13518@@ -178,6 +186,282 @@ ENTRY(native_usergs_sysret64)
13519 ENDPROC(native_usergs_sysret64)
13520 #endif /* CONFIG_PARAVIRT */
13521
13522+ .macro ljmpq sel, off
13523+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
13524+ .byte 0x48; ljmp *1234f(%rip)
13525+ .pushsection .rodata
13526+ .align 16
13527+ 1234: .quad \off; .word \sel
13528+ .popsection
13529+#else
13530+ pushq $\sel
13531+ pushq $\off
13532+ lretq
13533+#endif
13534+ .endm
13535+
13536+ .macro pax_enter_kernel
13537+ pax_set_fptr_mask
13538+#ifdef CONFIG_PAX_KERNEXEC
13539+ call pax_enter_kernel
13540+#endif
13541+ .endm
13542+
13543+ .macro pax_exit_kernel
13544+#ifdef CONFIG_PAX_KERNEXEC
13545+ call pax_exit_kernel
13546+#endif
13547+ .endm
13548+
13549+#ifdef CONFIG_PAX_KERNEXEC
13550+ENTRY(pax_enter_kernel)
13551+ pushq %rdi
13552+
13553+#ifdef CONFIG_PARAVIRT
13554+ PV_SAVE_REGS(CLBR_RDI)
13555+#endif
13556+
13557+ GET_CR0_INTO_RDI
13558+ bts $16,%rdi
13559+ jnc 3f
13560+ mov %cs,%edi
13561+ cmp $__KERNEL_CS,%edi
13562+ jnz 2f
13563+1:
13564+
13565+#ifdef CONFIG_PARAVIRT
13566+ PV_RESTORE_REGS(CLBR_RDI)
13567+#endif
13568+
13569+ popq %rdi
13570+ pax_force_retaddr
13571+ retq
13572+
13573+2: ljmpq __KERNEL_CS,1f
13574+3: ljmpq __KERNEXEC_KERNEL_CS,4f
13575+4: SET_RDI_INTO_CR0
13576+ jmp 1b
13577+ENDPROC(pax_enter_kernel)
13578+
13579+ENTRY(pax_exit_kernel)
13580+ pushq %rdi
13581+
13582+#ifdef CONFIG_PARAVIRT
13583+ PV_SAVE_REGS(CLBR_RDI)
13584+#endif
13585+
13586+ mov %cs,%rdi
13587+ cmp $__KERNEXEC_KERNEL_CS,%edi
13588+ jz 2f
13589+1:
13590+
13591+#ifdef CONFIG_PARAVIRT
13592+ PV_RESTORE_REGS(CLBR_RDI);
13593+#endif
13594+
13595+ popq %rdi
13596+ pax_force_retaddr
13597+ retq
13598+
13599+2: GET_CR0_INTO_RDI
13600+ btr $16,%rdi
13601+ ljmpq __KERNEL_CS,3f
13602+3: SET_RDI_INTO_CR0
13603+ jmp 1b
13604+#ifdef CONFIG_PARAVIRT
13605+ PV_RESTORE_REGS(CLBR_RDI);
13606+#endif
13607+
13608+ popq %rdi
13609+ pax_force_retaddr
13610+ retq
13611+ENDPROC(pax_exit_kernel)
13612+#endif
13613+
13614+ .macro pax_enter_kernel_user
13615+ pax_set_fptr_mask
13616+#ifdef CONFIG_PAX_MEMORY_UDEREF
13617+ call pax_enter_kernel_user
13618+#endif
13619+ .endm
13620+
13621+ .macro pax_exit_kernel_user
13622+#ifdef CONFIG_PAX_MEMORY_UDEREF
13623+ call pax_exit_kernel_user
13624+#endif
13625+#ifdef CONFIG_PAX_RANDKSTACK
13626+ pushq %rax
13627+ call pax_randomize_kstack
13628+ popq %rax
13629+#endif
13630+ .endm
13631+
13632+#ifdef CONFIG_PAX_MEMORY_UDEREF
13633+ENTRY(pax_enter_kernel_user)
13634+ pushq %rdi
13635+ pushq %rbx
13636+
13637+#ifdef CONFIG_PARAVIRT
13638+ PV_SAVE_REGS(CLBR_RDI)
13639+#endif
13640+
13641+ GET_CR3_INTO_RDI
13642+ mov %rdi,%rbx
13643+ add $__START_KERNEL_map,%rbx
13644+ sub phys_base(%rip),%rbx
13645+
13646+#ifdef CONFIG_PARAVIRT
13647+ pushq %rdi
13648+ cmpl $0, pv_info+PARAVIRT_enabled
13649+ jz 1f
13650+ i = 0
13651+ .rept USER_PGD_PTRS
13652+ mov i*8(%rbx),%rsi
13653+ mov $0,%sil
13654+ lea i*8(%rbx),%rdi
13655+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13656+ i = i + 1
13657+ .endr
13658+ jmp 2f
13659+1:
13660+#endif
13661+
13662+ i = 0
13663+ .rept USER_PGD_PTRS
13664+ movb $0,i*8(%rbx)
13665+ i = i + 1
13666+ .endr
13667+
13668+#ifdef CONFIG_PARAVIRT
13669+2: popq %rdi
13670+#endif
13671+ SET_RDI_INTO_CR3
13672+
13673+#ifdef CONFIG_PAX_KERNEXEC
13674+ GET_CR0_INTO_RDI
13675+ bts $16,%rdi
13676+ SET_RDI_INTO_CR0
13677+#endif
13678+
13679+#ifdef CONFIG_PARAVIRT
13680+ PV_RESTORE_REGS(CLBR_RDI)
13681+#endif
13682+
13683+ popq %rbx
13684+ popq %rdi
13685+ pax_force_retaddr
13686+ retq
13687+ENDPROC(pax_enter_kernel_user)
13688+
13689+ENTRY(pax_exit_kernel_user)
13690+ push %rdi
13691+
13692+#ifdef CONFIG_PARAVIRT
13693+ pushq %rbx
13694+ PV_SAVE_REGS(CLBR_RDI)
13695+#endif
13696+
13697+#ifdef CONFIG_PAX_KERNEXEC
13698+ GET_CR0_INTO_RDI
13699+ btr $16,%rdi
13700+ SET_RDI_INTO_CR0
13701+#endif
13702+
13703+ GET_CR3_INTO_RDI
13704+ add $__START_KERNEL_map,%rdi
13705+ sub phys_base(%rip),%rdi
13706+
13707+#ifdef CONFIG_PARAVIRT
13708+ cmpl $0, pv_info+PARAVIRT_enabled
13709+ jz 1f
13710+ mov %rdi,%rbx
13711+ i = 0
13712+ .rept USER_PGD_PTRS
13713+ mov i*8(%rbx),%rsi
13714+ mov $0x67,%sil
13715+ lea i*8(%rbx),%rdi
13716+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13717+ i = i + 1
13718+ .endr
13719+ jmp 2f
13720+1:
13721+#endif
13722+
13723+ i = 0
13724+ .rept USER_PGD_PTRS
13725+ movb $0x67,i*8(%rdi)
13726+ i = i + 1
13727+ .endr
13728+
13729+#ifdef CONFIG_PARAVIRT
13730+2: PV_RESTORE_REGS(CLBR_RDI)
13731+ popq %rbx
13732+#endif
13733+
13734+ popq %rdi
13735+ pax_force_retaddr
13736+ retq
13737+ENDPROC(pax_exit_kernel_user)
13738+#endif
13739+
13740+.macro pax_erase_kstack
13741+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13742+ call pax_erase_kstack
13743+#endif
13744+.endm
13745+
13746+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13747+/*
13748+ * r11: thread_info
13749+ * rcx, rdx: can be clobbered
13750+ */
13751+ENTRY(pax_erase_kstack)
13752+ pushq %rdi
13753+ pushq %rax
13754+ pushq %r11
13755+
13756+ GET_THREAD_INFO(%r11)
13757+ mov TI_lowest_stack(%r11), %rdi
13758+ mov $-0xBEEF, %rax
13759+ std
13760+
13761+1: mov %edi, %ecx
13762+ and $THREAD_SIZE_asm - 1, %ecx
13763+ shr $3, %ecx
13764+ repne scasq
13765+ jecxz 2f
13766+
13767+ cmp $2*8, %ecx
13768+ jc 2f
13769+
13770+ mov $2*8, %ecx
13771+ repe scasq
13772+ jecxz 2f
13773+ jne 1b
13774+
13775+2: cld
13776+ mov %esp, %ecx
13777+ sub %edi, %ecx
13778+
13779+ cmp $THREAD_SIZE_asm, %rcx
13780+ jb 3f
13781+ ud2
13782+3:
13783+
13784+ shr $3, %ecx
13785+ rep stosq
13786+
13787+ mov TI_task_thread_sp0(%r11), %rdi
13788+ sub $256, %rdi
13789+ mov %rdi, TI_lowest_stack(%r11)
13790+
13791+ popq %r11
13792+ popq %rax
13793+ popq %rdi
13794+ pax_force_retaddr
13795+ ret
13796+ENDPROC(pax_erase_kstack)
13797+#endif
13798
13799 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
13800 #ifdef CONFIG_TRACE_IRQFLAGS
13801@@ -231,8 +515,8 @@ ENDPROC(native_usergs_sysret64)
13802 .endm
13803
13804 .macro UNFAKE_STACK_FRAME
13805- addq $8*6, %rsp
13806- CFI_ADJUST_CFA_OFFSET -(6*8)
13807+ addq $8*6 + ARG_SKIP, %rsp
13808+ CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
13809 .endm
13810
13811 /*
13812@@ -319,7 +603,7 @@ ENDPROC(native_usergs_sysret64)
13813 movq %rsp, %rsi
13814
13815 leaq -RBP(%rsp),%rdi /* arg1 for handler */
13816- testl $3, CS(%rdi)
13817+ testb $3, CS(%rdi)
13818 je 1f
13819 SWAPGS
13820 /*
13821@@ -350,9 +634,10 @@ ENTRY(save_rest)
13822 movq_cfi r15, R15+16
13823 movq %r11, 8(%rsp) /* return address */
13824 FIXUP_TOP_OF_STACK %r11, 16
13825+ pax_force_retaddr
13826 ret
13827 CFI_ENDPROC
13828-END(save_rest)
13829+ENDPROC(save_rest)
13830
13831 /* save complete stack frame */
13832 .pushsection .kprobes.text, "ax"
13833@@ -381,9 +666,10 @@ ENTRY(save_paranoid)
13834 js 1f /* negative -> in kernel */
13835 SWAPGS
13836 xorl %ebx,%ebx
13837-1: ret
13838+1: pax_force_retaddr_bts
13839+ ret
13840 CFI_ENDPROC
13841-END(save_paranoid)
13842+ENDPROC(save_paranoid)
13843 .popsection
13844
13845 /*
13846@@ -405,7 +691,7 @@ ENTRY(ret_from_fork)
13847
13848 RESTORE_REST
13849
13850- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13851+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13852 je int_ret_from_sys_call
13853
13854 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
13855@@ -415,7 +701,7 @@ ENTRY(ret_from_fork)
13856 jmp ret_from_sys_call # go to the SYSRET fastpath
13857
13858 CFI_ENDPROC
13859-END(ret_from_fork)
13860+ENDPROC(ret_from_fork)
13861
13862 /*
13863 * System call entry. Up to 6 arguments in registers are supported.
13864@@ -451,7 +737,7 @@ END(ret_from_fork)
13865 ENTRY(system_call)
13866 CFI_STARTPROC simple
13867 CFI_SIGNAL_FRAME
13868- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
13869+ CFI_DEF_CFA rsp,0
13870 CFI_REGISTER rip,rcx
13871 /*CFI_REGISTER rflags,r11*/
13872 SWAPGS_UNSAFE_STACK
13873@@ -464,12 +750,13 @@ ENTRY(system_call_after_swapgs)
13874
13875 movq %rsp,PER_CPU_VAR(old_rsp)
13876 movq PER_CPU_VAR(kernel_stack),%rsp
13877+ SAVE_ARGS 8*6,0
13878+ pax_enter_kernel_user
13879 /*
13880 * No need to follow this irqs off/on section - it's straight
13881 * and short:
13882 */
13883 ENABLE_INTERRUPTS(CLBR_NONE)
13884- SAVE_ARGS 8,0
13885 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
13886 movq %rcx,RIP-ARGOFFSET(%rsp)
13887 CFI_REL_OFFSET rip,RIP-ARGOFFSET
13888@@ -479,7 +766,7 @@ ENTRY(system_call_after_swapgs)
13889 system_call_fastpath:
13890 cmpq $__NR_syscall_max,%rax
13891 ja badsys
13892- movq %r10,%rcx
13893+ movq R10-ARGOFFSET(%rsp),%rcx
13894 call *sys_call_table(,%rax,8) # XXX: rip relative
13895 movq %rax,RAX-ARGOFFSET(%rsp)
13896 /*
13897@@ -498,6 +785,8 @@ sysret_check:
13898 andl %edi,%edx
13899 jnz sysret_careful
13900 CFI_REMEMBER_STATE
13901+ pax_exit_kernel_user
13902+ pax_erase_kstack
13903 /*
13904 * sysretq will re-enable interrupts:
13905 */
13906@@ -549,14 +838,18 @@ badsys:
13907 * jump back to the normal fast path.
13908 */
13909 auditsys:
13910- movq %r10,%r9 /* 6th arg: 4th syscall arg */
13911+ movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
13912 movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
13913 movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
13914 movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
13915 movq %rax,%rsi /* 2nd arg: syscall number */
13916 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
13917 call audit_syscall_entry
13918+
13919+ pax_erase_kstack
13920+
13921 LOAD_ARGS 0 /* reload call-clobbered registers */
13922+ pax_set_fptr_mask
13923 jmp system_call_fastpath
13924
13925 /*
13926@@ -586,16 +879,20 @@ tracesys:
13927 FIXUP_TOP_OF_STACK %rdi
13928 movq %rsp,%rdi
13929 call syscall_trace_enter
13930+
13931+ pax_erase_kstack
13932+
13933 /*
13934 * Reload arg registers from stack in case ptrace changed them.
13935 * We don't reload %rax because syscall_trace_enter() returned
13936 * the value it wants us to use in the table lookup.
13937 */
13938 LOAD_ARGS ARGOFFSET, 1
13939+ pax_set_fptr_mask
13940 RESTORE_REST
13941 cmpq $__NR_syscall_max,%rax
13942 ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
13943- movq %r10,%rcx /* fixup for C */
13944+ movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
13945 call *sys_call_table(,%rax,8)
13946 movq %rax,RAX-ARGOFFSET(%rsp)
13947 /* Use IRET because user could have changed frame */
13948@@ -607,7 +904,7 @@ tracesys:
13949 GLOBAL(int_ret_from_sys_call)
13950 DISABLE_INTERRUPTS(CLBR_NONE)
13951 TRACE_IRQS_OFF
13952- testl $3,CS-ARGOFFSET(%rsp)
13953+ testb $3,CS-ARGOFFSET(%rsp)
13954 je retint_restore_args
13955 movl $_TIF_ALLWORK_MASK,%edi
13956 /* edi: mask to check */
13957@@ -664,7 +961,7 @@ int_restore_rest:
13958 TRACE_IRQS_OFF
13959 jmp int_with_check
13960 CFI_ENDPROC
13961-END(system_call)
13962+ENDPROC(system_call)
13963
13964 /*
13965 * Certain special system calls that need to save a complete full stack frame.
13966@@ -680,7 +977,7 @@ ENTRY(\label)
13967 call \func
13968 jmp ptregscall_common
13969 CFI_ENDPROC
13970-END(\label)
13971+ENDPROC(\label)
13972 .endm
13973
13974 PTREGSCALL stub_clone, sys_clone, %r8
13975@@ -698,9 +995,10 @@ ENTRY(ptregscall_common)
13976 movq_cfi_restore R12+8, r12
13977 movq_cfi_restore RBP+8, rbp
13978 movq_cfi_restore RBX+8, rbx
13979+ pax_force_retaddr
13980 ret $REST_SKIP /* pop extended registers */
13981 CFI_ENDPROC
13982-END(ptregscall_common)
13983+ENDPROC(ptregscall_common)
13984
13985 ENTRY(stub_execve)
13986 CFI_STARTPROC
13987@@ -715,7 +1013,7 @@ ENTRY(stub_execve)
13988 RESTORE_REST
13989 jmp int_ret_from_sys_call
13990 CFI_ENDPROC
13991-END(stub_execve)
13992+ENDPROC(stub_execve)
13993
13994 /*
13995 * sigreturn is special because it needs to restore all registers on return.
13996@@ -733,7 +1031,7 @@ ENTRY(stub_rt_sigreturn)
13997 RESTORE_REST
13998 jmp int_ret_from_sys_call
13999 CFI_ENDPROC
14000-END(stub_rt_sigreturn)
14001+ENDPROC(stub_rt_sigreturn)
14002
14003 /*
14004 * Build the entry stubs and pointer table with some assembler magic.
14005@@ -768,7 +1066,7 @@ vector=vector+1
14006 2: jmp common_interrupt
14007 .endr
14008 CFI_ENDPROC
14009-END(irq_entries_start)
14010+ENDPROC(irq_entries_start)
14011
14012 .previous
14013 END(interrupt)
14014@@ -789,6 +1087,16 @@ END(interrupt)
14015 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14016 SAVE_ARGS_IRQ
14017 PARTIAL_FRAME 0
14018+#ifdef CONFIG_PAX_MEMORY_UDEREF
14019+ testb $3, CS(%rdi)
14020+ jnz 1f
14021+ pax_enter_kernel
14022+ jmp 2f
14023+1: pax_enter_kernel_user
14024+2:
14025+#else
14026+ pax_enter_kernel
14027+#endif
14028 call \func
14029 .endm
14030
14031@@ -820,7 +1128,7 @@ ret_from_intr:
14032
14033 exit_intr:
14034 GET_THREAD_INFO(%rcx)
14035- testl $3,CS-ARGOFFSET(%rsp)
14036+ testb $3,CS-ARGOFFSET(%rsp)
14037 je retint_kernel
14038
14039 /* Interrupt came from user space */
14040@@ -842,12 +1150,16 @@ retint_swapgs: /* return to user-space */
14041 * The iretq could re-enable interrupts:
14042 */
14043 DISABLE_INTERRUPTS(CLBR_ANY)
14044+ pax_exit_kernel_user
14045+ pax_erase_kstack
14046 TRACE_IRQS_IRETQ
14047 SWAPGS
14048 jmp restore_args
14049
14050 retint_restore_args: /* return to kernel space */
14051 DISABLE_INTERRUPTS(CLBR_ANY)
14052+ pax_exit_kernel
14053+ pax_force_retaddr RIP-ARGOFFSET
14054 /*
14055 * The iretq could re-enable interrupts:
14056 */
14057@@ -936,7 +1248,7 @@ ENTRY(retint_kernel)
14058 #endif
14059
14060 CFI_ENDPROC
14061-END(common_interrupt)
14062+ENDPROC(common_interrupt)
14063 /*
14064 * End of kprobes section
14065 */
14066@@ -952,7 +1264,7 @@ ENTRY(\sym)
14067 interrupt \do_sym
14068 jmp ret_from_intr
14069 CFI_ENDPROC
14070-END(\sym)
14071+ENDPROC(\sym)
14072 .endm
14073
14074 #ifdef CONFIG_SMP
14075@@ -1017,12 +1329,22 @@ ENTRY(\sym)
14076 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14077 call error_entry
14078 DEFAULT_FRAME 0
14079+#ifdef CONFIG_PAX_MEMORY_UDEREF
14080+ testb $3, CS(%rsp)
14081+ jnz 1f
14082+ pax_enter_kernel
14083+ jmp 2f
14084+1: pax_enter_kernel_user
14085+2:
14086+#else
14087+ pax_enter_kernel
14088+#endif
14089 movq %rsp,%rdi /* pt_regs pointer */
14090 xorl %esi,%esi /* no error code */
14091 call \do_sym
14092 jmp error_exit /* %ebx: no swapgs flag */
14093 CFI_ENDPROC
14094-END(\sym)
14095+ENDPROC(\sym)
14096 .endm
14097
14098 .macro paranoidzeroentry sym do_sym
14099@@ -1034,15 +1356,25 @@ ENTRY(\sym)
14100 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14101 call save_paranoid
14102 TRACE_IRQS_OFF
14103+#ifdef CONFIG_PAX_MEMORY_UDEREF
14104+ testb $3, CS(%rsp)
14105+ jnz 1f
14106+ pax_enter_kernel
14107+ jmp 2f
14108+1: pax_enter_kernel_user
14109+2:
14110+#else
14111+ pax_enter_kernel
14112+#endif
14113 movq %rsp,%rdi /* pt_regs pointer */
14114 xorl %esi,%esi /* no error code */
14115 call \do_sym
14116 jmp paranoid_exit /* %ebx: no swapgs flag */
14117 CFI_ENDPROC
14118-END(\sym)
14119+ENDPROC(\sym)
14120 .endm
14121
14122-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14123+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14124 .macro paranoidzeroentry_ist sym do_sym ist
14125 ENTRY(\sym)
14126 INTR_FRAME
14127@@ -1052,14 +1384,30 @@ ENTRY(\sym)
14128 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14129 call save_paranoid
14130 TRACE_IRQS_OFF
14131+#ifdef CONFIG_PAX_MEMORY_UDEREF
14132+ testb $3, CS(%rsp)
14133+ jnz 1f
14134+ pax_enter_kernel
14135+ jmp 2f
14136+1: pax_enter_kernel_user
14137+2:
14138+#else
14139+ pax_enter_kernel
14140+#endif
14141 movq %rsp,%rdi /* pt_regs pointer */
14142 xorl %esi,%esi /* no error code */
14143+#ifdef CONFIG_SMP
14144+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14145+ lea init_tss(%r12), %r12
14146+#else
14147+ lea init_tss(%rip), %r12
14148+#endif
14149 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14150 call \do_sym
14151 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14152 jmp paranoid_exit /* %ebx: no swapgs flag */
14153 CFI_ENDPROC
14154-END(\sym)
14155+ENDPROC(\sym)
14156 .endm
14157
14158 .macro errorentry sym do_sym
14159@@ -1070,13 +1418,23 @@ ENTRY(\sym)
14160 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14161 call error_entry
14162 DEFAULT_FRAME 0
14163+#ifdef CONFIG_PAX_MEMORY_UDEREF
14164+ testb $3, CS(%rsp)
14165+ jnz 1f
14166+ pax_enter_kernel
14167+ jmp 2f
14168+1: pax_enter_kernel_user
14169+2:
14170+#else
14171+ pax_enter_kernel
14172+#endif
14173 movq %rsp,%rdi /* pt_regs pointer */
14174 movq ORIG_RAX(%rsp),%rsi /* get error code */
14175 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14176 call \do_sym
14177 jmp error_exit /* %ebx: no swapgs flag */
14178 CFI_ENDPROC
14179-END(\sym)
14180+ENDPROC(\sym)
14181 .endm
14182
14183 /* error code is on the stack already */
14184@@ -1089,13 +1447,23 @@ ENTRY(\sym)
14185 call save_paranoid
14186 DEFAULT_FRAME 0
14187 TRACE_IRQS_OFF
14188+#ifdef CONFIG_PAX_MEMORY_UDEREF
14189+ testb $3, CS(%rsp)
14190+ jnz 1f
14191+ pax_enter_kernel
14192+ jmp 2f
14193+1: pax_enter_kernel_user
14194+2:
14195+#else
14196+ pax_enter_kernel
14197+#endif
14198 movq %rsp,%rdi /* pt_regs pointer */
14199 movq ORIG_RAX(%rsp),%rsi /* get error code */
14200 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14201 call \do_sym
14202 jmp paranoid_exit /* %ebx: no swapgs flag */
14203 CFI_ENDPROC
14204-END(\sym)
14205+ENDPROC(\sym)
14206 .endm
14207
14208 zeroentry divide_error do_divide_error
14209@@ -1125,9 +1493,10 @@ gs_change:
14210 2: mfence /* workaround */
14211 SWAPGS
14212 popfq_cfi
14213+ pax_force_retaddr
14214 ret
14215 CFI_ENDPROC
14216-END(native_load_gs_index)
14217+ENDPROC(native_load_gs_index)
14218
14219 .section __ex_table,"a"
14220 .align 8
14221@@ -1149,13 +1518,14 @@ ENTRY(kernel_thread_helper)
14222 * Here we are in the child and the registers are set as they were
14223 * at kernel_thread() invocation in the parent.
14224 */
14225+ pax_force_fptr %rsi
14226 call *%rsi
14227 # exit
14228 mov %eax, %edi
14229 call do_exit
14230 ud2 # padding for call trace
14231 CFI_ENDPROC
14232-END(kernel_thread_helper)
14233+ENDPROC(kernel_thread_helper)
14234
14235 /*
14236 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
14237@@ -1182,11 +1552,11 @@ ENTRY(kernel_execve)
14238 RESTORE_REST
14239 testq %rax,%rax
14240 je int_ret_from_sys_call
14241- RESTORE_ARGS
14242 UNFAKE_STACK_FRAME
14243+ pax_force_retaddr
14244 ret
14245 CFI_ENDPROC
14246-END(kernel_execve)
14247+ENDPROC(kernel_execve)
14248
14249 /* Call softirq on interrupt stack. Interrupts are off. */
14250 ENTRY(call_softirq)
14251@@ -1204,9 +1574,10 @@ ENTRY(call_softirq)
14252 CFI_DEF_CFA_REGISTER rsp
14253 CFI_ADJUST_CFA_OFFSET -8
14254 decl PER_CPU_VAR(irq_count)
14255+ pax_force_retaddr
14256 ret
14257 CFI_ENDPROC
14258-END(call_softirq)
14259+ENDPROC(call_softirq)
14260
14261 #ifdef CONFIG_XEN
14262 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
14263@@ -1244,7 +1615,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
14264 decl PER_CPU_VAR(irq_count)
14265 jmp error_exit
14266 CFI_ENDPROC
14267-END(xen_do_hypervisor_callback)
14268+ENDPROC(xen_do_hypervisor_callback)
14269
14270 /*
14271 * Hypervisor uses this for application faults while it executes.
14272@@ -1303,7 +1674,7 @@ ENTRY(xen_failsafe_callback)
14273 SAVE_ALL
14274 jmp error_exit
14275 CFI_ENDPROC
14276-END(xen_failsafe_callback)
14277+ENDPROC(xen_failsafe_callback)
14278
14279 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
14280 xen_hvm_callback_vector xen_evtchn_do_upcall
14281@@ -1352,16 +1723,31 @@ ENTRY(paranoid_exit)
14282 TRACE_IRQS_OFF
14283 testl %ebx,%ebx /* swapgs needed? */
14284 jnz paranoid_restore
14285- testl $3,CS(%rsp)
14286+ testb $3,CS(%rsp)
14287 jnz paranoid_userspace
14288+#ifdef CONFIG_PAX_MEMORY_UDEREF
14289+ pax_exit_kernel
14290+ TRACE_IRQS_IRETQ 0
14291+ SWAPGS_UNSAFE_STACK
14292+ RESTORE_ALL 8
14293+ pax_force_retaddr_bts
14294+ jmp irq_return
14295+#endif
14296 paranoid_swapgs:
14297+#ifdef CONFIG_PAX_MEMORY_UDEREF
14298+ pax_exit_kernel_user
14299+#else
14300+ pax_exit_kernel
14301+#endif
14302 TRACE_IRQS_IRETQ 0
14303 SWAPGS_UNSAFE_STACK
14304 RESTORE_ALL 8
14305 jmp irq_return
14306 paranoid_restore:
14307+ pax_exit_kernel
14308 TRACE_IRQS_IRETQ 0
14309 RESTORE_ALL 8
14310+ pax_force_retaddr_bts
14311 jmp irq_return
14312 paranoid_userspace:
14313 GET_THREAD_INFO(%rcx)
14314@@ -1390,7 +1776,7 @@ paranoid_schedule:
14315 TRACE_IRQS_OFF
14316 jmp paranoid_userspace
14317 CFI_ENDPROC
14318-END(paranoid_exit)
14319+ENDPROC(paranoid_exit)
14320
14321 /*
14322 * Exception entry point. This expects an error code/orig_rax on the stack.
14323@@ -1417,12 +1803,13 @@ ENTRY(error_entry)
14324 movq_cfi r14, R14+8
14325 movq_cfi r15, R15+8
14326 xorl %ebx,%ebx
14327- testl $3,CS+8(%rsp)
14328+ testb $3,CS+8(%rsp)
14329 je error_kernelspace
14330 error_swapgs:
14331 SWAPGS
14332 error_sti:
14333 TRACE_IRQS_OFF
14334+ pax_force_retaddr_bts
14335 ret
14336
14337 /*
14338@@ -1449,7 +1836,7 @@ bstep_iret:
14339 movq %rcx,RIP+8(%rsp)
14340 jmp error_swapgs
14341 CFI_ENDPROC
14342-END(error_entry)
14343+ENDPROC(error_entry)
14344
14345
14346 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
14347@@ -1469,7 +1856,7 @@ ENTRY(error_exit)
14348 jnz retint_careful
14349 jmp retint_swapgs
14350 CFI_ENDPROC
14351-END(error_exit)
14352+ENDPROC(error_exit)
14353
14354
14355 /* runs on exception stack */
14356@@ -1481,6 +1868,16 @@ ENTRY(nmi)
14357 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14358 call save_paranoid
14359 DEFAULT_FRAME 0
14360+#ifdef CONFIG_PAX_MEMORY_UDEREF
14361+ testb $3, CS(%rsp)
14362+ jnz 1f
14363+ pax_enter_kernel
14364+ jmp 2f
14365+1: pax_enter_kernel_user
14366+2:
14367+#else
14368+ pax_enter_kernel
14369+#endif
14370 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14371 movq %rsp,%rdi
14372 movq $-1,%rsi
14373@@ -1491,12 +1888,28 @@ ENTRY(nmi)
14374 DISABLE_INTERRUPTS(CLBR_NONE)
14375 testl %ebx,%ebx /* swapgs needed? */
14376 jnz nmi_restore
14377- testl $3,CS(%rsp)
14378+ testb $3,CS(%rsp)
14379 jnz nmi_userspace
14380+#ifdef CONFIG_PAX_MEMORY_UDEREF
14381+ pax_exit_kernel
14382+ SWAPGS_UNSAFE_STACK
14383+ RESTORE_ALL 8
14384+ pax_force_retaddr_bts
14385+ jmp irq_return
14386+#endif
14387 nmi_swapgs:
14388+#ifdef CONFIG_PAX_MEMORY_UDEREF
14389+ pax_exit_kernel_user
14390+#else
14391+ pax_exit_kernel
14392+#endif
14393 SWAPGS_UNSAFE_STACK
14394+ RESTORE_ALL 8
14395+ jmp irq_return
14396 nmi_restore:
14397+ pax_exit_kernel
14398 RESTORE_ALL 8
14399+ pax_force_retaddr_bts
14400 jmp irq_return
14401 nmi_userspace:
14402 GET_THREAD_INFO(%rcx)
14403@@ -1525,14 +1938,14 @@ nmi_schedule:
14404 jmp paranoid_exit
14405 CFI_ENDPROC
14406 #endif
14407-END(nmi)
14408+ENDPROC(nmi)
14409
14410 ENTRY(ignore_sysret)
14411 CFI_STARTPROC
14412 mov $-ENOSYS,%eax
14413 sysret
14414 CFI_ENDPROC
14415-END(ignore_sysret)
14416+ENDPROC(ignore_sysret)
14417
14418 /*
14419 * End of kprobes section
14420diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
14421index c9a281f..ce2f317 100644
14422--- a/arch/x86/kernel/ftrace.c
14423+++ b/arch/x86/kernel/ftrace.c
14424@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the IP to write to */
14425 static const void *mod_code_newcode; /* holds the text to write to the IP */
14426
14427 static unsigned nmi_wait_count;
14428-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14429+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14430
14431 int ftrace_arch_read_dyn_info(char *buf, int size)
14432 {
14433@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
14434
14435 r = snprintf(buf, size, "%u %u",
14436 nmi_wait_count,
14437- atomic_read(&nmi_update_count));
14438+ atomic_read_unchecked(&nmi_update_count));
14439 return r;
14440 }
14441
14442@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14443
14444 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14445 smp_rmb();
14446+ pax_open_kernel();
14447 ftrace_mod_code();
14448- atomic_inc(&nmi_update_count);
14449+ pax_close_kernel();
14450+ atomic_inc_unchecked(&nmi_update_count);
14451 }
14452 /* Must have previous changes seen before executions */
14453 smp_mb();
14454@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
14455 {
14456 unsigned char replaced[MCOUNT_INSN_SIZE];
14457
14458+ ip = ktla_ktva(ip);
14459+
14460 /*
14461 * Note: Due to modules and __init, code can
14462 * disappear and change, we need to protect against faulting
14463@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
14464 unsigned char old[MCOUNT_INSN_SIZE], *new;
14465 int ret;
14466
14467- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14468+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14469 new = ftrace_call_replace(ip, (unsigned long)func);
14470 ret = ftrace_modify_code(ip, old, new);
14471
14472@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long ip,
14473 {
14474 unsigned char code[MCOUNT_INSN_SIZE];
14475
14476+ ip = ktla_ktva(ip);
14477+
14478 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14479 return -EFAULT;
14480
14481diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
14482index 3bb0850..55a56f4 100644
14483--- a/arch/x86/kernel/head32.c
14484+++ b/arch/x86/kernel/head32.c
14485@@ -19,6 +19,7 @@
14486 #include <asm/io_apic.h>
14487 #include <asm/bios_ebda.h>
14488 #include <asm/tlbflush.h>
14489+#include <asm/boot.h>
14490
14491 static void __init i386_default_early_setup(void)
14492 {
14493@@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
14494 {
14495 memblock_init();
14496
14497- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14498+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14499
14500 #ifdef CONFIG_BLK_DEV_INITRD
14501 /* Reserve INITRD */
14502diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
14503index ce0be7c..c41476e 100644
14504--- a/arch/x86/kernel/head_32.S
14505+++ b/arch/x86/kernel/head_32.S
14506@@ -25,6 +25,12 @@
14507 /* Physical address */
14508 #define pa(X) ((X) - __PAGE_OFFSET)
14509
14510+#ifdef CONFIG_PAX_KERNEXEC
14511+#define ta(X) (X)
14512+#else
14513+#define ta(X) ((X) - __PAGE_OFFSET)
14514+#endif
14515+
14516 /*
14517 * References to members of the new_cpu_data structure.
14518 */
14519@@ -54,11 +60,7 @@
14520 * and small than max_low_pfn, otherwise will waste some page table entries
14521 */
14522
14523-#if PTRS_PER_PMD > 1
14524-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14525-#else
14526-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14527-#endif
14528+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14529
14530 /* Number of possible pages in the lowmem region */
14531 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14532@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
14533 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14534
14535 /*
14536+ * Real beginning of normal "text" segment
14537+ */
14538+ENTRY(stext)
14539+ENTRY(_stext)
14540+
14541+/*
14542 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14543 * %esi points to the real-mode code as a 32-bit pointer.
14544 * CS and DS must be 4 GB flat segments, but we don't depend on
14545@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14546 * can.
14547 */
14548 __HEAD
14549+
14550+#ifdef CONFIG_PAX_KERNEXEC
14551+ jmp startup_32
14552+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14553+.fill PAGE_SIZE-5,1,0xcc
14554+#endif
14555+
14556 ENTRY(startup_32)
14557 movl pa(stack_start),%ecx
14558
14559@@ -105,6 +120,57 @@ ENTRY(startup_32)
14560 2:
14561 leal -__PAGE_OFFSET(%ecx),%esp
14562
14563+#ifdef CONFIG_SMP
14564+ movl $pa(cpu_gdt_table),%edi
14565+ movl $__per_cpu_load,%eax
14566+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14567+ rorl $16,%eax
14568+ movb %al,__KERNEL_PERCPU + 4(%edi)
14569+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14570+ movl $__per_cpu_end - 1,%eax
14571+ subl $__per_cpu_start,%eax
14572+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14573+#endif
14574+
14575+#ifdef CONFIG_PAX_MEMORY_UDEREF
14576+ movl $NR_CPUS,%ecx
14577+ movl $pa(cpu_gdt_table),%edi
14578+1:
14579+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14580+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14581+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14582+ addl $PAGE_SIZE_asm,%edi
14583+ loop 1b
14584+#endif
14585+
14586+#ifdef CONFIG_PAX_KERNEXEC
14587+ movl $pa(boot_gdt),%edi
14588+ movl $__LOAD_PHYSICAL_ADDR,%eax
14589+ movw %ax,__BOOT_CS + 2(%edi)
14590+ rorl $16,%eax
14591+ movb %al,__BOOT_CS + 4(%edi)
14592+ movb %ah,__BOOT_CS + 7(%edi)
14593+ rorl $16,%eax
14594+
14595+ ljmp $(__BOOT_CS),$1f
14596+1:
14597+
14598+ movl $NR_CPUS,%ecx
14599+ movl $pa(cpu_gdt_table),%edi
14600+ addl $__PAGE_OFFSET,%eax
14601+1:
14602+ movw %ax,__KERNEL_CS + 2(%edi)
14603+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14604+ rorl $16,%eax
14605+ movb %al,__KERNEL_CS + 4(%edi)
14606+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14607+ movb %ah,__KERNEL_CS + 7(%edi)
14608+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14609+ rorl $16,%eax
14610+ addl $PAGE_SIZE_asm,%edi
14611+ loop 1b
14612+#endif
14613+
14614 /*
14615 * Clear BSS first so that there are no surprises...
14616 */
14617@@ -195,8 +261,11 @@ ENTRY(startup_32)
14618 movl %eax, pa(max_pfn_mapped)
14619
14620 /* Do early initialization of the fixmap area */
14621- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14622- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14623+#ifdef CONFIG_COMPAT_VDSO
14624+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14625+#else
14626+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14627+#endif
14628 #else /* Not PAE */
14629
14630 page_pde_offset = (__PAGE_OFFSET >> 20);
14631@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14632 movl %eax, pa(max_pfn_mapped)
14633
14634 /* Do early initialization of the fixmap area */
14635- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14636- movl %eax,pa(initial_page_table+0xffc)
14637+#ifdef CONFIG_COMPAT_VDSO
14638+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14639+#else
14640+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14641+#endif
14642 #endif
14643
14644 #ifdef CONFIG_PARAVIRT
14645@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14646 cmpl $num_subarch_entries, %eax
14647 jae bad_subarch
14648
14649- movl pa(subarch_entries)(,%eax,4), %eax
14650- subl $__PAGE_OFFSET, %eax
14651- jmp *%eax
14652+ jmp *pa(subarch_entries)(,%eax,4)
14653
14654 bad_subarch:
14655 WEAK(lguest_entry)
14656@@ -255,10 +325,10 @@ WEAK(xen_entry)
14657 __INITDATA
14658
14659 subarch_entries:
14660- .long default_entry /* normal x86/PC */
14661- .long lguest_entry /* lguest hypervisor */
14662- .long xen_entry /* Xen hypervisor */
14663- .long default_entry /* Moorestown MID */
14664+ .long ta(default_entry) /* normal x86/PC */
14665+ .long ta(lguest_entry) /* lguest hypervisor */
14666+ .long ta(xen_entry) /* Xen hypervisor */
14667+ .long ta(default_entry) /* Moorestown MID */
14668 num_subarch_entries = (. - subarch_entries) / 4
14669 .previous
14670 #else
14671@@ -312,6 +382,7 @@ default_entry:
14672 orl %edx,%eax
14673 movl %eax,%cr4
14674
14675+#ifdef CONFIG_X86_PAE
14676 testb $X86_CR4_PAE, %al # check if PAE is enabled
14677 jz 6f
14678
14679@@ -340,6 +411,9 @@ default_entry:
14680 /* Make changes effective */
14681 wrmsr
14682
14683+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14684+#endif
14685+
14686 6:
14687
14688 /*
14689@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14690 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14691 movl %eax,%ss # after changing gdt.
14692
14693- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14694+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14695 movl %eax,%ds
14696 movl %eax,%es
14697
14698@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14699 */
14700 cmpb $0,ready
14701 jne 1f
14702- movl $gdt_page,%eax
14703+ movl $cpu_gdt_table,%eax
14704 movl $stack_canary,%ecx
14705+#ifdef CONFIG_SMP
14706+ addl $__per_cpu_load,%ecx
14707+#endif
14708 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14709 shrl $16, %ecx
14710 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14711 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14712 1:
14713-#endif
14714 movl $(__KERNEL_STACK_CANARY),%eax
14715+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14716+ movl $(__USER_DS),%eax
14717+#else
14718+ xorl %eax,%eax
14719+#endif
14720 movl %eax,%gs
14721
14722 xorl %eax,%eax # Clear LDT
14723@@ -558,22 +639,22 @@ early_page_fault:
14724 jmp early_fault
14725
14726 early_fault:
14727- cld
14728 #ifdef CONFIG_PRINTK
14729+ cmpl $1,%ss:early_recursion_flag
14730+ je hlt_loop
14731+ incl %ss:early_recursion_flag
14732+ cld
14733 pusha
14734 movl $(__KERNEL_DS),%eax
14735 movl %eax,%ds
14736 movl %eax,%es
14737- cmpl $2,early_recursion_flag
14738- je hlt_loop
14739- incl early_recursion_flag
14740 movl %cr2,%eax
14741 pushl %eax
14742 pushl %edx /* trapno */
14743 pushl $fault_msg
14744 call printk
14745+; call dump_stack
14746 #endif
14747- call dump_stack
14748 hlt_loop:
14749 hlt
14750 jmp hlt_loop
14751@@ -581,8 +662,11 @@ hlt_loop:
14752 /* This is the default interrupt "handler" :-) */
14753 ALIGN
14754 ignore_int:
14755- cld
14756 #ifdef CONFIG_PRINTK
14757+ cmpl $2,%ss:early_recursion_flag
14758+ je hlt_loop
14759+ incl %ss:early_recursion_flag
14760+ cld
14761 pushl %eax
14762 pushl %ecx
14763 pushl %edx
14764@@ -591,9 +675,6 @@ ignore_int:
14765 movl $(__KERNEL_DS),%eax
14766 movl %eax,%ds
14767 movl %eax,%es
14768- cmpl $2,early_recursion_flag
14769- je hlt_loop
14770- incl early_recursion_flag
14771 pushl 16(%esp)
14772 pushl 24(%esp)
14773 pushl 32(%esp)
14774@@ -622,29 +703,43 @@ ENTRY(initial_code)
14775 /*
14776 * BSS section
14777 */
14778-__PAGE_ALIGNED_BSS
14779- .align PAGE_SIZE
14780 #ifdef CONFIG_X86_PAE
14781+.section .initial_pg_pmd,"a",@progbits
14782 initial_pg_pmd:
14783 .fill 1024*KPMDS,4,0
14784 #else
14785+.section .initial_page_table,"a",@progbits
14786 ENTRY(initial_page_table)
14787 .fill 1024,4,0
14788 #endif
14789+.section .initial_pg_fixmap,"a",@progbits
14790 initial_pg_fixmap:
14791 .fill 1024,4,0
14792+.section .empty_zero_page,"a",@progbits
14793 ENTRY(empty_zero_page)
14794 .fill 4096,1,0
14795+.section .swapper_pg_dir,"a",@progbits
14796 ENTRY(swapper_pg_dir)
14797+#ifdef CONFIG_X86_PAE
14798+ .fill 4,8,0
14799+#else
14800 .fill 1024,4,0
14801+#endif
14802+
14803+/*
14804+ * The IDT has to be page-aligned to simplify the Pentium
14805+ * F0 0F bug workaround.. We have a special link segment
14806+ * for this.
14807+ */
14808+.section .idt,"a",@progbits
14809+ENTRY(idt_table)
14810+ .fill 256,8,0
14811
14812 /*
14813 * This starts the data section.
14814 */
14815 #ifdef CONFIG_X86_PAE
14816-__PAGE_ALIGNED_DATA
14817- /* Page-aligned for the benefit of paravirt? */
14818- .align PAGE_SIZE
14819+.section .initial_page_table,"a",@progbits
14820 ENTRY(initial_page_table)
14821 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
14822 # if KPMDS == 3
14823@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
14824 # error "Kernel PMDs should be 1, 2 or 3"
14825 # endif
14826 .align PAGE_SIZE /* needs to be page-sized too */
14827+
14828+#ifdef CONFIG_PAX_PER_CPU_PGD
14829+ENTRY(cpu_pgd)
14830+ .rept NR_CPUS
14831+ .fill 4,8,0
14832+ .endr
14833+#endif
14834+
14835 #endif
14836
14837 .data
14838 .balign 4
14839 ENTRY(stack_start)
14840- .long init_thread_union+THREAD_SIZE
14841+ .long init_thread_union+THREAD_SIZE-8
14842
14843+ready: .byte 0
14844+
14845+.section .rodata,"a",@progbits
14846 early_recursion_flag:
14847 .long 0
14848
14849-ready: .byte 0
14850-
14851 int_msg:
14852 .asciz "Unknown interrupt or fault at: %p %p %p\n"
14853
14854@@ -707,7 +811,7 @@ fault_msg:
14855 .word 0 # 32 bit align gdt_desc.address
14856 boot_gdt_descr:
14857 .word __BOOT_DS+7
14858- .long boot_gdt - __PAGE_OFFSET
14859+ .long pa(boot_gdt)
14860
14861 .word 0 # 32-bit align idt_desc.address
14862 idt_descr:
14863@@ -718,7 +822,7 @@ idt_descr:
14864 .word 0 # 32 bit align gdt_desc.address
14865 ENTRY(early_gdt_descr)
14866 .word GDT_ENTRIES*8-1
14867- .long gdt_page /* Overwritten for secondary CPUs */
14868+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
14869
14870 /*
14871 * The boot_gdt must mirror the equivalent in setup.S and is
14872@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
14873 .align L1_CACHE_BYTES
14874 ENTRY(boot_gdt)
14875 .fill GDT_ENTRY_BOOT_CS,8,0
14876- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
14877- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
14878+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
14879+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
14880+
14881+ .align PAGE_SIZE_asm
14882+ENTRY(cpu_gdt_table)
14883+ .rept NR_CPUS
14884+ .quad 0x0000000000000000 /* NULL descriptor */
14885+ .quad 0x0000000000000000 /* 0x0b reserved */
14886+ .quad 0x0000000000000000 /* 0x13 reserved */
14887+ .quad 0x0000000000000000 /* 0x1b reserved */
14888+
14889+#ifdef CONFIG_PAX_KERNEXEC
14890+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
14891+#else
14892+ .quad 0x0000000000000000 /* 0x20 unused */
14893+#endif
14894+
14895+ .quad 0x0000000000000000 /* 0x28 unused */
14896+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
14897+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
14898+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
14899+ .quad 0x0000000000000000 /* 0x4b reserved */
14900+ .quad 0x0000000000000000 /* 0x53 reserved */
14901+ .quad 0x0000000000000000 /* 0x5b reserved */
14902+
14903+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
14904+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
14905+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
14906+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
14907+
14908+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
14909+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
14910+
14911+ /*
14912+ * Segments used for calling PnP BIOS have byte granularity.
14913+ * The code segments and data segments have fixed 64k limits,
14914+ * the transfer segment sizes are set at run time.
14915+ */
14916+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
14917+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
14918+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
14919+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
14920+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
14921+
14922+ /*
14923+ * The APM segments have byte granularity and their bases
14924+ * are set at run time. All have 64k limits.
14925+ */
14926+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
14927+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
14928+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
14929+
14930+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
14931+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
14932+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
14933+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
14934+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
14935+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
14936+
14937+ /* Be sure this is zeroed to avoid false validations in Xen */
14938+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
14939+ .endr
14940diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
14941index e11e394..9aebc5d 100644
14942--- a/arch/x86/kernel/head_64.S
14943+++ b/arch/x86/kernel/head_64.S
14944@@ -19,6 +19,8 @@
14945 #include <asm/cache.h>
14946 #include <asm/processor-flags.h>
14947 #include <asm/percpu.h>
14948+#include <asm/cpufeature.h>
14949+#include <asm/alternative-asm.h>
14950
14951 #ifdef CONFIG_PARAVIRT
14952 #include <asm/asm-offsets.h>
14953@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
14954 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
14955 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
14956 L3_START_KERNEL = pud_index(__START_KERNEL_map)
14957+L4_VMALLOC_START = pgd_index(VMALLOC_START)
14958+L3_VMALLOC_START = pud_index(VMALLOC_START)
14959+L4_VMALLOC_END = pgd_index(VMALLOC_END)
14960+L3_VMALLOC_END = pud_index(VMALLOC_END)
14961+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
14962+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
14963
14964 .text
14965 __HEAD
14966@@ -85,35 +93,23 @@ startup_64:
14967 */
14968 addq %rbp, init_level4_pgt + 0(%rip)
14969 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
14970+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
14971+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
14972+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
14973 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
14974
14975 addq %rbp, level3_ident_pgt + 0(%rip)
14976+#ifndef CONFIG_XEN
14977+ addq %rbp, level3_ident_pgt + 8(%rip)
14978+#endif
14979
14980- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
14981- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
14982+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
14983+
14984+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
14985+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
14986
14987 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
14988-
14989- /* Add an Identity mapping if I am above 1G */
14990- leaq _text(%rip), %rdi
14991- andq $PMD_PAGE_MASK, %rdi
14992-
14993- movq %rdi, %rax
14994- shrq $PUD_SHIFT, %rax
14995- andq $(PTRS_PER_PUD - 1), %rax
14996- jz ident_complete
14997-
14998- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
14999- leaq level3_ident_pgt(%rip), %rbx
15000- movq %rdx, 0(%rbx, %rax, 8)
15001-
15002- movq %rdi, %rax
15003- shrq $PMD_SHIFT, %rax
15004- andq $(PTRS_PER_PMD - 1), %rax
15005- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15006- leaq level2_spare_pgt(%rip), %rbx
15007- movq %rdx, 0(%rbx, %rax, 8)
15008-ident_complete:
15009+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15010
15011 /*
15012 * Fixup the kernel text+data virtual addresses. Note that
15013@@ -160,8 +156,8 @@ ENTRY(secondary_startup_64)
15014 * after the boot processor executes this code.
15015 */
15016
15017- /* Enable PAE mode and PGE */
15018- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15019+ /* Enable PAE mode and PSE/PGE */
15020+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15021 movq %rax, %cr4
15022
15023 /* Setup early boot stage 4 level pagetables. */
15024@@ -183,9 +179,17 @@ ENTRY(secondary_startup_64)
15025 movl $MSR_EFER, %ecx
15026 rdmsr
15027 btsl $_EFER_SCE, %eax /* Enable System Call */
15028- btl $20,%edi /* No Execute supported? */
15029+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15030 jnc 1f
15031 btsl $_EFER_NX, %eax
15032+ leaq init_level4_pgt(%rip), %rdi
15033+#ifndef CONFIG_EFI
15034+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15035+#endif
15036+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15037+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
15038+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15039+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15040 1: wrmsr /* Make changes effective */
15041
15042 /* Setup cr0 */
15043@@ -247,6 +251,7 @@ ENTRY(secondary_startup_64)
15044 * jump. In addition we need to ensure %cs is set so we make this
15045 * a far return.
15046 */
15047+ pax_set_fptr_mask
15048 movq initial_code(%rip),%rax
15049 pushq $0 # fake return address to stop unwinder
15050 pushq $__KERNEL_CS # set correct cs
15051@@ -269,7 +274,7 @@ ENTRY(secondary_startup_64)
15052 bad_address:
15053 jmp bad_address
15054
15055- .section ".init.text","ax"
15056+ __INIT
15057 #ifdef CONFIG_EARLY_PRINTK
15058 .globl early_idt_handlers
15059 early_idt_handlers:
15060@@ -314,18 +319,23 @@ ENTRY(early_idt_handler)
15061 #endif /* EARLY_PRINTK */
15062 1: hlt
15063 jmp 1b
15064+ .previous
15065
15066 #ifdef CONFIG_EARLY_PRINTK
15067+ __INITDATA
15068 early_recursion_flag:
15069 .long 0
15070+ .previous
15071
15072+ .section .rodata,"a",@progbits
15073 early_idt_msg:
15074 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15075 early_idt_ripmsg:
15076 .asciz "RIP %s\n"
15077+ .previous
15078 #endif /* CONFIG_EARLY_PRINTK */
15079- .previous
15080
15081+ .section .rodata,"a",@progbits
15082 #define NEXT_PAGE(name) \
15083 .balign PAGE_SIZE; \
15084 ENTRY(name)
15085@@ -338,7 +348,6 @@ ENTRY(name)
15086 i = i + 1 ; \
15087 .endr
15088
15089- .data
15090 /*
15091 * This default setting generates an ident mapping at address 0x100000
15092 * and a mapping for the kernel that precisely maps virtual address
15093@@ -349,13 +358,41 @@ NEXT_PAGE(init_level4_pgt)
15094 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15095 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15096 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15097+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15098+ .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
15099+ .org init_level4_pgt + L4_VMALLOC_END*8, 0
15100+ .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
15101+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15102+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15103 .org init_level4_pgt + L4_START_KERNEL*8, 0
15104 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15105 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15106
15107+#ifdef CONFIG_PAX_PER_CPU_PGD
15108+NEXT_PAGE(cpu_pgd)
15109+ .rept NR_CPUS
15110+ .fill 512,8,0
15111+ .endr
15112+#endif
15113+
15114 NEXT_PAGE(level3_ident_pgt)
15115 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15116+#ifdef CONFIG_XEN
15117 .fill 511,8,0
15118+#else
15119+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15120+ .fill 510,8,0
15121+#endif
15122+
15123+NEXT_PAGE(level3_vmalloc_start_pgt)
15124+ .fill 512,8,0
15125+
15126+NEXT_PAGE(level3_vmalloc_end_pgt)
15127+ .fill 512,8,0
15128+
15129+NEXT_PAGE(level3_vmemmap_pgt)
15130+ .fill L3_VMEMMAP_START,8,0
15131+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15132
15133 NEXT_PAGE(level3_kernel_pgt)
15134 .fill L3_START_KERNEL,8,0
15135@@ -363,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt)
15136 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15137 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15138
15139+NEXT_PAGE(level2_vmemmap_pgt)
15140+ .fill 512,8,0
15141+
15142 NEXT_PAGE(level2_fixmap_pgt)
15143- .fill 506,8,0
15144- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15145- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15146- .fill 5,8,0
15147+ .fill 507,8,0
15148+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15149+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15150+ .fill 4,8,0
15151
15152-NEXT_PAGE(level1_fixmap_pgt)
15153+NEXT_PAGE(level1_vsyscall_pgt)
15154 .fill 512,8,0
15155
15156-NEXT_PAGE(level2_ident_pgt)
15157- /* Since I easily can, map the first 1G.
15158+ /* Since I easily can, map the first 2G.
15159 * Don't set NX because code runs from these pages.
15160 */
15161- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15162+NEXT_PAGE(level2_ident_pgt)
15163+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15164
15165 NEXT_PAGE(level2_kernel_pgt)
15166 /*
15167@@ -389,33 +429,55 @@ NEXT_PAGE(level2_kernel_pgt)
15168 * If you want to increase this then increase MODULES_VADDR
15169 * too.)
15170 */
15171- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15172- KERNEL_IMAGE_SIZE/PMD_SIZE)
15173-
15174-NEXT_PAGE(level2_spare_pgt)
15175- .fill 512, 8, 0
15176+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15177
15178 #undef PMDS
15179 #undef NEXT_PAGE
15180
15181- .data
15182+ .align PAGE_SIZE
15183+ENTRY(cpu_gdt_table)
15184+ .rept NR_CPUS
15185+ .quad 0x0000000000000000 /* NULL descriptor */
15186+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15187+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15188+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15189+ .quad 0x00cffb000000ffff /* __USER32_CS */
15190+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15191+ .quad 0x00affb000000ffff /* __USER_CS */
15192+
15193+#ifdef CONFIG_PAX_KERNEXEC
15194+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15195+#else
15196+ .quad 0x0 /* unused */
15197+#endif
15198+
15199+ .quad 0,0 /* TSS */
15200+ .quad 0,0 /* LDT */
15201+ .quad 0,0,0 /* three TLS descriptors */
15202+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15203+ /* asm/segment.h:GDT_ENTRIES must match this */
15204+
15205+ /* zero the remaining page */
15206+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15207+ .endr
15208+
15209 .align 16
15210 .globl early_gdt_descr
15211 early_gdt_descr:
15212 .word GDT_ENTRIES*8-1
15213 early_gdt_descr_base:
15214- .quad INIT_PER_CPU_VAR(gdt_page)
15215+ .quad cpu_gdt_table
15216
15217 ENTRY(phys_base)
15218 /* This must match the first entry in level2_kernel_pgt */
15219 .quad 0x0000000000000000
15220
15221 #include "../../x86/xen/xen-head.S"
15222-
15223- .section .bss, "aw", @nobits
15224+
15225+ .section .rodata,"a",@progbits
15226 .align L1_CACHE_BYTES
15227 ENTRY(idt_table)
15228- .skip IDT_ENTRIES * 16
15229+ .fill 512,8,0
15230
15231 __PAGE_ALIGNED_BSS
15232 .align PAGE_SIZE
15233diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
15234index 9c3bd4a..e1d9b35 100644
15235--- a/arch/x86/kernel/i386_ksyms_32.c
15236+++ b/arch/x86/kernel/i386_ksyms_32.c
15237@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15238 EXPORT_SYMBOL(cmpxchg8b_emu);
15239 #endif
15240
15241+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15242+
15243 /* Networking helper routines. */
15244 EXPORT_SYMBOL(csum_partial_copy_generic);
15245+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15246+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15247
15248 EXPORT_SYMBOL(__get_user_1);
15249 EXPORT_SYMBOL(__get_user_2);
15250@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15251
15252 EXPORT_SYMBOL(csum_partial);
15253 EXPORT_SYMBOL(empty_zero_page);
15254+
15255+#ifdef CONFIG_PAX_KERNEXEC
15256+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15257+#endif
15258diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
15259index 6104852..6114160 100644
15260--- a/arch/x86/kernel/i8259.c
15261+++ b/arch/x86/kernel/i8259.c
15262@@ -210,7 +210,7 @@ spurious_8259A_irq:
15263 "spurious 8259A interrupt: IRQ%d.\n", irq);
15264 spurious_irq_mask |= irqmask;
15265 }
15266- atomic_inc(&irq_err_count);
15267+ atomic_inc_unchecked(&irq_err_count);
15268 /*
15269 * Theoretically we do not have to handle this IRQ,
15270 * but in Linux this does not cause problems and is
15271diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
15272index 43e9ccf..44ccf6f 100644
15273--- a/arch/x86/kernel/init_task.c
15274+++ b/arch/x86/kernel/init_task.c
15275@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
15276 * way process stacks are handled. This is done by having a special
15277 * "init_task" linker map entry..
15278 */
15279-union thread_union init_thread_union __init_task_data =
15280- { INIT_THREAD_INFO(init_task) };
15281+union thread_union init_thread_union __init_task_data;
15282
15283 /*
15284 * Initial task structure.
15285@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15286 * section. Since TSS's are completely CPU-local, we want them
15287 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15288 */
15289-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15290-
15291+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15292+EXPORT_SYMBOL(init_tss);
15293diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
15294index 8c96897..be66bfa 100644
15295--- a/arch/x86/kernel/ioport.c
15296+++ b/arch/x86/kernel/ioport.c
15297@@ -6,6 +6,7 @@
15298 #include <linux/sched.h>
15299 #include <linux/kernel.h>
15300 #include <linux/capability.h>
15301+#include <linux/security.h>
15302 #include <linux/errno.h>
15303 #include <linux/types.h>
15304 #include <linux/ioport.h>
15305@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15306
15307 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15308 return -EINVAL;
15309+#ifdef CONFIG_GRKERNSEC_IO
15310+ if (turn_on && grsec_disable_privio) {
15311+ gr_handle_ioperm();
15312+ return -EPERM;
15313+ }
15314+#endif
15315 if (turn_on && !capable(CAP_SYS_RAWIO))
15316 return -EPERM;
15317
15318@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15319 * because the ->io_bitmap_max value must match the bitmap
15320 * contents:
15321 */
15322- tss = &per_cpu(init_tss, get_cpu());
15323+ tss = init_tss + get_cpu();
15324
15325 if (turn_on)
15326 bitmap_clear(t->io_bitmap_ptr, from, num);
15327@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct pt_regs *regs)
15328 return -EINVAL;
15329 /* Trying to gain more privileges? */
15330 if (level > old) {
15331+#ifdef CONFIG_GRKERNSEC_IO
15332+ if (grsec_disable_privio) {
15333+ gr_handle_iopl();
15334+ return -EPERM;
15335+ }
15336+#endif
15337 if (!capable(CAP_SYS_RAWIO))
15338 return -EPERM;
15339 }
15340diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
15341index 6c0802e..bea25ae 100644
15342--- a/arch/x86/kernel/irq.c
15343+++ b/arch/x86/kernel/irq.c
15344@@ -17,7 +17,7 @@
15345 #include <asm/mce.h>
15346 #include <asm/hw_irq.h>
15347
15348-atomic_t irq_err_count;
15349+atomic_unchecked_t irq_err_count;
15350
15351 /* Function pointer for generic interrupt vector handling */
15352 void (*x86_platform_ipi_callback)(void) = NULL;
15353@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
15354 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15355 seq_printf(p, " Machine check polls\n");
15356 #endif
15357- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15358+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15359 #if defined(CONFIG_X86_IO_APIC)
15360- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15361+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15362 #endif
15363 return 0;
15364 }
15365@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15366
15367 u64 arch_irq_stat(void)
15368 {
15369- u64 sum = atomic_read(&irq_err_count);
15370+ u64 sum = atomic_read_unchecked(&irq_err_count);
15371
15372 #ifdef CONFIG_X86_IO_APIC
15373- sum += atomic_read(&irq_mis_count);
15374+ sum += atomic_read_unchecked(&irq_mis_count);
15375 #endif
15376 return sum;
15377 }
15378diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
15379index 7209070..cbcd71a 100644
15380--- a/arch/x86/kernel/irq_32.c
15381+++ b/arch/x86/kernel/irq_32.c
15382@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15383 __asm__ __volatile__("andl %%esp,%0" :
15384 "=r" (sp) : "0" (THREAD_SIZE - 1));
15385
15386- return sp < (sizeof(struct thread_info) + STACK_WARN);
15387+ return sp < STACK_WARN;
15388 }
15389
15390 static void print_stack_overflow(void)
15391@@ -54,8 +54,8 @@ static inline void print_stack_overflow(void) { }
15392 * per-CPU IRQ handling contexts (thread information and stack)
15393 */
15394 union irq_ctx {
15395- struct thread_info tinfo;
15396- u32 stack[THREAD_SIZE/sizeof(u32)];
15397+ unsigned long previous_esp;
15398+ u32 stack[THREAD_SIZE/sizeof(u32)];
15399 } __attribute__((aligned(THREAD_SIZE)));
15400
15401 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15402@@ -75,10 +75,9 @@ static void call_on_stack(void *func, void *stack)
15403 static inline int
15404 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15405 {
15406- union irq_ctx *curctx, *irqctx;
15407+ union irq_ctx *irqctx;
15408 u32 *isp, arg1, arg2;
15409
15410- curctx = (union irq_ctx *) current_thread_info();
15411 irqctx = __this_cpu_read(hardirq_ctx);
15412
15413 /*
15414@@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15415 * handler) we can't do that and just have to keep using the
15416 * current stack (which is the irq stack already after all)
15417 */
15418- if (unlikely(curctx == irqctx))
15419+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15420 return 0;
15421
15422 /* build the stack frame on the IRQ stack */
15423- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15424- irqctx->tinfo.task = curctx->tinfo.task;
15425- irqctx->tinfo.previous_esp = current_stack_pointer;
15426+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15427+ irqctx->previous_esp = current_stack_pointer;
15428
15429- /*
15430- * Copy the softirq bits in preempt_count so that the
15431- * softirq checks work in the hardirq context.
15432- */
15433- irqctx->tinfo.preempt_count =
15434- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15435- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15436+#ifdef CONFIG_PAX_MEMORY_UDEREF
15437+ __set_fs(MAKE_MM_SEG(0));
15438+#endif
15439
15440 if (unlikely(overflow))
15441 call_on_stack(print_stack_overflow, isp);
15442@@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15443 : "0" (irq), "1" (desc), "2" (isp),
15444 "D" (desc->handle_irq)
15445 : "memory", "cc", "ecx");
15446+
15447+#ifdef CONFIG_PAX_MEMORY_UDEREF
15448+ __set_fs(current_thread_info()->addr_limit);
15449+#endif
15450+
15451 return 1;
15452 }
15453
15454@@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15455 */
15456 void __cpuinit irq_ctx_init(int cpu)
15457 {
15458- union irq_ctx *irqctx;
15459-
15460 if (per_cpu(hardirq_ctx, cpu))
15461 return;
15462
15463- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15464- THREAD_FLAGS,
15465- THREAD_ORDER));
15466- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15467- irqctx->tinfo.cpu = cpu;
15468- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15469- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15470-
15471- per_cpu(hardirq_ctx, cpu) = irqctx;
15472-
15473- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15474- THREAD_FLAGS,
15475- THREAD_ORDER));
15476- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15477- irqctx->tinfo.cpu = cpu;
15478- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15479-
15480- per_cpu(softirq_ctx, cpu) = irqctx;
15481+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15482+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15483
15484 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15485 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15486@@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
15487 asmlinkage void do_softirq(void)
15488 {
15489 unsigned long flags;
15490- struct thread_info *curctx;
15491 union irq_ctx *irqctx;
15492 u32 *isp;
15493
15494@@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
15495 local_irq_save(flags);
15496
15497 if (local_softirq_pending()) {
15498- curctx = current_thread_info();
15499 irqctx = __this_cpu_read(softirq_ctx);
15500- irqctx->tinfo.task = curctx->task;
15501- irqctx->tinfo.previous_esp = current_stack_pointer;
15502+ irqctx->previous_esp = current_stack_pointer;
15503
15504 /* build the stack frame on the softirq stack */
15505- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15506+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15507+
15508+#ifdef CONFIG_PAX_MEMORY_UDEREF
15509+ __set_fs(MAKE_MM_SEG(0));
15510+#endif
15511
15512 call_on_stack(__do_softirq, isp);
15513+
15514+#ifdef CONFIG_PAX_MEMORY_UDEREF
15515+ __set_fs(current_thread_info()->addr_limit);
15516+#endif
15517+
15518 /*
15519 * Shouldn't happen, we returned above if in_interrupt():
15520 */
15521diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
15522index 00354d4..187ae44 100644
15523--- a/arch/x86/kernel/kgdb.c
15524+++ b/arch/x86/kernel/kgdb.c
15525@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
15526 #ifdef CONFIG_X86_32
15527 switch (regno) {
15528 case GDB_SS:
15529- if (!user_mode_vm(regs))
15530+ if (!user_mode(regs))
15531 *(unsigned long *)mem = __KERNEL_DS;
15532 break;
15533 case GDB_SP:
15534- if (!user_mode_vm(regs))
15535+ if (!user_mode(regs))
15536 *(unsigned long *)mem = kernel_stack_pointer(regs);
15537 break;
15538 case GDB_GS:
15539@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
15540 case 'k':
15541 /* clear the trace bit */
15542 linux_regs->flags &= ~X86_EFLAGS_TF;
15543- atomic_set(&kgdb_cpu_doing_single_step, -1);
15544+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15545
15546 /* set the trace bit if we're stepping */
15547 if (remcomInBuffer[0] == 's') {
15548 linux_regs->flags |= X86_EFLAGS_TF;
15549- atomic_set(&kgdb_cpu_doing_single_step,
15550+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15551 raw_smp_processor_id());
15552 }
15553
15554@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
15555 return NOTIFY_DONE;
15556
15557 case DIE_DEBUG:
15558- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15559+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15560 if (user_mode(regs))
15561 return single_step_cont(regs, args);
15562 break;
15563diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
15564index 794bc95..c6e29e9 100644
15565--- a/arch/x86/kernel/kprobes.c
15566+++ b/arch/x86/kernel/kprobes.c
15567@@ -117,8 +117,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
15568 } __attribute__((packed)) *insn;
15569
15570 insn = (struct __arch_relative_insn *)from;
15571+
15572+ pax_open_kernel();
15573 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15574 insn->op = op;
15575+ pax_close_kernel();
15576 }
15577
15578 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15579@@ -155,7 +158,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
15580 kprobe_opcode_t opcode;
15581 kprobe_opcode_t *orig_opcodes = opcodes;
15582
15583- if (search_exception_tables((unsigned long)opcodes))
15584+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15585 return 0; /* Page fault may occur on this address. */
15586
15587 retry:
15588@@ -316,7 +319,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15589 }
15590 }
15591 insn_get_length(&insn);
15592+ pax_open_kernel();
15593 memcpy(dest, insn.kaddr, insn.length);
15594+ pax_close_kernel();
15595
15596 #ifdef CONFIG_X86_64
15597 if (insn_rip_relative(&insn)) {
15598@@ -340,7 +345,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15599 (u8 *) dest;
15600 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15601 disp = (u8 *) dest + insn_offset_displacement(&insn);
15602+ pax_open_kernel();
15603 *(s32 *) disp = (s32) newdisp;
15604+ pax_close_kernel();
15605 }
15606 #endif
15607 return insn.length;
15608@@ -354,12 +361,12 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
15609 */
15610 __copy_instruction(p->ainsn.insn, p->addr, 0);
15611
15612- if (can_boost(p->addr))
15613+ if (can_boost(ktla_ktva(p->addr)))
15614 p->ainsn.boostable = 0;
15615 else
15616 p->ainsn.boostable = -1;
15617
15618- p->opcode = *p->addr;
15619+ p->opcode = *(ktla_ktva(p->addr));
15620 }
15621
15622 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15623@@ -476,7 +483,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15624 * nor set current_kprobe, because it doesn't use single
15625 * stepping.
15626 */
15627- regs->ip = (unsigned long)p->ainsn.insn;
15628+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15629 preempt_enable_no_resched();
15630 return;
15631 }
15632@@ -495,7 +502,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15633 if (p->opcode == BREAKPOINT_INSTRUCTION)
15634 regs->ip = (unsigned long)p->addr;
15635 else
15636- regs->ip = (unsigned long)p->ainsn.insn;
15637+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15638 }
15639
15640 /*
15641@@ -574,7 +581,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
15642 setup_singlestep(p, regs, kcb, 0);
15643 return 1;
15644 }
15645- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15646+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15647 /*
15648 * The breakpoint instruction was removed right
15649 * after we hit it. Another cpu has removed
15650@@ -682,6 +689,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
15651 " movq %rax, 152(%rsp)\n"
15652 RESTORE_REGS_STRING
15653 " popfq\n"
15654+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
15655+ " btsq $63,(%rsp)\n"
15656+#endif
15657 #else
15658 " pushf\n"
15659 SAVE_REGS_STRING
15660@@ -819,7 +829,7 @@ static void __kprobes resume_execution(struct kprobe *p,
15661 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15662 {
15663 unsigned long *tos = stack_addr(regs);
15664- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15665+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15666 unsigned long orig_ip = (unsigned long)p->addr;
15667 kprobe_opcode_t *insn = p->ainsn.insn;
15668
15669@@ -1001,7 +1011,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
15670 struct die_args *args = data;
15671 int ret = NOTIFY_DONE;
15672
15673- if (args->regs && user_mode_vm(args->regs))
15674+ if (args->regs && user_mode(args->regs))
15675 return ret;
15676
15677 switch (val) {
15678@@ -1383,7 +1393,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15679 * Verify if the address gap is in 2GB range, because this uses
15680 * a relative jump.
15681 */
15682- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15683+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15684 if (abs(rel) > 0x7fffffff)
15685 return -ERANGE;
15686
15687@@ -1404,11 +1414,11 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15688 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15689
15690 /* Set probe function call */
15691- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15692+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15693
15694 /* Set returning jmp instruction at the tail of out-of-line buffer */
15695 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15696- (u8 *)op->kp.addr + op->optinsn.size);
15697+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15698
15699 flush_icache_range((unsigned long) buf,
15700 (unsigned long) buf + TMPL_END_IDX +
15701@@ -1430,7 +1440,7 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
15702 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15703
15704 /* Backup instructions which will be replaced by jump address */
15705- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15706+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15707 RELATIVE_ADDR_SIZE);
15708
15709 insn_buf[0] = RELATIVEJUMP_OPCODE;
15710diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
15711index a9c2116..a52d4fc 100644
15712--- a/arch/x86/kernel/kvm.c
15713+++ b/arch/x86/kernel/kvm.c
15714@@ -437,6 +437,7 @@ static void __init paravirt_ops_setup(void)
15715 pv_mmu_ops.set_pud = kvm_set_pud;
15716 #if PAGETABLE_LEVELS == 4
15717 pv_mmu_ops.set_pgd = kvm_set_pgd;
15718+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
15719 #endif
15720 #endif
15721 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
15722diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
15723index ea69726..604d066 100644
15724--- a/arch/x86/kernel/ldt.c
15725+++ b/arch/x86/kernel/ldt.c
15726@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
15727 if (reload) {
15728 #ifdef CONFIG_SMP
15729 preempt_disable();
15730- load_LDT(pc);
15731+ load_LDT_nolock(pc);
15732 if (!cpumask_equal(mm_cpumask(current->mm),
15733 cpumask_of(smp_processor_id())))
15734 smp_call_function(flush_ldt, current->mm, 1);
15735 preempt_enable();
15736 #else
15737- load_LDT(pc);
15738+ load_LDT_nolock(pc);
15739 #endif
15740 }
15741 if (oldsize) {
15742@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
15743 return err;
15744
15745 for (i = 0; i < old->size; i++)
15746- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15747+ write_ldt_entry(new->ldt, i, old->ldt + i);
15748 return 0;
15749 }
15750
15751@@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
15752 retval = copy_ldt(&mm->context, &old_mm->context);
15753 mutex_unlock(&old_mm->context.lock);
15754 }
15755+
15756+ if (tsk == current) {
15757+ mm->context.vdso = 0;
15758+
15759+#ifdef CONFIG_X86_32
15760+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15761+ mm->context.user_cs_base = 0UL;
15762+ mm->context.user_cs_limit = ~0UL;
15763+
15764+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15765+ cpus_clear(mm->context.cpu_user_cs_mask);
15766+#endif
15767+
15768+#endif
15769+#endif
15770+
15771+ }
15772+
15773 return retval;
15774 }
15775
15776@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
15777 }
15778 }
15779
15780+#ifdef CONFIG_PAX_SEGMEXEC
15781+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15782+ error = -EINVAL;
15783+ goto out_unlock;
15784+ }
15785+#endif
15786+
15787 fill_ldt(&ldt, &ldt_info);
15788 if (oldmode)
15789 ldt.avl = 0;
15790diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
15791index a3fa43b..8966f4c 100644
15792--- a/arch/x86/kernel/machine_kexec_32.c
15793+++ b/arch/x86/kernel/machine_kexec_32.c
15794@@ -27,7 +27,7 @@
15795 #include <asm/cacheflush.h>
15796 #include <asm/debugreg.h>
15797
15798-static void set_idt(void *newidt, __u16 limit)
15799+static void set_idt(struct desc_struct *newidt, __u16 limit)
15800 {
15801 struct desc_ptr curidt;
15802
15803@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16 limit)
15804 }
15805
15806
15807-static void set_gdt(void *newgdt, __u16 limit)
15808+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15809 {
15810 struct desc_ptr curgdt;
15811
15812@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15813 }
15814
15815 control_page = page_address(image->control_code_page);
15816- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15817+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15818
15819 relocate_kernel_ptr = control_page;
15820 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15821diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
15822index 1a1b606..5c89b55 100644
15823--- a/arch/x86/kernel/microcode_intel.c
15824+++ b/arch/x86/kernel/microcode_intel.c
15825@@ -440,13 +440,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
15826
15827 static int get_ucode_user(void *to, const void *from, size_t n)
15828 {
15829- return copy_from_user(to, from, n);
15830+ return copy_from_user(to, (const void __force_user *)from, n);
15831 }
15832
15833 static enum ucode_state
15834 request_microcode_user(int cpu, const void __user *buf, size_t size)
15835 {
15836- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
15837+ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
15838 }
15839
15840 static void microcode_fini_cpu(int cpu)
15841diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
15842index 925179f..85bec6c 100644
15843--- a/arch/x86/kernel/module.c
15844+++ b/arch/x86/kernel/module.c
15845@@ -36,15 +36,60 @@
15846 #define DEBUGP(fmt...)
15847 #endif
15848
15849-void *module_alloc(unsigned long size)
15850+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
15851 {
15852 if (PAGE_ALIGN(size) > MODULES_LEN)
15853 return NULL;
15854 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
15855- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
15856+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
15857 -1, __builtin_return_address(0));
15858 }
15859
15860+void *module_alloc(unsigned long size)
15861+{
15862+
15863+#ifdef CONFIG_PAX_KERNEXEC
15864+ return __module_alloc(size, PAGE_KERNEL);
15865+#else
15866+ return __module_alloc(size, PAGE_KERNEL_EXEC);
15867+#endif
15868+
15869+}
15870+
15871+#ifdef CONFIG_PAX_KERNEXEC
15872+#ifdef CONFIG_X86_32
15873+void *module_alloc_exec(unsigned long size)
15874+{
15875+ struct vm_struct *area;
15876+
15877+ if (size == 0)
15878+ return NULL;
15879+
15880+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
15881+ return area ? area->addr : NULL;
15882+}
15883+EXPORT_SYMBOL(module_alloc_exec);
15884+
15885+void module_free_exec(struct module *mod, void *module_region)
15886+{
15887+ vunmap(module_region);
15888+}
15889+EXPORT_SYMBOL(module_free_exec);
15890+#else
15891+void module_free_exec(struct module *mod, void *module_region)
15892+{
15893+ module_free(mod, module_region);
15894+}
15895+EXPORT_SYMBOL(module_free_exec);
15896+
15897+void *module_alloc_exec(unsigned long size)
15898+{
15899+ return __module_alloc(size, PAGE_KERNEL_RX);
15900+}
15901+EXPORT_SYMBOL(module_alloc_exec);
15902+#endif
15903+#endif
15904+
15905 #ifdef CONFIG_X86_32
15906 int apply_relocate(Elf32_Shdr *sechdrs,
15907 const char *strtab,
15908@@ -55,14 +100,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15909 unsigned int i;
15910 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
15911 Elf32_Sym *sym;
15912- uint32_t *location;
15913+ uint32_t *plocation, location;
15914
15915 DEBUGP("Applying relocate section %u to %u\n", relsec,
15916 sechdrs[relsec].sh_info);
15917 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
15918 /* This is where to make the change */
15919- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
15920- + rel[i].r_offset;
15921+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
15922+ location = (uint32_t)plocation;
15923+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
15924+ plocation = ktla_ktva((void *)plocation);
15925 /* This is the symbol it is referring to. Note that all
15926 undefined symbols have been resolved. */
15927 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
15928@@ -71,11 +118,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15929 switch (ELF32_R_TYPE(rel[i].r_info)) {
15930 case R_386_32:
15931 /* We add the value into the location given */
15932- *location += sym->st_value;
15933+ pax_open_kernel();
15934+ *plocation += sym->st_value;
15935+ pax_close_kernel();
15936 break;
15937 case R_386_PC32:
15938 /* Add the value, subtract its postition */
15939- *location += sym->st_value - (uint32_t)location;
15940+ pax_open_kernel();
15941+ *plocation += sym->st_value - location;
15942+ pax_close_kernel();
15943 break;
15944 default:
15945 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
15946@@ -120,21 +171,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
15947 case R_X86_64_NONE:
15948 break;
15949 case R_X86_64_64:
15950+ pax_open_kernel();
15951 *(u64 *)loc = val;
15952+ pax_close_kernel();
15953 break;
15954 case R_X86_64_32:
15955+ pax_open_kernel();
15956 *(u32 *)loc = val;
15957+ pax_close_kernel();
15958 if (val != *(u32 *)loc)
15959 goto overflow;
15960 break;
15961 case R_X86_64_32S:
15962+ pax_open_kernel();
15963 *(s32 *)loc = val;
15964+ pax_close_kernel();
15965 if ((s64)val != *(s32 *)loc)
15966 goto overflow;
15967 break;
15968 case R_X86_64_PC32:
15969 val -= (u64)loc;
15970+ pax_open_kernel();
15971 *(u32 *)loc = val;
15972+ pax_close_kernel();
15973+
15974 #if 0
15975 if ((s64)val != *(s32 *)loc)
15976 goto overflow;
15977diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
15978index 676b8c7..870ba04 100644
15979--- a/arch/x86/kernel/paravirt-spinlocks.c
15980+++ b/arch/x86/kernel/paravirt-spinlocks.c
15981@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
15982 arch_spin_lock(lock);
15983 }
15984
15985-struct pv_lock_ops pv_lock_ops = {
15986+struct pv_lock_ops pv_lock_ops __read_only = {
15987 #ifdef CONFIG_SMP
15988 .spin_is_locked = __ticket_spin_is_locked,
15989 .spin_is_contended = __ticket_spin_is_contended,
15990diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
15991index d90272e..2d54e8e 100644
15992--- a/arch/x86/kernel/paravirt.c
15993+++ b/arch/x86/kernel/paravirt.c
15994@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
15995 {
15996 return x;
15997 }
15998+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
15999+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
16000+#endif
16001
16002 void __init default_banner(void)
16003 {
16004@@ -133,6 +136,9 @@ static void *get_call_destination(u8 type)
16005 .pv_lock_ops = pv_lock_ops,
16006 #endif
16007 };
16008+
16009+ pax_track_stack();
16010+
16011 return *((void **)&tmpl + type);
16012 }
16013
16014@@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
16015 if (opfunc == NULL)
16016 /* If there's no function, patch it with a ud2a (BUG) */
16017 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16018- else if (opfunc == _paravirt_nop)
16019+ else if (opfunc == (void *)_paravirt_nop)
16020 /* If the operation is a nop, then nop the callsite */
16021 ret = paravirt_patch_nop();
16022
16023 /* identity functions just return their single argument */
16024- else if (opfunc == _paravirt_ident_32)
16025+ else if (opfunc == (void *)_paravirt_ident_32)
16026 ret = paravirt_patch_ident_32(insnbuf, len);
16027- else if (opfunc == _paravirt_ident_64)
16028+ else if (opfunc == (void *)_paravirt_ident_64)
16029 ret = paravirt_patch_ident_64(insnbuf, len);
16030+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16031+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16032+ ret = paravirt_patch_ident_64(insnbuf, len);
16033+#endif
16034
16035 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16036 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16037@@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
16038 if (insn_len > len || start == NULL)
16039 insn_len = len;
16040 else
16041- memcpy(insnbuf, start, insn_len);
16042+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16043
16044 return insn_len;
16045 }
16046@@ -302,7 +312,7 @@ void arch_flush_lazy_mmu_mode(void)
16047 preempt_enable();
16048 }
16049
16050-struct pv_info pv_info = {
16051+struct pv_info pv_info __read_only = {
16052 .name = "bare hardware",
16053 .paravirt_enabled = 0,
16054 .kernel_rpl = 0,
16055@@ -313,16 +323,16 @@ struct pv_info pv_info = {
16056 #endif
16057 };
16058
16059-struct pv_init_ops pv_init_ops = {
16060+struct pv_init_ops pv_init_ops __read_only = {
16061 .patch = native_patch,
16062 };
16063
16064-struct pv_time_ops pv_time_ops = {
16065+struct pv_time_ops pv_time_ops __read_only = {
16066 .sched_clock = native_sched_clock,
16067 .steal_clock = native_steal_clock,
16068 };
16069
16070-struct pv_irq_ops pv_irq_ops = {
16071+struct pv_irq_ops pv_irq_ops __read_only = {
16072 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16073 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16074 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16075@@ -334,7 +344,7 @@ struct pv_irq_ops pv_irq_ops = {
16076 #endif
16077 };
16078
16079-struct pv_cpu_ops pv_cpu_ops = {
16080+struct pv_cpu_ops pv_cpu_ops __read_only = {
16081 .cpuid = native_cpuid,
16082 .get_debugreg = native_get_debugreg,
16083 .set_debugreg = native_set_debugreg,
16084@@ -395,21 +405,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16085 .end_context_switch = paravirt_nop,
16086 };
16087
16088-struct pv_apic_ops pv_apic_ops = {
16089+struct pv_apic_ops pv_apic_ops __read_only = {
16090 #ifdef CONFIG_X86_LOCAL_APIC
16091 .startup_ipi_hook = paravirt_nop,
16092 #endif
16093 };
16094
16095-#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16096+#ifdef CONFIG_X86_32
16097+#ifdef CONFIG_X86_PAE
16098+/* 64-bit pagetable entries */
16099+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16100+#else
16101 /* 32-bit pagetable entries */
16102 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16103+#endif
16104 #else
16105 /* 64-bit pagetable entries */
16106 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16107 #endif
16108
16109-struct pv_mmu_ops pv_mmu_ops = {
16110+struct pv_mmu_ops pv_mmu_ops __read_only = {
16111
16112 .read_cr2 = native_read_cr2,
16113 .write_cr2 = native_write_cr2,
16114@@ -459,6 +474,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16115 .make_pud = PTE_IDENT,
16116
16117 .set_pgd = native_set_pgd,
16118+ .set_pgd_batched = native_set_pgd_batched,
16119 #endif
16120 #endif /* PAGETABLE_LEVELS >= 3 */
16121
16122@@ -478,6 +494,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16123 },
16124
16125 .set_fixmap = native_set_fixmap,
16126+
16127+#ifdef CONFIG_PAX_KERNEXEC
16128+ .pax_open_kernel = native_pax_open_kernel,
16129+ .pax_close_kernel = native_pax_close_kernel,
16130+#endif
16131+
16132 };
16133
16134 EXPORT_SYMBOL_GPL(pv_time_ops);
16135diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
16136index 35ccf75..67e7d4d 100644
16137--- a/arch/x86/kernel/pci-iommu_table.c
16138+++ b/arch/x86/kernel/pci-iommu_table.c
16139@@ -2,7 +2,7 @@
16140 #include <asm/iommu_table.h>
16141 #include <linux/string.h>
16142 #include <linux/kallsyms.h>
16143-
16144+#include <linux/sched.h>
16145
16146 #define DEBUG 1
16147
16148@@ -51,6 +51,8 @@ void __init check_iommu_entries(struct iommu_table_entry *start,
16149 {
16150 struct iommu_table_entry *p, *q, *x;
16151
16152+ pax_track_stack();
16153+
16154 /* Simple cyclic dependency checker. */
16155 for (p = start; p < finish; p++) {
16156 q = find_dependents_of(start, finish, p);
16157diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
16158index 30eb651..37fa2d7 100644
16159--- a/arch/x86/kernel/process.c
16160+++ b/arch/x86/kernel/process.c
16161@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_struct *tsk)
16162
16163 void free_thread_info(struct thread_info *ti)
16164 {
16165- free_thread_xstate(ti->task);
16166 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16167 }
16168
16169+static struct kmem_cache *task_struct_cachep;
16170+
16171 void arch_task_cache_init(void)
16172 {
16173- task_xstate_cachep =
16174- kmem_cache_create("task_xstate", xstate_size,
16175+ /* create a slab on which task_structs can be allocated */
16176+ task_struct_cachep =
16177+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16178+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16179+
16180+ task_xstate_cachep =
16181+ kmem_cache_create("task_xstate", xstate_size,
16182 __alignof__(union thread_xstate),
16183- SLAB_PANIC | SLAB_NOTRACK, NULL);
16184+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16185+}
16186+
16187+struct task_struct *alloc_task_struct_node(int node)
16188+{
16189+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16190+}
16191+
16192+void free_task_struct(struct task_struct *task)
16193+{
16194+ free_thread_xstate(task);
16195+ kmem_cache_free(task_struct_cachep, task);
16196 }
16197
16198 /*
16199@@ -70,7 +87,7 @@ void exit_thread(void)
16200 unsigned long *bp = t->io_bitmap_ptr;
16201
16202 if (bp) {
16203- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16204+ struct tss_struct *tss = init_tss + get_cpu();
16205
16206 t->io_bitmap_ptr = NULL;
16207 clear_thread_flag(TIF_IO_BITMAP);
16208@@ -106,7 +123,7 @@ void show_regs_common(void)
16209
16210 printk(KERN_CONT "\n");
16211 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16212- current->pid, current->comm, print_tainted(),
16213+ task_pid_nr(current), current->comm, print_tainted(),
16214 init_utsname()->release,
16215 (int)strcspn(init_utsname()->version, " "),
16216 init_utsname()->version);
16217@@ -120,6 +137,9 @@ void flush_thread(void)
16218 {
16219 struct task_struct *tsk = current;
16220
16221+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16222+ loadsegment(gs, 0);
16223+#endif
16224 flush_ptrace_hw_breakpoint(tsk);
16225 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16226 /*
16227@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
16228 regs.di = (unsigned long) arg;
16229
16230 #ifdef CONFIG_X86_32
16231- regs.ds = __USER_DS;
16232- regs.es = __USER_DS;
16233+ regs.ds = __KERNEL_DS;
16234+ regs.es = __KERNEL_DS;
16235 regs.fs = __KERNEL_PERCPU;
16236- regs.gs = __KERNEL_STACK_CANARY;
16237+ savesegment(gs, regs.gs);
16238 #else
16239 regs.ss = __KERNEL_DS;
16240 #endif
16241@@ -411,7 +431,7 @@ bool set_pm_idle_to_default(void)
16242
16243 return ret;
16244 }
16245-void stop_this_cpu(void *dummy)
16246+__noreturn void stop_this_cpu(void *dummy)
16247 {
16248 local_irq_disable();
16249 /*
16250@@ -653,16 +673,37 @@ static int __init idle_setup(char *str)
16251 }
16252 early_param("idle", idle_setup);
16253
16254-unsigned long arch_align_stack(unsigned long sp)
16255+#ifdef CONFIG_PAX_RANDKSTACK
16256+void pax_randomize_kstack(struct pt_regs *regs)
16257 {
16258- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16259- sp -= get_random_int() % 8192;
16260- return sp & ~0xf;
16261-}
16262+ struct thread_struct *thread = &current->thread;
16263+ unsigned long time;
16264
16265-unsigned long arch_randomize_brk(struct mm_struct *mm)
16266-{
16267- unsigned long range_end = mm->brk + 0x02000000;
16268- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16269-}
16270+ if (!randomize_va_space)
16271+ return;
16272+
16273+ if (v8086_mode(regs))
16274+ return;
16275
16276+ rdtscl(time);
16277+
16278+ /* P4 seems to return a 0 LSB, ignore it */
16279+#ifdef CONFIG_MPENTIUM4
16280+ time &= 0x3EUL;
16281+ time <<= 2;
16282+#elif defined(CONFIG_X86_64)
16283+ time &= 0xFUL;
16284+ time <<= 4;
16285+#else
16286+ time &= 0x1FUL;
16287+ time <<= 3;
16288+#endif
16289+
16290+ thread->sp0 ^= time;
16291+ load_sp0(init_tss + smp_processor_id(), thread);
16292+
16293+#ifdef CONFIG_X86_64
16294+ percpu_write(kernel_stack, thread->sp0);
16295+#endif
16296+}
16297+#endif
16298diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
16299index 7a3b651..5a946f6 100644
16300--- a/arch/x86/kernel/process_32.c
16301+++ b/arch/x86/kernel/process_32.c
16302@@ -66,6 +66,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
16303 unsigned long thread_saved_pc(struct task_struct *tsk)
16304 {
16305 return ((unsigned long *)tsk->thread.sp)[3];
16306+//XXX return tsk->thread.eip;
16307 }
16308
16309 #ifndef CONFIG_SMP
16310@@ -128,15 +129,14 @@ void __show_regs(struct pt_regs *regs, int all)
16311 unsigned long sp;
16312 unsigned short ss, gs;
16313
16314- if (user_mode_vm(regs)) {
16315+ if (user_mode(regs)) {
16316 sp = regs->sp;
16317 ss = regs->ss & 0xffff;
16318- gs = get_user_gs(regs);
16319 } else {
16320 sp = kernel_stack_pointer(regs);
16321 savesegment(ss, ss);
16322- savesegment(gs, gs);
16323 }
16324+ gs = get_user_gs(regs);
16325
16326 show_regs_common();
16327
16328@@ -198,13 +198,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16329 struct task_struct *tsk;
16330 int err;
16331
16332- childregs = task_pt_regs(p);
16333+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16334 *childregs = *regs;
16335 childregs->ax = 0;
16336 childregs->sp = sp;
16337
16338 p->thread.sp = (unsigned long) childregs;
16339 p->thread.sp0 = (unsigned long) (childregs+1);
16340+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16341
16342 p->thread.ip = (unsigned long) ret_from_fork;
16343
16344@@ -294,7 +295,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16345 struct thread_struct *prev = &prev_p->thread,
16346 *next = &next_p->thread;
16347 int cpu = smp_processor_id();
16348- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16349+ struct tss_struct *tss = init_tss + cpu;
16350 bool preload_fpu;
16351
16352 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16353@@ -329,6 +330,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16354 */
16355 lazy_save_gs(prev->gs);
16356
16357+#ifdef CONFIG_PAX_MEMORY_UDEREF
16358+ __set_fs(task_thread_info(next_p)->addr_limit);
16359+#endif
16360+
16361 /*
16362 * Load the per-thread Thread-Local Storage descriptor.
16363 */
16364@@ -364,6 +369,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16365 */
16366 arch_end_context_switch(next_p);
16367
16368+ percpu_write(current_task, next_p);
16369+ percpu_write(current_tinfo, &next_p->tinfo);
16370+
16371 if (preload_fpu)
16372 __math_state_restore();
16373
16374@@ -373,8 +381,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16375 if (prev->gs | next->gs)
16376 lazy_load_gs(next->gs);
16377
16378- percpu_write(current_task, next_p);
16379-
16380 return prev_p;
16381 }
16382
16383@@ -404,4 +410,3 @@ unsigned long get_wchan(struct task_struct *p)
16384 } while (count++ < 16);
16385 return 0;
16386 }
16387-
16388diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
16389index f693e44..3c979b2 100644
16390--- a/arch/x86/kernel/process_64.c
16391+++ b/arch/x86/kernel/process_64.c
16392@@ -88,7 +88,7 @@ static void __exit_idle(void)
16393 void exit_idle(void)
16394 {
16395 /* idle loop has pid 0 */
16396- if (current->pid)
16397+ if (task_pid_nr(current))
16398 return;
16399 __exit_idle();
16400 }
16401@@ -262,8 +262,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16402 struct pt_regs *childregs;
16403 struct task_struct *me = current;
16404
16405- childregs = ((struct pt_regs *)
16406- (THREAD_SIZE + task_stack_page(p))) - 1;
16407+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16408 *childregs = *regs;
16409
16410 childregs->ax = 0;
16411@@ -275,6 +274,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16412 p->thread.sp = (unsigned long) childregs;
16413 p->thread.sp0 = (unsigned long) (childregs+1);
16414 p->thread.usersp = me->thread.usersp;
16415+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16416
16417 set_tsk_thread_flag(p, TIF_FORK);
16418
16419@@ -377,7 +377,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16420 struct thread_struct *prev = &prev_p->thread;
16421 struct thread_struct *next = &next_p->thread;
16422 int cpu = smp_processor_id();
16423- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16424+ struct tss_struct *tss = init_tss + cpu;
16425 unsigned fsindex, gsindex;
16426 bool preload_fpu;
16427
16428@@ -473,10 +473,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16429 prev->usersp = percpu_read(old_rsp);
16430 percpu_write(old_rsp, next->usersp);
16431 percpu_write(current_task, next_p);
16432+ percpu_write(current_tinfo, &next_p->tinfo);
16433
16434- percpu_write(kernel_stack,
16435- (unsigned long)task_stack_page(next_p) +
16436- THREAD_SIZE - KERNEL_STACK_OFFSET);
16437+ percpu_write(kernel_stack, next->sp0);
16438
16439 /*
16440 * Now maybe reload the debug registers and handle I/O bitmaps
16441@@ -538,12 +537,11 @@ unsigned long get_wchan(struct task_struct *p)
16442 if (!p || p == current || p->state == TASK_RUNNING)
16443 return 0;
16444 stack = (unsigned long)task_stack_page(p);
16445- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16446+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16447 return 0;
16448 fp = *(u64 *)(p->thread.sp);
16449 do {
16450- if (fp < (unsigned long)stack ||
16451- fp >= (unsigned long)stack+THREAD_SIZE)
16452+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16453 return 0;
16454 ip = *(u64 *)(fp+8);
16455 if (!in_sched_functions(ip))
16456diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
16457index 8252879..d3219e0 100644
16458--- a/arch/x86/kernel/ptrace.c
16459+++ b/arch/x86/kernel/ptrace.c
16460@@ -822,7 +822,7 @@ long arch_ptrace(struct task_struct *child, long request,
16461 unsigned long addr, unsigned long data)
16462 {
16463 int ret;
16464- unsigned long __user *datap = (unsigned long __user *)data;
16465+ unsigned long __user *datap = (__force unsigned long __user *)data;
16466
16467 switch (request) {
16468 /* read the word at location addr in the USER area. */
16469@@ -907,14 +907,14 @@ long arch_ptrace(struct task_struct *child, long request,
16470 if ((int) addr < 0)
16471 return -EIO;
16472 ret = do_get_thread_area(child, addr,
16473- (struct user_desc __user *)data);
16474+ (__force struct user_desc __user *) data);
16475 break;
16476
16477 case PTRACE_SET_THREAD_AREA:
16478 if ((int) addr < 0)
16479 return -EIO;
16480 ret = do_set_thread_area(child, addr,
16481- (struct user_desc __user *)data, 0);
16482+ (__force struct user_desc __user *) data, 0);
16483 break;
16484 #endif
16485
16486@@ -1331,7 +1331,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
16487 memset(info, 0, sizeof(*info));
16488 info->si_signo = SIGTRAP;
16489 info->si_code = si_code;
16490- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16491+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16492 }
16493
16494 void user_single_step_siginfo(struct task_struct *tsk,
16495diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
16496index 42eb330..139955c 100644
16497--- a/arch/x86/kernel/pvclock.c
16498+++ b/arch/x86/kernel/pvclock.c
16499@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
16500 return pv_tsc_khz;
16501 }
16502
16503-static atomic64_t last_value = ATOMIC64_INIT(0);
16504+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16505
16506 void pvclock_resume(void)
16507 {
16508- atomic64_set(&last_value, 0);
16509+ atomic64_set_unchecked(&last_value, 0);
16510 }
16511
16512 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16513@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16514 * updating at the same time, and one of them could be slightly behind,
16515 * making the assumption that last_value always go forward fail to hold.
16516 */
16517- last = atomic64_read(&last_value);
16518+ last = atomic64_read_unchecked(&last_value);
16519 do {
16520 if (ret < last)
16521 return last;
16522- last = atomic64_cmpxchg(&last_value, last, ret);
16523+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16524 } while (unlikely(last != ret));
16525
16526 return ret;
16527diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
16528index d4a705f..ef8f1a9 100644
16529--- a/arch/x86/kernel/reboot.c
16530+++ b/arch/x86/kernel/reboot.c
16531@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16532 EXPORT_SYMBOL(pm_power_off);
16533
16534 static const struct desc_ptr no_idt = {};
16535-static int reboot_mode;
16536+static unsigned short reboot_mode;
16537 enum reboot_type reboot_type = BOOT_ACPI;
16538 int reboot_force;
16539
16540@@ -324,13 +324,17 @@ core_initcall(reboot_init);
16541 extern const unsigned char machine_real_restart_asm[];
16542 extern const u64 machine_real_restart_gdt[3];
16543
16544-void machine_real_restart(unsigned int type)
16545+__noreturn void machine_real_restart(unsigned int type)
16546 {
16547 void *restart_va;
16548 unsigned long restart_pa;
16549- void (*restart_lowmem)(unsigned int);
16550+ void (* __noreturn restart_lowmem)(unsigned int);
16551 u64 *lowmem_gdt;
16552
16553+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16554+ struct desc_struct *gdt;
16555+#endif
16556+
16557 local_irq_disable();
16558
16559 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16560@@ -356,14 +360,14 @@ void machine_real_restart(unsigned int type)
16561 boot)". This seems like a fairly standard thing that gets set by
16562 REBOOT.COM programs, and the previous reset routine did this
16563 too. */
16564- *((unsigned short *)0x472) = reboot_mode;
16565+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16566
16567 /* Patch the GDT in the low memory trampoline */
16568 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16569
16570 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16571 restart_pa = virt_to_phys(restart_va);
16572- restart_lowmem = (void (*)(unsigned int))restart_pa;
16573+ restart_lowmem = (void *)restart_pa;
16574
16575 /* GDT[0]: GDT self-pointer */
16576 lowmem_gdt[0] =
16577@@ -374,7 +378,33 @@ void machine_real_restart(unsigned int type)
16578 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16579
16580 /* Jump to the identity-mapped low memory code */
16581+
16582+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16583+ gdt = get_cpu_gdt_table(smp_processor_id());
16584+ pax_open_kernel();
16585+#ifdef CONFIG_PAX_MEMORY_UDEREF
16586+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16587+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16588+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16589+#endif
16590+#ifdef CONFIG_PAX_KERNEXEC
16591+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16592+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16593+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16594+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16595+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16596+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16597+#endif
16598+ pax_close_kernel();
16599+#endif
16600+
16601+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16602+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16603+ unreachable();
16604+#else
16605 restart_lowmem(type);
16606+#endif
16607+
16608 }
16609 #ifdef CONFIG_APM_MODULE
16610 EXPORT_SYMBOL(machine_real_restart);
16611@@ -532,7 +562,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
16612 * try to force a triple fault and then cycle between hitting the keyboard
16613 * controller and doing that
16614 */
16615-static void native_machine_emergency_restart(void)
16616+__noreturn static void native_machine_emergency_restart(void)
16617 {
16618 int i;
16619 int attempt = 0;
16620@@ -656,13 +686,13 @@ void native_machine_shutdown(void)
16621 #endif
16622 }
16623
16624-static void __machine_emergency_restart(int emergency)
16625+static __noreturn void __machine_emergency_restart(int emergency)
16626 {
16627 reboot_emergency = emergency;
16628 machine_ops.emergency_restart();
16629 }
16630
16631-static void native_machine_restart(char *__unused)
16632+static __noreturn void native_machine_restart(char *__unused)
16633 {
16634 printk("machine restart\n");
16635
16636@@ -671,7 +701,7 @@ static void native_machine_restart(char *__unused)
16637 __machine_emergency_restart(0);
16638 }
16639
16640-static void native_machine_halt(void)
16641+static __noreturn void native_machine_halt(void)
16642 {
16643 /* stop other cpus and apics */
16644 machine_shutdown();
16645@@ -682,7 +712,7 @@ static void native_machine_halt(void)
16646 stop_this_cpu(NULL);
16647 }
16648
16649-static void native_machine_power_off(void)
16650+__noreturn static void native_machine_power_off(void)
16651 {
16652 if (pm_power_off) {
16653 if (!reboot_force)
16654@@ -691,6 +721,7 @@ static void native_machine_power_off(void)
16655 }
16656 /* a fallback in case there is no PM info available */
16657 tboot_shutdown(TB_SHUTDOWN_HALT);
16658+ unreachable();
16659 }
16660
16661 struct machine_ops machine_ops = {
16662diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
16663index 7a6f3b3..bed145d7 100644
16664--- a/arch/x86/kernel/relocate_kernel_64.S
16665+++ b/arch/x86/kernel/relocate_kernel_64.S
16666@@ -11,6 +11,7 @@
16667 #include <asm/kexec.h>
16668 #include <asm/processor-flags.h>
16669 #include <asm/pgtable_types.h>
16670+#include <asm/alternative-asm.h>
16671
16672 /*
16673 * Must be relocatable PIC code callable as a C function
16674@@ -160,13 +161,14 @@ identity_mapped:
16675 xorq %rbp, %rbp
16676 xorq %r8, %r8
16677 xorq %r9, %r9
16678- xorq %r10, %r9
16679+ xorq %r10, %r10
16680 xorq %r11, %r11
16681 xorq %r12, %r12
16682 xorq %r13, %r13
16683 xorq %r14, %r14
16684 xorq %r15, %r15
16685
16686+ pax_force_retaddr 0, 1
16687 ret
16688
16689 1:
16690diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
16691index afaf384..1a101fe 100644
16692--- a/arch/x86/kernel/setup.c
16693+++ b/arch/x86/kernel/setup.c
16694@@ -447,7 +447,7 @@ static void __init parse_setup_data(void)
16695
16696 switch (data->type) {
16697 case SETUP_E820_EXT:
16698- parse_e820_ext(data);
16699+ parse_e820_ext((struct setup_data __force_kernel *)data);
16700 break;
16701 case SETUP_DTB:
16702 add_dtb(pa_data);
16703@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16704 * area (640->1Mb) as ram even though it is not.
16705 * take them out.
16706 */
16707- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16708+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16709 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16710 }
16711
16712@@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
16713
16714 if (!boot_params.hdr.root_flags)
16715 root_mountflags &= ~MS_RDONLY;
16716- init_mm.start_code = (unsigned long) _text;
16717- init_mm.end_code = (unsigned long) _etext;
16718+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16719+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16720 init_mm.end_data = (unsigned long) _edata;
16721 init_mm.brk = _brk_end;
16722
16723- code_resource.start = virt_to_phys(_text);
16724- code_resource.end = virt_to_phys(_etext)-1;
16725- data_resource.start = virt_to_phys(_etext);
16726+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16727+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16728+ data_resource.start = virt_to_phys(_sdata);
16729 data_resource.end = virt_to_phys(_edata)-1;
16730 bss_resource.start = virt_to_phys(&__bss_start);
16731 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16732diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
16733index 71f4727..16dc9f7 100644
16734--- a/arch/x86/kernel/setup_percpu.c
16735+++ b/arch/x86/kernel/setup_percpu.c
16736@@ -21,19 +21,17 @@
16737 #include <asm/cpu.h>
16738 #include <asm/stackprotector.h>
16739
16740-DEFINE_PER_CPU(int, cpu_number);
16741+#ifdef CONFIG_SMP
16742+DEFINE_PER_CPU(unsigned int, cpu_number);
16743 EXPORT_PER_CPU_SYMBOL(cpu_number);
16744+#endif
16745
16746-#ifdef CONFIG_X86_64
16747 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16748-#else
16749-#define BOOT_PERCPU_OFFSET 0
16750-#endif
16751
16752 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16753 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16754
16755-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16756+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16757 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16758 };
16759 EXPORT_SYMBOL(__per_cpu_offset);
16760@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
16761 {
16762 #ifdef CONFIG_X86_32
16763 struct desc_struct gdt;
16764+ unsigned long base = per_cpu_offset(cpu);
16765
16766- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16767- 0x2 | DESCTYPE_S, 0x8);
16768- gdt.s = 1;
16769+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16770+ 0x83 | DESCTYPE_S, 0xC);
16771 write_gdt_entry(get_cpu_gdt_table(cpu),
16772 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16773 #endif
16774@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
16775 /* alrighty, percpu areas up and running */
16776 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16777 for_each_possible_cpu(cpu) {
16778+#ifdef CONFIG_CC_STACKPROTECTOR
16779+#ifdef CONFIG_X86_32
16780+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
16781+#endif
16782+#endif
16783 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
16784 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
16785 per_cpu(cpu_number, cpu) = cpu;
16786@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
16787 */
16788 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
16789 #endif
16790+#ifdef CONFIG_CC_STACKPROTECTOR
16791+#ifdef CONFIG_X86_32
16792+ if (!cpu)
16793+ per_cpu(stack_canary.canary, cpu) = canary;
16794+#endif
16795+#endif
16796 /*
16797 * Up to this point, the boot CPU has been using .init.data
16798 * area. Reload any changed state for the boot CPU.
16799diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
16800index 54ddaeb2..a6aa4d2 100644
16801--- a/arch/x86/kernel/signal.c
16802+++ b/arch/x86/kernel/signal.c
16803@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsigned long sp)
16804 * Align the stack pointer according to the i386 ABI,
16805 * i.e. so that on function entry ((sp + 4) & 15) == 0.
16806 */
16807- sp = ((sp + 4) & -16ul) - 4;
16808+ sp = ((sp - 12) & -16ul) - 4;
16809 #else /* !CONFIG_X86_32 */
16810 sp = round_down(sp, 16) - 8;
16811 #endif
16812@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
16813 * Return an always-bogus address instead so we will die with SIGSEGV.
16814 */
16815 if (onsigstack && !likely(on_sig_stack(sp)))
16816- return (void __user *)-1L;
16817+ return (__force void __user *)-1L;
16818
16819 /* save i387 state */
16820 if (used_math() && save_i387_xstate(*fpstate) < 0)
16821- return (void __user *)-1L;
16822+ return (__force void __user *)-1L;
16823
16824 return (void __user *)sp;
16825 }
16826@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16827 }
16828
16829 if (current->mm->context.vdso)
16830- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16831+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16832 else
16833- restorer = &frame->retcode;
16834+ restorer = (void __user *)&frame->retcode;
16835 if (ka->sa.sa_flags & SA_RESTORER)
16836 restorer = ka->sa.sa_restorer;
16837
16838@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16839 * reasons and because gdb uses it as a signature to notice
16840 * signal handler stack frames.
16841 */
16842- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
16843+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
16844
16845 if (err)
16846 return -EFAULT;
16847@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16848 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
16849
16850 /* Set up to return from userspace. */
16851- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16852+ if (current->mm->context.vdso)
16853+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16854+ else
16855+ restorer = (void __user *)&frame->retcode;
16856 if (ka->sa.sa_flags & SA_RESTORER)
16857 restorer = ka->sa.sa_restorer;
16858 put_user_ex(restorer, &frame->pretcode);
16859@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16860 * reasons and because gdb uses it as a signature to notice
16861 * signal handler stack frames.
16862 */
16863- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
16864+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
16865 } put_user_catch(err);
16866
16867 if (err)
16868@@ -762,6 +765,8 @@ static void do_signal(struct pt_regs *regs)
16869 siginfo_t info;
16870 int signr;
16871
16872+ pax_track_stack();
16873+
16874 /*
16875 * We want the common case to go fast, which is why we may in certain
16876 * cases get here from kernel mode. Just return without doing anything
16877@@ -769,7 +774,7 @@ static void do_signal(struct pt_regs *regs)
16878 * X86_32: vm86 regs switched out by assembly code before reaching
16879 * here, so testing against kernel CS suffices.
16880 */
16881- if (!user_mode(regs))
16882+ if (!user_mode_novm(regs))
16883 return;
16884
16885 signr = get_signal_to_deliver(&info, &ka, regs, NULL);
16886diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
16887index 9f548cb..caf76f7 100644
16888--- a/arch/x86/kernel/smpboot.c
16889+++ b/arch/x86/kernel/smpboot.c
16890@@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
16891 set_idle_for_cpu(cpu, c_idle.idle);
16892 do_rest:
16893 per_cpu(current_task, cpu) = c_idle.idle;
16894+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
16895 #ifdef CONFIG_X86_32
16896 /* Stack for startup_32 can be just as for start_secondary onwards */
16897 irq_ctx_init(cpu);
16898 #else
16899 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
16900 initial_gs = per_cpu_offset(cpu);
16901- per_cpu(kernel_stack, cpu) =
16902- (unsigned long)task_stack_page(c_idle.idle) -
16903- KERNEL_STACK_OFFSET + THREAD_SIZE;
16904+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
16905 #endif
16906+
16907+ pax_open_kernel();
16908 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
16909+ pax_close_kernel();
16910+
16911 initial_code = (unsigned long)start_secondary;
16912 stack_start = c_idle.idle->thread.sp;
16913
16914@@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
16915
16916 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
16917
16918+#ifdef CONFIG_PAX_PER_CPU_PGD
16919+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
16920+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16921+ KERNEL_PGD_PTRS);
16922+#endif
16923+
16924 err = do_boot_cpu(apicid, cpu);
16925 if (err) {
16926 pr_debug("do_boot_cpu failed %d\n", err);
16927diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
16928index c346d11..d43b163 100644
16929--- a/arch/x86/kernel/step.c
16930+++ b/arch/x86/kernel/step.c
16931@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16932 struct desc_struct *desc;
16933 unsigned long base;
16934
16935- seg &= ~7UL;
16936+ seg >>= 3;
16937
16938 mutex_lock(&child->mm->context.lock);
16939- if (unlikely((seg >> 3) >= child->mm->context.size))
16940+ if (unlikely(seg >= child->mm->context.size))
16941 addr = -1L; /* bogus selector, access would fault */
16942 else {
16943 desc = child->mm->context.ldt + seg;
16944@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16945 addr += base;
16946 }
16947 mutex_unlock(&child->mm->context.lock);
16948- }
16949+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
16950+ addr = ktla_ktva(addr);
16951
16952 return addr;
16953 }
16954@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
16955 unsigned char opcode[15];
16956 unsigned long addr = convert_ip_to_linear(child, regs);
16957
16958+ if (addr == -EINVAL)
16959+ return 0;
16960+
16961 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
16962 for (i = 0; i < copied; i++) {
16963 switch (opcode[i]) {
16964diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
16965index 0b0cb5f..db6b9ed 100644
16966--- a/arch/x86/kernel/sys_i386_32.c
16967+++ b/arch/x86/kernel/sys_i386_32.c
16968@@ -24,17 +24,224 @@
16969
16970 #include <asm/syscalls.h>
16971
16972-/*
16973- * Do a system call from kernel instead of calling sys_execve so we
16974- * end up with proper pt_regs.
16975- */
16976-int kernel_execve(const char *filename,
16977- const char *const argv[],
16978- const char *const envp[])
16979+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
16980 {
16981- long __res;
16982- asm volatile ("int $0x80"
16983- : "=a" (__res)
16984- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
16985- return __res;
16986+ unsigned long pax_task_size = TASK_SIZE;
16987+
16988+#ifdef CONFIG_PAX_SEGMEXEC
16989+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
16990+ pax_task_size = SEGMEXEC_TASK_SIZE;
16991+#endif
16992+
16993+ if (len > pax_task_size || addr > pax_task_size - len)
16994+ return -EINVAL;
16995+
16996+ return 0;
16997+}
16998+
16999+unsigned long
17000+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17001+ unsigned long len, unsigned long pgoff, unsigned long flags)
17002+{
17003+ struct mm_struct *mm = current->mm;
17004+ struct vm_area_struct *vma;
17005+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17006+
17007+#ifdef CONFIG_PAX_SEGMEXEC
17008+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17009+ pax_task_size = SEGMEXEC_TASK_SIZE;
17010+#endif
17011+
17012+ pax_task_size -= PAGE_SIZE;
17013+
17014+ if (len > pax_task_size)
17015+ return -ENOMEM;
17016+
17017+ if (flags & MAP_FIXED)
17018+ return addr;
17019+
17020+#ifdef CONFIG_PAX_RANDMMAP
17021+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17022+#endif
17023+
17024+ if (addr) {
17025+ addr = PAGE_ALIGN(addr);
17026+ if (pax_task_size - len >= addr) {
17027+ vma = find_vma(mm, addr);
17028+ if (check_heap_stack_gap(vma, addr, len))
17029+ return addr;
17030+ }
17031+ }
17032+ if (len > mm->cached_hole_size) {
17033+ start_addr = addr = mm->free_area_cache;
17034+ } else {
17035+ start_addr = addr = mm->mmap_base;
17036+ mm->cached_hole_size = 0;
17037+ }
17038+
17039+#ifdef CONFIG_PAX_PAGEEXEC
17040+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17041+ start_addr = 0x00110000UL;
17042+
17043+#ifdef CONFIG_PAX_RANDMMAP
17044+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17045+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17046+#endif
17047+
17048+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17049+ start_addr = addr = mm->mmap_base;
17050+ else
17051+ addr = start_addr;
17052+ }
17053+#endif
17054+
17055+full_search:
17056+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17057+ /* At this point: (!vma || addr < vma->vm_end). */
17058+ if (pax_task_size - len < addr) {
17059+ /*
17060+ * Start a new search - just in case we missed
17061+ * some holes.
17062+ */
17063+ if (start_addr != mm->mmap_base) {
17064+ start_addr = addr = mm->mmap_base;
17065+ mm->cached_hole_size = 0;
17066+ goto full_search;
17067+ }
17068+ return -ENOMEM;
17069+ }
17070+ if (check_heap_stack_gap(vma, addr, len))
17071+ break;
17072+ if (addr + mm->cached_hole_size < vma->vm_start)
17073+ mm->cached_hole_size = vma->vm_start - addr;
17074+ addr = vma->vm_end;
17075+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17076+ start_addr = addr = mm->mmap_base;
17077+ mm->cached_hole_size = 0;
17078+ goto full_search;
17079+ }
17080+ }
17081+
17082+ /*
17083+ * Remember the place where we stopped the search:
17084+ */
17085+ mm->free_area_cache = addr + len;
17086+ return addr;
17087+}
17088+
17089+unsigned long
17090+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17091+ const unsigned long len, const unsigned long pgoff,
17092+ const unsigned long flags)
17093+{
17094+ struct vm_area_struct *vma;
17095+ struct mm_struct *mm = current->mm;
17096+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17097+
17098+#ifdef CONFIG_PAX_SEGMEXEC
17099+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17100+ pax_task_size = SEGMEXEC_TASK_SIZE;
17101+#endif
17102+
17103+ pax_task_size -= PAGE_SIZE;
17104+
17105+ /* requested length too big for entire address space */
17106+ if (len > pax_task_size)
17107+ return -ENOMEM;
17108+
17109+ if (flags & MAP_FIXED)
17110+ return addr;
17111+
17112+#ifdef CONFIG_PAX_PAGEEXEC
17113+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17114+ goto bottomup;
17115+#endif
17116+
17117+#ifdef CONFIG_PAX_RANDMMAP
17118+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17119+#endif
17120+
17121+ /* requesting a specific address */
17122+ if (addr) {
17123+ addr = PAGE_ALIGN(addr);
17124+ if (pax_task_size - len >= addr) {
17125+ vma = find_vma(mm, addr);
17126+ if (check_heap_stack_gap(vma, addr, len))
17127+ return addr;
17128+ }
17129+ }
17130+
17131+ /* check if free_area_cache is useful for us */
17132+ if (len <= mm->cached_hole_size) {
17133+ mm->cached_hole_size = 0;
17134+ mm->free_area_cache = mm->mmap_base;
17135+ }
17136+
17137+ /* either no address requested or can't fit in requested address hole */
17138+ addr = mm->free_area_cache;
17139+
17140+ /* make sure it can fit in the remaining address space */
17141+ if (addr > len) {
17142+ vma = find_vma(mm, addr-len);
17143+ if (check_heap_stack_gap(vma, addr - len, len))
17144+ /* remember the address as a hint for next time */
17145+ return (mm->free_area_cache = addr-len);
17146+ }
17147+
17148+ if (mm->mmap_base < len)
17149+ goto bottomup;
17150+
17151+ addr = mm->mmap_base-len;
17152+
17153+ do {
17154+ /*
17155+ * Lookup failure means no vma is above this address,
17156+ * else if new region fits below vma->vm_start,
17157+ * return with success:
17158+ */
17159+ vma = find_vma(mm, addr);
17160+ if (check_heap_stack_gap(vma, addr, len))
17161+ /* remember the address as a hint for next time */
17162+ return (mm->free_area_cache = addr);
17163+
17164+ /* remember the largest hole we saw so far */
17165+ if (addr + mm->cached_hole_size < vma->vm_start)
17166+ mm->cached_hole_size = vma->vm_start - addr;
17167+
17168+ /* try just below the current vma->vm_start */
17169+ addr = skip_heap_stack_gap(vma, len);
17170+ } while (!IS_ERR_VALUE(addr));
17171+
17172+bottomup:
17173+ /*
17174+ * A failed mmap() very likely causes application failure,
17175+ * so fall back to the bottom-up function here. This scenario
17176+ * can happen with large stack limits and large mmap()
17177+ * allocations.
17178+ */
17179+
17180+#ifdef CONFIG_PAX_SEGMEXEC
17181+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17182+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17183+ else
17184+#endif
17185+
17186+ mm->mmap_base = TASK_UNMAPPED_BASE;
17187+
17188+#ifdef CONFIG_PAX_RANDMMAP
17189+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17190+ mm->mmap_base += mm->delta_mmap;
17191+#endif
17192+
17193+ mm->free_area_cache = mm->mmap_base;
17194+ mm->cached_hole_size = ~0UL;
17195+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17196+ /*
17197+ * Restore the topdown base:
17198+ */
17199+ mm->mmap_base = base;
17200+ mm->free_area_cache = base;
17201+ mm->cached_hole_size = ~0UL;
17202+
17203+ return addr;
17204 }
17205diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
17206index ff14a50..35626c3 100644
17207--- a/arch/x86/kernel/sys_x86_64.c
17208+++ b/arch/x86/kernel/sys_x86_64.c
17209@@ -32,8 +32,8 @@ out:
17210 return error;
17211 }
17212
17213-static void find_start_end(unsigned long flags, unsigned long *begin,
17214- unsigned long *end)
17215+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17216+ unsigned long *begin, unsigned long *end)
17217 {
17218 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17219 unsigned long new_begin;
17220@@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
17221 *begin = new_begin;
17222 }
17223 } else {
17224- *begin = TASK_UNMAPPED_BASE;
17225+ *begin = mm->mmap_base;
17226 *end = TASK_SIZE;
17227 }
17228 }
17229@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
17230 if (flags & MAP_FIXED)
17231 return addr;
17232
17233- find_start_end(flags, &begin, &end);
17234+ find_start_end(mm, flags, &begin, &end);
17235
17236 if (len > end)
17237 return -ENOMEM;
17238
17239+#ifdef CONFIG_PAX_RANDMMAP
17240+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17241+#endif
17242+
17243 if (addr) {
17244 addr = PAGE_ALIGN(addr);
17245 vma = find_vma(mm, addr);
17246- if (end - len >= addr &&
17247- (!vma || addr + len <= vma->vm_start))
17248+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17249 return addr;
17250 }
17251 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17252@@ -106,7 +109,7 @@ full_search:
17253 }
17254 return -ENOMEM;
17255 }
17256- if (!vma || addr + len <= vma->vm_start) {
17257+ if (check_heap_stack_gap(vma, addr, len)) {
17258 /*
17259 * Remember the place where we stopped the search:
17260 */
17261@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17262 {
17263 struct vm_area_struct *vma;
17264 struct mm_struct *mm = current->mm;
17265- unsigned long addr = addr0;
17266+ unsigned long base = mm->mmap_base, addr = addr0;
17267
17268 /* requested length too big for entire address space */
17269 if (len > TASK_SIZE)
17270@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17271 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17272 goto bottomup;
17273
17274+#ifdef CONFIG_PAX_RANDMMAP
17275+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17276+#endif
17277+
17278 /* requesting a specific address */
17279 if (addr) {
17280 addr = PAGE_ALIGN(addr);
17281- vma = find_vma(mm, addr);
17282- if (TASK_SIZE - len >= addr &&
17283- (!vma || addr + len <= vma->vm_start))
17284- return addr;
17285+ if (TASK_SIZE - len >= addr) {
17286+ vma = find_vma(mm, addr);
17287+ if (check_heap_stack_gap(vma, addr, len))
17288+ return addr;
17289+ }
17290 }
17291
17292 /* check if free_area_cache is useful for us */
17293@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17294 /* make sure it can fit in the remaining address space */
17295 if (addr > len) {
17296 vma = find_vma(mm, addr-len);
17297- if (!vma || addr <= vma->vm_start)
17298+ if (check_heap_stack_gap(vma, addr - len, len))
17299 /* remember the address as a hint for next time */
17300 return mm->free_area_cache = addr-len;
17301 }
17302@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17303 * return with success:
17304 */
17305 vma = find_vma(mm, addr);
17306- if (!vma || addr+len <= vma->vm_start)
17307+ if (check_heap_stack_gap(vma, addr, len))
17308 /* remember the address as a hint for next time */
17309 return mm->free_area_cache = addr;
17310
17311@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17312 mm->cached_hole_size = vma->vm_start - addr;
17313
17314 /* try just below the current vma->vm_start */
17315- addr = vma->vm_start-len;
17316- } while (len < vma->vm_start);
17317+ addr = skip_heap_stack_gap(vma, len);
17318+ } while (!IS_ERR_VALUE(addr));
17319
17320 bottomup:
17321 /*
17322@@ -198,13 +206,21 @@ bottomup:
17323 * can happen with large stack limits and large mmap()
17324 * allocations.
17325 */
17326+ mm->mmap_base = TASK_UNMAPPED_BASE;
17327+
17328+#ifdef CONFIG_PAX_RANDMMAP
17329+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17330+ mm->mmap_base += mm->delta_mmap;
17331+#endif
17332+
17333+ mm->free_area_cache = mm->mmap_base;
17334 mm->cached_hole_size = ~0UL;
17335- mm->free_area_cache = TASK_UNMAPPED_BASE;
17336 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17337 /*
17338 * Restore the topdown base:
17339 */
17340- mm->free_area_cache = mm->mmap_base;
17341+ mm->mmap_base = base;
17342+ mm->free_area_cache = base;
17343 mm->cached_hole_size = ~0UL;
17344
17345 return addr;
17346diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
17347index bc19be3..0f5fbf7 100644
17348--- a/arch/x86/kernel/syscall_table_32.S
17349+++ b/arch/x86/kernel/syscall_table_32.S
17350@@ -1,3 +1,4 @@
17351+.section .rodata,"a",@progbits
17352 ENTRY(sys_call_table)
17353 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17354 .long sys_exit
17355diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
17356index e07a2fc..db0369d 100644
17357--- a/arch/x86/kernel/tboot.c
17358+++ b/arch/x86/kernel/tboot.c
17359@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17360
17361 void tboot_shutdown(u32 shutdown_type)
17362 {
17363- void (*shutdown)(void);
17364+ void (* __noreturn shutdown)(void);
17365
17366 if (!tboot_enabled())
17367 return;
17368@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17369
17370 switch_to_tboot_pt();
17371
17372- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17373+ shutdown = (void *)tboot->shutdown_entry;
17374 shutdown();
17375
17376 /* should not reach here */
17377@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
17378 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17379 }
17380
17381-static atomic_t ap_wfs_count;
17382+static atomic_unchecked_t ap_wfs_count;
17383
17384 static int tboot_wait_for_aps(int num_aps)
17385 {
17386@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
17387 {
17388 switch (action) {
17389 case CPU_DYING:
17390- atomic_inc(&ap_wfs_count);
17391+ atomic_inc_unchecked(&ap_wfs_count);
17392 if (num_online_cpus() == 1)
17393- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17394+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17395 return NOTIFY_BAD;
17396 break;
17397 }
17398@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17399
17400 tboot_create_trampoline();
17401
17402- atomic_set(&ap_wfs_count, 0);
17403+ atomic_set_unchecked(&ap_wfs_count, 0);
17404 register_hotcpu_notifier(&tboot_cpu_notifier);
17405 return 0;
17406 }
17407diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
17408index 5a64d05..804587b 100644
17409--- a/arch/x86/kernel/time.c
17410+++ b/arch/x86/kernel/time.c
17411@@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
17412 {
17413 unsigned long pc = instruction_pointer(regs);
17414
17415- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17416+ if (!user_mode(regs) && in_lock_functions(pc)) {
17417 #ifdef CONFIG_FRAME_POINTER
17418- return *(unsigned long *)(regs->bp + sizeof(long));
17419+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17420 #else
17421 unsigned long *sp =
17422 (unsigned long *)kernel_stack_pointer(regs);
17423@@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
17424 * or above a saved flags. Eflags has bits 22-31 zero,
17425 * kernel addresses don't.
17426 */
17427+
17428+#ifdef CONFIG_PAX_KERNEXEC
17429+ return ktla_ktva(sp[0]);
17430+#else
17431 if (sp[0] >> 22)
17432 return sp[0];
17433 if (sp[1] >> 22)
17434 return sp[1];
17435 #endif
17436+
17437+#endif
17438 }
17439 return pc;
17440 }
17441diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
17442index 6bb7b85..dd853e1 100644
17443--- a/arch/x86/kernel/tls.c
17444+++ b/arch/x86/kernel/tls.c
17445@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
17446 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17447 return -EINVAL;
17448
17449+#ifdef CONFIG_PAX_SEGMEXEC
17450+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17451+ return -EINVAL;
17452+#endif
17453+
17454 set_tls_desc(p, idx, &info, 1);
17455
17456 return 0;
17457diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
17458index 451c0a7..e57f551 100644
17459--- a/arch/x86/kernel/trampoline_32.S
17460+++ b/arch/x86/kernel/trampoline_32.S
17461@@ -32,6 +32,12 @@
17462 #include <asm/segment.h>
17463 #include <asm/page_types.h>
17464
17465+#ifdef CONFIG_PAX_KERNEXEC
17466+#define ta(X) (X)
17467+#else
17468+#define ta(X) ((X) - __PAGE_OFFSET)
17469+#endif
17470+
17471 #ifdef CONFIG_SMP
17472
17473 .section ".x86_trampoline","a"
17474@@ -62,7 +68,7 @@ r_base = .
17475 inc %ax # protected mode (PE) bit
17476 lmsw %ax # into protected mode
17477 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17478- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17479+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17480
17481 # These need to be in the same 64K segment as the above;
17482 # hence we don't use the boot_gdt_descr defined in head.S
17483diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
17484index 09ff517..df19fbff 100644
17485--- a/arch/x86/kernel/trampoline_64.S
17486+++ b/arch/x86/kernel/trampoline_64.S
17487@@ -90,7 +90,7 @@ startup_32:
17488 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17489 movl %eax, %ds
17490
17491- movl $X86_CR4_PAE, %eax
17492+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17493 movl %eax, %cr4 # Enable PAE mode
17494
17495 # Setup trampoline 4 level pagetables
17496@@ -138,7 +138,7 @@ tidt:
17497 # so the kernel can live anywhere
17498 .balign 4
17499 tgdt:
17500- .short tgdt_end - tgdt # gdt limit
17501+ .short tgdt_end - tgdt - 1 # gdt limit
17502 .long tgdt - r_base
17503 .short 0
17504 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17505diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
17506index 6913369..7e7dff6 100644
17507--- a/arch/x86/kernel/traps.c
17508+++ b/arch/x86/kernel/traps.c
17509@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17510
17511 /* Do we ignore FPU interrupts ? */
17512 char ignore_fpu_irq;
17513-
17514-/*
17515- * The IDT has to be page-aligned to simplify the Pentium
17516- * F0 0F bug workaround.
17517- */
17518-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17519 #endif
17520
17521 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17522@@ -117,13 +111,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
17523 }
17524
17525 static void __kprobes
17526-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17527+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17528 long error_code, siginfo_t *info)
17529 {
17530 struct task_struct *tsk = current;
17531
17532 #ifdef CONFIG_X86_32
17533- if (regs->flags & X86_VM_MASK) {
17534+ if (v8086_mode(regs)) {
17535 /*
17536 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17537 * On nmi (interrupt 2), do_trap should not be called.
17538@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17539 }
17540 #endif
17541
17542- if (!user_mode(regs))
17543+ if (!user_mode_novm(regs))
17544 goto kernel_trap;
17545
17546 #ifdef CONFIG_X86_32
17547@@ -157,7 +151,7 @@ trap_signal:
17548 printk_ratelimit()) {
17549 printk(KERN_INFO
17550 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17551- tsk->comm, tsk->pid, str,
17552+ tsk->comm, task_pid_nr(tsk), str,
17553 regs->ip, regs->sp, error_code);
17554 print_vma_addr(" in ", regs->ip);
17555 printk("\n");
17556@@ -174,8 +168,20 @@ kernel_trap:
17557 if (!fixup_exception(regs)) {
17558 tsk->thread.error_code = error_code;
17559 tsk->thread.trap_no = trapnr;
17560+
17561+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17562+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17563+ str = "PAX: suspicious stack segment fault";
17564+#endif
17565+
17566 die(str, regs, error_code);
17567 }
17568+
17569+#ifdef CONFIG_PAX_REFCOUNT
17570+ if (trapnr == 4)
17571+ pax_report_refcount_overflow(regs);
17572+#endif
17573+
17574 return;
17575
17576 #ifdef CONFIG_X86_32
17577@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
17578 conditional_sti(regs);
17579
17580 #ifdef CONFIG_X86_32
17581- if (regs->flags & X86_VM_MASK)
17582+ if (v8086_mode(regs))
17583 goto gp_in_vm86;
17584 #endif
17585
17586 tsk = current;
17587- if (!user_mode(regs))
17588+ if (!user_mode_novm(regs))
17589 goto gp_in_kernel;
17590
17591+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17592+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17593+ struct mm_struct *mm = tsk->mm;
17594+ unsigned long limit;
17595+
17596+ down_write(&mm->mmap_sem);
17597+ limit = mm->context.user_cs_limit;
17598+ if (limit < TASK_SIZE) {
17599+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17600+ up_write(&mm->mmap_sem);
17601+ return;
17602+ }
17603+ up_write(&mm->mmap_sem);
17604+ }
17605+#endif
17606+
17607 tsk->thread.error_code = error_code;
17608 tsk->thread.trap_no = 13;
17609
17610@@ -304,6 +326,13 @@ gp_in_kernel:
17611 if (notify_die(DIE_GPF, "general protection fault", regs,
17612 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17613 return;
17614+
17615+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17616+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17617+ die("PAX: suspicious general protection fault", regs, error_code);
17618+ else
17619+#endif
17620+
17621 die("general protection fault", regs, error_code);
17622 }
17623
17624@@ -433,6 +462,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
17625 dotraplinkage notrace __kprobes void
17626 do_nmi(struct pt_regs *regs, long error_code)
17627 {
17628+
17629+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17630+ if (!user_mode(regs)) {
17631+ unsigned long cs = regs->cs & 0xFFFF;
17632+ unsigned long ip = ktva_ktla(regs->ip);
17633+
17634+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
17635+ regs->ip = ip;
17636+ }
17637+#endif
17638+
17639 nmi_enter();
17640
17641 inc_irq_stat(__nmi_count);
17642@@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17643 /* It's safe to allow irq's after DR6 has been saved */
17644 preempt_conditional_sti(regs);
17645
17646- if (regs->flags & X86_VM_MASK) {
17647+ if (v8086_mode(regs)) {
17648 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17649 error_code, 1);
17650 preempt_conditional_cli(regs);
17651@@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17652 * We already checked v86 mode above, so we can check for kernel mode
17653 * by just checking the CPL of CS.
17654 */
17655- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17656+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17657 tsk->thread.debugreg6 &= ~DR_STEP;
17658 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17659 regs->flags &= ~X86_EFLAGS_TF;
17660@@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
17661 return;
17662 conditional_sti(regs);
17663
17664- if (!user_mode_vm(regs))
17665+ if (!user_mode(regs))
17666 {
17667 if (!fixup_exception(regs)) {
17668 task->thread.error_code = error_code;
17669@@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
17670 void __math_state_restore(void)
17671 {
17672 struct thread_info *thread = current_thread_info();
17673- struct task_struct *tsk = thread->task;
17674+ struct task_struct *tsk = current;
17675
17676 /*
17677 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17678@@ -750,8 +790,7 @@ void __math_state_restore(void)
17679 */
17680 asmlinkage void math_state_restore(void)
17681 {
17682- struct thread_info *thread = current_thread_info();
17683- struct task_struct *tsk = thread->task;
17684+ struct task_struct *tsk = current;
17685
17686 if (!tsk_used_math(tsk)) {
17687 local_irq_enable();
17688diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
17689index b9242ba..50c5edd 100644
17690--- a/arch/x86/kernel/verify_cpu.S
17691+++ b/arch/x86/kernel/verify_cpu.S
17692@@ -20,6 +20,7 @@
17693 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
17694 * arch/x86/kernel/trampoline_64.S: secondary processor verification
17695 * arch/x86/kernel/head_32.S: processor startup
17696+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
17697 *
17698 * verify_cpu, returns the status of longmode and SSE in register %eax.
17699 * 0: Success 1: Failure
17700diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
17701index 863f875..4307295 100644
17702--- a/arch/x86/kernel/vm86_32.c
17703+++ b/arch/x86/kernel/vm86_32.c
17704@@ -41,6 +41,7 @@
17705 #include <linux/ptrace.h>
17706 #include <linux/audit.h>
17707 #include <linux/stddef.h>
17708+#include <linux/grsecurity.h>
17709
17710 #include <asm/uaccess.h>
17711 #include <asm/io.h>
17712@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
17713 do_exit(SIGSEGV);
17714 }
17715
17716- tss = &per_cpu(init_tss, get_cpu());
17717+ tss = init_tss + get_cpu();
17718 current->thread.sp0 = current->thread.saved_sp0;
17719 current->thread.sysenter_cs = __KERNEL_CS;
17720 load_sp0(tss, &current->thread);
17721@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
17722 struct task_struct *tsk;
17723 int tmp, ret = -EPERM;
17724
17725+#ifdef CONFIG_GRKERNSEC_VM86
17726+ if (!capable(CAP_SYS_RAWIO)) {
17727+ gr_handle_vm86();
17728+ goto out;
17729+ }
17730+#endif
17731+
17732 tsk = current;
17733 if (tsk->thread.saved_sp0)
17734 goto out;
17735@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
17736 int tmp, ret;
17737 struct vm86plus_struct __user *v86;
17738
17739+#ifdef CONFIG_GRKERNSEC_VM86
17740+ if (!capable(CAP_SYS_RAWIO)) {
17741+ gr_handle_vm86();
17742+ ret = -EPERM;
17743+ goto out;
17744+ }
17745+#endif
17746+
17747 tsk = current;
17748 switch (cmd) {
17749 case VM86_REQUEST_IRQ:
17750@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
17751 tsk->thread.saved_fs = info->regs32->fs;
17752 tsk->thread.saved_gs = get_user_gs(info->regs32);
17753
17754- tss = &per_cpu(init_tss, get_cpu());
17755+ tss = init_tss + get_cpu();
17756 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17757 if (cpu_has_sep)
17758 tsk->thread.sysenter_cs = 0;
17759@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
17760 goto cannot_handle;
17761 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17762 goto cannot_handle;
17763- intr_ptr = (unsigned long __user *) (i << 2);
17764+ intr_ptr = (__force unsigned long __user *) (i << 2);
17765 if (get_user(segoffs, intr_ptr))
17766 goto cannot_handle;
17767 if ((segoffs >> 16) == BIOSSEG)
17768diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
17769index 0f703f1..9e15f64 100644
17770--- a/arch/x86/kernel/vmlinux.lds.S
17771+++ b/arch/x86/kernel/vmlinux.lds.S
17772@@ -26,6 +26,13 @@
17773 #include <asm/page_types.h>
17774 #include <asm/cache.h>
17775 #include <asm/boot.h>
17776+#include <asm/segment.h>
17777+
17778+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17779+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17780+#else
17781+#define __KERNEL_TEXT_OFFSET 0
17782+#endif
17783
17784 #undef i386 /* in case the preprocessor is a 32bit one */
17785
17786@@ -69,30 +76,43 @@ jiffies_64 = jiffies;
17787
17788 PHDRS {
17789 text PT_LOAD FLAGS(5); /* R_E */
17790+#ifdef CONFIG_X86_32
17791+ module PT_LOAD FLAGS(5); /* R_E */
17792+#endif
17793+#ifdef CONFIG_XEN
17794+ rodata PT_LOAD FLAGS(5); /* R_E */
17795+#else
17796+ rodata PT_LOAD FLAGS(4); /* R__ */
17797+#endif
17798 data PT_LOAD FLAGS(6); /* RW_ */
17799-#ifdef CONFIG_X86_64
17800+ init.begin PT_LOAD FLAGS(6); /* RW_ */
17801 #ifdef CONFIG_SMP
17802 percpu PT_LOAD FLAGS(6); /* RW_ */
17803 #endif
17804+ text.init PT_LOAD FLAGS(5); /* R_E */
17805+ text.exit PT_LOAD FLAGS(5); /* R_E */
17806 init PT_LOAD FLAGS(7); /* RWE */
17807-#endif
17808 note PT_NOTE FLAGS(0); /* ___ */
17809 }
17810
17811 SECTIONS
17812 {
17813 #ifdef CONFIG_X86_32
17814- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
17815- phys_startup_32 = startup_32 - LOAD_OFFSET;
17816+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
17817 #else
17818- . = __START_KERNEL;
17819- phys_startup_64 = startup_64 - LOAD_OFFSET;
17820+ . = __START_KERNEL;
17821 #endif
17822
17823 /* Text and read-only data */
17824- .text : AT(ADDR(.text) - LOAD_OFFSET) {
17825- _text = .;
17826+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17827 /* bootstrapping code */
17828+#ifdef CONFIG_X86_32
17829+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17830+#else
17831+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17832+#endif
17833+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17834+ _text = .;
17835 HEAD_TEXT
17836 #ifdef CONFIG_X86_32
17837 . = ALIGN(PAGE_SIZE);
17838@@ -108,13 +128,47 @@ SECTIONS
17839 IRQENTRY_TEXT
17840 *(.fixup)
17841 *(.gnu.warning)
17842- /* End of text section */
17843- _etext = .;
17844 } :text = 0x9090
17845
17846- NOTES :text :note
17847+ . += __KERNEL_TEXT_OFFSET;
17848
17849- EXCEPTION_TABLE(16) :text = 0x9090
17850+#ifdef CONFIG_X86_32
17851+ . = ALIGN(PAGE_SIZE);
17852+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
17853+
17854+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
17855+ MODULES_EXEC_VADDR = .;
17856+ BYTE(0)
17857+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
17858+ . = ALIGN(HPAGE_SIZE);
17859+ MODULES_EXEC_END = . - 1;
17860+#endif
17861+
17862+ } :module
17863+#endif
17864+
17865+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
17866+ /* End of text section */
17867+ _etext = . - __KERNEL_TEXT_OFFSET;
17868+ }
17869+
17870+#ifdef CONFIG_X86_32
17871+ . = ALIGN(PAGE_SIZE);
17872+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
17873+ *(.idt)
17874+ . = ALIGN(PAGE_SIZE);
17875+ *(.empty_zero_page)
17876+ *(.initial_pg_fixmap)
17877+ *(.initial_pg_pmd)
17878+ *(.initial_page_table)
17879+ *(.swapper_pg_dir)
17880+ } :rodata
17881+#endif
17882+
17883+ . = ALIGN(PAGE_SIZE);
17884+ NOTES :rodata :note
17885+
17886+ EXCEPTION_TABLE(16) :rodata
17887
17888 #if defined(CONFIG_DEBUG_RODATA)
17889 /* .text should occupy whole number of pages */
17890@@ -126,16 +180,20 @@ SECTIONS
17891
17892 /* Data */
17893 .data : AT(ADDR(.data) - LOAD_OFFSET) {
17894+
17895+#ifdef CONFIG_PAX_KERNEXEC
17896+ . = ALIGN(HPAGE_SIZE);
17897+#else
17898+ . = ALIGN(PAGE_SIZE);
17899+#endif
17900+
17901 /* Start of data section */
17902 _sdata = .;
17903
17904 /* init_task */
17905 INIT_TASK_DATA(THREAD_SIZE)
17906
17907-#ifdef CONFIG_X86_32
17908- /* 32 bit has nosave before _edata */
17909 NOSAVE_DATA
17910-#endif
17911
17912 PAGE_ALIGNED_DATA(PAGE_SIZE)
17913
17914@@ -176,12 +234,19 @@ SECTIONS
17915 #endif /* CONFIG_X86_64 */
17916
17917 /* Init code and data - will be freed after init */
17918- . = ALIGN(PAGE_SIZE);
17919 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
17920+ BYTE(0)
17921+
17922+#ifdef CONFIG_PAX_KERNEXEC
17923+ . = ALIGN(HPAGE_SIZE);
17924+#else
17925+ . = ALIGN(PAGE_SIZE);
17926+#endif
17927+
17928 __init_begin = .; /* paired with __init_end */
17929- }
17930+ } :init.begin
17931
17932-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
17933+#ifdef CONFIG_SMP
17934 /*
17935 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
17936 * output PHDR, so the next output section - .init.text - should
17937@@ -190,12 +255,27 @@ SECTIONS
17938 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
17939 #endif
17940
17941- INIT_TEXT_SECTION(PAGE_SIZE)
17942-#ifdef CONFIG_X86_64
17943- :init
17944-#endif
17945+ . = ALIGN(PAGE_SIZE);
17946+ init_begin = .;
17947+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
17948+ VMLINUX_SYMBOL(_sinittext) = .;
17949+ INIT_TEXT
17950+ VMLINUX_SYMBOL(_einittext) = .;
17951+ . = ALIGN(PAGE_SIZE);
17952+ } :text.init
17953
17954- INIT_DATA_SECTION(16)
17955+ /*
17956+ * .exit.text is discard at runtime, not link time, to deal with
17957+ * references from .altinstructions and .eh_frame
17958+ */
17959+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17960+ EXIT_TEXT
17961+ . = ALIGN(16);
17962+ } :text.exit
17963+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
17964+
17965+ . = ALIGN(PAGE_SIZE);
17966+ INIT_DATA_SECTION(16) :init
17967
17968 /*
17969 * Code and data for a variety of lowlevel trampolines, to be
17970@@ -269,19 +349,12 @@ SECTIONS
17971 }
17972
17973 . = ALIGN(8);
17974- /*
17975- * .exit.text is discard at runtime, not link time, to deal with
17976- * references from .altinstructions and .eh_frame
17977- */
17978- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
17979- EXIT_TEXT
17980- }
17981
17982 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
17983 EXIT_DATA
17984 }
17985
17986-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
17987+#ifndef CONFIG_SMP
17988 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
17989 #endif
17990
17991@@ -300,16 +373,10 @@ SECTIONS
17992 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
17993 __smp_locks = .;
17994 *(.smp_locks)
17995- . = ALIGN(PAGE_SIZE);
17996 __smp_locks_end = .;
17997+ . = ALIGN(PAGE_SIZE);
17998 }
17999
18000-#ifdef CONFIG_X86_64
18001- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18002- NOSAVE_DATA
18003- }
18004-#endif
18005-
18006 /* BSS */
18007 . = ALIGN(PAGE_SIZE);
18008 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18009@@ -325,6 +392,7 @@ SECTIONS
18010 __brk_base = .;
18011 . += 64 * 1024; /* 64k alignment slop space */
18012 *(.brk_reservation) /* areas brk users have reserved */
18013+ . = ALIGN(HPAGE_SIZE);
18014 __brk_limit = .;
18015 }
18016
18017@@ -351,13 +419,12 @@ SECTIONS
18018 * for the boot processor.
18019 */
18020 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18021-INIT_PER_CPU(gdt_page);
18022 INIT_PER_CPU(irq_stack_union);
18023
18024 /*
18025 * Build-time check on the image size:
18026 */
18027-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18028+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18029 "kernel image bigger than KERNEL_IMAGE_SIZE");
18030
18031 #ifdef CONFIG_SMP
18032diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
18033index b56c65de..561a55b 100644
18034--- a/arch/x86/kernel/vsyscall_64.c
18035+++ b/arch/x86/kernel/vsyscall_64.c
18036@@ -56,15 +56,13 @@ DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
18037 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
18038 };
18039
18040-static enum { EMULATE, NATIVE, NONE } vsyscall_mode = NATIVE;
18041+static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
18042
18043 static int __init vsyscall_setup(char *str)
18044 {
18045 if (str) {
18046 if (!strcmp("emulate", str))
18047 vsyscall_mode = EMULATE;
18048- else if (!strcmp("native", str))
18049- vsyscall_mode = NATIVE;
18050 else if (!strcmp("none", str))
18051 vsyscall_mode = NONE;
18052 else
18053@@ -177,7 +175,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18054
18055 tsk = current;
18056 if (seccomp_mode(&tsk->seccomp))
18057- do_exit(SIGKILL);
18058+ do_group_exit(SIGKILL);
18059
18060 switch (vsyscall_nr) {
18061 case 0:
18062@@ -219,8 +217,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18063 return true;
18064
18065 sigsegv:
18066- force_sig(SIGSEGV, current);
18067- return true;
18068+ do_group_exit(SIGKILL);
18069 }
18070
18071 /*
18072@@ -273,10 +270,7 @@ void __init map_vsyscall(void)
18073 extern char __vvar_page;
18074 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
18075
18076- __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
18077- vsyscall_mode == NATIVE
18078- ? PAGE_KERNEL_VSYSCALL
18079- : PAGE_KERNEL_VVAR);
18080+ __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
18081 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
18082 (unsigned long)VSYSCALL_START);
18083
18084diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
18085index 9796c2f..f686fbf 100644
18086--- a/arch/x86/kernel/x8664_ksyms_64.c
18087+++ b/arch/x86/kernel/x8664_ksyms_64.c
18088@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18089 EXPORT_SYMBOL(copy_user_generic_string);
18090 EXPORT_SYMBOL(copy_user_generic_unrolled);
18091 EXPORT_SYMBOL(__copy_user_nocache);
18092-EXPORT_SYMBOL(_copy_from_user);
18093-EXPORT_SYMBOL(_copy_to_user);
18094
18095 EXPORT_SYMBOL(copy_page);
18096 EXPORT_SYMBOL(clear_page);
18097diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
18098index a391134..d0b63b6e 100644
18099--- a/arch/x86/kernel/xsave.c
18100+++ b/arch/x86/kernel/xsave.c
18101@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
18102 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18103 return -EINVAL;
18104
18105- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18106+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18107 fx_sw_user->extended_size -
18108 FP_XSTATE_MAGIC2_SIZE));
18109 if (err)
18110@@ -267,7 +267,7 @@ fx_only:
18111 * the other extended state.
18112 */
18113 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18114- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18115+ return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
18116 }
18117
18118 /*
18119@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf)
18120 if (use_xsave())
18121 err = restore_user_xstate(buf);
18122 else
18123- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18124+ err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
18125 buf);
18126 if (unlikely(err)) {
18127 /*
18128diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
18129index 8b4cc5f..f086b5b 100644
18130--- a/arch/x86/kvm/emulate.c
18131+++ b/arch/x86/kvm/emulate.c
18132@@ -96,7 +96,7 @@
18133 #define Src2ImmByte (2<<29)
18134 #define Src2One (3<<29)
18135 #define Src2Imm (4<<29)
18136-#define Src2Mask (7<<29)
18137+#define Src2Mask (7U<<29)
18138
18139 #define X2(x...) x, x
18140 #define X3(x...) X2(x), x
18141@@ -207,6 +207,7 @@ struct gprefix {
18142
18143 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18144 do { \
18145+ unsigned long _tmp; \
18146 __asm__ __volatile__ ( \
18147 _PRE_EFLAGS("0", "4", "2") \
18148 _op _suffix " %"_x"3,%1; " \
18149@@ -220,8 +221,6 @@ struct gprefix {
18150 /* Raw emulation: instruction has two explicit operands. */
18151 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18152 do { \
18153- unsigned long _tmp; \
18154- \
18155 switch ((_dst).bytes) { \
18156 case 2: \
18157 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18158@@ -237,7 +236,6 @@ struct gprefix {
18159
18160 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18161 do { \
18162- unsigned long _tmp; \
18163 switch ((_dst).bytes) { \
18164 case 1: \
18165 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18166diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
18167index 57dcbd4..79aba9b 100644
18168--- a/arch/x86/kvm/lapic.c
18169+++ b/arch/x86/kvm/lapic.c
18170@@ -53,7 +53,7 @@
18171 #define APIC_BUS_CYCLE_NS 1
18172
18173 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18174-#define apic_debug(fmt, arg...)
18175+#define apic_debug(fmt, arg...) do {} while (0)
18176
18177 #define APIC_LVT_NUM 6
18178 /* 14 is the version for Xeon and Pentium 8.4.8*/
18179diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
18180index 8e8da79..13bc641 100644
18181--- a/arch/x86/kvm/mmu.c
18182+++ b/arch/x86/kvm/mmu.c
18183@@ -3552,7 +3552,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18184
18185 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18186
18187- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18188+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18189
18190 /*
18191 * Assume that the pte write on a page table of the same type
18192@@ -3584,7 +3584,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18193 }
18194
18195 spin_lock(&vcpu->kvm->mmu_lock);
18196- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18197+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18198 gentry = 0;
18199 kvm_mmu_free_some_pages(vcpu);
18200 ++vcpu->kvm->stat.mmu_pte_write;
18201diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
18202index 507e2b8..fc55f89 100644
18203--- a/arch/x86/kvm/paging_tmpl.h
18204+++ b/arch/x86/kvm/paging_tmpl.h
18205@@ -197,7 +197,7 @@ retry_walk:
18206 if (unlikely(kvm_is_error_hva(host_addr)))
18207 goto error;
18208
18209- ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
18210+ ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
18211 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
18212 goto error;
18213
18214@@ -575,6 +575,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
18215 unsigned long mmu_seq;
18216 bool map_writable;
18217
18218+ pax_track_stack();
18219+
18220 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18221
18222 if (unlikely(error_code & PFERR_RSVD_MASK))
18223@@ -701,7 +703,7 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
18224 if (need_flush)
18225 kvm_flush_remote_tlbs(vcpu->kvm);
18226
18227- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18228+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18229
18230 spin_unlock(&vcpu->kvm->mmu_lock);
18231
18232diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
18233index 475d1c9..33658ff 100644
18234--- a/arch/x86/kvm/svm.c
18235+++ b/arch/x86/kvm/svm.c
18236@@ -3381,7 +3381,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
18237 int cpu = raw_smp_processor_id();
18238
18239 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18240+
18241+ pax_open_kernel();
18242 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18243+ pax_close_kernel();
18244+
18245 load_TR_desc();
18246 }
18247
18248@@ -3759,6 +3763,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
18249 #endif
18250 #endif
18251
18252+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18253+ __set_fs(current_thread_info()->addr_limit);
18254+#endif
18255+
18256 reload_tss(vcpu);
18257
18258 local_irq_disable();
18259diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
18260index e65a158..656dc24 100644
18261--- a/arch/x86/kvm/vmx.c
18262+++ b/arch/x86/kvm/vmx.c
18263@@ -1251,7 +1251,11 @@ static void reload_tss(void)
18264 struct desc_struct *descs;
18265
18266 descs = (void *)gdt->address;
18267+
18268+ pax_open_kernel();
18269 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18270+ pax_close_kernel();
18271+
18272 load_TR_desc();
18273 }
18274
18275@@ -2520,8 +2524,11 @@ static __init int hardware_setup(void)
18276 if (!cpu_has_vmx_flexpriority())
18277 flexpriority_enabled = 0;
18278
18279- if (!cpu_has_vmx_tpr_shadow())
18280- kvm_x86_ops->update_cr8_intercept = NULL;
18281+ if (!cpu_has_vmx_tpr_shadow()) {
18282+ pax_open_kernel();
18283+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18284+ pax_close_kernel();
18285+ }
18286
18287 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18288 kvm_disable_largepages();
18289@@ -3535,7 +3542,7 @@ static void vmx_set_constant_host_state(void)
18290 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18291
18292 asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
18293- vmcs_writel(HOST_RIP, tmpl); /* 22.2.5 */
18294+ vmcs_writel(HOST_RIP, ktla_ktva(tmpl)); /* 22.2.5 */
18295
18296 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
18297 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
18298@@ -6021,6 +6028,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18299 "jmp .Lkvm_vmx_return \n\t"
18300 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18301 ".Lkvm_vmx_return: "
18302+
18303+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18304+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18305+ ".Lkvm_vmx_return2: "
18306+#endif
18307+
18308 /* Save guest registers, load host registers, keep flags */
18309 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18310 "pop %0 \n\t"
18311@@ -6069,6 +6082,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18312 #endif
18313 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18314 [wordsize]"i"(sizeof(ulong))
18315+
18316+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18317+ ,[cs]"i"(__KERNEL_CS)
18318+#endif
18319+
18320 : "cc", "memory"
18321 , R"ax", R"bx", R"di", R"si"
18322 #ifdef CONFIG_X86_64
18323@@ -6097,7 +6115,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18324 }
18325 }
18326
18327- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18328+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18329+
18330+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18331+ loadsegment(fs, __KERNEL_PERCPU);
18332+#endif
18333+
18334+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18335+ __set_fs(current_thread_info()->addr_limit);
18336+#endif
18337+
18338 vmx->loaded_vmcs->launched = 1;
18339
18340 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18341diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
18342index 84a28ea..9326501 100644
18343--- a/arch/x86/kvm/x86.c
18344+++ b/arch/x86/kvm/x86.c
18345@@ -1334,8 +1334,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
18346 {
18347 struct kvm *kvm = vcpu->kvm;
18348 int lm = is_long_mode(vcpu);
18349- u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18350- : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18351+ u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18352+ : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18353 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
18354 : kvm->arch.xen_hvm_config.blob_size_32;
18355 u32 page_num = data & ~PAGE_MASK;
18356@@ -2137,6 +2137,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
18357 if (n < msr_list.nmsrs)
18358 goto out;
18359 r = -EFAULT;
18360+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18361+ goto out;
18362 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18363 num_msrs_to_save * sizeof(u32)))
18364 goto out;
18365@@ -2312,15 +2314,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
18366 struct kvm_cpuid2 *cpuid,
18367 struct kvm_cpuid_entry2 __user *entries)
18368 {
18369- int r;
18370+ int r, i;
18371
18372 r = -E2BIG;
18373 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18374 goto out;
18375 r = -EFAULT;
18376- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18377- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18378+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18379 goto out;
18380+ for (i = 0; i < cpuid->nent; ++i) {
18381+ struct kvm_cpuid_entry2 cpuid_entry;
18382+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18383+ goto out;
18384+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18385+ }
18386 vcpu->arch.cpuid_nent = cpuid->nent;
18387 kvm_apic_set_version(vcpu);
18388 kvm_x86_ops->cpuid_update(vcpu);
18389@@ -2335,15 +2342,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
18390 struct kvm_cpuid2 *cpuid,
18391 struct kvm_cpuid_entry2 __user *entries)
18392 {
18393- int r;
18394+ int r, i;
18395
18396 r = -E2BIG;
18397 if (cpuid->nent < vcpu->arch.cpuid_nent)
18398 goto out;
18399 r = -EFAULT;
18400- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18401- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18402+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18403 goto out;
18404+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18405+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18406+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18407+ goto out;
18408+ }
18409 return 0;
18410
18411 out:
18412@@ -2718,7 +2729,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
18413 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18414 struct kvm_interrupt *irq)
18415 {
18416- if (irq->irq < 0 || irq->irq >= 256)
18417+ if (irq->irq >= 256)
18418 return -EINVAL;
18419 if (irqchip_in_kernel(vcpu->kvm))
18420 return -ENXIO;
18421@@ -5089,7 +5100,7 @@ static void kvm_set_mmio_spte_mask(void)
18422 kvm_mmu_set_mmio_spte_mask(mask);
18423 }
18424
18425-int kvm_arch_init(void *opaque)
18426+int kvm_arch_init(const void *opaque)
18427 {
18428 int r;
18429 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18430diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
18431index 13ee258..b9632f6 100644
18432--- a/arch/x86/lguest/boot.c
18433+++ b/arch/x86/lguest/boot.c
18434@@ -1184,9 +1184,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
18435 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
18436 * Launcher to reboot us.
18437 */
18438-static void lguest_restart(char *reason)
18439+static __noreturn void lguest_restart(char *reason)
18440 {
18441 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
18442+ BUG();
18443 }
18444
18445 /*G:050
18446diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
18447index 042f682..c92afb6 100644
18448--- a/arch/x86/lib/atomic64_32.c
18449+++ b/arch/x86/lib/atomic64_32.c
18450@@ -8,18 +8,30 @@
18451
18452 long long atomic64_read_cx8(long long, const atomic64_t *v);
18453 EXPORT_SYMBOL(atomic64_read_cx8);
18454+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18455+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18456 long long atomic64_set_cx8(long long, const atomic64_t *v);
18457 EXPORT_SYMBOL(atomic64_set_cx8);
18458+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18459+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18460 long long atomic64_xchg_cx8(long long, unsigned high);
18461 EXPORT_SYMBOL(atomic64_xchg_cx8);
18462 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18463 EXPORT_SYMBOL(atomic64_add_return_cx8);
18464+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18465+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18466 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18467 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18468+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18469+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18470 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18471 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18472+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18473+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18474 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18475 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18476+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18477+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18478 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18479 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18480 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18481@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18482 #ifndef CONFIG_X86_CMPXCHG64
18483 long long atomic64_read_386(long long, const atomic64_t *v);
18484 EXPORT_SYMBOL(atomic64_read_386);
18485+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18486+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18487 long long atomic64_set_386(long long, const atomic64_t *v);
18488 EXPORT_SYMBOL(atomic64_set_386);
18489+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18490+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18491 long long atomic64_xchg_386(long long, unsigned high);
18492 EXPORT_SYMBOL(atomic64_xchg_386);
18493 long long atomic64_add_return_386(long long a, atomic64_t *v);
18494 EXPORT_SYMBOL(atomic64_add_return_386);
18495+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18496+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18497 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18498 EXPORT_SYMBOL(atomic64_sub_return_386);
18499+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18500+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18501 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18502 EXPORT_SYMBOL(atomic64_inc_return_386);
18503+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18504+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18505 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18506 EXPORT_SYMBOL(atomic64_dec_return_386);
18507+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18508+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18509 long long atomic64_add_386(long long a, atomic64_t *v);
18510 EXPORT_SYMBOL(atomic64_add_386);
18511+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18512+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18513 long long atomic64_sub_386(long long a, atomic64_t *v);
18514 EXPORT_SYMBOL(atomic64_sub_386);
18515+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18516+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18517 long long atomic64_inc_386(long long a, atomic64_t *v);
18518 EXPORT_SYMBOL(atomic64_inc_386);
18519+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18520+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18521 long long atomic64_dec_386(long long a, atomic64_t *v);
18522 EXPORT_SYMBOL(atomic64_dec_386);
18523+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18524+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18525 long long atomic64_dec_if_positive_386(atomic64_t *v);
18526 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18527 int atomic64_inc_not_zero_386(atomic64_t *v);
18528diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
18529index e8e7e0d..56fd1b0 100644
18530--- a/arch/x86/lib/atomic64_386_32.S
18531+++ b/arch/x86/lib/atomic64_386_32.S
18532@@ -48,6 +48,10 @@ BEGIN(read)
18533 movl (v), %eax
18534 movl 4(v), %edx
18535 RET_ENDP
18536+BEGIN(read_unchecked)
18537+ movl (v), %eax
18538+ movl 4(v), %edx
18539+RET_ENDP
18540 #undef v
18541
18542 #define v %esi
18543@@ -55,6 +59,10 @@ BEGIN(set)
18544 movl %ebx, (v)
18545 movl %ecx, 4(v)
18546 RET_ENDP
18547+BEGIN(set_unchecked)
18548+ movl %ebx, (v)
18549+ movl %ecx, 4(v)
18550+RET_ENDP
18551 #undef v
18552
18553 #define v %esi
18554@@ -70,6 +78,20 @@ RET_ENDP
18555 BEGIN(add)
18556 addl %eax, (v)
18557 adcl %edx, 4(v)
18558+
18559+#ifdef CONFIG_PAX_REFCOUNT
18560+ jno 0f
18561+ subl %eax, (v)
18562+ sbbl %edx, 4(v)
18563+ int $4
18564+0:
18565+ _ASM_EXTABLE(0b, 0b)
18566+#endif
18567+
18568+RET_ENDP
18569+BEGIN(add_unchecked)
18570+ addl %eax, (v)
18571+ adcl %edx, 4(v)
18572 RET_ENDP
18573 #undef v
18574
18575@@ -77,6 +99,24 @@ RET_ENDP
18576 BEGIN(add_return)
18577 addl (v), %eax
18578 adcl 4(v), %edx
18579+
18580+#ifdef CONFIG_PAX_REFCOUNT
18581+ into
18582+1234:
18583+ _ASM_EXTABLE(1234b, 2f)
18584+#endif
18585+
18586+ movl %eax, (v)
18587+ movl %edx, 4(v)
18588+
18589+#ifdef CONFIG_PAX_REFCOUNT
18590+2:
18591+#endif
18592+
18593+RET_ENDP
18594+BEGIN(add_return_unchecked)
18595+ addl (v), %eax
18596+ adcl 4(v), %edx
18597 movl %eax, (v)
18598 movl %edx, 4(v)
18599 RET_ENDP
18600@@ -86,6 +126,20 @@ RET_ENDP
18601 BEGIN(sub)
18602 subl %eax, (v)
18603 sbbl %edx, 4(v)
18604+
18605+#ifdef CONFIG_PAX_REFCOUNT
18606+ jno 0f
18607+ addl %eax, (v)
18608+ adcl %edx, 4(v)
18609+ int $4
18610+0:
18611+ _ASM_EXTABLE(0b, 0b)
18612+#endif
18613+
18614+RET_ENDP
18615+BEGIN(sub_unchecked)
18616+ subl %eax, (v)
18617+ sbbl %edx, 4(v)
18618 RET_ENDP
18619 #undef v
18620
18621@@ -96,6 +150,27 @@ BEGIN(sub_return)
18622 sbbl $0, %edx
18623 addl (v), %eax
18624 adcl 4(v), %edx
18625+
18626+#ifdef CONFIG_PAX_REFCOUNT
18627+ into
18628+1234:
18629+ _ASM_EXTABLE(1234b, 2f)
18630+#endif
18631+
18632+ movl %eax, (v)
18633+ movl %edx, 4(v)
18634+
18635+#ifdef CONFIG_PAX_REFCOUNT
18636+2:
18637+#endif
18638+
18639+RET_ENDP
18640+BEGIN(sub_return_unchecked)
18641+ negl %edx
18642+ negl %eax
18643+ sbbl $0, %edx
18644+ addl (v), %eax
18645+ adcl 4(v), %edx
18646 movl %eax, (v)
18647 movl %edx, 4(v)
18648 RET_ENDP
18649@@ -105,6 +180,20 @@ RET_ENDP
18650 BEGIN(inc)
18651 addl $1, (v)
18652 adcl $0, 4(v)
18653+
18654+#ifdef CONFIG_PAX_REFCOUNT
18655+ jno 0f
18656+ subl $1, (v)
18657+ sbbl $0, 4(v)
18658+ int $4
18659+0:
18660+ _ASM_EXTABLE(0b, 0b)
18661+#endif
18662+
18663+RET_ENDP
18664+BEGIN(inc_unchecked)
18665+ addl $1, (v)
18666+ adcl $0, 4(v)
18667 RET_ENDP
18668 #undef v
18669
18670@@ -114,6 +203,26 @@ BEGIN(inc_return)
18671 movl 4(v), %edx
18672 addl $1, %eax
18673 adcl $0, %edx
18674+
18675+#ifdef CONFIG_PAX_REFCOUNT
18676+ into
18677+1234:
18678+ _ASM_EXTABLE(1234b, 2f)
18679+#endif
18680+
18681+ movl %eax, (v)
18682+ movl %edx, 4(v)
18683+
18684+#ifdef CONFIG_PAX_REFCOUNT
18685+2:
18686+#endif
18687+
18688+RET_ENDP
18689+BEGIN(inc_return_unchecked)
18690+ movl (v), %eax
18691+ movl 4(v), %edx
18692+ addl $1, %eax
18693+ adcl $0, %edx
18694 movl %eax, (v)
18695 movl %edx, 4(v)
18696 RET_ENDP
18697@@ -123,6 +232,20 @@ RET_ENDP
18698 BEGIN(dec)
18699 subl $1, (v)
18700 sbbl $0, 4(v)
18701+
18702+#ifdef CONFIG_PAX_REFCOUNT
18703+ jno 0f
18704+ addl $1, (v)
18705+ adcl $0, 4(v)
18706+ int $4
18707+0:
18708+ _ASM_EXTABLE(0b, 0b)
18709+#endif
18710+
18711+RET_ENDP
18712+BEGIN(dec_unchecked)
18713+ subl $1, (v)
18714+ sbbl $0, 4(v)
18715 RET_ENDP
18716 #undef v
18717
18718@@ -132,6 +255,26 @@ BEGIN(dec_return)
18719 movl 4(v), %edx
18720 subl $1, %eax
18721 sbbl $0, %edx
18722+
18723+#ifdef CONFIG_PAX_REFCOUNT
18724+ into
18725+1234:
18726+ _ASM_EXTABLE(1234b, 2f)
18727+#endif
18728+
18729+ movl %eax, (v)
18730+ movl %edx, 4(v)
18731+
18732+#ifdef CONFIG_PAX_REFCOUNT
18733+2:
18734+#endif
18735+
18736+RET_ENDP
18737+BEGIN(dec_return_unchecked)
18738+ movl (v), %eax
18739+ movl 4(v), %edx
18740+ subl $1, %eax
18741+ sbbl $0, %edx
18742 movl %eax, (v)
18743 movl %edx, 4(v)
18744 RET_ENDP
18745@@ -143,6 +286,13 @@ BEGIN(add_unless)
18746 adcl %edx, %edi
18747 addl (v), %eax
18748 adcl 4(v), %edx
18749+
18750+#ifdef CONFIG_PAX_REFCOUNT
18751+ into
18752+1234:
18753+ _ASM_EXTABLE(1234b, 2f)
18754+#endif
18755+
18756 cmpl %eax, %esi
18757 je 3f
18758 1:
18759@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18760 1:
18761 addl $1, %eax
18762 adcl $0, %edx
18763+
18764+#ifdef CONFIG_PAX_REFCOUNT
18765+ into
18766+1234:
18767+ _ASM_EXTABLE(1234b, 2f)
18768+#endif
18769+
18770 movl %eax, (v)
18771 movl %edx, 4(v)
18772 movl $1, %eax
18773@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18774 movl 4(v), %edx
18775 subl $1, %eax
18776 sbbl $0, %edx
18777+
18778+#ifdef CONFIG_PAX_REFCOUNT
18779+ into
18780+1234:
18781+ _ASM_EXTABLE(1234b, 1f)
18782+#endif
18783+
18784 js 1f
18785 movl %eax, (v)
18786 movl %edx, 4(v)
18787diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
18788index 391a083..d658e9f 100644
18789--- a/arch/x86/lib/atomic64_cx8_32.S
18790+++ b/arch/x86/lib/atomic64_cx8_32.S
18791@@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
18792 CFI_STARTPROC
18793
18794 read64 %ecx
18795+ pax_force_retaddr
18796 ret
18797 CFI_ENDPROC
18798 ENDPROC(atomic64_read_cx8)
18799
18800+ENTRY(atomic64_read_unchecked_cx8)
18801+ CFI_STARTPROC
18802+
18803+ read64 %ecx
18804+ pax_force_retaddr
18805+ ret
18806+ CFI_ENDPROC
18807+ENDPROC(atomic64_read_unchecked_cx8)
18808+
18809 ENTRY(atomic64_set_cx8)
18810 CFI_STARTPROC
18811
18812@@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
18813 cmpxchg8b (%esi)
18814 jne 1b
18815
18816+ pax_force_retaddr
18817 ret
18818 CFI_ENDPROC
18819 ENDPROC(atomic64_set_cx8)
18820
18821+ENTRY(atomic64_set_unchecked_cx8)
18822+ CFI_STARTPROC
18823+
18824+1:
18825+/* we don't need LOCK_PREFIX since aligned 64-bit writes
18826+ * are atomic on 586 and newer */
18827+ cmpxchg8b (%esi)
18828+ jne 1b
18829+
18830+ pax_force_retaddr
18831+ ret
18832+ CFI_ENDPROC
18833+ENDPROC(atomic64_set_unchecked_cx8)
18834+
18835 ENTRY(atomic64_xchg_cx8)
18836 CFI_STARTPROC
18837
18838@@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
18839 cmpxchg8b (%esi)
18840 jne 1b
18841
18842+ pax_force_retaddr
18843 ret
18844 CFI_ENDPROC
18845 ENDPROC(atomic64_xchg_cx8)
18846
18847-.macro addsub_return func ins insc
18848-ENTRY(atomic64_\func\()_return_cx8)
18849+.macro addsub_return func ins insc unchecked=""
18850+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18851 CFI_STARTPROC
18852 SAVE ebp
18853 SAVE ebx
18854@@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
18855 movl %edx, %ecx
18856 \ins\()l %esi, %ebx
18857 \insc\()l %edi, %ecx
18858+
18859+.ifb \unchecked
18860+#ifdef CONFIG_PAX_REFCOUNT
18861+ into
18862+2:
18863+ _ASM_EXTABLE(2b, 3f)
18864+#endif
18865+.endif
18866+
18867 LOCK_PREFIX
18868 cmpxchg8b (%ebp)
18869 jne 1b
18870-
18871-10:
18872 movl %ebx, %eax
18873 movl %ecx, %edx
18874+
18875+.ifb \unchecked
18876+#ifdef CONFIG_PAX_REFCOUNT
18877+3:
18878+#endif
18879+.endif
18880+
18881 RESTORE edi
18882 RESTORE esi
18883 RESTORE ebx
18884 RESTORE ebp
18885+ pax_force_retaddr
18886 ret
18887 CFI_ENDPROC
18888-ENDPROC(atomic64_\func\()_return_cx8)
18889+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18890 .endm
18891
18892 addsub_return add add adc
18893 addsub_return sub sub sbb
18894+addsub_return add add adc _unchecked
18895+addsub_return sub sub sbb _unchecked
18896
18897-.macro incdec_return func ins insc
18898-ENTRY(atomic64_\func\()_return_cx8)
18899+.macro incdec_return func ins insc unchecked
18900+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18901 CFI_STARTPROC
18902 SAVE ebx
18903
18904@@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
18905 movl %edx, %ecx
18906 \ins\()l $1, %ebx
18907 \insc\()l $0, %ecx
18908+
18909+.ifb \unchecked
18910+#ifdef CONFIG_PAX_REFCOUNT
18911+ into
18912+2:
18913+ _ASM_EXTABLE(2b, 3f)
18914+#endif
18915+.endif
18916+
18917 LOCK_PREFIX
18918 cmpxchg8b (%esi)
18919 jne 1b
18920
18921-10:
18922 movl %ebx, %eax
18923 movl %ecx, %edx
18924+
18925+.ifb \unchecked
18926+#ifdef CONFIG_PAX_REFCOUNT
18927+3:
18928+#endif
18929+.endif
18930+
18931 RESTORE ebx
18932+ pax_force_retaddr
18933 ret
18934 CFI_ENDPROC
18935-ENDPROC(atomic64_\func\()_return_cx8)
18936+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18937 .endm
18938
18939 incdec_return inc add adc
18940 incdec_return dec sub sbb
18941+incdec_return inc add adc _unchecked
18942+incdec_return dec sub sbb _unchecked
18943
18944 ENTRY(atomic64_dec_if_positive_cx8)
18945 CFI_STARTPROC
18946@@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
18947 movl %edx, %ecx
18948 subl $1, %ebx
18949 sbb $0, %ecx
18950+
18951+#ifdef CONFIG_PAX_REFCOUNT
18952+ into
18953+1234:
18954+ _ASM_EXTABLE(1234b, 2f)
18955+#endif
18956+
18957 js 2f
18958 LOCK_PREFIX
18959 cmpxchg8b (%esi)
18960@@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
18961 movl %ebx, %eax
18962 movl %ecx, %edx
18963 RESTORE ebx
18964+ pax_force_retaddr
18965 ret
18966 CFI_ENDPROC
18967 ENDPROC(atomic64_dec_if_positive_cx8)
18968@@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
18969 movl %edx, %ecx
18970 addl %esi, %ebx
18971 adcl %edi, %ecx
18972+
18973+#ifdef CONFIG_PAX_REFCOUNT
18974+ into
18975+1234:
18976+ _ASM_EXTABLE(1234b, 3f)
18977+#endif
18978+
18979 LOCK_PREFIX
18980 cmpxchg8b (%ebp)
18981 jne 1b
18982@@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
18983 CFI_ADJUST_CFA_OFFSET -8
18984 RESTORE ebx
18985 RESTORE ebp
18986+ pax_force_retaddr
18987 ret
18988 4:
18989 cmpl %edx, 4(%esp)
18990@@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
18991 movl %edx, %ecx
18992 addl $1, %ebx
18993 adcl $0, %ecx
18994+
18995+#ifdef CONFIG_PAX_REFCOUNT
18996+ into
18997+1234:
18998+ _ASM_EXTABLE(1234b, 3f)
18999+#endif
19000+
19001 LOCK_PREFIX
19002 cmpxchg8b (%esi)
19003 jne 1b
19004@@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
19005 movl $1, %eax
19006 3:
19007 RESTORE ebx
19008+ pax_force_retaddr
19009 ret
19010 4:
19011 testl %edx, %edx
19012diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
19013index 78d16a5..fbcf666 100644
19014--- a/arch/x86/lib/checksum_32.S
19015+++ b/arch/x86/lib/checksum_32.S
19016@@ -28,7 +28,8 @@
19017 #include <linux/linkage.h>
19018 #include <asm/dwarf2.h>
19019 #include <asm/errno.h>
19020-
19021+#include <asm/segment.h>
19022+
19023 /*
19024 * computes a partial checksum, e.g. for TCP/UDP fragments
19025 */
19026@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
19027
19028 #define ARGBASE 16
19029 #define FP 12
19030-
19031-ENTRY(csum_partial_copy_generic)
19032+
19033+ENTRY(csum_partial_copy_generic_to_user)
19034 CFI_STARTPROC
19035+
19036+#ifdef CONFIG_PAX_MEMORY_UDEREF
19037+ pushl_cfi %gs
19038+ popl_cfi %es
19039+ jmp csum_partial_copy_generic
19040+#endif
19041+
19042+ENTRY(csum_partial_copy_generic_from_user)
19043+
19044+#ifdef CONFIG_PAX_MEMORY_UDEREF
19045+ pushl_cfi %gs
19046+ popl_cfi %ds
19047+#endif
19048+
19049+ENTRY(csum_partial_copy_generic)
19050 subl $4,%esp
19051 CFI_ADJUST_CFA_OFFSET 4
19052 pushl_cfi %edi
19053@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19054 jmp 4f
19055 SRC(1: movw (%esi), %bx )
19056 addl $2, %esi
19057-DST( movw %bx, (%edi) )
19058+DST( movw %bx, %es:(%edi) )
19059 addl $2, %edi
19060 addw %bx, %ax
19061 adcl $0, %eax
19062@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19063 SRC(1: movl (%esi), %ebx )
19064 SRC( movl 4(%esi), %edx )
19065 adcl %ebx, %eax
19066-DST( movl %ebx, (%edi) )
19067+DST( movl %ebx, %es:(%edi) )
19068 adcl %edx, %eax
19069-DST( movl %edx, 4(%edi) )
19070+DST( movl %edx, %es:4(%edi) )
19071
19072 SRC( movl 8(%esi), %ebx )
19073 SRC( movl 12(%esi), %edx )
19074 adcl %ebx, %eax
19075-DST( movl %ebx, 8(%edi) )
19076+DST( movl %ebx, %es:8(%edi) )
19077 adcl %edx, %eax
19078-DST( movl %edx, 12(%edi) )
19079+DST( movl %edx, %es:12(%edi) )
19080
19081 SRC( movl 16(%esi), %ebx )
19082 SRC( movl 20(%esi), %edx )
19083 adcl %ebx, %eax
19084-DST( movl %ebx, 16(%edi) )
19085+DST( movl %ebx, %es:16(%edi) )
19086 adcl %edx, %eax
19087-DST( movl %edx, 20(%edi) )
19088+DST( movl %edx, %es:20(%edi) )
19089
19090 SRC( movl 24(%esi), %ebx )
19091 SRC( movl 28(%esi), %edx )
19092 adcl %ebx, %eax
19093-DST( movl %ebx, 24(%edi) )
19094+DST( movl %ebx, %es:24(%edi) )
19095 adcl %edx, %eax
19096-DST( movl %edx, 28(%edi) )
19097+DST( movl %edx, %es:28(%edi) )
19098
19099 lea 32(%esi), %esi
19100 lea 32(%edi), %edi
19101@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19102 shrl $2, %edx # This clears CF
19103 SRC(3: movl (%esi), %ebx )
19104 adcl %ebx, %eax
19105-DST( movl %ebx, (%edi) )
19106+DST( movl %ebx, %es:(%edi) )
19107 lea 4(%esi), %esi
19108 lea 4(%edi), %edi
19109 dec %edx
19110@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19111 jb 5f
19112 SRC( movw (%esi), %cx )
19113 leal 2(%esi), %esi
19114-DST( movw %cx, (%edi) )
19115+DST( movw %cx, %es:(%edi) )
19116 leal 2(%edi), %edi
19117 je 6f
19118 shll $16,%ecx
19119 SRC(5: movb (%esi), %cl )
19120-DST( movb %cl, (%edi) )
19121+DST( movb %cl, %es:(%edi) )
19122 6: addl %ecx, %eax
19123 adcl $0, %eax
19124 7:
19125@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19126
19127 6001:
19128 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19129- movl $-EFAULT, (%ebx)
19130+ movl $-EFAULT, %ss:(%ebx)
19131
19132 # zero the complete destination - computing the rest
19133 # is too much work
19134@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19135
19136 6002:
19137 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19138- movl $-EFAULT,(%ebx)
19139+ movl $-EFAULT,%ss:(%ebx)
19140 jmp 5000b
19141
19142 .previous
19143
19144+ pushl_cfi %ss
19145+ popl_cfi %ds
19146+ pushl_cfi %ss
19147+ popl_cfi %es
19148 popl_cfi %ebx
19149 CFI_RESTORE ebx
19150 popl_cfi %esi
19151@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19152 popl_cfi %ecx # equivalent to addl $4,%esp
19153 ret
19154 CFI_ENDPROC
19155-ENDPROC(csum_partial_copy_generic)
19156+ENDPROC(csum_partial_copy_generic_to_user)
19157
19158 #else
19159
19160 /* Version for PentiumII/PPro */
19161
19162 #define ROUND1(x) \
19163+ nop; nop; nop; \
19164 SRC(movl x(%esi), %ebx ) ; \
19165 addl %ebx, %eax ; \
19166- DST(movl %ebx, x(%edi) ) ;
19167+ DST(movl %ebx, %es:x(%edi)) ;
19168
19169 #define ROUND(x) \
19170+ nop; nop; nop; \
19171 SRC(movl x(%esi), %ebx ) ; \
19172 adcl %ebx, %eax ; \
19173- DST(movl %ebx, x(%edi) ) ;
19174+ DST(movl %ebx, %es:x(%edi)) ;
19175
19176 #define ARGBASE 12
19177-
19178-ENTRY(csum_partial_copy_generic)
19179+
19180+ENTRY(csum_partial_copy_generic_to_user)
19181 CFI_STARTPROC
19182+
19183+#ifdef CONFIG_PAX_MEMORY_UDEREF
19184+ pushl_cfi %gs
19185+ popl_cfi %es
19186+ jmp csum_partial_copy_generic
19187+#endif
19188+
19189+ENTRY(csum_partial_copy_generic_from_user)
19190+
19191+#ifdef CONFIG_PAX_MEMORY_UDEREF
19192+ pushl_cfi %gs
19193+ popl_cfi %ds
19194+#endif
19195+
19196+ENTRY(csum_partial_copy_generic)
19197 pushl_cfi %ebx
19198 CFI_REL_OFFSET ebx, 0
19199 pushl_cfi %edi
19200@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19201 subl %ebx, %edi
19202 lea -1(%esi),%edx
19203 andl $-32,%edx
19204- lea 3f(%ebx,%ebx), %ebx
19205+ lea 3f(%ebx,%ebx,2), %ebx
19206 testl %esi, %esi
19207 jmp *%ebx
19208 1: addl $64,%esi
19209@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19210 jb 5f
19211 SRC( movw (%esi), %dx )
19212 leal 2(%esi), %esi
19213-DST( movw %dx, (%edi) )
19214+DST( movw %dx, %es:(%edi) )
19215 leal 2(%edi), %edi
19216 je 6f
19217 shll $16,%edx
19218 5:
19219 SRC( movb (%esi), %dl )
19220-DST( movb %dl, (%edi) )
19221+DST( movb %dl, %es:(%edi) )
19222 6: addl %edx, %eax
19223 adcl $0, %eax
19224 7:
19225 .section .fixup, "ax"
19226 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19227- movl $-EFAULT, (%ebx)
19228+ movl $-EFAULT, %ss:(%ebx)
19229 # zero the complete destination (computing the rest is too much work)
19230 movl ARGBASE+8(%esp),%edi # dst
19231 movl ARGBASE+12(%esp),%ecx # len
19232@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19233 rep; stosb
19234 jmp 7b
19235 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19236- movl $-EFAULT, (%ebx)
19237+ movl $-EFAULT, %ss:(%ebx)
19238 jmp 7b
19239 .previous
19240
19241+#ifdef CONFIG_PAX_MEMORY_UDEREF
19242+ pushl_cfi %ss
19243+ popl_cfi %ds
19244+ pushl_cfi %ss
19245+ popl_cfi %es
19246+#endif
19247+
19248 popl_cfi %esi
19249 CFI_RESTORE esi
19250 popl_cfi %edi
19251@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19252 CFI_RESTORE ebx
19253 ret
19254 CFI_ENDPROC
19255-ENDPROC(csum_partial_copy_generic)
19256+ENDPROC(csum_partial_copy_generic_to_user)
19257
19258 #undef ROUND
19259 #undef ROUND1
19260diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
19261index f2145cf..cea889d 100644
19262--- a/arch/x86/lib/clear_page_64.S
19263+++ b/arch/x86/lib/clear_page_64.S
19264@@ -11,6 +11,7 @@ ENTRY(clear_page_c)
19265 movl $4096/8,%ecx
19266 xorl %eax,%eax
19267 rep stosq
19268+ pax_force_retaddr
19269 ret
19270 CFI_ENDPROC
19271 ENDPROC(clear_page_c)
19272@@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
19273 movl $4096,%ecx
19274 xorl %eax,%eax
19275 rep stosb
19276+ pax_force_retaddr
19277 ret
19278 CFI_ENDPROC
19279 ENDPROC(clear_page_c_e)
19280@@ -43,6 +45,7 @@ ENTRY(clear_page)
19281 leaq 64(%rdi),%rdi
19282 jnz .Lloop
19283 nop
19284+ pax_force_retaddr
19285 ret
19286 CFI_ENDPROC
19287 .Lclear_page_end:
19288@@ -58,7 +61,7 @@ ENDPROC(clear_page)
19289
19290 #include <asm/cpufeature.h>
19291
19292- .section .altinstr_replacement,"ax"
19293+ .section .altinstr_replacement,"a"
19294 1: .byte 0xeb /* jmp <disp8> */
19295 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19296 2: .byte 0xeb /* jmp <disp8> */
19297diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
19298index 1e572c5..2a162cd 100644
19299--- a/arch/x86/lib/cmpxchg16b_emu.S
19300+++ b/arch/x86/lib/cmpxchg16b_emu.S
19301@@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
19302
19303 popf
19304 mov $1, %al
19305+ pax_force_retaddr
19306 ret
19307
19308 not_same:
19309 popf
19310 xor %al,%al
19311+ pax_force_retaddr
19312 ret
19313
19314 CFI_ENDPROC
19315diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
19316index 01c805b..dccb07f 100644
19317--- a/arch/x86/lib/copy_page_64.S
19318+++ b/arch/x86/lib/copy_page_64.S
19319@@ -9,6 +9,7 @@ copy_page_c:
19320 CFI_STARTPROC
19321 movl $4096/8,%ecx
19322 rep movsq
19323+ pax_force_retaddr
19324 ret
19325 CFI_ENDPROC
19326 ENDPROC(copy_page_c)
19327@@ -39,7 +40,7 @@ ENTRY(copy_page)
19328 movq 16 (%rsi), %rdx
19329 movq 24 (%rsi), %r8
19330 movq 32 (%rsi), %r9
19331- movq 40 (%rsi), %r10
19332+ movq 40 (%rsi), %r13
19333 movq 48 (%rsi), %r11
19334 movq 56 (%rsi), %r12
19335
19336@@ -50,7 +51,7 @@ ENTRY(copy_page)
19337 movq %rdx, 16 (%rdi)
19338 movq %r8, 24 (%rdi)
19339 movq %r9, 32 (%rdi)
19340- movq %r10, 40 (%rdi)
19341+ movq %r13, 40 (%rdi)
19342 movq %r11, 48 (%rdi)
19343 movq %r12, 56 (%rdi)
19344
19345@@ -69,7 +70,7 @@ ENTRY(copy_page)
19346 movq 16 (%rsi), %rdx
19347 movq 24 (%rsi), %r8
19348 movq 32 (%rsi), %r9
19349- movq 40 (%rsi), %r10
19350+ movq 40 (%rsi), %r13
19351 movq 48 (%rsi), %r11
19352 movq 56 (%rsi), %r12
19353
19354@@ -78,7 +79,7 @@ ENTRY(copy_page)
19355 movq %rdx, 16 (%rdi)
19356 movq %r8, 24 (%rdi)
19357 movq %r9, 32 (%rdi)
19358- movq %r10, 40 (%rdi)
19359+ movq %r13, 40 (%rdi)
19360 movq %r11, 48 (%rdi)
19361 movq %r12, 56 (%rdi)
19362
19363@@ -95,6 +96,7 @@ ENTRY(copy_page)
19364 CFI_RESTORE r13
19365 addq $3*8,%rsp
19366 CFI_ADJUST_CFA_OFFSET -3*8
19367+ pax_force_retaddr
19368 ret
19369 .Lcopy_page_end:
19370 CFI_ENDPROC
19371@@ -105,7 +107,7 @@ ENDPROC(copy_page)
19372
19373 #include <asm/cpufeature.h>
19374
19375- .section .altinstr_replacement,"ax"
19376+ .section .altinstr_replacement,"a"
19377 1: .byte 0xeb /* jmp <disp8> */
19378 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19379 2:
19380diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
19381index 0248402..821c786 100644
19382--- a/arch/x86/lib/copy_user_64.S
19383+++ b/arch/x86/lib/copy_user_64.S
19384@@ -16,6 +16,7 @@
19385 #include <asm/thread_info.h>
19386 #include <asm/cpufeature.h>
19387 #include <asm/alternative-asm.h>
19388+#include <asm/pgtable.h>
19389
19390 /*
19391 * By placing feature2 after feature1 in altinstructions section, we logically
19392@@ -29,7 +30,7 @@
19393 .byte 0xe9 /* 32bit jump */
19394 .long \orig-1f /* by default jump to orig */
19395 1:
19396- .section .altinstr_replacement,"ax"
19397+ .section .altinstr_replacement,"a"
19398 2: .byte 0xe9 /* near jump with 32bit immediate */
19399 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
19400 3: .byte 0xe9 /* near jump with 32bit immediate */
19401@@ -71,47 +72,20 @@
19402 #endif
19403 .endm
19404
19405-/* Standard copy_to_user with segment limit checking */
19406-ENTRY(_copy_to_user)
19407- CFI_STARTPROC
19408- GET_THREAD_INFO(%rax)
19409- movq %rdi,%rcx
19410- addq %rdx,%rcx
19411- jc bad_to_user
19412- cmpq TI_addr_limit(%rax),%rcx
19413- ja bad_to_user
19414- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19415- copy_user_generic_unrolled,copy_user_generic_string, \
19416- copy_user_enhanced_fast_string
19417- CFI_ENDPROC
19418-ENDPROC(_copy_to_user)
19419-
19420-/* Standard copy_from_user with segment limit checking */
19421-ENTRY(_copy_from_user)
19422- CFI_STARTPROC
19423- GET_THREAD_INFO(%rax)
19424- movq %rsi,%rcx
19425- addq %rdx,%rcx
19426- jc bad_from_user
19427- cmpq TI_addr_limit(%rax),%rcx
19428- ja bad_from_user
19429- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19430- copy_user_generic_unrolled,copy_user_generic_string, \
19431- copy_user_enhanced_fast_string
19432- CFI_ENDPROC
19433-ENDPROC(_copy_from_user)
19434-
19435 .section .fixup,"ax"
19436 /* must zero dest */
19437 ENTRY(bad_from_user)
19438 bad_from_user:
19439 CFI_STARTPROC
19440+ testl %edx,%edx
19441+ js bad_to_user
19442 movl %edx,%ecx
19443 xorl %eax,%eax
19444 rep
19445 stosb
19446 bad_to_user:
19447 movl %edx,%eax
19448+ pax_force_retaddr
19449 ret
19450 CFI_ENDPROC
19451 ENDPROC(bad_from_user)
19452@@ -141,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
19453 jz 17f
19454 1: movq (%rsi),%r8
19455 2: movq 1*8(%rsi),%r9
19456-3: movq 2*8(%rsi),%r10
19457+3: movq 2*8(%rsi),%rax
19458 4: movq 3*8(%rsi),%r11
19459 5: movq %r8,(%rdi)
19460 6: movq %r9,1*8(%rdi)
19461-7: movq %r10,2*8(%rdi)
19462+7: movq %rax,2*8(%rdi)
19463 8: movq %r11,3*8(%rdi)
19464 9: movq 4*8(%rsi),%r8
19465 10: movq 5*8(%rsi),%r9
19466-11: movq 6*8(%rsi),%r10
19467+11: movq 6*8(%rsi),%rax
19468 12: movq 7*8(%rsi),%r11
19469 13: movq %r8,4*8(%rdi)
19470 14: movq %r9,5*8(%rdi)
19471-15: movq %r10,6*8(%rdi)
19472+15: movq %rax,6*8(%rdi)
19473 16: movq %r11,7*8(%rdi)
19474 leaq 64(%rsi),%rsi
19475 leaq 64(%rdi),%rdi
19476@@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
19477 decl %ecx
19478 jnz 21b
19479 23: xor %eax,%eax
19480+ pax_force_retaddr
19481 ret
19482
19483 .section .fixup,"ax"
19484@@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
19485 3: rep
19486 movsb
19487 4: xorl %eax,%eax
19488+ pax_force_retaddr
19489 ret
19490
19491 .section .fixup,"ax"
19492@@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
19493 1: rep
19494 movsb
19495 2: xorl %eax,%eax
19496+ pax_force_retaddr
19497 ret
19498
19499 .section .fixup,"ax"
19500diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
19501index cb0c112..e3a6895 100644
19502--- a/arch/x86/lib/copy_user_nocache_64.S
19503+++ b/arch/x86/lib/copy_user_nocache_64.S
19504@@ -8,12 +8,14 @@
19505
19506 #include <linux/linkage.h>
19507 #include <asm/dwarf2.h>
19508+#include <asm/alternative-asm.h>
19509
19510 #define FIX_ALIGNMENT 1
19511
19512 #include <asm/current.h>
19513 #include <asm/asm-offsets.h>
19514 #include <asm/thread_info.h>
19515+#include <asm/pgtable.h>
19516
19517 .macro ALIGN_DESTINATION
19518 #ifdef FIX_ALIGNMENT
19519@@ -50,6 +52,15 @@
19520 */
19521 ENTRY(__copy_user_nocache)
19522 CFI_STARTPROC
19523+
19524+#ifdef CONFIG_PAX_MEMORY_UDEREF
19525+ mov $PAX_USER_SHADOW_BASE,%rcx
19526+ cmp %rcx,%rsi
19527+ jae 1f
19528+ add %rcx,%rsi
19529+1:
19530+#endif
19531+
19532 cmpl $8,%edx
19533 jb 20f /* less then 8 bytes, go to byte copy loop */
19534 ALIGN_DESTINATION
19535@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
19536 jz 17f
19537 1: movq (%rsi),%r8
19538 2: movq 1*8(%rsi),%r9
19539-3: movq 2*8(%rsi),%r10
19540+3: movq 2*8(%rsi),%rax
19541 4: movq 3*8(%rsi),%r11
19542 5: movnti %r8,(%rdi)
19543 6: movnti %r9,1*8(%rdi)
19544-7: movnti %r10,2*8(%rdi)
19545+7: movnti %rax,2*8(%rdi)
19546 8: movnti %r11,3*8(%rdi)
19547 9: movq 4*8(%rsi),%r8
19548 10: movq 5*8(%rsi),%r9
19549-11: movq 6*8(%rsi),%r10
19550+11: movq 6*8(%rsi),%rax
19551 12: movq 7*8(%rsi),%r11
19552 13: movnti %r8,4*8(%rdi)
19553 14: movnti %r9,5*8(%rdi)
19554-15: movnti %r10,6*8(%rdi)
19555+15: movnti %rax,6*8(%rdi)
19556 16: movnti %r11,7*8(%rdi)
19557 leaq 64(%rsi),%rsi
19558 leaq 64(%rdi),%rdi
19559@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
19560 jnz 21b
19561 23: xorl %eax,%eax
19562 sfence
19563+ pax_force_retaddr
19564 ret
19565
19566 .section .fixup,"ax"
19567diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
19568index fb903b7..c92b7f7 100644
19569--- a/arch/x86/lib/csum-copy_64.S
19570+++ b/arch/x86/lib/csum-copy_64.S
19571@@ -8,6 +8,7 @@
19572 #include <linux/linkage.h>
19573 #include <asm/dwarf2.h>
19574 #include <asm/errno.h>
19575+#include <asm/alternative-asm.h>
19576
19577 /*
19578 * Checksum copy with exception handling.
19579@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
19580 CFI_RESTORE rbp
19581 addq $7*8, %rsp
19582 CFI_ADJUST_CFA_OFFSET -7*8
19583+ pax_force_retaddr 0, 1
19584 ret
19585 CFI_RESTORE_STATE
19586
19587diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
19588index 459b58a..9570bc7 100644
19589--- a/arch/x86/lib/csum-wrappers_64.c
19590+++ b/arch/x86/lib/csum-wrappers_64.c
19591@@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
19592 len -= 2;
19593 }
19594 }
19595- isum = csum_partial_copy_generic((__force const void *)src,
19596+
19597+#ifdef CONFIG_PAX_MEMORY_UDEREF
19598+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19599+ src += PAX_USER_SHADOW_BASE;
19600+#endif
19601+
19602+ isum = csum_partial_copy_generic((const void __force_kernel *)src,
19603 dst, len, isum, errp, NULL);
19604 if (unlikely(*errp))
19605 goto out_err;
19606@@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
19607 }
19608
19609 *errp = 0;
19610- return csum_partial_copy_generic(src, (void __force *)dst,
19611+
19612+#ifdef CONFIG_PAX_MEMORY_UDEREF
19613+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19614+ dst += PAX_USER_SHADOW_BASE;
19615+#endif
19616+
19617+ return csum_partial_copy_generic(src, (void __force_kernel *)dst,
19618 len, isum, NULL, errp);
19619 }
19620 EXPORT_SYMBOL(csum_partial_copy_to_user);
19621diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
19622index 51f1504..ddac4c1 100644
19623--- a/arch/x86/lib/getuser.S
19624+++ b/arch/x86/lib/getuser.S
19625@@ -33,15 +33,38 @@
19626 #include <asm/asm-offsets.h>
19627 #include <asm/thread_info.h>
19628 #include <asm/asm.h>
19629+#include <asm/segment.h>
19630+#include <asm/pgtable.h>
19631+#include <asm/alternative-asm.h>
19632+
19633+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19634+#define __copyuser_seg gs;
19635+#else
19636+#define __copyuser_seg
19637+#endif
19638
19639 .text
19640 ENTRY(__get_user_1)
19641 CFI_STARTPROC
19642+
19643+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19644 GET_THREAD_INFO(%_ASM_DX)
19645 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19646 jae bad_get_user
19647-1: movzb (%_ASM_AX),%edx
19648+
19649+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19650+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19651+ cmp %_ASM_DX,%_ASM_AX
19652+ jae 1234f
19653+ add %_ASM_DX,%_ASM_AX
19654+1234:
19655+#endif
19656+
19657+#endif
19658+
19659+1: __copyuser_seg movzb (%_ASM_AX),%edx
19660 xor %eax,%eax
19661+ pax_force_retaddr
19662 ret
19663 CFI_ENDPROC
19664 ENDPROC(__get_user_1)
19665@@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
19666 ENTRY(__get_user_2)
19667 CFI_STARTPROC
19668 add $1,%_ASM_AX
19669+
19670+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19671 jc bad_get_user
19672 GET_THREAD_INFO(%_ASM_DX)
19673 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19674 jae bad_get_user
19675-2: movzwl -1(%_ASM_AX),%edx
19676+
19677+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19678+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19679+ cmp %_ASM_DX,%_ASM_AX
19680+ jae 1234f
19681+ add %_ASM_DX,%_ASM_AX
19682+1234:
19683+#endif
19684+
19685+#endif
19686+
19687+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19688 xor %eax,%eax
19689+ pax_force_retaddr
19690 ret
19691 CFI_ENDPROC
19692 ENDPROC(__get_user_2)
19693@@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
19694 ENTRY(__get_user_4)
19695 CFI_STARTPROC
19696 add $3,%_ASM_AX
19697+
19698+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19699 jc bad_get_user
19700 GET_THREAD_INFO(%_ASM_DX)
19701 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19702 jae bad_get_user
19703-3: mov -3(%_ASM_AX),%edx
19704+
19705+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19706+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19707+ cmp %_ASM_DX,%_ASM_AX
19708+ jae 1234f
19709+ add %_ASM_DX,%_ASM_AX
19710+1234:
19711+#endif
19712+
19713+#endif
19714+
19715+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19716 xor %eax,%eax
19717+ pax_force_retaddr
19718 ret
19719 CFI_ENDPROC
19720 ENDPROC(__get_user_4)
19721@@ -80,8 +131,18 @@ ENTRY(__get_user_8)
19722 GET_THREAD_INFO(%_ASM_DX)
19723 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19724 jae bad_get_user
19725+
19726+#ifdef CONFIG_PAX_MEMORY_UDEREF
19727+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19728+ cmp %_ASM_DX,%_ASM_AX
19729+ jae 1234f
19730+ add %_ASM_DX,%_ASM_AX
19731+1234:
19732+#endif
19733+
19734 4: movq -7(%_ASM_AX),%_ASM_DX
19735 xor %eax,%eax
19736+ pax_force_retaddr
19737 ret
19738 CFI_ENDPROC
19739 ENDPROC(__get_user_8)
19740@@ -91,6 +152,7 @@ bad_get_user:
19741 CFI_STARTPROC
19742 xor %edx,%edx
19743 mov $(-EFAULT),%_ASM_AX
19744+ pax_force_retaddr
19745 ret
19746 CFI_ENDPROC
19747 END(bad_get_user)
19748diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
19749index 9f33b98..dfc7678 100644
19750--- a/arch/x86/lib/insn.c
19751+++ b/arch/x86/lib/insn.c
19752@@ -21,6 +21,11 @@
19753 #include <linux/string.h>
19754 #include <asm/inat.h>
19755 #include <asm/insn.h>
19756+#ifdef __KERNEL__
19757+#include <asm/pgtable_types.h>
19758+#else
19759+#define ktla_ktva(addr) addr
19760+#endif
19761
19762 #define get_next(t, insn) \
19763 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19764@@ -40,8 +45,8 @@
19765 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19766 {
19767 memset(insn, 0, sizeof(*insn));
19768- insn->kaddr = kaddr;
19769- insn->next_byte = kaddr;
19770+ insn->kaddr = ktla_ktva(kaddr);
19771+ insn->next_byte = ktla_ktva(kaddr);
19772 insn->x86_64 = x86_64 ? 1 : 0;
19773 insn->opnd_bytes = 4;
19774 if (x86_64)
19775diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
19776index 05a95e7..326f2fa 100644
19777--- a/arch/x86/lib/iomap_copy_64.S
19778+++ b/arch/x86/lib/iomap_copy_64.S
19779@@ -17,6 +17,7 @@
19780
19781 #include <linux/linkage.h>
19782 #include <asm/dwarf2.h>
19783+#include <asm/alternative-asm.h>
19784
19785 /*
19786 * override generic version in lib/iomap_copy.c
19787@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
19788 CFI_STARTPROC
19789 movl %edx,%ecx
19790 rep movsd
19791+ pax_force_retaddr
19792 ret
19793 CFI_ENDPROC
19794 ENDPROC(__iowrite32_copy)
19795diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
19796index efbf2a0..8893637 100644
19797--- a/arch/x86/lib/memcpy_64.S
19798+++ b/arch/x86/lib/memcpy_64.S
19799@@ -34,6 +34,7 @@
19800 rep movsq
19801 movl %edx, %ecx
19802 rep movsb
19803+ pax_force_retaddr
19804 ret
19805 .Lmemcpy_e:
19806 .previous
19807@@ -51,6 +52,7 @@
19808
19809 movl %edx, %ecx
19810 rep movsb
19811+ pax_force_retaddr
19812 ret
19813 .Lmemcpy_e_e:
19814 .previous
19815@@ -81,13 +83,13 @@ ENTRY(memcpy)
19816 */
19817 movq 0*8(%rsi), %r8
19818 movq 1*8(%rsi), %r9
19819- movq 2*8(%rsi), %r10
19820+ movq 2*8(%rsi), %rcx
19821 movq 3*8(%rsi), %r11
19822 leaq 4*8(%rsi), %rsi
19823
19824 movq %r8, 0*8(%rdi)
19825 movq %r9, 1*8(%rdi)
19826- movq %r10, 2*8(%rdi)
19827+ movq %rcx, 2*8(%rdi)
19828 movq %r11, 3*8(%rdi)
19829 leaq 4*8(%rdi), %rdi
19830 jae .Lcopy_forward_loop
19831@@ -110,12 +112,12 @@ ENTRY(memcpy)
19832 subq $0x20, %rdx
19833 movq -1*8(%rsi), %r8
19834 movq -2*8(%rsi), %r9
19835- movq -3*8(%rsi), %r10
19836+ movq -3*8(%rsi), %rcx
19837 movq -4*8(%rsi), %r11
19838 leaq -4*8(%rsi), %rsi
19839 movq %r8, -1*8(%rdi)
19840 movq %r9, -2*8(%rdi)
19841- movq %r10, -3*8(%rdi)
19842+ movq %rcx, -3*8(%rdi)
19843 movq %r11, -4*8(%rdi)
19844 leaq -4*8(%rdi), %rdi
19845 jae .Lcopy_backward_loop
19846@@ -135,12 +137,13 @@ ENTRY(memcpy)
19847 */
19848 movq 0*8(%rsi), %r8
19849 movq 1*8(%rsi), %r9
19850- movq -2*8(%rsi, %rdx), %r10
19851+ movq -2*8(%rsi, %rdx), %rcx
19852 movq -1*8(%rsi, %rdx), %r11
19853 movq %r8, 0*8(%rdi)
19854 movq %r9, 1*8(%rdi)
19855- movq %r10, -2*8(%rdi, %rdx)
19856+ movq %rcx, -2*8(%rdi, %rdx)
19857 movq %r11, -1*8(%rdi, %rdx)
19858+ pax_force_retaddr
19859 retq
19860 .p2align 4
19861 .Lless_16bytes:
19862@@ -153,6 +156,7 @@ ENTRY(memcpy)
19863 movq -1*8(%rsi, %rdx), %r9
19864 movq %r8, 0*8(%rdi)
19865 movq %r9, -1*8(%rdi, %rdx)
19866+ pax_force_retaddr
19867 retq
19868 .p2align 4
19869 .Lless_8bytes:
19870@@ -166,6 +170,7 @@ ENTRY(memcpy)
19871 movl -4(%rsi, %rdx), %r8d
19872 movl %ecx, (%rdi)
19873 movl %r8d, -4(%rdi, %rdx)
19874+ pax_force_retaddr
19875 retq
19876 .p2align 4
19877 .Lless_3bytes:
19878@@ -183,6 +188,7 @@ ENTRY(memcpy)
19879 jnz .Lloop_1
19880
19881 .Lend:
19882+ pax_force_retaddr
19883 retq
19884 CFI_ENDPROC
19885 ENDPROC(memcpy)
19886diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
19887index ee16461..c39c199 100644
19888--- a/arch/x86/lib/memmove_64.S
19889+++ b/arch/x86/lib/memmove_64.S
19890@@ -61,13 +61,13 @@ ENTRY(memmove)
19891 5:
19892 sub $0x20, %rdx
19893 movq 0*8(%rsi), %r11
19894- movq 1*8(%rsi), %r10
19895+ movq 1*8(%rsi), %rcx
19896 movq 2*8(%rsi), %r9
19897 movq 3*8(%rsi), %r8
19898 leaq 4*8(%rsi), %rsi
19899
19900 movq %r11, 0*8(%rdi)
19901- movq %r10, 1*8(%rdi)
19902+ movq %rcx, 1*8(%rdi)
19903 movq %r9, 2*8(%rdi)
19904 movq %r8, 3*8(%rdi)
19905 leaq 4*8(%rdi), %rdi
19906@@ -81,10 +81,10 @@ ENTRY(memmove)
19907 4:
19908 movq %rdx, %rcx
19909 movq -8(%rsi, %rdx), %r11
19910- lea -8(%rdi, %rdx), %r10
19911+ lea -8(%rdi, %rdx), %r9
19912 shrq $3, %rcx
19913 rep movsq
19914- movq %r11, (%r10)
19915+ movq %r11, (%r9)
19916 jmp 13f
19917 .Lmemmove_end_forward:
19918
19919@@ -95,14 +95,14 @@ ENTRY(memmove)
19920 7:
19921 movq %rdx, %rcx
19922 movq (%rsi), %r11
19923- movq %rdi, %r10
19924+ movq %rdi, %r9
19925 leaq -8(%rsi, %rdx), %rsi
19926 leaq -8(%rdi, %rdx), %rdi
19927 shrq $3, %rcx
19928 std
19929 rep movsq
19930 cld
19931- movq %r11, (%r10)
19932+ movq %r11, (%r9)
19933 jmp 13f
19934
19935 /*
19936@@ -127,13 +127,13 @@ ENTRY(memmove)
19937 8:
19938 subq $0x20, %rdx
19939 movq -1*8(%rsi), %r11
19940- movq -2*8(%rsi), %r10
19941+ movq -2*8(%rsi), %rcx
19942 movq -3*8(%rsi), %r9
19943 movq -4*8(%rsi), %r8
19944 leaq -4*8(%rsi), %rsi
19945
19946 movq %r11, -1*8(%rdi)
19947- movq %r10, -2*8(%rdi)
19948+ movq %rcx, -2*8(%rdi)
19949 movq %r9, -3*8(%rdi)
19950 movq %r8, -4*8(%rdi)
19951 leaq -4*8(%rdi), %rdi
19952@@ -151,11 +151,11 @@ ENTRY(memmove)
19953 * Move data from 16 bytes to 31 bytes.
19954 */
19955 movq 0*8(%rsi), %r11
19956- movq 1*8(%rsi), %r10
19957+ movq 1*8(%rsi), %rcx
19958 movq -2*8(%rsi, %rdx), %r9
19959 movq -1*8(%rsi, %rdx), %r8
19960 movq %r11, 0*8(%rdi)
19961- movq %r10, 1*8(%rdi)
19962+ movq %rcx, 1*8(%rdi)
19963 movq %r9, -2*8(%rdi, %rdx)
19964 movq %r8, -1*8(%rdi, %rdx)
19965 jmp 13f
19966@@ -167,9 +167,9 @@ ENTRY(memmove)
19967 * Move data from 8 bytes to 15 bytes.
19968 */
19969 movq 0*8(%rsi), %r11
19970- movq -1*8(%rsi, %rdx), %r10
19971+ movq -1*8(%rsi, %rdx), %r9
19972 movq %r11, 0*8(%rdi)
19973- movq %r10, -1*8(%rdi, %rdx)
19974+ movq %r9, -1*8(%rdi, %rdx)
19975 jmp 13f
19976 10:
19977 cmpq $4, %rdx
19978@@ -178,9 +178,9 @@ ENTRY(memmove)
19979 * Move data from 4 bytes to 7 bytes.
19980 */
19981 movl (%rsi), %r11d
19982- movl -4(%rsi, %rdx), %r10d
19983+ movl -4(%rsi, %rdx), %r9d
19984 movl %r11d, (%rdi)
19985- movl %r10d, -4(%rdi, %rdx)
19986+ movl %r9d, -4(%rdi, %rdx)
19987 jmp 13f
19988 11:
19989 cmp $2, %rdx
19990@@ -189,9 +189,9 @@ ENTRY(memmove)
19991 * Move data from 2 bytes to 3 bytes.
19992 */
19993 movw (%rsi), %r11w
19994- movw -2(%rsi, %rdx), %r10w
19995+ movw -2(%rsi, %rdx), %r9w
19996 movw %r11w, (%rdi)
19997- movw %r10w, -2(%rdi, %rdx)
19998+ movw %r9w, -2(%rdi, %rdx)
19999 jmp 13f
20000 12:
20001 cmp $1, %rdx
20002@@ -202,6 +202,7 @@ ENTRY(memmove)
20003 movb (%rsi), %r11b
20004 movb %r11b, (%rdi)
20005 13:
20006+ pax_force_retaddr
20007 retq
20008 CFI_ENDPROC
20009
20010@@ -210,6 +211,7 @@ ENTRY(memmove)
20011 /* Forward moving data. */
20012 movq %rdx, %rcx
20013 rep movsb
20014+ pax_force_retaddr
20015 retq
20016 .Lmemmove_end_forward_efs:
20017 .previous
20018diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
20019index 79bd454..dff325a 100644
20020--- a/arch/x86/lib/memset_64.S
20021+++ b/arch/x86/lib/memset_64.S
20022@@ -31,6 +31,7 @@
20023 movl %r8d,%ecx
20024 rep stosb
20025 movq %r9,%rax
20026+ pax_force_retaddr
20027 ret
20028 .Lmemset_e:
20029 .previous
20030@@ -53,6 +54,7 @@
20031 movl %edx,%ecx
20032 rep stosb
20033 movq %r9,%rax
20034+ pax_force_retaddr
20035 ret
20036 .Lmemset_e_e:
20037 .previous
20038@@ -60,13 +62,13 @@
20039 ENTRY(memset)
20040 ENTRY(__memset)
20041 CFI_STARTPROC
20042- movq %rdi,%r10
20043 movq %rdx,%r11
20044
20045 /* expand byte value */
20046 movzbl %sil,%ecx
20047 movabs $0x0101010101010101,%rax
20048 mul %rcx /* with rax, clobbers rdx */
20049+ movq %rdi,%rdx
20050
20051 /* align dst */
20052 movl %edi,%r9d
20053@@ -120,7 +122,8 @@ ENTRY(__memset)
20054 jnz .Lloop_1
20055
20056 .Lende:
20057- movq %r10,%rax
20058+ movq %rdx,%rax
20059+ pax_force_retaddr
20060 ret
20061
20062 CFI_RESTORE_STATE
20063diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
20064index c9f2d9b..e7fd2c0 100644
20065--- a/arch/x86/lib/mmx_32.c
20066+++ b/arch/x86/lib/mmx_32.c
20067@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20068 {
20069 void *p;
20070 int i;
20071+ unsigned long cr0;
20072
20073 if (unlikely(in_interrupt()))
20074 return __memcpy(to, from, len);
20075@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20076 kernel_fpu_begin();
20077
20078 __asm__ __volatile__ (
20079- "1: prefetch (%0)\n" /* This set is 28 bytes */
20080- " prefetch 64(%0)\n"
20081- " prefetch 128(%0)\n"
20082- " prefetch 192(%0)\n"
20083- " prefetch 256(%0)\n"
20084+ "1: prefetch (%1)\n" /* This set is 28 bytes */
20085+ " prefetch 64(%1)\n"
20086+ " prefetch 128(%1)\n"
20087+ " prefetch 192(%1)\n"
20088+ " prefetch 256(%1)\n"
20089 "2: \n"
20090 ".section .fixup, \"ax\"\n"
20091- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20092+ "3: \n"
20093+
20094+#ifdef CONFIG_PAX_KERNEXEC
20095+ " movl %%cr0, %0\n"
20096+ " movl %0, %%eax\n"
20097+ " andl $0xFFFEFFFF, %%eax\n"
20098+ " movl %%eax, %%cr0\n"
20099+#endif
20100+
20101+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20102+
20103+#ifdef CONFIG_PAX_KERNEXEC
20104+ " movl %0, %%cr0\n"
20105+#endif
20106+
20107 " jmp 2b\n"
20108 ".previous\n"
20109 _ASM_EXTABLE(1b, 3b)
20110- : : "r" (from));
20111+ : "=&r" (cr0) : "r" (from) : "ax");
20112
20113 for ( ; i > 5; i--) {
20114 __asm__ __volatile__ (
20115- "1: prefetch 320(%0)\n"
20116- "2: movq (%0), %%mm0\n"
20117- " movq 8(%0), %%mm1\n"
20118- " movq 16(%0), %%mm2\n"
20119- " movq 24(%0), %%mm3\n"
20120- " movq %%mm0, (%1)\n"
20121- " movq %%mm1, 8(%1)\n"
20122- " movq %%mm2, 16(%1)\n"
20123- " movq %%mm3, 24(%1)\n"
20124- " movq 32(%0), %%mm0\n"
20125- " movq 40(%0), %%mm1\n"
20126- " movq 48(%0), %%mm2\n"
20127- " movq 56(%0), %%mm3\n"
20128- " movq %%mm0, 32(%1)\n"
20129- " movq %%mm1, 40(%1)\n"
20130- " movq %%mm2, 48(%1)\n"
20131- " movq %%mm3, 56(%1)\n"
20132+ "1: prefetch 320(%1)\n"
20133+ "2: movq (%1), %%mm0\n"
20134+ " movq 8(%1), %%mm1\n"
20135+ " movq 16(%1), %%mm2\n"
20136+ " movq 24(%1), %%mm3\n"
20137+ " movq %%mm0, (%2)\n"
20138+ " movq %%mm1, 8(%2)\n"
20139+ " movq %%mm2, 16(%2)\n"
20140+ " movq %%mm3, 24(%2)\n"
20141+ " movq 32(%1), %%mm0\n"
20142+ " movq 40(%1), %%mm1\n"
20143+ " movq 48(%1), %%mm2\n"
20144+ " movq 56(%1), %%mm3\n"
20145+ " movq %%mm0, 32(%2)\n"
20146+ " movq %%mm1, 40(%2)\n"
20147+ " movq %%mm2, 48(%2)\n"
20148+ " movq %%mm3, 56(%2)\n"
20149 ".section .fixup, \"ax\"\n"
20150- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20151+ "3:\n"
20152+
20153+#ifdef CONFIG_PAX_KERNEXEC
20154+ " movl %%cr0, %0\n"
20155+ " movl %0, %%eax\n"
20156+ " andl $0xFFFEFFFF, %%eax\n"
20157+ " movl %%eax, %%cr0\n"
20158+#endif
20159+
20160+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20161+
20162+#ifdef CONFIG_PAX_KERNEXEC
20163+ " movl %0, %%cr0\n"
20164+#endif
20165+
20166 " jmp 2b\n"
20167 ".previous\n"
20168 _ASM_EXTABLE(1b, 3b)
20169- : : "r" (from), "r" (to) : "memory");
20170+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20171
20172 from += 64;
20173 to += 64;
20174@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20175 static void fast_copy_page(void *to, void *from)
20176 {
20177 int i;
20178+ unsigned long cr0;
20179
20180 kernel_fpu_begin();
20181
20182@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
20183 * but that is for later. -AV
20184 */
20185 __asm__ __volatile__(
20186- "1: prefetch (%0)\n"
20187- " prefetch 64(%0)\n"
20188- " prefetch 128(%0)\n"
20189- " prefetch 192(%0)\n"
20190- " prefetch 256(%0)\n"
20191+ "1: prefetch (%1)\n"
20192+ " prefetch 64(%1)\n"
20193+ " prefetch 128(%1)\n"
20194+ " prefetch 192(%1)\n"
20195+ " prefetch 256(%1)\n"
20196 "2: \n"
20197 ".section .fixup, \"ax\"\n"
20198- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20199+ "3: \n"
20200+
20201+#ifdef CONFIG_PAX_KERNEXEC
20202+ " movl %%cr0, %0\n"
20203+ " movl %0, %%eax\n"
20204+ " andl $0xFFFEFFFF, %%eax\n"
20205+ " movl %%eax, %%cr0\n"
20206+#endif
20207+
20208+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20209+
20210+#ifdef CONFIG_PAX_KERNEXEC
20211+ " movl %0, %%cr0\n"
20212+#endif
20213+
20214 " jmp 2b\n"
20215 ".previous\n"
20216- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20217+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20218
20219 for (i = 0; i < (4096-320)/64; i++) {
20220 __asm__ __volatile__ (
20221- "1: prefetch 320(%0)\n"
20222- "2: movq (%0), %%mm0\n"
20223- " movntq %%mm0, (%1)\n"
20224- " movq 8(%0), %%mm1\n"
20225- " movntq %%mm1, 8(%1)\n"
20226- " movq 16(%0), %%mm2\n"
20227- " movntq %%mm2, 16(%1)\n"
20228- " movq 24(%0), %%mm3\n"
20229- " movntq %%mm3, 24(%1)\n"
20230- " movq 32(%0), %%mm4\n"
20231- " movntq %%mm4, 32(%1)\n"
20232- " movq 40(%0), %%mm5\n"
20233- " movntq %%mm5, 40(%1)\n"
20234- " movq 48(%0), %%mm6\n"
20235- " movntq %%mm6, 48(%1)\n"
20236- " movq 56(%0), %%mm7\n"
20237- " movntq %%mm7, 56(%1)\n"
20238+ "1: prefetch 320(%1)\n"
20239+ "2: movq (%1), %%mm0\n"
20240+ " movntq %%mm0, (%2)\n"
20241+ " movq 8(%1), %%mm1\n"
20242+ " movntq %%mm1, 8(%2)\n"
20243+ " movq 16(%1), %%mm2\n"
20244+ " movntq %%mm2, 16(%2)\n"
20245+ " movq 24(%1), %%mm3\n"
20246+ " movntq %%mm3, 24(%2)\n"
20247+ " movq 32(%1), %%mm4\n"
20248+ " movntq %%mm4, 32(%2)\n"
20249+ " movq 40(%1), %%mm5\n"
20250+ " movntq %%mm5, 40(%2)\n"
20251+ " movq 48(%1), %%mm6\n"
20252+ " movntq %%mm6, 48(%2)\n"
20253+ " movq 56(%1), %%mm7\n"
20254+ " movntq %%mm7, 56(%2)\n"
20255 ".section .fixup, \"ax\"\n"
20256- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20257+ "3:\n"
20258+
20259+#ifdef CONFIG_PAX_KERNEXEC
20260+ " movl %%cr0, %0\n"
20261+ " movl %0, %%eax\n"
20262+ " andl $0xFFFEFFFF, %%eax\n"
20263+ " movl %%eax, %%cr0\n"
20264+#endif
20265+
20266+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20267+
20268+#ifdef CONFIG_PAX_KERNEXEC
20269+ " movl %0, %%cr0\n"
20270+#endif
20271+
20272 " jmp 2b\n"
20273 ".previous\n"
20274- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20275+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20276
20277 from += 64;
20278 to += 64;
20279@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20280 static void fast_copy_page(void *to, void *from)
20281 {
20282 int i;
20283+ unsigned long cr0;
20284
20285 kernel_fpu_begin();
20286
20287 __asm__ __volatile__ (
20288- "1: prefetch (%0)\n"
20289- " prefetch 64(%0)\n"
20290- " prefetch 128(%0)\n"
20291- " prefetch 192(%0)\n"
20292- " prefetch 256(%0)\n"
20293+ "1: prefetch (%1)\n"
20294+ " prefetch 64(%1)\n"
20295+ " prefetch 128(%1)\n"
20296+ " prefetch 192(%1)\n"
20297+ " prefetch 256(%1)\n"
20298 "2: \n"
20299 ".section .fixup, \"ax\"\n"
20300- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20301+ "3: \n"
20302+
20303+#ifdef CONFIG_PAX_KERNEXEC
20304+ " movl %%cr0, %0\n"
20305+ " movl %0, %%eax\n"
20306+ " andl $0xFFFEFFFF, %%eax\n"
20307+ " movl %%eax, %%cr0\n"
20308+#endif
20309+
20310+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20311+
20312+#ifdef CONFIG_PAX_KERNEXEC
20313+ " movl %0, %%cr0\n"
20314+#endif
20315+
20316 " jmp 2b\n"
20317 ".previous\n"
20318- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20319+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20320
20321 for (i = 0; i < 4096/64; i++) {
20322 __asm__ __volatile__ (
20323- "1: prefetch 320(%0)\n"
20324- "2: movq (%0), %%mm0\n"
20325- " movq 8(%0), %%mm1\n"
20326- " movq 16(%0), %%mm2\n"
20327- " movq 24(%0), %%mm3\n"
20328- " movq %%mm0, (%1)\n"
20329- " movq %%mm1, 8(%1)\n"
20330- " movq %%mm2, 16(%1)\n"
20331- " movq %%mm3, 24(%1)\n"
20332- " movq 32(%0), %%mm0\n"
20333- " movq 40(%0), %%mm1\n"
20334- " movq 48(%0), %%mm2\n"
20335- " movq 56(%0), %%mm3\n"
20336- " movq %%mm0, 32(%1)\n"
20337- " movq %%mm1, 40(%1)\n"
20338- " movq %%mm2, 48(%1)\n"
20339- " movq %%mm3, 56(%1)\n"
20340+ "1: prefetch 320(%1)\n"
20341+ "2: movq (%1), %%mm0\n"
20342+ " movq 8(%1), %%mm1\n"
20343+ " movq 16(%1), %%mm2\n"
20344+ " movq 24(%1), %%mm3\n"
20345+ " movq %%mm0, (%2)\n"
20346+ " movq %%mm1, 8(%2)\n"
20347+ " movq %%mm2, 16(%2)\n"
20348+ " movq %%mm3, 24(%2)\n"
20349+ " movq 32(%1), %%mm0\n"
20350+ " movq 40(%1), %%mm1\n"
20351+ " movq 48(%1), %%mm2\n"
20352+ " movq 56(%1), %%mm3\n"
20353+ " movq %%mm0, 32(%2)\n"
20354+ " movq %%mm1, 40(%2)\n"
20355+ " movq %%mm2, 48(%2)\n"
20356+ " movq %%mm3, 56(%2)\n"
20357 ".section .fixup, \"ax\"\n"
20358- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20359+ "3:\n"
20360+
20361+#ifdef CONFIG_PAX_KERNEXEC
20362+ " movl %%cr0, %0\n"
20363+ " movl %0, %%eax\n"
20364+ " andl $0xFFFEFFFF, %%eax\n"
20365+ " movl %%eax, %%cr0\n"
20366+#endif
20367+
20368+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20369+
20370+#ifdef CONFIG_PAX_KERNEXEC
20371+ " movl %0, %%cr0\n"
20372+#endif
20373+
20374 " jmp 2b\n"
20375 ".previous\n"
20376 _ASM_EXTABLE(1b, 3b)
20377- : : "r" (from), "r" (to) : "memory");
20378+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20379
20380 from += 64;
20381 to += 64;
20382diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
20383index 69fa106..adda88b 100644
20384--- a/arch/x86/lib/msr-reg.S
20385+++ b/arch/x86/lib/msr-reg.S
20386@@ -3,6 +3,7 @@
20387 #include <asm/dwarf2.h>
20388 #include <asm/asm.h>
20389 #include <asm/msr.h>
20390+#include <asm/alternative-asm.h>
20391
20392 #ifdef CONFIG_X86_64
20393 /*
20394@@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
20395 CFI_STARTPROC
20396 pushq_cfi %rbx
20397 pushq_cfi %rbp
20398- movq %rdi, %r10 /* Save pointer */
20399+ movq %rdi, %r9 /* Save pointer */
20400 xorl %r11d, %r11d /* Return value */
20401 movl (%rdi), %eax
20402 movl 4(%rdi), %ecx
20403@@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
20404 movl 28(%rdi), %edi
20405 CFI_REMEMBER_STATE
20406 1: \op
20407-2: movl %eax, (%r10)
20408+2: movl %eax, (%r9)
20409 movl %r11d, %eax /* Return value */
20410- movl %ecx, 4(%r10)
20411- movl %edx, 8(%r10)
20412- movl %ebx, 12(%r10)
20413- movl %ebp, 20(%r10)
20414- movl %esi, 24(%r10)
20415- movl %edi, 28(%r10)
20416+ movl %ecx, 4(%r9)
20417+ movl %edx, 8(%r9)
20418+ movl %ebx, 12(%r9)
20419+ movl %ebp, 20(%r9)
20420+ movl %esi, 24(%r9)
20421+ movl %edi, 28(%r9)
20422 popq_cfi %rbp
20423 popq_cfi %rbx
20424+ pax_force_retaddr
20425 ret
20426 3:
20427 CFI_RESTORE_STATE
20428diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
20429index 36b0d15..d381858 100644
20430--- a/arch/x86/lib/putuser.S
20431+++ b/arch/x86/lib/putuser.S
20432@@ -15,7 +15,9 @@
20433 #include <asm/thread_info.h>
20434 #include <asm/errno.h>
20435 #include <asm/asm.h>
20436-
20437+#include <asm/segment.h>
20438+#include <asm/pgtable.h>
20439+#include <asm/alternative-asm.h>
20440
20441 /*
20442 * __put_user_X
20443@@ -29,52 +31,119 @@
20444 * as they get called from within inline assembly.
20445 */
20446
20447-#define ENTER CFI_STARTPROC ; \
20448- GET_THREAD_INFO(%_ASM_BX)
20449-#define EXIT ret ; \
20450+#define ENTER CFI_STARTPROC
20451+#define EXIT pax_force_retaddr; ret ; \
20452 CFI_ENDPROC
20453
20454+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20455+#define _DEST %_ASM_CX,%_ASM_BX
20456+#else
20457+#define _DEST %_ASM_CX
20458+#endif
20459+
20460+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20461+#define __copyuser_seg gs;
20462+#else
20463+#define __copyuser_seg
20464+#endif
20465+
20466 .text
20467 ENTRY(__put_user_1)
20468 ENTER
20469+
20470+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20471+ GET_THREAD_INFO(%_ASM_BX)
20472 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20473 jae bad_put_user
20474-1: movb %al,(%_ASM_CX)
20475+
20476+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20477+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20478+ cmp %_ASM_BX,%_ASM_CX
20479+ jb 1234f
20480+ xor %ebx,%ebx
20481+1234:
20482+#endif
20483+
20484+#endif
20485+
20486+1: __copyuser_seg movb %al,(_DEST)
20487 xor %eax,%eax
20488 EXIT
20489 ENDPROC(__put_user_1)
20490
20491 ENTRY(__put_user_2)
20492 ENTER
20493+
20494+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20495+ GET_THREAD_INFO(%_ASM_BX)
20496 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20497 sub $1,%_ASM_BX
20498 cmp %_ASM_BX,%_ASM_CX
20499 jae bad_put_user
20500-2: movw %ax,(%_ASM_CX)
20501+
20502+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20503+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20504+ cmp %_ASM_BX,%_ASM_CX
20505+ jb 1234f
20506+ xor %ebx,%ebx
20507+1234:
20508+#endif
20509+
20510+#endif
20511+
20512+2: __copyuser_seg movw %ax,(_DEST)
20513 xor %eax,%eax
20514 EXIT
20515 ENDPROC(__put_user_2)
20516
20517 ENTRY(__put_user_4)
20518 ENTER
20519+
20520+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20521+ GET_THREAD_INFO(%_ASM_BX)
20522 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20523 sub $3,%_ASM_BX
20524 cmp %_ASM_BX,%_ASM_CX
20525 jae bad_put_user
20526-3: movl %eax,(%_ASM_CX)
20527+
20528+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20529+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20530+ cmp %_ASM_BX,%_ASM_CX
20531+ jb 1234f
20532+ xor %ebx,%ebx
20533+1234:
20534+#endif
20535+
20536+#endif
20537+
20538+3: __copyuser_seg movl %eax,(_DEST)
20539 xor %eax,%eax
20540 EXIT
20541 ENDPROC(__put_user_4)
20542
20543 ENTRY(__put_user_8)
20544 ENTER
20545+
20546+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20547+ GET_THREAD_INFO(%_ASM_BX)
20548 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20549 sub $7,%_ASM_BX
20550 cmp %_ASM_BX,%_ASM_CX
20551 jae bad_put_user
20552-4: mov %_ASM_AX,(%_ASM_CX)
20553+
20554+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20555+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20556+ cmp %_ASM_BX,%_ASM_CX
20557+ jb 1234f
20558+ xor %ebx,%ebx
20559+1234:
20560+#endif
20561+
20562+#endif
20563+
20564+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20565 #ifdef CONFIG_X86_32
20566-5: movl %edx,4(%_ASM_CX)
20567+5: __copyuser_seg movl %edx,4(_DEST)
20568 #endif
20569 xor %eax,%eax
20570 EXIT
20571diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
20572index 1cad221..de671ee 100644
20573--- a/arch/x86/lib/rwlock.S
20574+++ b/arch/x86/lib/rwlock.S
20575@@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
20576 FRAME
20577 0: LOCK_PREFIX
20578 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20579+
20580+#ifdef CONFIG_PAX_REFCOUNT
20581+ jno 1234f
20582+ LOCK_PREFIX
20583+ WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20584+ int $4
20585+1234:
20586+ _ASM_EXTABLE(1234b, 1234b)
20587+#endif
20588+
20589 1: rep; nop
20590 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
20591 jne 1b
20592 LOCK_PREFIX
20593 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20594+
20595+#ifdef CONFIG_PAX_REFCOUNT
20596+ jno 1234f
20597+ LOCK_PREFIX
20598+ WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20599+ int $4
20600+1234:
20601+ _ASM_EXTABLE(1234b, 1234b)
20602+#endif
20603+
20604 jnz 0b
20605 ENDFRAME
20606+ pax_force_retaddr
20607 ret
20608 CFI_ENDPROC
20609 END(__write_lock_failed)
20610@@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
20611 FRAME
20612 0: LOCK_PREFIX
20613 READ_LOCK_SIZE(inc) (%__lock_ptr)
20614+
20615+#ifdef CONFIG_PAX_REFCOUNT
20616+ jno 1234f
20617+ LOCK_PREFIX
20618+ READ_LOCK_SIZE(dec) (%__lock_ptr)
20619+ int $4
20620+1234:
20621+ _ASM_EXTABLE(1234b, 1234b)
20622+#endif
20623+
20624 1: rep; nop
20625 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
20626 js 1b
20627 LOCK_PREFIX
20628 READ_LOCK_SIZE(dec) (%__lock_ptr)
20629+
20630+#ifdef CONFIG_PAX_REFCOUNT
20631+ jno 1234f
20632+ LOCK_PREFIX
20633+ READ_LOCK_SIZE(inc) (%__lock_ptr)
20634+ int $4
20635+1234:
20636+ _ASM_EXTABLE(1234b, 1234b)
20637+#endif
20638+
20639 js 0b
20640 ENDFRAME
20641+ pax_force_retaddr
20642 ret
20643 CFI_ENDPROC
20644 END(__read_lock_failed)
20645diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
20646index 5dff5f0..cadebf4 100644
20647--- a/arch/x86/lib/rwsem.S
20648+++ b/arch/x86/lib/rwsem.S
20649@@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
20650 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20651 CFI_RESTORE __ASM_REG(dx)
20652 restore_common_regs
20653+ pax_force_retaddr
20654 ret
20655 CFI_ENDPROC
20656 ENDPROC(call_rwsem_down_read_failed)
20657@@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
20658 movq %rax,%rdi
20659 call rwsem_down_write_failed
20660 restore_common_regs
20661+ pax_force_retaddr
20662 ret
20663 CFI_ENDPROC
20664 ENDPROC(call_rwsem_down_write_failed)
20665@@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
20666 movq %rax,%rdi
20667 call rwsem_wake
20668 restore_common_regs
20669-1: ret
20670+1: pax_force_retaddr
20671+ ret
20672 CFI_ENDPROC
20673 ENDPROC(call_rwsem_wake)
20674
20675@@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
20676 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20677 CFI_RESTORE __ASM_REG(dx)
20678 restore_common_regs
20679+ pax_force_retaddr
20680 ret
20681 CFI_ENDPROC
20682 ENDPROC(call_rwsem_downgrade_wake)
20683diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
20684index a63efd6..ccecad8 100644
20685--- a/arch/x86/lib/thunk_64.S
20686+++ b/arch/x86/lib/thunk_64.S
20687@@ -8,6 +8,7 @@
20688 #include <linux/linkage.h>
20689 #include <asm/dwarf2.h>
20690 #include <asm/calling.h>
20691+#include <asm/alternative-asm.h>
20692
20693 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
20694 .macro THUNK name, func, put_ret_addr_in_rdi=0
20695@@ -41,5 +42,6 @@
20696 SAVE_ARGS
20697 restore:
20698 RESTORE_ARGS
20699+ pax_force_retaddr
20700 ret
20701 CFI_ENDPROC
20702diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
20703index e218d5d..35679b4 100644
20704--- a/arch/x86/lib/usercopy_32.c
20705+++ b/arch/x86/lib/usercopy_32.c
20706@@ -43,7 +43,7 @@ do { \
20707 __asm__ __volatile__( \
20708 " testl %1,%1\n" \
20709 " jz 2f\n" \
20710- "0: lodsb\n" \
20711+ "0: "__copyuser_seg"lodsb\n" \
20712 " stosb\n" \
20713 " testb %%al,%%al\n" \
20714 " jz 1f\n" \
20715@@ -128,10 +128,12 @@ do { \
20716 int __d0; \
20717 might_fault(); \
20718 __asm__ __volatile__( \
20719+ __COPYUSER_SET_ES \
20720 "0: rep; stosl\n" \
20721 " movl %2,%0\n" \
20722 "1: rep; stosb\n" \
20723 "2:\n" \
20724+ __COPYUSER_RESTORE_ES \
20725 ".section .fixup,\"ax\"\n" \
20726 "3: lea 0(%2,%0,4),%0\n" \
20727 " jmp 2b\n" \
20728@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
20729 might_fault();
20730
20731 __asm__ __volatile__(
20732+ __COPYUSER_SET_ES
20733 " testl %0, %0\n"
20734 " jz 3f\n"
20735 " andl %0,%%ecx\n"
20736@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
20737 " subl %%ecx,%0\n"
20738 " addl %0,%%eax\n"
20739 "1:\n"
20740+ __COPYUSER_RESTORE_ES
20741 ".section .fixup,\"ax\"\n"
20742 "2: xorl %%eax,%%eax\n"
20743 " jmp 1b\n"
20744@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20745
20746 #ifdef CONFIG_X86_INTEL_USERCOPY
20747 static unsigned long
20748-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20749+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20750 {
20751 int d0, d1;
20752 __asm__ __volatile__(
20753@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20754 " .align 2,0x90\n"
20755 "3: movl 0(%4), %%eax\n"
20756 "4: movl 4(%4), %%edx\n"
20757- "5: movl %%eax, 0(%3)\n"
20758- "6: movl %%edx, 4(%3)\n"
20759+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20760+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20761 "7: movl 8(%4), %%eax\n"
20762 "8: movl 12(%4),%%edx\n"
20763- "9: movl %%eax, 8(%3)\n"
20764- "10: movl %%edx, 12(%3)\n"
20765+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20766+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20767 "11: movl 16(%4), %%eax\n"
20768 "12: movl 20(%4), %%edx\n"
20769- "13: movl %%eax, 16(%3)\n"
20770- "14: movl %%edx, 20(%3)\n"
20771+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20772+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20773 "15: movl 24(%4), %%eax\n"
20774 "16: movl 28(%4), %%edx\n"
20775- "17: movl %%eax, 24(%3)\n"
20776- "18: movl %%edx, 28(%3)\n"
20777+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20778+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20779 "19: movl 32(%4), %%eax\n"
20780 "20: movl 36(%4), %%edx\n"
20781- "21: movl %%eax, 32(%3)\n"
20782- "22: movl %%edx, 36(%3)\n"
20783+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20784+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20785 "23: movl 40(%4), %%eax\n"
20786 "24: movl 44(%4), %%edx\n"
20787- "25: movl %%eax, 40(%3)\n"
20788- "26: movl %%edx, 44(%3)\n"
20789+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20790+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20791 "27: movl 48(%4), %%eax\n"
20792 "28: movl 52(%4), %%edx\n"
20793- "29: movl %%eax, 48(%3)\n"
20794- "30: movl %%edx, 52(%3)\n"
20795+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20796+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20797 "31: movl 56(%4), %%eax\n"
20798 "32: movl 60(%4), %%edx\n"
20799- "33: movl %%eax, 56(%3)\n"
20800- "34: movl %%edx, 60(%3)\n"
20801+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20802+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20803 " addl $-64, %0\n"
20804 " addl $64, %4\n"
20805 " addl $64, %3\n"
20806@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20807 " shrl $2, %0\n"
20808 " andl $3, %%eax\n"
20809 " cld\n"
20810+ __COPYUSER_SET_ES
20811 "99: rep; movsl\n"
20812 "36: movl %%eax, %0\n"
20813 "37: rep; movsb\n"
20814 "100:\n"
20815+ __COPYUSER_RESTORE_ES
20816+ ".section .fixup,\"ax\"\n"
20817+ "101: lea 0(%%eax,%0,4),%0\n"
20818+ " jmp 100b\n"
20819+ ".previous\n"
20820+ ".section __ex_table,\"a\"\n"
20821+ " .align 4\n"
20822+ " .long 1b,100b\n"
20823+ " .long 2b,100b\n"
20824+ " .long 3b,100b\n"
20825+ " .long 4b,100b\n"
20826+ " .long 5b,100b\n"
20827+ " .long 6b,100b\n"
20828+ " .long 7b,100b\n"
20829+ " .long 8b,100b\n"
20830+ " .long 9b,100b\n"
20831+ " .long 10b,100b\n"
20832+ " .long 11b,100b\n"
20833+ " .long 12b,100b\n"
20834+ " .long 13b,100b\n"
20835+ " .long 14b,100b\n"
20836+ " .long 15b,100b\n"
20837+ " .long 16b,100b\n"
20838+ " .long 17b,100b\n"
20839+ " .long 18b,100b\n"
20840+ " .long 19b,100b\n"
20841+ " .long 20b,100b\n"
20842+ " .long 21b,100b\n"
20843+ " .long 22b,100b\n"
20844+ " .long 23b,100b\n"
20845+ " .long 24b,100b\n"
20846+ " .long 25b,100b\n"
20847+ " .long 26b,100b\n"
20848+ " .long 27b,100b\n"
20849+ " .long 28b,100b\n"
20850+ " .long 29b,100b\n"
20851+ " .long 30b,100b\n"
20852+ " .long 31b,100b\n"
20853+ " .long 32b,100b\n"
20854+ " .long 33b,100b\n"
20855+ " .long 34b,100b\n"
20856+ " .long 35b,100b\n"
20857+ " .long 36b,100b\n"
20858+ " .long 37b,100b\n"
20859+ " .long 99b,101b\n"
20860+ ".previous"
20861+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20862+ : "1"(to), "2"(from), "0"(size)
20863+ : "eax", "edx", "memory");
20864+ return size;
20865+}
20866+
20867+static unsigned long
20868+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20869+{
20870+ int d0, d1;
20871+ __asm__ __volatile__(
20872+ " .align 2,0x90\n"
20873+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20874+ " cmpl $67, %0\n"
20875+ " jbe 3f\n"
20876+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20877+ " .align 2,0x90\n"
20878+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20879+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20880+ "5: movl %%eax, 0(%3)\n"
20881+ "6: movl %%edx, 4(%3)\n"
20882+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20883+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20884+ "9: movl %%eax, 8(%3)\n"
20885+ "10: movl %%edx, 12(%3)\n"
20886+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20887+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20888+ "13: movl %%eax, 16(%3)\n"
20889+ "14: movl %%edx, 20(%3)\n"
20890+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20891+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20892+ "17: movl %%eax, 24(%3)\n"
20893+ "18: movl %%edx, 28(%3)\n"
20894+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20895+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20896+ "21: movl %%eax, 32(%3)\n"
20897+ "22: movl %%edx, 36(%3)\n"
20898+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20899+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20900+ "25: movl %%eax, 40(%3)\n"
20901+ "26: movl %%edx, 44(%3)\n"
20902+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20903+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20904+ "29: movl %%eax, 48(%3)\n"
20905+ "30: movl %%edx, 52(%3)\n"
20906+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20907+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20908+ "33: movl %%eax, 56(%3)\n"
20909+ "34: movl %%edx, 60(%3)\n"
20910+ " addl $-64, %0\n"
20911+ " addl $64, %4\n"
20912+ " addl $64, %3\n"
20913+ " cmpl $63, %0\n"
20914+ " ja 1b\n"
20915+ "35: movl %0, %%eax\n"
20916+ " shrl $2, %0\n"
20917+ " andl $3, %%eax\n"
20918+ " cld\n"
20919+ "99: rep; "__copyuser_seg" movsl\n"
20920+ "36: movl %%eax, %0\n"
20921+ "37: rep; "__copyuser_seg" movsb\n"
20922+ "100:\n"
20923 ".section .fixup,\"ax\"\n"
20924 "101: lea 0(%%eax,%0,4),%0\n"
20925 " jmp 100b\n"
20926@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20927 int d0, d1;
20928 __asm__ __volatile__(
20929 " .align 2,0x90\n"
20930- "0: movl 32(%4), %%eax\n"
20931+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20932 " cmpl $67, %0\n"
20933 " jbe 2f\n"
20934- "1: movl 64(%4), %%eax\n"
20935+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20936 " .align 2,0x90\n"
20937- "2: movl 0(%4), %%eax\n"
20938- "21: movl 4(%4), %%edx\n"
20939+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20940+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20941 " movl %%eax, 0(%3)\n"
20942 " movl %%edx, 4(%3)\n"
20943- "3: movl 8(%4), %%eax\n"
20944- "31: movl 12(%4),%%edx\n"
20945+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20946+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20947 " movl %%eax, 8(%3)\n"
20948 " movl %%edx, 12(%3)\n"
20949- "4: movl 16(%4), %%eax\n"
20950- "41: movl 20(%4), %%edx\n"
20951+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20952+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20953 " movl %%eax, 16(%3)\n"
20954 " movl %%edx, 20(%3)\n"
20955- "10: movl 24(%4), %%eax\n"
20956- "51: movl 28(%4), %%edx\n"
20957+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20958+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20959 " movl %%eax, 24(%3)\n"
20960 " movl %%edx, 28(%3)\n"
20961- "11: movl 32(%4), %%eax\n"
20962- "61: movl 36(%4), %%edx\n"
20963+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20964+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20965 " movl %%eax, 32(%3)\n"
20966 " movl %%edx, 36(%3)\n"
20967- "12: movl 40(%4), %%eax\n"
20968- "71: movl 44(%4), %%edx\n"
20969+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20970+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20971 " movl %%eax, 40(%3)\n"
20972 " movl %%edx, 44(%3)\n"
20973- "13: movl 48(%4), %%eax\n"
20974- "81: movl 52(%4), %%edx\n"
20975+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20976+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20977 " movl %%eax, 48(%3)\n"
20978 " movl %%edx, 52(%3)\n"
20979- "14: movl 56(%4), %%eax\n"
20980- "91: movl 60(%4), %%edx\n"
20981+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20982+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20983 " movl %%eax, 56(%3)\n"
20984 " movl %%edx, 60(%3)\n"
20985 " addl $-64, %0\n"
20986@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20987 " shrl $2, %0\n"
20988 " andl $3, %%eax\n"
20989 " cld\n"
20990- "6: rep; movsl\n"
20991+ "6: rep; "__copyuser_seg" movsl\n"
20992 " movl %%eax,%0\n"
20993- "7: rep; movsb\n"
20994+ "7: rep; "__copyuser_seg" movsb\n"
20995 "8:\n"
20996 ".section .fixup,\"ax\"\n"
20997 "9: lea 0(%%eax,%0,4),%0\n"
20998@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
20999
21000 __asm__ __volatile__(
21001 " .align 2,0x90\n"
21002- "0: movl 32(%4), %%eax\n"
21003+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21004 " cmpl $67, %0\n"
21005 " jbe 2f\n"
21006- "1: movl 64(%4), %%eax\n"
21007+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21008 " .align 2,0x90\n"
21009- "2: movl 0(%4), %%eax\n"
21010- "21: movl 4(%4), %%edx\n"
21011+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21012+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21013 " movnti %%eax, 0(%3)\n"
21014 " movnti %%edx, 4(%3)\n"
21015- "3: movl 8(%4), %%eax\n"
21016- "31: movl 12(%4),%%edx\n"
21017+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21018+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21019 " movnti %%eax, 8(%3)\n"
21020 " movnti %%edx, 12(%3)\n"
21021- "4: movl 16(%4), %%eax\n"
21022- "41: movl 20(%4), %%edx\n"
21023+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21024+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21025 " movnti %%eax, 16(%3)\n"
21026 " movnti %%edx, 20(%3)\n"
21027- "10: movl 24(%4), %%eax\n"
21028- "51: movl 28(%4), %%edx\n"
21029+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21030+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21031 " movnti %%eax, 24(%3)\n"
21032 " movnti %%edx, 28(%3)\n"
21033- "11: movl 32(%4), %%eax\n"
21034- "61: movl 36(%4), %%edx\n"
21035+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21036+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21037 " movnti %%eax, 32(%3)\n"
21038 " movnti %%edx, 36(%3)\n"
21039- "12: movl 40(%4), %%eax\n"
21040- "71: movl 44(%4), %%edx\n"
21041+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21042+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21043 " movnti %%eax, 40(%3)\n"
21044 " movnti %%edx, 44(%3)\n"
21045- "13: movl 48(%4), %%eax\n"
21046- "81: movl 52(%4), %%edx\n"
21047+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21048+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21049 " movnti %%eax, 48(%3)\n"
21050 " movnti %%edx, 52(%3)\n"
21051- "14: movl 56(%4), %%eax\n"
21052- "91: movl 60(%4), %%edx\n"
21053+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21054+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21055 " movnti %%eax, 56(%3)\n"
21056 " movnti %%edx, 60(%3)\n"
21057 " addl $-64, %0\n"
21058@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
21059 " shrl $2, %0\n"
21060 " andl $3, %%eax\n"
21061 " cld\n"
21062- "6: rep; movsl\n"
21063+ "6: rep; "__copyuser_seg" movsl\n"
21064 " movl %%eax,%0\n"
21065- "7: rep; movsb\n"
21066+ "7: rep; "__copyuser_seg" movsb\n"
21067 "8:\n"
21068 ".section .fixup,\"ax\"\n"
21069 "9: lea 0(%%eax,%0,4),%0\n"
21070@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
21071
21072 __asm__ __volatile__(
21073 " .align 2,0x90\n"
21074- "0: movl 32(%4), %%eax\n"
21075+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21076 " cmpl $67, %0\n"
21077 " jbe 2f\n"
21078- "1: movl 64(%4), %%eax\n"
21079+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21080 " .align 2,0x90\n"
21081- "2: movl 0(%4), %%eax\n"
21082- "21: movl 4(%4), %%edx\n"
21083+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21084+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21085 " movnti %%eax, 0(%3)\n"
21086 " movnti %%edx, 4(%3)\n"
21087- "3: movl 8(%4), %%eax\n"
21088- "31: movl 12(%4),%%edx\n"
21089+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21090+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21091 " movnti %%eax, 8(%3)\n"
21092 " movnti %%edx, 12(%3)\n"
21093- "4: movl 16(%4), %%eax\n"
21094- "41: movl 20(%4), %%edx\n"
21095+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21096+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21097 " movnti %%eax, 16(%3)\n"
21098 " movnti %%edx, 20(%3)\n"
21099- "10: movl 24(%4), %%eax\n"
21100- "51: movl 28(%4), %%edx\n"
21101+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21102+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21103 " movnti %%eax, 24(%3)\n"
21104 " movnti %%edx, 28(%3)\n"
21105- "11: movl 32(%4), %%eax\n"
21106- "61: movl 36(%4), %%edx\n"
21107+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21108+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21109 " movnti %%eax, 32(%3)\n"
21110 " movnti %%edx, 36(%3)\n"
21111- "12: movl 40(%4), %%eax\n"
21112- "71: movl 44(%4), %%edx\n"
21113+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21114+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21115 " movnti %%eax, 40(%3)\n"
21116 " movnti %%edx, 44(%3)\n"
21117- "13: movl 48(%4), %%eax\n"
21118- "81: movl 52(%4), %%edx\n"
21119+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21120+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21121 " movnti %%eax, 48(%3)\n"
21122 " movnti %%edx, 52(%3)\n"
21123- "14: movl 56(%4), %%eax\n"
21124- "91: movl 60(%4), %%edx\n"
21125+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21126+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21127 " movnti %%eax, 56(%3)\n"
21128 " movnti %%edx, 60(%3)\n"
21129 " addl $-64, %0\n"
21130@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
21131 " shrl $2, %0\n"
21132 " andl $3, %%eax\n"
21133 " cld\n"
21134- "6: rep; movsl\n"
21135+ "6: rep; "__copyuser_seg" movsl\n"
21136 " movl %%eax,%0\n"
21137- "7: rep; movsb\n"
21138+ "7: rep; "__copyuser_seg" movsb\n"
21139 "8:\n"
21140 ".section .fixup,\"ax\"\n"
21141 "9: lea 0(%%eax,%0,4),%0\n"
21142@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
21143 */
21144 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21145 unsigned long size);
21146-unsigned long __copy_user_intel(void __user *to, const void *from,
21147+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21148+ unsigned long size);
21149+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
21150 unsigned long size);
21151 unsigned long __copy_user_zeroing_intel_nocache(void *to,
21152 const void __user *from, unsigned long size);
21153 #endif /* CONFIG_X86_INTEL_USERCOPY */
21154
21155 /* Generic arbitrary sized copy. */
21156-#define __copy_user(to, from, size) \
21157+#define __copy_user(to, from, size, prefix, set, restore) \
21158 do { \
21159 int __d0, __d1, __d2; \
21160 __asm__ __volatile__( \
21161+ set \
21162 " cmp $7,%0\n" \
21163 " jbe 1f\n" \
21164 " movl %1,%0\n" \
21165 " negl %0\n" \
21166 " andl $7,%0\n" \
21167 " subl %0,%3\n" \
21168- "4: rep; movsb\n" \
21169+ "4: rep; "prefix"movsb\n" \
21170 " movl %3,%0\n" \
21171 " shrl $2,%0\n" \
21172 " andl $3,%3\n" \
21173 " .align 2,0x90\n" \
21174- "0: rep; movsl\n" \
21175+ "0: rep; "prefix"movsl\n" \
21176 " movl %3,%0\n" \
21177- "1: rep; movsb\n" \
21178+ "1: rep; "prefix"movsb\n" \
21179 "2:\n" \
21180+ restore \
21181 ".section .fixup,\"ax\"\n" \
21182 "5: addl %3,%0\n" \
21183 " jmp 2b\n" \
21184@@ -682,14 +799,14 @@ do { \
21185 " negl %0\n" \
21186 " andl $7,%0\n" \
21187 " subl %0,%3\n" \
21188- "4: rep; movsb\n" \
21189+ "4: rep; "__copyuser_seg"movsb\n" \
21190 " movl %3,%0\n" \
21191 " shrl $2,%0\n" \
21192 " andl $3,%3\n" \
21193 " .align 2,0x90\n" \
21194- "0: rep; movsl\n" \
21195+ "0: rep; "__copyuser_seg"movsl\n" \
21196 " movl %3,%0\n" \
21197- "1: rep; movsb\n" \
21198+ "1: rep; "__copyuser_seg"movsb\n" \
21199 "2:\n" \
21200 ".section .fixup,\"ax\"\n" \
21201 "5: addl %3,%0\n" \
21202@@ -775,9 +892,9 @@ survive:
21203 }
21204 #endif
21205 if (movsl_is_ok(to, from, n))
21206- __copy_user(to, from, n);
21207+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
21208 else
21209- n = __copy_user_intel(to, from, n);
21210+ n = __generic_copy_to_user_intel(to, from, n);
21211 return n;
21212 }
21213 EXPORT_SYMBOL(__copy_to_user_ll);
21214@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
21215 unsigned long n)
21216 {
21217 if (movsl_is_ok(to, from, n))
21218- __copy_user(to, from, n);
21219+ __copy_user(to, from, n, __copyuser_seg, "", "");
21220 else
21221- n = __copy_user_intel((void __user *)to,
21222- (const void *)from, n);
21223+ n = __generic_copy_from_user_intel(to, from, n);
21224 return n;
21225 }
21226 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21227@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
21228 if (n > 64 && cpu_has_xmm2)
21229 n = __copy_user_intel_nocache(to, from, n);
21230 else
21231- __copy_user(to, from, n);
21232+ __copy_user(to, from, n, __copyuser_seg, "", "");
21233 #else
21234- __copy_user(to, from, n);
21235+ __copy_user(to, from, n, __copyuser_seg, "", "");
21236 #endif
21237 return n;
21238 }
21239 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21240
21241-/**
21242- * copy_to_user: - Copy a block of data into user space.
21243- * @to: Destination address, in user space.
21244- * @from: Source address, in kernel space.
21245- * @n: Number of bytes to copy.
21246- *
21247- * Context: User context only. This function may sleep.
21248- *
21249- * Copy data from kernel space to user space.
21250- *
21251- * Returns number of bytes that could not be copied.
21252- * On success, this will be zero.
21253- */
21254-unsigned long
21255-copy_to_user(void __user *to, const void *from, unsigned long n)
21256-{
21257- if (access_ok(VERIFY_WRITE, to, n))
21258- n = __copy_to_user(to, from, n);
21259- return n;
21260-}
21261-EXPORT_SYMBOL(copy_to_user);
21262-
21263-/**
21264- * copy_from_user: - Copy a block of data from user space.
21265- * @to: Destination address, in kernel space.
21266- * @from: Source address, in user space.
21267- * @n: Number of bytes to copy.
21268- *
21269- * Context: User context only. This function may sleep.
21270- *
21271- * Copy data from user space to kernel space.
21272- *
21273- * Returns number of bytes that could not be copied.
21274- * On success, this will be zero.
21275- *
21276- * If some data could not be copied, this function will pad the copied
21277- * data to the requested size using zero bytes.
21278- */
21279-unsigned long
21280-_copy_from_user(void *to, const void __user *from, unsigned long n)
21281-{
21282- if (access_ok(VERIFY_READ, from, n))
21283- n = __copy_from_user(to, from, n);
21284- else
21285- memset(to, 0, n);
21286- return n;
21287-}
21288-EXPORT_SYMBOL(_copy_from_user);
21289-
21290 void copy_from_user_overflow(void)
21291 {
21292 WARN(1, "Buffer overflow detected!\n");
21293 }
21294 EXPORT_SYMBOL(copy_from_user_overflow);
21295+
21296+void copy_to_user_overflow(void)
21297+{
21298+ WARN(1, "Buffer overflow detected!\n");
21299+}
21300+EXPORT_SYMBOL(copy_to_user_overflow);
21301+
21302+#ifdef CONFIG_PAX_MEMORY_UDEREF
21303+void __set_fs(mm_segment_t x)
21304+{
21305+ switch (x.seg) {
21306+ case 0:
21307+ loadsegment(gs, 0);
21308+ break;
21309+ case TASK_SIZE_MAX:
21310+ loadsegment(gs, __USER_DS);
21311+ break;
21312+ case -1UL:
21313+ loadsegment(gs, __KERNEL_DS);
21314+ break;
21315+ default:
21316+ BUG();
21317+ }
21318+ return;
21319+}
21320+EXPORT_SYMBOL(__set_fs);
21321+
21322+void set_fs(mm_segment_t x)
21323+{
21324+ current_thread_info()->addr_limit = x;
21325+ __set_fs(x);
21326+}
21327+EXPORT_SYMBOL(set_fs);
21328+#endif
21329diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
21330index b7c2849..8633ad8 100644
21331--- a/arch/x86/lib/usercopy_64.c
21332+++ b/arch/x86/lib/usercopy_64.c
21333@@ -42,6 +42,12 @@ long
21334 __strncpy_from_user(char *dst, const char __user *src, long count)
21335 {
21336 long res;
21337+
21338+#ifdef CONFIG_PAX_MEMORY_UDEREF
21339+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21340+ src += PAX_USER_SHADOW_BASE;
21341+#endif
21342+
21343 __do_strncpy_from_user(dst, src, count, res);
21344 return res;
21345 }
21346@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
21347 {
21348 long __d0;
21349 might_fault();
21350+
21351+#ifdef CONFIG_PAX_MEMORY_UDEREF
21352+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21353+ addr += PAX_USER_SHADOW_BASE;
21354+#endif
21355+
21356 /* no memory constraint because it doesn't change any memory gcc knows
21357 about */
21358 asm volatile(
21359@@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
21360 }
21361 EXPORT_SYMBOL(strlen_user);
21362
21363-unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21364+unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
21365 {
21366- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21367- return copy_user_generic((__force void *)to, (__force void *)from, len);
21368- }
21369- return len;
21370+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21371+
21372+#ifdef CONFIG_PAX_MEMORY_UDEREF
21373+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21374+ to += PAX_USER_SHADOW_BASE;
21375+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21376+ from += PAX_USER_SHADOW_BASE;
21377+#endif
21378+
21379+ return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
21380+ }
21381+ return len;
21382 }
21383 EXPORT_SYMBOL(copy_in_user);
21384
21385@@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
21386 * it is not necessary to optimize tail handling.
21387 */
21388 unsigned long
21389-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
21390+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
21391 {
21392 char c;
21393 unsigned zero_len;
21394diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
21395index d0474ad..36e9257 100644
21396--- a/arch/x86/mm/extable.c
21397+++ b/arch/x86/mm/extable.c
21398@@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs)
21399 const struct exception_table_entry *fixup;
21400
21401 #ifdef CONFIG_PNPBIOS
21402- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21403+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21404 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21405 extern u32 pnp_bios_is_utter_crap;
21406 pnp_bios_is_utter_crap = 1;
21407diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
21408index 0d17c8c..c5d9925 100644
21409--- a/arch/x86/mm/fault.c
21410+++ b/arch/x86/mm/fault.c
21411@@ -13,11 +13,18 @@
21412 #include <linux/perf_event.h> /* perf_sw_event */
21413 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21414 #include <linux/prefetch.h> /* prefetchw */
21415+#include <linux/unistd.h>
21416+#include <linux/compiler.h>
21417
21418 #include <asm/traps.h> /* dotraplinkage, ... */
21419 #include <asm/pgalloc.h> /* pgd_*(), ... */
21420 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21421 #include <asm/vsyscall.h>
21422+#include <asm/tlbflush.h>
21423+
21424+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21425+#include <asm/stacktrace.h>
21426+#endif
21427
21428 /*
21429 * Page fault error code bits:
21430@@ -55,7 +62,7 @@ static inline int __kprobes notify_page_fault(struct pt_regs *regs)
21431 int ret = 0;
21432
21433 /* kprobe_running() needs smp_processor_id() */
21434- if (kprobes_built_in() && !user_mode_vm(regs)) {
21435+ if (kprobes_built_in() && !user_mode(regs)) {
21436 preempt_disable();
21437 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21438 ret = 1;
21439@@ -116,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
21440 return !instr_lo || (instr_lo>>1) == 1;
21441 case 0x00:
21442 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21443- if (probe_kernel_address(instr, opcode))
21444+ if (user_mode(regs)) {
21445+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21446+ return 0;
21447+ } else if (probe_kernel_address(instr, opcode))
21448 return 0;
21449
21450 *prefetch = (instr_lo == 0xF) &&
21451@@ -150,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
21452 while (instr < max_instr) {
21453 unsigned char opcode;
21454
21455- if (probe_kernel_address(instr, opcode))
21456+ if (user_mode(regs)) {
21457+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21458+ break;
21459+ } else if (probe_kernel_address(instr, opcode))
21460 break;
21461
21462 instr++;
21463@@ -181,6 +194,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
21464 force_sig_info(si_signo, &info, tsk);
21465 }
21466
21467+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21468+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
21469+#endif
21470+
21471+#ifdef CONFIG_PAX_EMUTRAMP
21472+static int pax_handle_fetch_fault(struct pt_regs *regs);
21473+#endif
21474+
21475+#ifdef CONFIG_PAX_PAGEEXEC
21476+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21477+{
21478+ pgd_t *pgd;
21479+ pud_t *pud;
21480+ pmd_t *pmd;
21481+
21482+ pgd = pgd_offset(mm, address);
21483+ if (!pgd_present(*pgd))
21484+ return NULL;
21485+ pud = pud_offset(pgd, address);
21486+ if (!pud_present(*pud))
21487+ return NULL;
21488+ pmd = pmd_offset(pud, address);
21489+ if (!pmd_present(*pmd))
21490+ return NULL;
21491+ return pmd;
21492+}
21493+#endif
21494+
21495 DEFINE_SPINLOCK(pgd_lock);
21496 LIST_HEAD(pgd_list);
21497
21498@@ -231,10 +272,22 @@ void vmalloc_sync_all(void)
21499 for (address = VMALLOC_START & PMD_MASK;
21500 address >= TASK_SIZE && address < FIXADDR_TOP;
21501 address += PMD_SIZE) {
21502+
21503+#ifdef CONFIG_PAX_PER_CPU_PGD
21504+ unsigned long cpu;
21505+#else
21506 struct page *page;
21507+#endif
21508
21509 spin_lock(&pgd_lock);
21510+
21511+#ifdef CONFIG_PAX_PER_CPU_PGD
21512+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21513+ pgd_t *pgd = get_cpu_pgd(cpu);
21514+ pmd_t *ret;
21515+#else
21516 list_for_each_entry(page, &pgd_list, lru) {
21517+ pgd_t *pgd = page_address(page);
21518 spinlock_t *pgt_lock;
21519 pmd_t *ret;
21520
21521@@ -242,8 +295,13 @@ void vmalloc_sync_all(void)
21522 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21523
21524 spin_lock(pgt_lock);
21525- ret = vmalloc_sync_one(page_address(page), address);
21526+#endif
21527+
21528+ ret = vmalloc_sync_one(pgd, address);
21529+
21530+#ifndef CONFIG_PAX_PER_CPU_PGD
21531 spin_unlock(pgt_lock);
21532+#endif
21533
21534 if (!ret)
21535 break;
21536@@ -277,6 +335,11 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21537 * an interrupt in the middle of a task switch..
21538 */
21539 pgd_paddr = read_cr3();
21540+
21541+#ifdef CONFIG_PAX_PER_CPU_PGD
21542+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21543+#endif
21544+
21545 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21546 if (!pmd_k)
21547 return -1;
21548@@ -372,7 +435,14 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21549 * happen within a race in page table update. In the later
21550 * case just flush:
21551 */
21552+
21553+#ifdef CONFIG_PAX_PER_CPU_PGD
21554+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21555+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21556+#else
21557 pgd = pgd_offset(current->active_mm, address);
21558+#endif
21559+
21560 pgd_ref = pgd_offset_k(address);
21561 if (pgd_none(*pgd_ref))
21562 return -1;
21563@@ -534,7 +604,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
21564 static int is_errata100(struct pt_regs *regs, unsigned long address)
21565 {
21566 #ifdef CONFIG_X86_64
21567- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21568+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21569 return 1;
21570 #endif
21571 return 0;
21572@@ -561,7 +631,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
21573 }
21574
21575 static const char nx_warning[] = KERN_CRIT
21576-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21577+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21578
21579 static void
21580 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21581@@ -570,15 +640,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21582 if (!oops_may_print())
21583 return;
21584
21585- if (error_code & PF_INSTR) {
21586+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21587 unsigned int level;
21588
21589 pte_t *pte = lookup_address(address, &level);
21590
21591 if (pte && pte_present(*pte) && !pte_exec(*pte))
21592- printk(nx_warning, current_uid());
21593+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21594 }
21595
21596+#ifdef CONFIG_PAX_KERNEXEC
21597+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21598+ if (current->signal->curr_ip)
21599+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21600+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21601+ else
21602+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21603+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21604+ }
21605+#endif
21606+
21607 printk(KERN_ALERT "BUG: unable to handle kernel ");
21608 if (address < PAGE_SIZE)
21609 printk(KERN_CONT "NULL pointer dereference");
21610@@ -733,6 +814,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
21611 }
21612 #endif
21613
21614+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21615+ if (pax_is_fetch_fault(regs, error_code, address)) {
21616+
21617+#ifdef CONFIG_PAX_EMUTRAMP
21618+ switch (pax_handle_fetch_fault(regs)) {
21619+ case 2:
21620+ return;
21621+ }
21622+#endif
21623+
21624+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21625+ do_group_exit(SIGKILL);
21626+ }
21627+#endif
21628+
21629 if (unlikely(show_unhandled_signals))
21630 show_signal_msg(regs, error_code, address, tsk);
21631
21632@@ -829,7 +925,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
21633 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
21634 printk(KERN_ERR
21635 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
21636- tsk->comm, tsk->pid, address);
21637+ tsk->comm, task_pid_nr(tsk), address);
21638 code = BUS_MCEERR_AR;
21639 }
21640 #endif
21641@@ -884,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
21642 return 1;
21643 }
21644
21645+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21646+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21647+{
21648+ pte_t *pte;
21649+ pmd_t *pmd;
21650+ spinlock_t *ptl;
21651+ unsigned char pte_mask;
21652+
21653+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21654+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21655+ return 0;
21656+
21657+ /* PaX: it's our fault, let's handle it if we can */
21658+
21659+ /* PaX: take a look at read faults before acquiring any locks */
21660+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21661+ /* instruction fetch attempt from a protected page in user mode */
21662+ up_read(&mm->mmap_sem);
21663+
21664+#ifdef CONFIG_PAX_EMUTRAMP
21665+ switch (pax_handle_fetch_fault(regs)) {
21666+ case 2:
21667+ return 1;
21668+ }
21669+#endif
21670+
21671+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21672+ do_group_exit(SIGKILL);
21673+ }
21674+
21675+ pmd = pax_get_pmd(mm, address);
21676+ if (unlikely(!pmd))
21677+ return 0;
21678+
21679+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21680+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21681+ pte_unmap_unlock(pte, ptl);
21682+ return 0;
21683+ }
21684+
21685+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21686+ /* write attempt to a protected page in user mode */
21687+ pte_unmap_unlock(pte, ptl);
21688+ return 0;
21689+ }
21690+
21691+#ifdef CONFIG_SMP
21692+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21693+#else
21694+ if (likely(address > get_limit(regs->cs)))
21695+#endif
21696+ {
21697+ set_pte(pte, pte_mkread(*pte));
21698+ __flush_tlb_one(address);
21699+ pte_unmap_unlock(pte, ptl);
21700+ up_read(&mm->mmap_sem);
21701+ return 1;
21702+ }
21703+
21704+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21705+
21706+ /*
21707+ * PaX: fill DTLB with user rights and retry
21708+ */
21709+ __asm__ __volatile__ (
21710+ "orb %2,(%1)\n"
21711+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21712+/*
21713+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21714+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21715+ * page fault when examined during a TLB load attempt. this is true not only
21716+ * for PTEs holding a non-present entry but also present entries that will
21717+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21718+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21719+ * for our target pages since their PTEs are simply not in the TLBs at all.
21720+
21721+ * the best thing in omitting it is that we gain around 15-20% speed in the
21722+ * fast path of the page fault handler and can get rid of tracing since we
21723+ * can no longer flush unintended entries.
21724+ */
21725+ "invlpg (%0)\n"
21726+#endif
21727+ __copyuser_seg"testb $0,(%0)\n"
21728+ "xorb %3,(%1)\n"
21729+ :
21730+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21731+ : "memory", "cc");
21732+ pte_unmap_unlock(pte, ptl);
21733+ up_read(&mm->mmap_sem);
21734+ return 1;
21735+}
21736+#endif
21737+
21738 /*
21739 * Handle a spurious fault caused by a stale TLB entry.
21740 *
21741@@ -956,6 +1145,9 @@ int show_unhandled_signals = 1;
21742 static inline int
21743 access_error(unsigned long error_code, struct vm_area_struct *vma)
21744 {
21745+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21746+ return 1;
21747+
21748 if (error_code & PF_WRITE) {
21749 /* write, present and write, not present: */
21750 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21751@@ -989,18 +1181,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21752 {
21753 struct vm_area_struct *vma;
21754 struct task_struct *tsk;
21755- unsigned long address;
21756 struct mm_struct *mm;
21757 int fault;
21758 int write = error_code & PF_WRITE;
21759 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
21760 (write ? FAULT_FLAG_WRITE : 0);
21761
21762- tsk = current;
21763- mm = tsk->mm;
21764-
21765 /* Get the faulting address: */
21766- address = read_cr2();
21767+ unsigned long address = read_cr2();
21768+
21769+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21770+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21771+ if (!search_exception_tables(regs->ip)) {
21772+ bad_area_nosemaphore(regs, error_code, address);
21773+ return;
21774+ }
21775+ if (address < PAX_USER_SHADOW_BASE) {
21776+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21777+ printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
21778+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21779+ } else
21780+ address -= PAX_USER_SHADOW_BASE;
21781+ }
21782+#endif
21783+
21784+ tsk = current;
21785+ mm = tsk->mm;
21786
21787 /*
21788 * Detect and handle instructions that would cause a page fault for
21789@@ -1061,7 +1267,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21790 * User-mode registers count as a user access even for any
21791 * potential system fault or CPU buglet:
21792 */
21793- if (user_mode_vm(regs)) {
21794+ if (user_mode(regs)) {
21795 local_irq_enable();
21796 error_code |= PF_USER;
21797 } else {
21798@@ -1116,6 +1322,11 @@ retry:
21799 might_sleep();
21800 }
21801
21802+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21803+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21804+ return;
21805+#endif
21806+
21807 vma = find_vma(mm, address);
21808 if (unlikely(!vma)) {
21809 bad_area(regs, error_code, address);
21810@@ -1127,18 +1338,24 @@ retry:
21811 bad_area(regs, error_code, address);
21812 return;
21813 }
21814- if (error_code & PF_USER) {
21815- /*
21816- * Accessing the stack below %sp is always a bug.
21817- * The large cushion allows instructions like enter
21818- * and pusha to work. ("enter $65535, $31" pushes
21819- * 32 pointers and then decrements %sp by 65535.)
21820- */
21821- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21822- bad_area(regs, error_code, address);
21823- return;
21824- }
21825+ /*
21826+ * Accessing the stack below %sp is always a bug.
21827+ * The large cushion allows instructions like enter
21828+ * and pusha to work. ("enter $65535, $31" pushes
21829+ * 32 pointers and then decrements %sp by 65535.)
21830+ */
21831+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21832+ bad_area(regs, error_code, address);
21833+ return;
21834 }
21835+
21836+#ifdef CONFIG_PAX_SEGMEXEC
21837+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21838+ bad_area(regs, error_code, address);
21839+ return;
21840+ }
21841+#endif
21842+
21843 if (unlikely(expand_stack(vma, address))) {
21844 bad_area(regs, error_code, address);
21845 return;
21846@@ -1193,3 +1410,292 @@ good_area:
21847
21848 up_read(&mm->mmap_sem);
21849 }
21850+
21851+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21852+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
21853+{
21854+ struct mm_struct *mm = current->mm;
21855+ unsigned long ip = regs->ip;
21856+
21857+ if (v8086_mode(regs))
21858+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21859+
21860+#ifdef CONFIG_PAX_PAGEEXEC
21861+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
21862+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
21863+ return true;
21864+ if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
21865+ return true;
21866+ return false;
21867+ }
21868+#endif
21869+
21870+#ifdef CONFIG_PAX_SEGMEXEC
21871+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
21872+ if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
21873+ return true;
21874+ return false;
21875+ }
21876+#endif
21877+
21878+ return false;
21879+}
21880+#endif
21881+
21882+#ifdef CONFIG_PAX_EMUTRAMP
21883+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21884+{
21885+ int err;
21886+
21887+ do { /* PaX: libffi trampoline emulation */
21888+ unsigned char mov, jmp;
21889+ unsigned int addr1, addr2;
21890+
21891+#ifdef CONFIG_X86_64
21892+ if ((regs->ip + 9) >> 32)
21893+ break;
21894+#endif
21895+
21896+ err = get_user(mov, (unsigned char __user *)regs->ip);
21897+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21898+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21899+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21900+
21901+ if (err)
21902+ break;
21903+
21904+ if (mov == 0xB8 && jmp == 0xE9) {
21905+ regs->ax = addr1;
21906+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21907+ return 2;
21908+ }
21909+ } while (0);
21910+
21911+ do { /* PaX: gcc trampoline emulation #1 */
21912+ unsigned char mov1, mov2;
21913+ unsigned short jmp;
21914+ unsigned int addr1, addr2;
21915+
21916+#ifdef CONFIG_X86_64
21917+ if ((regs->ip + 11) >> 32)
21918+ break;
21919+#endif
21920+
21921+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21922+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21923+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21924+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21925+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21926+
21927+ if (err)
21928+ break;
21929+
21930+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21931+ regs->cx = addr1;
21932+ regs->ax = addr2;
21933+ regs->ip = addr2;
21934+ return 2;
21935+ }
21936+ } while (0);
21937+
21938+ do { /* PaX: gcc trampoline emulation #2 */
21939+ unsigned char mov, jmp;
21940+ unsigned int addr1, addr2;
21941+
21942+#ifdef CONFIG_X86_64
21943+ if ((regs->ip + 9) >> 32)
21944+ break;
21945+#endif
21946+
21947+ err = get_user(mov, (unsigned char __user *)regs->ip);
21948+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21949+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21950+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21951+
21952+ if (err)
21953+ break;
21954+
21955+ if (mov == 0xB9 && jmp == 0xE9) {
21956+ regs->cx = addr1;
21957+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21958+ return 2;
21959+ }
21960+ } while (0);
21961+
21962+ return 1; /* PaX in action */
21963+}
21964+
21965+#ifdef CONFIG_X86_64
21966+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21967+{
21968+ int err;
21969+
21970+ do { /* PaX: libffi trampoline emulation */
21971+ unsigned short mov1, mov2, jmp1;
21972+ unsigned char stcclc, jmp2;
21973+ unsigned long addr1, addr2;
21974+
21975+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21976+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21977+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21978+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21979+ err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
21980+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
21981+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
21982+
21983+ if (err)
21984+ break;
21985+
21986+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21987+ regs->r11 = addr1;
21988+ regs->r10 = addr2;
21989+ if (stcclc == 0xF8)
21990+ regs->flags &= ~X86_EFLAGS_CF;
21991+ else
21992+ regs->flags |= X86_EFLAGS_CF;
21993+ regs->ip = addr1;
21994+ return 2;
21995+ }
21996+ } while (0);
21997+
21998+ do { /* PaX: gcc trampoline emulation #1 */
21999+ unsigned short mov1, mov2, jmp1;
22000+ unsigned char jmp2;
22001+ unsigned int addr1;
22002+ unsigned long addr2;
22003+
22004+ err = get_user(mov1, (unsigned short __user *)regs->ip);
22005+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
22006+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
22007+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
22008+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
22009+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
22010+
22011+ if (err)
22012+ break;
22013+
22014+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22015+ regs->r11 = addr1;
22016+ regs->r10 = addr2;
22017+ regs->ip = addr1;
22018+ return 2;
22019+ }
22020+ } while (0);
22021+
22022+ do { /* PaX: gcc trampoline emulation #2 */
22023+ unsigned short mov1, mov2, jmp1;
22024+ unsigned char jmp2;
22025+ unsigned long addr1, addr2;
22026+
22027+ err = get_user(mov1, (unsigned short __user *)regs->ip);
22028+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
22029+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
22030+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
22031+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
22032+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
22033+
22034+ if (err)
22035+ break;
22036+
22037+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22038+ regs->r11 = addr1;
22039+ regs->r10 = addr2;
22040+ regs->ip = addr1;
22041+ return 2;
22042+ }
22043+ } while (0);
22044+
22045+ return 1; /* PaX in action */
22046+}
22047+#endif
22048+
22049+/*
22050+ * PaX: decide what to do with offenders (regs->ip = fault address)
22051+ *
22052+ * returns 1 when task should be killed
22053+ * 2 when gcc trampoline was detected
22054+ */
22055+static int pax_handle_fetch_fault(struct pt_regs *regs)
22056+{
22057+ if (v8086_mode(regs))
22058+ return 1;
22059+
22060+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
22061+ return 1;
22062+
22063+#ifdef CONFIG_X86_32
22064+ return pax_handle_fetch_fault_32(regs);
22065+#else
22066+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
22067+ return pax_handle_fetch_fault_32(regs);
22068+ else
22069+ return pax_handle_fetch_fault_64(regs);
22070+#endif
22071+}
22072+#endif
22073+
22074+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22075+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
22076+{
22077+ long i;
22078+
22079+ printk(KERN_ERR "PAX: bytes at PC: ");
22080+ for (i = 0; i < 20; i++) {
22081+ unsigned char c;
22082+ if (get_user(c, (unsigned char __force_user *)pc+i))
22083+ printk(KERN_CONT "?? ");
22084+ else
22085+ printk(KERN_CONT "%02x ", c);
22086+ }
22087+ printk("\n");
22088+
22089+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22090+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
22091+ unsigned long c;
22092+ if (get_user(c, (unsigned long __force_user *)sp+i)) {
22093+#ifdef CONFIG_X86_32
22094+ printk(KERN_CONT "???????? ");
22095+#else
22096+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
22097+ printk(KERN_CONT "???????? ???????? ");
22098+ else
22099+ printk(KERN_CONT "???????????????? ");
22100+#endif
22101+ } else {
22102+#ifdef CONFIG_X86_64
22103+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
22104+ printk(KERN_CONT "%08x ", (unsigned int)c);
22105+ printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
22106+ } else
22107+#endif
22108+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
22109+ }
22110+ }
22111+ printk("\n");
22112+}
22113+#endif
22114+
22115+/**
22116+ * probe_kernel_write(): safely attempt to write to a location
22117+ * @dst: address to write to
22118+ * @src: pointer to the data that shall be written
22119+ * @size: size of the data chunk
22120+ *
22121+ * Safely write to address @dst from the buffer at @src. If a kernel fault
22122+ * happens, handle that and return -EFAULT.
22123+ */
22124+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
22125+{
22126+ long ret;
22127+ mm_segment_t old_fs = get_fs();
22128+
22129+ set_fs(KERNEL_DS);
22130+ pagefault_disable();
22131+ pax_open_kernel();
22132+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
22133+ pax_close_kernel();
22134+ pagefault_enable();
22135+ set_fs(old_fs);
22136+
22137+ return ret ? -EFAULT : 0;
22138+}
22139diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
22140index dd74e46..7d26398 100644
22141--- a/arch/x86/mm/gup.c
22142+++ b/arch/x86/mm/gup.c
22143@@ -255,7 +255,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
22144 addr = start;
22145 len = (unsigned long) nr_pages << PAGE_SHIFT;
22146 end = start + len;
22147- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22148+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22149 (void __user *)start, len)))
22150 return 0;
22151
22152diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
22153index f4f29b1..5cac4fb 100644
22154--- a/arch/x86/mm/highmem_32.c
22155+++ b/arch/x86/mm/highmem_32.c
22156@@ -44,7 +44,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
22157 idx = type + KM_TYPE_NR*smp_processor_id();
22158 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22159 BUG_ON(!pte_none(*(kmap_pte-idx)));
22160+
22161+ pax_open_kernel();
22162 set_pte(kmap_pte-idx, mk_pte(page, prot));
22163+ pax_close_kernel();
22164+
22165 arch_flush_lazy_mmu_mode();
22166
22167 return (void *)vaddr;
22168diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
22169index f581a18..29efd37 100644
22170--- a/arch/x86/mm/hugetlbpage.c
22171+++ b/arch/x86/mm/hugetlbpage.c
22172@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
22173 struct hstate *h = hstate_file(file);
22174 struct mm_struct *mm = current->mm;
22175 struct vm_area_struct *vma;
22176- unsigned long start_addr;
22177+ unsigned long start_addr, pax_task_size = TASK_SIZE;
22178+
22179+#ifdef CONFIG_PAX_SEGMEXEC
22180+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22181+ pax_task_size = SEGMEXEC_TASK_SIZE;
22182+#endif
22183+
22184+ pax_task_size -= PAGE_SIZE;
22185
22186 if (len > mm->cached_hole_size) {
22187- start_addr = mm->free_area_cache;
22188+ start_addr = mm->free_area_cache;
22189 } else {
22190- start_addr = TASK_UNMAPPED_BASE;
22191- mm->cached_hole_size = 0;
22192+ start_addr = mm->mmap_base;
22193+ mm->cached_hole_size = 0;
22194 }
22195
22196 full_search:
22197@@ -280,26 +287,27 @@ full_search:
22198
22199 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
22200 /* At this point: (!vma || addr < vma->vm_end). */
22201- if (TASK_SIZE - len < addr) {
22202+ if (pax_task_size - len < addr) {
22203 /*
22204 * Start a new search - just in case we missed
22205 * some holes.
22206 */
22207- if (start_addr != TASK_UNMAPPED_BASE) {
22208- start_addr = TASK_UNMAPPED_BASE;
22209+ if (start_addr != mm->mmap_base) {
22210+ start_addr = mm->mmap_base;
22211 mm->cached_hole_size = 0;
22212 goto full_search;
22213 }
22214 return -ENOMEM;
22215 }
22216- if (!vma || addr + len <= vma->vm_start) {
22217- mm->free_area_cache = addr + len;
22218- return addr;
22219- }
22220+ if (check_heap_stack_gap(vma, addr, len))
22221+ break;
22222 if (addr + mm->cached_hole_size < vma->vm_start)
22223 mm->cached_hole_size = vma->vm_start - addr;
22224 addr = ALIGN(vma->vm_end, huge_page_size(h));
22225 }
22226+
22227+ mm->free_area_cache = addr + len;
22228+ return addr;
22229 }
22230
22231 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22232@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22233 {
22234 struct hstate *h = hstate_file(file);
22235 struct mm_struct *mm = current->mm;
22236- struct vm_area_struct *vma, *prev_vma;
22237- unsigned long base = mm->mmap_base, addr = addr0;
22238+ struct vm_area_struct *vma;
22239+ unsigned long base = mm->mmap_base, addr;
22240 unsigned long largest_hole = mm->cached_hole_size;
22241- int first_time = 1;
22242
22243 /* don't allow allocations above current base */
22244 if (mm->free_area_cache > base)
22245@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22246 largest_hole = 0;
22247 mm->free_area_cache = base;
22248 }
22249-try_again:
22250+
22251 /* make sure it can fit in the remaining address space */
22252 if (mm->free_area_cache < len)
22253 goto fail;
22254
22255 /* either no address requested or can't fit in requested address hole */
22256- addr = (mm->free_area_cache - len) & huge_page_mask(h);
22257+ addr = (mm->free_area_cache - len);
22258 do {
22259+ addr &= huge_page_mask(h);
22260+ vma = find_vma(mm, addr);
22261 /*
22262 * Lookup failure means no vma is above this address,
22263 * i.e. return with success:
22264- */
22265- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22266- return addr;
22267-
22268- /*
22269 * new region fits between prev_vma->vm_end and
22270 * vma->vm_start, use it:
22271 */
22272- if (addr + len <= vma->vm_start &&
22273- (!prev_vma || (addr >= prev_vma->vm_end))) {
22274+ if (check_heap_stack_gap(vma, addr, len)) {
22275 /* remember the address as a hint for next time */
22276- mm->cached_hole_size = largest_hole;
22277- return (mm->free_area_cache = addr);
22278- } else {
22279- /* pull free_area_cache down to the first hole */
22280- if (mm->free_area_cache == vma->vm_end) {
22281- mm->free_area_cache = vma->vm_start;
22282- mm->cached_hole_size = largest_hole;
22283- }
22284+ mm->cached_hole_size = largest_hole;
22285+ return (mm->free_area_cache = addr);
22286+ }
22287+ /* pull free_area_cache down to the first hole */
22288+ if (mm->free_area_cache == vma->vm_end) {
22289+ mm->free_area_cache = vma->vm_start;
22290+ mm->cached_hole_size = largest_hole;
22291 }
22292
22293 /* remember the largest hole we saw so far */
22294 if (addr + largest_hole < vma->vm_start)
22295- largest_hole = vma->vm_start - addr;
22296+ largest_hole = vma->vm_start - addr;
22297
22298 /* try just below the current vma->vm_start */
22299- addr = (vma->vm_start - len) & huge_page_mask(h);
22300- } while (len <= vma->vm_start);
22301+ addr = skip_heap_stack_gap(vma, len);
22302+ } while (!IS_ERR_VALUE(addr));
22303
22304 fail:
22305 /*
22306- * if hint left us with no space for the requested
22307- * mapping then try again:
22308- */
22309- if (first_time) {
22310- mm->free_area_cache = base;
22311- largest_hole = 0;
22312- first_time = 0;
22313- goto try_again;
22314- }
22315- /*
22316 * A failed mmap() very likely causes application failure,
22317 * so fall back to the bottom-up function here. This scenario
22318 * can happen with large stack limits and large mmap()
22319 * allocations.
22320 */
22321- mm->free_area_cache = TASK_UNMAPPED_BASE;
22322+
22323+#ifdef CONFIG_PAX_SEGMEXEC
22324+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22325+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22326+ else
22327+#endif
22328+
22329+ mm->mmap_base = TASK_UNMAPPED_BASE;
22330+
22331+#ifdef CONFIG_PAX_RANDMMAP
22332+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22333+ mm->mmap_base += mm->delta_mmap;
22334+#endif
22335+
22336+ mm->free_area_cache = mm->mmap_base;
22337 mm->cached_hole_size = ~0UL;
22338 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22339 len, pgoff, flags);
22340@@ -386,6 +392,7 @@ fail:
22341 /*
22342 * Restore the topdown base:
22343 */
22344+ mm->mmap_base = base;
22345 mm->free_area_cache = base;
22346 mm->cached_hole_size = ~0UL;
22347
22348@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22349 struct hstate *h = hstate_file(file);
22350 struct mm_struct *mm = current->mm;
22351 struct vm_area_struct *vma;
22352+ unsigned long pax_task_size = TASK_SIZE;
22353
22354 if (len & ~huge_page_mask(h))
22355 return -EINVAL;
22356- if (len > TASK_SIZE)
22357+
22358+#ifdef CONFIG_PAX_SEGMEXEC
22359+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22360+ pax_task_size = SEGMEXEC_TASK_SIZE;
22361+#endif
22362+
22363+ pax_task_size -= PAGE_SIZE;
22364+
22365+ if (len > pax_task_size)
22366 return -ENOMEM;
22367
22368 if (flags & MAP_FIXED) {
22369@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22370 if (addr) {
22371 addr = ALIGN(addr, huge_page_size(h));
22372 vma = find_vma(mm, addr);
22373- if (TASK_SIZE - len >= addr &&
22374- (!vma || addr + len <= vma->vm_start))
22375+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22376 return addr;
22377 }
22378 if (mm->get_unmapped_area == arch_get_unmapped_area)
22379diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
22380index 87488b9..7129f32 100644
22381--- a/arch/x86/mm/init.c
22382+++ b/arch/x86/mm/init.c
22383@@ -31,7 +31,7 @@ int direct_gbpages
22384 static void __init find_early_table_space(unsigned long end, int use_pse,
22385 int use_gbpages)
22386 {
22387- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22388+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22389 phys_addr_t base;
22390
22391 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22392@@ -312,8 +312,29 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
22393 */
22394 int devmem_is_allowed(unsigned long pagenr)
22395 {
22396+#ifdef CONFIG_GRKERNSEC_KMEM
22397+ /* allow BDA */
22398+ if (!pagenr)
22399+ return 1;
22400+ /* allow EBDA */
22401+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22402+ return 1;
22403+#else
22404+ if (!pagenr)
22405+ return 1;
22406+#ifdef CONFIG_VM86
22407+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22408+ return 1;
22409+#endif
22410+#endif
22411+
22412+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22413+ return 1;
22414+#ifdef CONFIG_GRKERNSEC_KMEM
22415+ /* throw out everything else below 1MB */
22416 if (pagenr <= 256)
22417- return 1;
22418+ return 0;
22419+#endif
22420 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22421 return 0;
22422 if (!page_is_ram(pagenr))
22423@@ -372,6 +393,86 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
22424
22425 void free_initmem(void)
22426 {
22427+
22428+#ifdef CONFIG_PAX_KERNEXEC
22429+#ifdef CONFIG_X86_32
22430+ /* PaX: limit KERNEL_CS to actual size */
22431+ unsigned long addr, limit;
22432+ struct desc_struct d;
22433+ int cpu;
22434+
22435+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22436+ limit = (limit - 1UL) >> PAGE_SHIFT;
22437+
22438+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22439+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22440+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22441+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22442+ }
22443+
22444+ /* PaX: make KERNEL_CS read-only */
22445+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22446+ if (!paravirt_enabled())
22447+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22448+/*
22449+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22450+ pgd = pgd_offset_k(addr);
22451+ pud = pud_offset(pgd, addr);
22452+ pmd = pmd_offset(pud, addr);
22453+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22454+ }
22455+*/
22456+#ifdef CONFIG_X86_PAE
22457+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22458+/*
22459+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22460+ pgd = pgd_offset_k(addr);
22461+ pud = pud_offset(pgd, addr);
22462+ pmd = pmd_offset(pud, addr);
22463+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22464+ }
22465+*/
22466+#endif
22467+
22468+#ifdef CONFIG_MODULES
22469+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22470+#endif
22471+
22472+#else
22473+ pgd_t *pgd;
22474+ pud_t *pud;
22475+ pmd_t *pmd;
22476+ unsigned long addr, end;
22477+
22478+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22479+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22480+ pgd = pgd_offset_k(addr);
22481+ pud = pud_offset(pgd, addr);
22482+ pmd = pmd_offset(pud, addr);
22483+ if (!pmd_present(*pmd))
22484+ continue;
22485+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22486+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22487+ else
22488+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22489+ }
22490+
22491+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22492+ end = addr + KERNEL_IMAGE_SIZE;
22493+ for (; addr < end; addr += PMD_SIZE) {
22494+ pgd = pgd_offset_k(addr);
22495+ pud = pud_offset(pgd, addr);
22496+ pmd = pmd_offset(pud, addr);
22497+ if (!pmd_present(*pmd))
22498+ continue;
22499+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22500+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22501+ }
22502+#endif
22503+
22504+ flush_tlb_all();
22505+#endif
22506+
22507 free_init_pages("unused kernel memory",
22508 (unsigned long)(&__init_begin),
22509 (unsigned long)(&__init_end));
22510diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
22511index 29f7c6d..b46b35b 100644
22512--- a/arch/x86/mm/init_32.c
22513+++ b/arch/x86/mm/init_32.c
22514@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
22515 }
22516
22517 /*
22518- * Creates a middle page table and puts a pointer to it in the
22519- * given global directory entry. This only returns the gd entry
22520- * in non-PAE compilation mode, since the middle layer is folded.
22521- */
22522-static pmd_t * __init one_md_table_init(pgd_t *pgd)
22523-{
22524- pud_t *pud;
22525- pmd_t *pmd_table;
22526-
22527-#ifdef CONFIG_X86_PAE
22528- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22529- if (after_bootmem)
22530- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22531- else
22532- pmd_table = (pmd_t *)alloc_low_page();
22533- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22534- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22535- pud = pud_offset(pgd, 0);
22536- BUG_ON(pmd_table != pmd_offset(pud, 0));
22537-
22538- return pmd_table;
22539- }
22540-#endif
22541- pud = pud_offset(pgd, 0);
22542- pmd_table = pmd_offset(pud, 0);
22543-
22544- return pmd_table;
22545-}
22546-
22547-/*
22548 * Create a page table and place a pointer to it in a middle page
22549 * directory entry:
22550 */
22551@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
22552 page_table = (pte_t *)alloc_low_page();
22553
22554 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22555+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22556+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22557+#else
22558 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22559+#endif
22560 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22561 }
22562
22563 return pte_offset_kernel(pmd, 0);
22564 }
22565
22566+static pmd_t * __init one_md_table_init(pgd_t *pgd)
22567+{
22568+ pud_t *pud;
22569+ pmd_t *pmd_table;
22570+
22571+ pud = pud_offset(pgd, 0);
22572+ pmd_table = pmd_offset(pud, 0);
22573+
22574+ return pmd_table;
22575+}
22576+
22577 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22578 {
22579 int pgd_idx = pgd_index(vaddr);
22580@@ -203,6 +188,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22581 int pgd_idx, pmd_idx;
22582 unsigned long vaddr;
22583 pgd_t *pgd;
22584+ pud_t *pud;
22585 pmd_t *pmd;
22586 pte_t *pte = NULL;
22587
22588@@ -212,8 +198,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22589 pgd = pgd_base + pgd_idx;
22590
22591 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22592- pmd = one_md_table_init(pgd);
22593- pmd = pmd + pmd_index(vaddr);
22594+ pud = pud_offset(pgd, vaddr);
22595+ pmd = pmd_offset(pud, vaddr);
22596+
22597+#ifdef CONFIG_X86_PAE
22598+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22599+#endif
22600+
22601 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22602 pmd++, pmd_idx++) {
22603 pte = page_table_kmap_check(one_page_table_init(pmd),
22604@@ -225,11 +216,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22605 }
22606 }
22607
22608-static inline int is_kernel_text(unsigned long addr)
22609+static inline int is_kernel_text(unsigned long start, unsigned long end)
22610 {
22611- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22612- return 1;
22613- return 0;
22614+ if ((start > ktla_ktva((unsigned long)_etext) ||
22615+ end <= ktla_ktva((unsigned long)_stext)) &&
22616+ (start > ktla_ktva((unsigned long)_einittext) ||
22617+ end <= ktla_ktva((unsigned long)_sinittext)) &&
22618+
22619+#ifdef CONFIG_ACPI_SLEEP
22620+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22621+#endif
22622+
22623+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22624+ return 0;
22625+ return 1;
22626 }
22627
22628 /*
22629@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned long start,
22630 unsigned long last_map_addr = end;
22631 unsigned long start_pfn, end_pfn;
22632 pgd_t *pgd_base = swapper_pg_dir;
22633- int pgd_idx, pmd_idx, pte_ofs;
22634+ unsigned int pgd_idx, pmd_idx, pte_ofs;
22635 unsigned long pfn;
22636 pgd_t *pgd;
22637+ pud_t *pud;
22638 pmd_t *pmd;
22639 pte_t *pte;
22640 unsigned pages_2m, pages_4k;
22641@@ -281,8 +282,13 @@ repeat:
22642 pfn = start_pfn;
22643 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22644 pgd = pgd_base + pgd_idx;
22645- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22646- pmd = one_md_table_init(pgd);
22647+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22648+ pud = pud_offset(pgd, 0);
22649+ pmd = pmd_offset(pud, 0);
22650+
22651+#ifdef CONFIG_X86_PAE
22652+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22653+#endif
22654
22655 if (pfn >= end_pfn)
22656 continue;
22657@@ -294,14 +300,13 @@ repeat:
22658 #endif
22659 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22660 pmd++, pmd_idx++) {
22661- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22662+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22663
22664 /*
22665 * Map with big pages if possible, otherwise
22666 * create normal page tables:
22667 */
22668 if (use_pse) {
22669- unsigned int addr2;
22670 pgprot_t prot = PAGE_KERNEL_LARGE;
22671 /*
22672 * first pass will use the same initial
22673@@ -311,11 +316,7 @@ repeat:
22674 __pgprot(PTE_IDENT_ATTR |
22675 _PAGE_PSE);
22676
22677- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22678- PAGE_OFFSET + PAGE_SIZE-1;
22679-
22680- if (is_kernel_text(addr) ||
22681- is_kernel_text(addr2))
22682+ if (is_kernel_text(address, address + PMD_SIZE))
22683 prot = PAGE_KERNEL_LARGE_EXEC;
22684
22685 pages_2m++;
22686@@ -332,7 +333,7 @@ repeat:
22687 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22688 pte += pte_ofs;
22689 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22690- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22691+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22692 pgprot_t prot = PAGE_KERNEL;
22693 /*
22694 * first pass will use the same initial
22695@@ -340,7 +341,7 @@ repeat:
22696 */
22697 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22698
22699- if (is_kernel_text(addr))
22700+ if (is_kernel_text(address, address + PAGE_SIZE))
22701 prot = PAGE_KERNEL_EXEC;
22702
22703 pages_4k++;
22704@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
22705
22706 pud = pud_offset(pgd, va);
22707 pmd = pmd_offset(pud, va);
22708- if (!pmd_present(*pmd))
22709+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22710 break;
22711
22712 pte = pte_offset_kernel(pmd, va);
22713@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_range_init(void)
22714
22715 static void __init pagetable_init(void)
22716 {
22717- pgd_t *pgd_base = swapper_pg_dir;
22718-
22719- permanent_kmaps_init(pgd_base);
22720+ permanent_kmaps_init(swapper_pg_dir);
22721 }
22722
22723-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22724+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22725 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22726
22727 /* user-defined highmem size */
22728@@ -757,6 +756,12 @@ void __init mem_init(void)
22729
22730 pci_iommu_alloc();
22731
22732+#ifdef CONFIG_PAX_PER_CPU_PGD
22733+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22734+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22735+ KERNEL_PGD_PTRS);
22736+#endif
22737+
22738 #ifdef CONFIG_FLATMEM
22739 BUG_ON(!mem_map);
22740 #endif
22741@@ -774,7 +779,7 @@ void __init mem_init(void)
22742 set_highmem_pages_init();
22743
22744 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22745- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22746+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22747 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22748
22749 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22750@@ -815,10 +820,10 @@ void __init mem_init(void)
22751 ((unsigned long)&__init_end -
22752 (unsigned long)&__init_begin) >> 10,
22753
22754- (unsigned long)&_etext, (unsigned long)&_edata,
22755- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22756+ (unsigned long)&_sdata, (unsigned long)&_edata,
22757+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22758
22759- (unsigned long)&_text, (unsigned long)&_etext,
22760+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22761 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22762
22763 /*
22764@@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
22765 if (!kernel_set_to_readonly)
22766 return;
22767
22768+ start = ktla_ktva(start);
22769 pr_debug("Set kernel text: %lx - %lx for read write\n",
22770 start, start+size);
22771
22772@@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
22773 if (!kernel_set_to_readonly)
22774 return;
22775
22776+ start = ktla_ktva(start);
22777 pr_debug("Set kernel text: %lx - %lx for read only\n",
22778 start, start+size);
22779
22780@@ -938,6 +945,7 @@ void mark_rodata_ro(void)
22781 unsigned long start = PFN_ALIGN(_text);
22782 unsigned long size = PFN_ALIGN(_etext) - start;
22783
22784+ start = ktla_ktva(start);
22785 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22786 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22787 size >> 10);
22788diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
22789index bbaaa00..16dffad 100644
22790--- a/arch/x86/mm/init_64.c
22791+++ b/arch/x86/mm/init_64.c
22792@@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
22793 * around without checking the pgd every time.
22794 */
22795
22796-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22797+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22798 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22799
22800 int force_personality32;
22801@@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22802
22803 for (address = start; address <= end; address += PGDIR_SIZE) {
22804 const pgd_t *pgd_ref = pgd_offset_k(address);
22805+
22806+#ifdef CONFIG_PAX_PER_CPU_PGD
22807+ unsigned long cpu;
22808+#else
22809 struct page *page;
22810+#endif
22811
22812 if (pgd_none(*pgd_ref))
22813 continue;
22814
22815 spin_lock(&pgd_lock);
22816+
22817+#ifdef CONFIG_PAX_PER_CPU_PGD
22818+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22819+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22820+#else
22821 list_for_each_entry(page, &pgd_list, lru) {
22822 pgd_t *pgd;
22823 spinlock_t *pgt_lock;
22824@@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22825 /* the pgt_lock only for Xen */
22826 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22827 spin_lock(pgt_lock);
22828+#endif
22829
22830 if (pgd_none(*pgd))
22831 set_pgd(pgd, *pgd_ref);
22832@@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22833 BUG_ON(pgd_page_vaddr(*pgd)
22834 != pgd_page_vaddr(*pgd_ref));
22835
22836+#ifndef CONFIG_PAX_PER_CPU_PGD
22837 spin_unlock(pgt_lock);
22838+#endif
22839+
22840 }
22841 spin_unlock(&pgd_lock);
22842 }
22843@@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
22844 pmd = fill_pmd(pud, vaddr);
22845 pte = fill_pte(pmd, vaddr);
22846
22847+ pax_open_kernel();
22848 set_pte(pte, new_pte);
22849+ pax_close_kernel();
22850
22851 /*
22852 * It's enough to flush this one mapping.
22853@@ -262,14 +278,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
22854 pgd = pgd_offset_k((unsigned long)__va(phys));
22855 if (pgd_none(*pgd)) {
22856 pud = (pud_t *) spp_getpage();
22857- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22858- _PAGE_USER));
22859+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22860 }
22861 pud = pud_offset(pgd, (unsigned long)__va(phys));
22862 if (pud_none(*pud)) {
22863 pmd = (pmd_t *) spp_getpage();
22864- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22865- _PAGE_USER));
22866+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22867 }
22868 pmd = pmd_offset(pud, phys);
22869 BUG_ON(!pmd_none(*pmd));
22870@@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
22871 if (pfn >= pgt_buf_top)
22872 panic("alloc_low_page: ran out of memory");
22873
22874- adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22875+ adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22876 clear_page(adr);
22877 *phys = pfn * PAGE_SIZE;
22878 return adr;
22879@@ -346,7 +360,7 @@ static __ref void *map_low_page(void *virt)
22880
22881 phys = __pa(virt);
22882 left = phys & (PAGE_SIZE - 1);
22883- adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22884+ adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22885 adr = (void *)(((unsigned long)adr) | left);
22886
22887 return adr;
22888@@ -693,6 +707,12 @@ void __init mem_init(void)
22889
22890 pci_iommu_alloc();
22891
22892+#ifdef CONFIG_PAX_PER_CPU_PGD
22893+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22894+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22895+ KERNEL_PGD_PTRS);
22896+#endif
22897+
22898 /* clear_bss() already clear the empty_zero_page */
22899
22900 reservedpages = 0;
22901@@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
22902 static struct vm_area_struct gate_vma = {
22903 .vm_start = VSYSCALL_START,
22904 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22905- .vm_page_prot = PAGE_READONLY_EXEC,
22906- .vm_flags = VM_READ | VM_EXEC
22907+ .vm_page_prot = PAGE_READONLY,
22908+ .vm_flags = VM_READ
22909 };
22910
22911 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22912@@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long addr)
22913
22914 const char *arch_vma_name(struct vm_area_struct *vma)
22915 {
22916- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22917+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22918 return "[vdso]";
22919 if (vma == &gate_vma)
22920 return "[vsyscall]";
22921diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
22922index 7b179b4..6bd1777 100644
22923--- a/arch/x86/mm/iomap_32.c
22924+++ b/arch/x86/mm/iomap_32.c
22925@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
22926 type = kmap_atomic_idx_push();
22927 idx = type + KM_TYPE_NR * smp_processor_id();
22928 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22929+
22930+ pax_open_kernel();
22931 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22932+ pax_close_kernel();
22933+
22934 arch_flush_lazy_mmu_mode();
22935
22936 return (void *)vaddr;
22937diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
22938index be1ef57..9680edc 100644
22939--- a/arch/x86/mm/ioremap.c
22940+++ b/arch/x86/mm/ioremap.c
22941@@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
22942 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22943 int is_ram = page_is_ram(pfn);
22944
22945- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22946+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22947 return NULL;
22948 WARN_ON_ONCE(is_ram);
22949 }
22950@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_setup(char *str)
22951 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22952
22953 static __initdata int after_paging_init;
22954-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22955+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22956
22957 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22958 {
22959@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22960 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22961
22962 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22963- memset(bm_pte, 0, sizeof(bm_pte));
22964- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22965+ pmd_populate_user(&init_mm, pmd, bm_pte);
22966
22967 /*
22968 * The boot-ioremap range spans multiple pmds, for which
22969diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
22970index d87dd6d..bf3fa66 100644
22971--- a/arch/x86/mm/kmemcheck/kmemcheck.c
22972+++ b/arch/x86/mm/kmemcheck/kmemcheck.c
22973@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
22974 * memory (e.g. tracked pages)? For now, we need this to avoid
22975 * invoking kmemcheck for PnP BIOS calls.
22976 */
22977- if (regs->flags & X86_VM_MASK)
22978+ if (v8086_mode(regs))
22979 return false;
22980- if (regs->cs != __KERNEL_CS)
22981+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22982 return false;
22983
22984 pte = kmemcheck_pte_lookup(address);
22985diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
22986index f927429..39c2947 100644
22987--- a/arch/x86/mm/mmap.c
22988+++ b/arch/x86/mm/mmap.c
22989@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
22990 * Leave an at least ~128 MB hole with possible stack randomization.
22991 */
22992 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22993-#define MAX_GAP (TASK_SIZE/6*5)
22994+#define MAX_GAP (pax_task_size/6*5)
22995
22996 /*
22997 * True on X86_32 or when emulating IA32 on X86_64
22998@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22999 return rnd << PAGE_SHIFT;
23000 }
23001
23002-static unsigned long mmap_base(void)
23003+static unsigned long mmap_base(struct mm_struct *mm)
23004 {
23005 unsigned long gap = rlimit(RLIMIT_STACK);
23006+ unsigned long pax_task_size = TASK_SIZE;
23007+
23008+#ifdef CONFIG_PAX_SEGMEXEC
23009+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
23010+ pax_task_size = SEGMEXEC_TASK_SIZE;
23011+#endif
23012
23013 if (gap < MIN_GAP)
23014 gap = MIN_GAP;
23015 else if (gap > MAX_GAP)
23016 gap = MAX_GAP;
23017
23018- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
23019+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
23020 }
23021
23022 /*
23023 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
23024 * does, but not when emulating X86_32
23025 */
23026-static unsigned long mmap_legacy_base(void)
23027+static unsigned long mmap_legacy_base(struct mm_struct *mm)
23028 {
23029- if (mmap_is_ia32())
23030+ if (mmap_is_ia32()) {
23031+
23032+#ifdef CONFIG_PAX_SEGMEXEC
23033+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
23034+ return SEGMEXEC_TASK_UNMAPPED_BASE;
23035+ else
23036+#endif
23037+
23038 return TASK_UNMAPPED_BASE;
23039- else
23040+ } else
23041 return TASK_UNMAPPED_BASE + mmap_rnd();
23042 }
23043
23044@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
23045 void arch_pick_mmap_layout(struct mm_struct *mm)
23046 {
23047 if (mmap_is_legacy()) {
23048- mm->mmap_base = mmap_legacy_base();
23049+ mm->mmap_base = mmap_legacy_base(mm);
23050+
23051+#ifdef CONFIG_PAX_RANDMMAP
23052+ if (mm->pax_flags & MF_PAX_RANDMMAP)
23053+ mm->mmap_base += mm->delta_mmap;
23054+#endif
23055+
23056 mm->get_unmapped_area = arch_get_unmapped_area;
23057 mm->unmap_area = arch_unmap_area;
23058 } else {
23059- mm->mmap_base = mmap_base();
23060+ mm->mmap_base = mmap_base(mm);
23061+
23062+#ifdef CONFIG_PAX_RANDMMAP
23063+ if (mm->pax_flags & MF_PAX_RANDMMAP)
23064+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
23065+#endif
23066+
23067 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
23068 mm->unmap_area = arch_unmap_area_topdown;
23069 }
23070diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
23071index 67421f3..8d6b107 100644
23072--- a/arch/x86/mm/mmio-mod.c
23073+++ b/arch/x86/mm/mmio-mod.c
23074@@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
23075 break;
23076 default:
23077 {
23078- unsigned char *ip = (unsigned char *)instptr;
23079+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23080 my_trace->opcode = MMIO_UNKNOWN_OP;
23081 my_trace->width = 0;
23082 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23083@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
23084 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23085 void __iomem *addr)
23086 {
23087- static atomic_t next_id;
23088+ static atomic_unchecked_t next_id;
23089 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23090 /* These are page-unaligned. */
23091 struct mmiotrace_map map = {
23092@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23093 .private = trace
23094 },
23095 .phys = offset,
23096- .id = atomic_inc_return(&next_id)
23097+ .id = atomic_inc_return_unchecked(&next_id)
23098 };
23099 map.map_id = trace->id;
23100
23101diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
23102index b008656..773eac2 100644
23103--- a/arch/x86/mm/pageattr-test.c
23104+++ b/arch/x86/mm/pageattr-test.c
23105@@ -36,7 +36,7 @@ enum {
23106
23107 static int pte_testbit(pte_t pte)
23108 {
23109- return pte_flags(pte) & _PAGE_UNUSED1;
23110+ return pte_flags(pte) & _PAGE_CPA_TEST;
23111 }
23112
23113 struct split_state {
23114diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
23115index f9e5267..6f6e27f 100644
23116--- a/arch/x86/mm/pageattr.c
23117+++ b/arch/x86/mm/pageattr.c
23118@@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23119 */
23120 #ifdef CONFIG_PCI_BIOS
23121 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23122- pgprot_val(forbidden) |= _PAGE_NX;
23123+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23124 #endif
23125
23126 /*
23127@@ -269,9 +269,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23128 * Does not cover __inittext since that is gone later on. On
23129 * 64bit we do not enforce !NX on the low mapping
23130 */
23131- if (within(address, (unsigned long)_text, (unsigned long)_etext))
23132- pgprot_val(forbidden) |= _PAGE_NX;
23133+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
23134+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23135
23136+#ifdef CONFIG_DEBUG_RODATA
23137 /*
23138 * The .rodata section needs to be read-only. Using the pfn
23139 * catches all aliases.
23140@@ -279,6 +280,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23141 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
23142 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
23143 pgprot_val(forbidden) |= _PAGE_RW;
23144+#endif
23145
23146 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
23147 /*
23148@@ -317,6 +319,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23149 }
23150 #endif
23151
23152+#ifdef CONFIG_PAX_KERNEXEC
23153+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
23154+ pgprot_val(forbidden) |= _PAGE_RW;
23155+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23156+ }
23157+#endif
23158+
23159 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
23160
23161 return prot;
23162@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
23163 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
23164 {
23165 /* change init_mm */
23166+ pax_open_kernel();
23167 set_pte_atomic(kpte, pte);
23168+
23169 #ifdef CONFIG_X86_32
23170 if (!SHARED_KERNEL_PMD) {
23171+
23172+#ifdef CONFIG_PAX_PER_CPU_PGD
23173+ unsigned long cpu;
23174+#else
23175 struct page *page;
23176+#endif
23177
23178+#ifdef CONFIG_PAX_PER_CPU_PGD
23179+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
23180+ pgd_t *pgd = get_cpu_pgd(cpu);
23181+#else
23182 list_for_each_entry(page, &pgd_list, lru) {
23183- pgd_t *pgd;
23184+ pgd_t *pgd = (pgd_t *)page_address(page);
23185+#endif
23186+
23187 pud_t *pud;
23188 pmd_t *pmd;
23189
23190- pgd = (pgd_t *)page_address(page) + pgd_index(address);
23191+ pgd += pgd_index(address);
23192 pud = pud_offset(pgd, address);
23193 pmd = pmd_offset(pud, address);
23194 set_pte_atomic((pte_t *)pmd, pte);
23195 }
23196 }
23197 #endif
23198+ pax_close_kernel();
23199 }
23200
23201 static int
23202diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
23203index f6ff57b..481690f 100644
23204--- a/arch/x86/mm/pat.c
23205+++ b/arch/x86/mm/pat.c
23206@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
23207
23208 if (!entry) {
23209 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
23210- current->comm, current->pid, start, end);
23211+ current->comm, task_pid_nr(current), start, end);
23212 return -EINVAL;
23213 }
23214
23215@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
23216 while (cursor < to) {
23217 if (!devmem_is_allowed(pfn)) {
23218 printk(KERN_INFO
23219- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
23220- current->comm, from, to);
23221+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
23222+ current->comm, from, to, cursor);
23223 return 0;
23224 }
23225 cursor += PAGE_SIZE;
23226@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
23227 printk(KERN_INFO
23228 "%s:%d ioremap_change_attr failed %s "
23229 "for %Lx-%Lx\n",
23230- current->comm, current->pid,
23231+ current->comm, task_pid_nr(current),
23232 cattr_name(flags),
23233 base, (unsigned long long)(base + size));
23234 return -EINVAL;
23235@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23236 if (want_flags != flags) {
23237 printk(KERN_WARNING
23238 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
23239- current->comm, current->pid,
23240+ current->comm, task_pid_nr(current),
23241 cattr_name(want_flags),
23242 (unsigned long long)paddr,
23243 (unsigned long long)(paddr + size),
23244@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23245 free_memtype(paddr, paddr + size);
23246 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23247 " for %Lx-%Lx, got %s\n",
23248- current->comm, current->pid,
23249+ current->comm, task_pid_nr(current),
23250 cattr_name(want_flags),
23251 (unsigned long long)paddr,
23252 (unsigned long long)(paddr + size),
23253diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
23254index 9f0614d..92ae64a 100644
23255--- a/arch/x86/mm/pf_in.c
23256+++ b/arch/x86/mm/pf_in.c
23257@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
23258 int i;
23259 enum reason_type rv = OTHERS;
23260
23261- p = (unsigned char *)ins_addr;
23262+ p = (unsigned char *)ktla_ktva(ins_addr);
23263 p += skip_prefix(p, &prf);
23264 p += get_opcode(p, &opcode);
23265
23266@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
23267 struct prefix_bits prf;
23268 int i;
23269
23270- p = (unsigned char *)ins_addr;
23271+ p = (unsigned char *)ktla_ktva(ins_addr);
23272 p += skip_prefix(p, &prf);
23273 p += get_opcode(p, &opcode);
23274
23275@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
23276 struct prefix_bits prf;
23277 int i;
23278
23279- p = (unsigned char *)ins_addr;
23280+ p = (unsigned char *)ktla_ktva(ins_addr);
23281 p += skip_prefix(p, &prf);
23282 p += get_opcode(p, &opcode);
23283
23284@@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
23285 struct prefix_bits prf;
23286 int i;
23287
23288- p = (unsigned char *)ins_addr;
23289+ p = (unsigned char *)ktla_ktva(ins_addr);
23290 p += skip_prefix(p, &prf);
23291 p += get_opcode(p, &opcode);
23292 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
23293@@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
23294 struct prefix_bits prf;
23295 int i;
23296
23297- p = (unsigned char *)ins_addr;
23298+ p = (unsigned char *)ktla_ktva(ins_addr);
23299 p += skip_prefix(p, &prf);
23300 p += get_opcode(p, &opcode);
23301 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
23302diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
23303index 8573b83..6372501 100644
23304--- a/arch/x86/mm/pgtable.c
23305+++ b/arch/x86/mm/pgtable.c
23306@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *pgd)
23307 list_del(&page->lru);
23308 }
23309
23310-#define UNSHARED_PTRS_PER_PGD \
23311- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23312+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23313+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23314
23315+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23316+{
23317+ while (count--)
23318+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23319+}
23320+#endif
23321
23322+#ifdef CONFIG_PAX_PER_CPU_PGD
23323+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23324+{
23325+ while (count--)
23326+
23327+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23328+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23329+#else
23330+ *dst++ = *src++;
23331+#endif
23332+
23333+}
23334+#endif
23335+
23336+#ifdef CONFIG_X86_64
23337+#define pxd_t pud_t
23338+#define pyd_t pgd_t
23339+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23340+#define pxd_free(mm, pud) pud_free((mm), (pud))
23341+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23342+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23343+#define PYD_SIZE PGDIR_SIZE
23344+#else
23345+#define pxd_t pmd_t
23346+#define pyd_t pud_t
23347+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23348+#define pxd_free(mm, pud) pmd_free((mm), (pud))
23349+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23350+#define pyd_offset(mm ,address) pud_offset((mm), (address))
23351+#define PYD_SIZE PUD_SIZE
23352+#endif
23353+
23354+#ifdef CONFIG_PAX_PER_CPU_PGD
23355+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
23356+static inline void pgd_dtor(pgd_t *pgd) {}
23357+#else
23358 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
23359 {
23360 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
23361@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
23362 pgd_list_del(pgd);
23363 spin_unlock(&pgd_lock);
23364 }
23365+#endif
23366
23367 /*
23368 * List of all pgd's needed for non-PAE so it can invalidate entries
23369@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
23370 * -- wli
23371 */
23372
23373-#ifdef CONFIG_X86_PAE
23374+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23375 /*
23376 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23377 * updating the top-level pagetable entries to guarantee the
23378@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
23379 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23380 * and initialize the kernel pmds here.
23381 */
23382-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23383+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23384
23385 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23386 {
23387@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23388 */
23389 flush_tlb_mm(mm);
23390 }
23391+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23392+#define PREALLOCATED_PXDS USER_PGD_PTRS
23393 #else /* !CONFIG_X86_PAE */
23394
23395 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23396-#define PREALLOCATED_PMDS 0
23397+#define PREALLOCATED_PXDS 0
23398
23399 #endif /* CONFIG_X86_PAE */
23400
23401-static void free_pmds(pmd_t *pmds[])
23402+static void free_pxds(pxd_t *pxds[])
23403 {
23404 int i;
23405
23406- for(i = 0; i < PREALLOCATED_PMDS; i++)
23407- if (pmds[i])
23408- free_page((unsigned long)pmds[i]);
23409+ for(i = 0; i < PREALLOCATED_PXDS; i++)
23410+ if (pxds[i])
23411+ free_page((unsigned long)pxds[i]);
23412 }
23413
23414-static int preallocate_pmds(pmd_t *pmds[])
23415+static int preallocate_pxds(pxd_t *pxds[])
23416 {
23417 int i;
23418 bool failed = false;
23419
23420- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23421- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23422- if (pmd == NULL)
23423+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23424+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23425+ if (pxd == NULL)
23426 failed = true;
23427- pmds[i] = pmd;
23428+ pxds[i] = pxd;
23429 }
23430
23431 if (failed) {
23432- free_pmds(pmds);
23433+ free_pxds(pxds);
23434 return -ENOMEM;
23435 }
23436
23437@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[])
23438 * preallocate which never got a corresponding vma will need to be
23439 * freed manually.
23440 */
23441-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23442+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23443 {
23444 int i;
23445
23446- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23447+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23448 pgd_t pgd = pgdp[i];
23449
23450 if (pgd_val(pgd) != 0) {
23451- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23452+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23453
23454- pgdp[i] = native_make_pgd(0);
23455+ set_pgd(pgdp + i, native_make_pgd(0));
23456
23457- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23458- pmd_free(mm, pmd);
23459+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23460+ pxd_free(mm, pxd);
23461 }
23462 }
23463 }
23464
23465-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23466+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23467 {
23468- pud_t *pud;
23469+ pyd_t *pyd;
23470 unsigned long addr;
23471 int i;
23472
23473- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23474+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23475 return;
23476
23477- pud = pud_offset(pgd, 0);
23478+#ifdef CONFIG_X86_64
23479+ pyd = pyd_offset(mm, 0L);
23480+#else
23481+ pyd = pyd_offset(pgd, 0L);
23482+#endif
23483
23484- for (addr = i = 0; i < PREALLOCATED_PMDS;
23485- i++, pud++, addr += PUD_SIZE) {
23486- pmd_t *pmd = pmds[i];
23487+ for (addr = i = 0; i < PREALLOCATED_PXDS;
23488+ i++, pyd++, addr += PYD_SIZE) {
23489+ pxd_t *pxd = pxds[i];
23490
23491 if (i >= KERNEL_PGD_BOUNDARY)
23492- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23493- sizeof(pmd_t) * PTRS_PER_PMD);
23494+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23495+ sizeof(pxd_t) * PTRS_PER_PMD);
23496
23497- pud_populate(mm, pud, pmd);
23498+ pyd_populate(mm, pyd, pxd);
23499 }
23500 }
23501
23502 pgd_t *pgd_alloc(struct mm_struct *mm)
23503 {
23504 pgd_t *pgd;
23505- pmd_t *pmds[PREALLOCATED_PMDS];
23506+ pxd_t *pxds[PREALLOCATED_PXDS];
23507
23508 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23509
23510@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23511
23512 mm->pgd = pgd;
23513
23514- if (preallocate_pmds(pmds) != 0)
23515+ if (preallocate_pxds(pxds) != 0)
23516 goto out_free_pgd;
23517
23518 if (paravirt_pgd_alloc(mm) != 0)
23519- goto out_free_pmds;
23520+ goto out_free_pxds;
23521
23522 /*
23523 * Make sure that pre-populating the pmds is atomic with
23524@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23525 spin_lock(&pgd_lock);
23526
23527 pgd_ctor(mm, pgd);
23528- pgd_prepopulate_pmd(mm, pgd, pmds);
23529+ pgd_prepopulate_pxd(mm, pgd, pxds);
23530
23531 spin_unlock(&pgd_lock);
23532
23533 return pgd;
23534
23535-out_free_pmds:
23536- free_pmds(pmds);
23537+out_free_pxds:
23538+ free_pxds(pxds);
23539 out_free_pgd:
23540 free_page((unsigned long)pgd);
23541 out:
23542@@ -295,7 +344,7 @@ out:
23543
23544 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23545 {
23546- pgd_mop_up_pmds(mm, pgd);
23547+ pgd_mop_up_pxds(mm, pgd);
23548 pgd_dtor(pgd);
23549 paravirt_pgd_free(mm, pgd);
23550 free_page((unsigned long)pgd);
23551diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
23552index cac7184..09a39fa 100644
23553--- a/arch/x86/mm/pgtable_32.c
23554+++ b/arch/x86/mm/pgtable_32.c
23555@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
23556 return;
23557 }
23558 pte = pte_offset_kernel(pmd, vaddr);
23559+
23560+ pax_open_kernel();
23561 if (pte_val(pteval))
23562 set_pte_at(&init_mm, vaddr, pte, pteval);
23563 else
23564 pte_clear(&init_mm, vaddr, pte);
23565+ pax_close_kernel();
23566
23567 /*
23568 * It's enough to flush this one mapping.
23569diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
23570index 410531d..0f16030 100644
23571--- a/arch/x86/mm/setup_nx.c
23572+++ b/arch/x86/mm/setup_nx.c
23573@@ -5,8 +5,10 @@
23574 #include <asm/pgtable.h>
23575 #include <asm/proto.h>
23576
23577+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23578 static int disable_nx __cpuinitdata;
23579
23580+#ifndef CONFIG_PAX_PAGEEXEC
23581 /*
23582 * noexec = on|off
23583 *
23584@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
23585 return 0;
23586 }
23587 early_param("noexec", noexec_setup);
23588+#endif
23589+
23590+#endif
23591
23592 void __cpuinit x86_configure_nx(void)
23593 {
23594+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23595 if (cpu_has_nx && !disable_nx)
23596 __supported_pte_mask |= _PAGE_NX;
23597 else
23598+#endif
23599 __supported_pte_mask &= ~_PAGE_NX;
23600 }
23601
23602diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
23603index d6c0418..06a0ad5 100644
23604--- a/arch/x86/mm/tlb.c
23605+++ b/arch/x86/mm/tlb.c
23606@@ -65,7 +65,11 @@ void leave_mm(int cpu)
23607 BUG();
23608 cpumask_clear_cpu(cpu,
23609 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23610+
23611+#ifndef CONFIG_PAX_PER_CPU_PGD
23612 load_cr3(swapper_pg_dir);
23613+#endif
23614+
23615 }
23616 EXPORT_SYMBOL_GPL(leave_mm);
23617
23618diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
23619index 6687022..ceabcfa 100644
23620--- a/arch/x86/net/bpf_jit.S
23621+++ b/arch/x86/net/bpf_jit.S
23622@@ -9,6 +9,7 @@
23623 */
23624 #include <linux/linkage.h>
23625 #include <asm/dwarf2.h>
23626+#include <asm/alternative-asm.h>
23627
23628 /*
23629 * Calling convention :
23630@@ -35,6 +36,7 @@ sk_load_word:
23631 jle bpf_slow_path_word
23632 mov (SKBDATA,%rsi),%eax
23633 bswap %eax /* ntohl() */
23634+ pax_force_retaddr
23635 ret
23636
23637
23638@@ -53,6 +55,7 @@ sk_load_half:
23639 jle bpf_slow_path_half
23640 movzwl (SKBDATA,%rsi),%eax
23641 rol $8,%ax # ntohs()
23642+ pax_force_retaddr
23643 ret
23644
23645 sk_load_byte_ind:
23646@@ -66,6 +69,7 @@ sk_load_byte:
23647 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
23648 jle bpf_slow_path_byte
23649 movzbl (SKBDATA,%rsi),%eax
23650+ pax_force_retaddr
23651 ret
23652
23653 /**
23654@@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
23655 movzbl (SKBDATA,%rsi),%ebx
23656 and $15,%bl
23657 shl $2,%bl
23658+ pax_force_retaddr
23659 ret
23660 CFI_ENDPROC
23661 ENDPROC(sk_load_byte_msh)
23662@@ -91,6 +96,7 @@ bpf_error:
23663 xor %eax,%eax
23664 mov -8(%rbp),%rbx
23665 leaveq
23666+ pax_force_retaddr
23667 ret
23668
23669 /* rsi contains offset and can be scratched */
23670@@ -113,6 +119,7 @@ bpf_slow_path_word:
23671 js bpf_error
23672 mov -12(%rbp),%eax
23673 bswap %eax
23674+ pax_force_retaddr
23675 ret
23676
23677 bpf_slow_path_half:
23678@@ -121,12 +128,14 @@ bpf_slow_path_half:
23679 mov -12(%rbp),%ax
23680 rol $8,%ax
23681 movzwl %ax,%eax
23682+ pax_force_retaddr
23683 ret
23684
23685 bpf_slow_path_byte:
23686 bpf_slow_path_common(1)
23687 js bpf_error
23688 movzbl -12(%rbp),%eax
23689+ pax_force_retaddr
23690 ret
23691
23692 bpf_slow_path_byte_msh:
23693@@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
23694 and $15,%al
23695 shl $2,%al
23696 xchg %eax,%ebx
23697+ pax_force_retaddr
23698 ret
23699diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
23700index 7b65f75..63097f6 100644
23701--- a/arch/x86/net/bpf_jit_comp.c
23702+++ b/arch/x86/net/bpf_jit_comp.c
23703@@ -117,6 +117,10 @@ static inline void bpf_flush_icache(void *start, void *end)
23704 set_fs(old_fs);
23705 }
23706
23707+struct bpf_jit_work {
23708+ struct work_struct work;
23709+ void *image;
23710+};
23711
23712 void bpf_jit_compile(struct sk_filter *fp)
23713 {
23714@@ -141,6 +145,10 @@ void bpf_jit_compile(struct sk_filter *fp)
23715 if (addrs == NULL)
23716 return;
23717
23718+ fp->work = kmalloc(sizeof(*fp->work), GFP_KERNEL);
23719+ if (!fp->work)
23720+ goto out;
23721+
23722 /* Before first pass, make a rough estimation of addrs[]
23723 * each bpf instruction is translated to less than 64 bytes
23724 */
23725@@ -585,11 +593,12 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23726 if (image) {
23727 if (unlikely(proglen + ilen > oldproglen)) {
23728 pr_err("bpb_jit_compile fatal error\n");
23729- kfree(addrs);
23730- module_free(NULL, image);
23731- return;
23732+ module_free_exec(NULL, image);
23733+ goto out;
23734 }
23735+ pax_open_kernel();
23736 memcpy(image + proglen, temp, ilen);
23737+ pax_close_kernel();
23738 }
23739 proglen += ilen;
23740 addrs[i] = proglen;
23741@@ -609,7 +618,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23742 break;
23743 }
23744 if (proglen == oldproglen) {
23745- image = module_alloc(max_t(unsigned int,
23746+ image = module_alloc_exec(max_t(unsigned int,
23747 proglen,
23748 sizeof(struct work_struct)));
23749 if (!image)
23750@@ -631,24 +640,27 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23751 fp->bpf_func = (void *)image;
23752 }
23753 out:
23754+ kfree(fp->work);
23755 kfree(addrs);
23756 return;
23757 }
23758
23759 static void jit_free_defer(struct work_struct *arg)
23760 {
23761- module_free(NULL, arg);
23762+ module_free_exec(NULL, ((struct bpf_jit_work*)arg)->image);
23763+ kfree(arg);
23764 }
23765
23766 /* run from softirq, we must use a work_struct to call
23767- * module_free() from process context
23768+ * module_free_exec() from process context
23769 */
23770 void bpf_jit_free(struct sk_filter *fp)
23771 {
23772 if (fp->bpf_func != sk_run_filter) {
23773- struct work_struct *work = (struct work_struct *)fp->bpf_func;
23774+ struct work_struct *work = &fp->work->work;
23775
23776 INIT_WORK(work, jit_free_defer);
23777+ fp->work->image = fp->bpf_func;
23778 schedule_work(work);
23779 }
23780 }
23781diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
23782index bff89df..377758a 100644
23783--- a/arch/x86/oprofile/backtrace.c
23784+++ b/arch/x86/oprofile/backtrace.c
23785@@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
23786 struct stack_frame_ia32 *fp;
23787 unsigned long bytes;
23788
23789- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23790+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23791 if (bytes != sizeof(bufhead))
23792 return NULL;
23793
23794- fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
23795+ fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
23796
23797 oprofile_add_trace(bufhead[0].return_address);
23798
23799@@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
23800 struct stack_frame bufhead[2];
23801 unsigned long bytes;
23802
23803- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23804+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23805 if (bytes != sizeof(bufhead))
23806 return NULL;
23807
23808@@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
23809 {
23810 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23811
23812- if (!user_mode_vm(regs)) {
23813+ if (!user_mode(regs)) {
23814 unsigned long stack = kernel_stack_pointer(regs);
23815 if (depth)
23816 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23817diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
23818index cb29191..036766d 100644
23819--- a/arch/x86/pci/mrst.c
23820+++ b/arch/x86/pci/mrst.c
23821@@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
23822 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
23823 pci_mmcfg_late_init();
23824 pcibios_enable_irq = mrst_pci_irq_enable;
23825- pci_root_ops = pci_mrst_ops;
23826+ pax_open_kernel();
23827+ memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
23828+ pax_close_kernel();
23829 /* Continue with standard init */
23830 return 1;
23831 }
23832diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
23833index f685535..2b76a81 100644
23834--- a/arch/x86/pci/pcbios.c
23835+++ b/arch/x86/pci/pcbios.c
23836@@ -79,50 +79,93 @@ union bios32 {
23837 static struct {
23838 unsigned long address;
23839 unsigned short segment;
23840-} bios32_indirect = { 0, __KERNEL_CS };
23841+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23842
23843 /*
23844 * Returns the entry point for the given service, NULL on error
23845 */
23846
23847-static unsigned long bios32_service(unsigned long service)
23848+static unsigned long __devinit bios32_service(unsigned long service)
23849 {
23850 unsigned char return_code; /* %al */
23851 unsigned long address; /* %ebx */
23852 unsigned long length; /* %ecx */
23853 unsigned long entry; /* %edx */
23854 unsigned long flags;
23855+ struct desc_struct d, *gdt;
23856
23857 local_irq_save(flags);
23858- __asm__("lcall *(%%edi); cld"
23859+
23860+ gdt = get_cpu_gdt_table(smp_processor_id());
23861+
23862+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23863+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23864+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23865+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23866+
23867+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23868 : "=a" (return_code),
23869 "=b" (address),
23870 "=c" (length),
23871 "=d" (entry)
23872 : "0" (service),
23873 "1" (0),
23874- "D" (&bios32_indirect));
23875+ "D" (&bios32_indirect),
23876+ "r"(__PCIBIOS_DS)
23877+ : "memory");
23878+
23879+ pax_open_kernel();
23880+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23881+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23882+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23883+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23884+ pax_close_kernel();
23885+
23886 local_irq_restore(flags);
23887
23888 switch (return_code) {
23889- case 0:
23890- return address + entry;
23891- case 0x80: /* Not present */
23892- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23893- return 0;
23894- default: /* Shouldn't happen */
23895- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23896- service, return_code);
23897+ case 0: {
23898+ int cpu;
23899+ unsigned char flags;
23900+
23901+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23902+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23903+ printk(KERN_WARNING "bios32_service: not valid\n");
23904 return 0;
23905+ }
23906+ address = address + PAGE_OFFSET;
23907+ length += 16UL; /* some BIOSs underreport this... */
23908+ flags = 4;
23909+ if (length >= 64*1024*1024) {
23910+ length >>= PAGE_SHIFT;
23911+ flags |= 8;
23912+ }
23913+
23914+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23915+ gdt = get_cpu_gdt_table(cpu);
23916+ pack_descriptor(&d, address, length, 0x9b, flags);
23917+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23918+ pack_descriptor(&d, address, length, 0x93, flags);
23919+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23920+ }
23921+ return entry;
23922+ }
23923+ case 0x80: /* Not present */
23924+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23925+ return 0;
23926+ default: /* Shouldn't happen */
23927+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23928+ service, return_code);
23929+ return 0;
23930 }
23931 }
23932
23933 static struct {
23934 unsigned long address;
23935 unsigned short segment;
23936-} pci_indirect = { 0, __KERNEL_CS };
23937+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23938
23939-static int pci_bios_present;
23940+static int pci_bios_present __read_only;
23941
23942 static int __devinit check_pcibios(void)
23943 {
23944@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23945 unsigned long flags, pcibios_entry;
23946
23947 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23948- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23949+ pci_indirect.address = pcibios_entry;
23950
23951 local_irq_save(flags);
23952- __asm__(
23953- "lcall *(%%edi); cld\n\t"
23954+ __asm__("movw %w6, %%ds\n\t"
23955+ "lcall *%%ss:(%%edi); cld\n\t"
23956+ "push %%ss\n\t"
23957+ "pop %%ds\n\t"
23958 "jc 1f\n\t"
23959 "xor %%ah, %%ah\n"
23960 "1:"
23961@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23962 "=b" (ebx),
23963 "=c" (ecx)
23964 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23965- "D" (&pci_indirect)
23966+ "D" (&pci_indirect),
23967+ "r" (__PCIBIOS_DS)
23968 : "memory");
23969 local_irq_restore(flags);
23970
23971@@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23972
23973 switch (len) {
23974 case 1:
23975- __asm__("lcall *(%%esi); cld\n\t"
23976+ __asm__("movw %w6, %%ds\n\t"
23977+ "lcall *%%ss:(%%esi); cld\n\t"
23978+ "push %%ss\n\t"
23979+ "pop %%ds\n\t"
23980 "jc 1f\n\t"
23981 "xor %%ah, %%ah\n"
23982 "1:"
23983@@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23984 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23985 "b" (bx),
23986 "D" ((long)reg),
23987- "S" (&pci_indirect));
23988+ "S" (&pci_indirect),
23989+ "r" (__PCIBIOS_DS));
23990 /*
23991 * Zero-extend the result beyond 8 bits, do not trust the
23992 * BIOS having done it:
23993@@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23994 *value &= 0xff;
23995 break;
23996 case 2:
23997- __asm__("lcall *(%%esi); cld\n\t"
23998+ __asm__("movw %w6, %%ds\n\t"
23999+ "lcall *%%ss:(%%esi); cld\n\t"
24000+ "push %%ss\n\t"
24001+ "pop %%ds\n\t"
24002 "jc 1f\n\t"
24003 "xor %%ah, %%ah\n"
24004 "1:"
24005@@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
24006 : "1" (PCIBIOS_READ_CONFIG_WORD),
24007 "b" (bx),
24008 "D" ((long)reg),
24009- "S" (&pci_indirect));
24010+ "S" (&pci_indirect),
24011+ "r" (__PCIBIOS_DS));
24012 /*
24013 * Zero-extend the result beyond 16 bits, do not trust the
24014 * BIOS having done it:
24015@@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
24016 *value &= 0xffff;
24017 break;
24018 case 4:
24019- __asm__("lcall *(%%esi); cld\n\t"
24020+ __asm__("movw %w6, %%ds\n\t"
24021+ "lcall *%%ss:(%%esi); cld\n\t"
24022+ "push %%ss\n\t"
24023+ "pop %%ds\n\t"
24024 "jc 1f\n\t"
24025 "xor %%ah, %%ah\n"
24026 "1:"
24027@@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
24028 : "1" (PCIBIOS_READ_CONFIG_DWORD),
24029 "b" (bx),
24030 "D" ((long)reg),
24031- "S" (&pci_indirect));
24032+ "S" (&pci_indirect),
24033+ "r" (__PCIBIOS_DS));
24034 break;
24035 }
24036
24037@@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24038
24039 switch (len) {
24040 case 1:
24041- __asm__("lcall *(%%esi); cld\n\t"
24042+ __asm__("movw %w6, %%ds\n\t"
24043+ "lcall *%%ss:(%%esi); cld\n\t"
24044+ "push %%ss\n\t"
24045+ "pop %%ds\n\t"
24046 "jc 1f\n\t"
24047 "xor %%ah, %%ah\n"
24048 "1:"
24049@@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24050 "c" (value),
24051 "b" (bx),
24052 "D" ((long)reg),
24053- "S" (&pci_indirect));
24054+ "S" (&pci_indirect),
24055+ "r" (__PCIBIOS_DS));
24056 break;
24057 case 2:
24058- __asm__("lcall *(%%esi); cld\n\t"
24059+ __asm__("movw %w6, %%ds\n\t"
24060+ "lcall *%%ss:(%%esi); cld\n\t"
24061+ "push %%ss\n\t"
24062+ "pop %%ds\n\t"
24063 "jc 1f\n\t"
24064 "xor %%ah, %%ah\n"
24065 "1:"
24066@@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24067 "c" (value),
24068 "b" (bx),
24069 "D" ((long)reg),
24070- "S" (&pci_indirect));
24071+ "S" (&pci_indirect),
24072+ "r" (__PCIBIOS_DS));
24073 break;
24074 case 4:
24075- __asm__("lcall *(%%esi); cld\n\t"
24076+ __asm__("movw %w6, %%ds\n\t"
24077+ "lcall *%%ss:(%%esi); cld\n\t"
24078+ "push %%ss\n\t"
24079+ "pop %%ds\n\t"
24080 "jc 1f\n\t"
24081 "xor %%ah, %%ah\n"
24082 "1:"
24083@@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24084 "c" (value),
24085 "b" (bx),
24086 "D" ((long)reg),
24087- "S" (&pci_indirect));
24088+ "S" (&pci_indirect),
24089+ "r" (__PCIBIOS_DS));
24090 break;
24091 }
24092
24093@@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24094
24095 DBG("PCI: Fetching IRQ routing table... ");
24096 __asm__("push %%es\n\t"
24097+ "movw %w8, %%ds\n\t"
24098 "push %%ds\n\t"
24099 "pop %%es\n\t"
24100- "lcall *(%%esi); cld\n\t"
24101+ "lcall *%%ss:(%%esi); cld\n\t"
24102 "pop %%es\n\t"
24103+ "push %%ss\n\t"
24104+ "pop %%ds\n"
24105 "jc 1f\n\t"
24106 "xor %%ah, %%ah\n"
24107 "1:"
24108@@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24109 "1" (0),
24110 "D" ((long) &opt),
24111 "S" (&pci_indirect),
24112- "m" (opt)
24113+ "m" (opt),
24114+ "r" (__PCIBIOS_DS)
24115 : "memory");
24116 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24117 if (ret & 0xff00)
24118@@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24119 {
24120 int ret;
24121
24122- __asm__("lcall *(%%esi); cld\n\t"
24123+ __asm__("movw %w5, %%ds\n\t"
24124+ "lcall *%%ss:(%%esi); cld\n\t"
24125+ "push %%ss\n\t"
24126+ "pop %%ds\n"
24127 "jc 1f\n\t"
24128 "xor %%ah, %%ah\n"
24129 "1:"
24130@@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24131 : "0" (PCIBIOS_SET_PCI_HW_INT),
24132 "b" ((dev->bus->number << 8) | dev->devfn),
24133 "c" ((irq << 8) | (pin + 10)),
24134- "S" (&pci_indirect));
24135+ "S" (&pci_indirect),
24136+ "r" (__PCIBIOS_DS));
24137 return !(ret & 0xff00);
24138 }
24139 EXPORT_SYMBOL(pcibios_set_irq_routing);
24140diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
24141index 5cab48e..b025f9b 100644
24142--- a/arch/x86/platform/efi/efi_32.c
24143+++ b/arch/x86/platform/efi/efi_32.c
24144@@ -38,70 +38,56 @@
24145 */
24146
24147 static unsigned long efi_rt_eflags;
24148-static pgd_t efi_bak_pg_dir_pointer[2];
24149+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
24150
24151-void efi_call_phys_prelog(void)
24152+void __init efi_call_phys_prelog(void)
24153 {
24154- unsigned long cr4;
24155- unsigned long temp;
24156 struct desc_ptr gdt_descr;
24157
24158+#ifdef CONFIG_PAX_KERNEXEC
24159+ struct desc_struct d;
24160+#endif
24161+
24162 local_irq_save(efi_rt_eflags);
24163
24164- /*
24165- * If I don't have PAE, I should just duplicate two entries in page
24166- * directory. If I have PAE, I just need to duplicate one entry in
24167- * page directory.
24168- */
24169- cr4 = read_cr4_safe();
24170-
24171- if (cr4 & X86_CR4_PAE) {
24172- efi_bak_pg_dir_pointer[0].pgd =
24173- swapper_pg_dir[pgd_index(0)].pgd;
24174- swapper_pg_dir[0].pgd =
24175- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24176- } else {
24177- efi_bak_pg_dir_pointer[0].pgd =
24178- swapper_pg_dir[pgd_index(0)].pgd;
24179- efi_bak_pg_dir_pointer[1].pgd =
24180- swapper_pg_dir[pgd_index(0x400000)].pgd;
24181- swapper_pg_dir[pgd_index(0)].pgd =
24182- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24183- temp = PAGE_OFFSET + 0x400000;
24184- swapper_pg_dir[pgd_index(0x400000)].pgd =
24185- swapper_pg_dir[pgd_index(temp)].pgd;
24186- }
24187+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
24188+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
24189+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
24190
24191 /*
24192 * After the lock is released, the original page table is restored.
24193 */
24194 __flush_tlb_all();
24195
24196+#ifdef CONFIG_PAX_KERNEXEC
24197+ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
24198+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24199+ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
24200+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24201+#endif
24202+
24203 gdt_descr.address = __pa(get_cpu_gdt_table(0));
24204 gdt_descr.size = GDT_SIZE - 1;
24205 load_gdt(&gdt_descr);
24206 }
24207
24208-void efi_call_phys_epilog(void)
24209+void __init efi_call_phys_epilog(void)
24210 {
24211- unsigned long cr4;
24212 struct desc_ptr gdt_descr;
24213
24214+#ifdef CONFIG_PAX_KERNEXEC
24215+ struct desc_struct d;
24216+
24217+ memset(&d, 0, sizeof d);
24218+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24219+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24220+#endif
24221+
24222 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
24223 gdt_descr.size = GDT_SIZE - 1;
24224 load_gdt(&gdt_descr);
24225
24226- cr4 = read_cr4_safe();
24227-
24228- if (cr4 & X86_CR4_PAE) {
24229- swapper_pg_dir[pgd_index(0)].pgd =
24230- efi_bak_pg_dir_pointer[0].pgd;
24231- } else {
24232- swapper_pg_dir[pgd_index(0)].pgd =
24233- efi_bak_pg_dir_pointer[0].pgd;
24234- swapper_pg_dir[pgd_index(0x400000)].pgd =
24235- efi_bak_pg_dir_pointer[1].pgd;
24236- }
24237+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
24238
24239 /*
24240 * After the lock is released, the original page table is restored.
24241diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
24242index fbe66e6..c5c0dd2 100644
24243--- a/arch/x86/platform/efi/efi_stub_32.S
24244+++ b/arch/x86/platform/efi/efi_stub_32.S
24245@@ -6,7 +6,9 @@
24246 */
24247
24248 #include <linux/linkage.h>
24249+#include <linux/init.h>
24250 #include <asm/page_types.h>
24251+#include <asm/segment.h>
24252
24253 /*
24254 * efi_call_phys(void *, ...) is a function with variable parameters.
24255@@ -20,7 +22,7 @@
24256 * service functions will comply with gcc calling convention, too.
24257 */
24258
24259-.text
24260+__INIT
24261 ENTRY(efi_call_phys)
24262 /*
24263 * 0. The function can only be called in Linux kernel. So CS has been
24264@@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
24265 * The mapping of lower virtual memory has been created in prelog and
24266 * epilog.
24267 */
24268- movl $1f, %edx
24269- subl $__PAGE_OFFSET, %edx
24270- jmp *%edx
24271+ movl $(__KERNEXEC_EFI_DS), %edx
24272+ mov %edx, %ds
24273+ mov %edx, %es
24274+ mov %edx, %ss
24275+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
24276 1:
24277
24278 /*
24279@@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
24280 * parameter 2, ..., param n. To make things easy, we save the return
24281 * address of efi_call_phys in a global variable.
24282 */
24283- popl %edx
24284- movl %edx, saved_return_addr
24285- /* get the function pointer into ECX*/
24286- popl %ecx
24287- movl %ecx, efi_rt_function_ptr
24288- movl $2f, %edx
24289- subl $__PAGE_OFFSET, %edx
24290- pushl %edx
24291+ popl (saved_return_addr)
24292+ popl (efi_rt_function_ptr)
24293
24294 /*
24295 * 3. Clear PG bit in %CR0.
24296@@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
24297 /*
24298 * 5. Call the physical function.
24299 */
24300- jmp *%ecx
24301+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
24302
24303-2:
24304 /*
24305 * 6. After EFI runtime service returns, control will return to
24306 * following instruction. We'd better readjust stack pointer first.
24307@@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
24308 movl %cr0, %edx
24309 orl $0x80000000, %edx
24310 movl %edx, %cr0
24311- jmp 1f
24312-1:
24313+
24314 /*
24315 * 8. Now restore the virtual mode from flat mode by
24316 * adding EIP with PAGE_OFFSET.
24317 */
24318- movl $1f, %edx
24319- jmp *%edx
24320+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
24321 1:
24322+ movl $(__KERNEL_DS), %edx
24323+ mov %edx, %ds
24324+ mov %edx, %es
24325+ mov %edx, %ss
24326
24327 /*
24328 * 9. Balance the stack. And because EAX contain the return value,
24329 * we'd better not clobber it.
24330 */
24331- leal efi_rt_function_ptr, %edx
24332- movl (%edx), %ecx
24333- pushl %ecx
24334+ pushl (efi_rt_function_ptr)
24335
24336 /*
24337- * 10. Push the saved return address onto the stack and return.
24338+ * 10. Return to the saved return address.
24339 */
24340- leal saved_return_addr, %edx
24341- movl (%edx), %ecx
24342- pushl %ecx
24343- ret
24344+ jmpl *(saved_return_addr)
24345 ENDPROC(efi_call_phys)
24346 .previous
24347
24348-.data
24349+__INITDATA
24350 saved_return_addr:
24351 .long 0
24352 efi_rt_function_ptr:
24353diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
24354index 4c07cca..2c8427d 100644
24355--- a/arch/x86/platform/efi/efi_stub_64.S
24356+++ b/arch/x86/platform/efi/efi_stub_64.S
24357@@ -7,6 +7,7 @@
24358 */
24359
24360 #include <linux/linkage.h>
24361+#include <asm/alternative-asm.h>
24362
24363 #define SAVE_XMM \
24364 mov %rsp, %rax; \
24365@@ -40,6 +41,7 @@ ENTRY(efi_call0)
24366 call *%rdi
24367 addq $32, %rsp
24368 RESTORE_XMM
24369+ pax_force_retaddr 0, 1
24370 ret
24371 ENDPROC(efi_call0)
24372
24373@@ -50,6 +52,7 @@ ENTRY(efi_call1)
24374 call *%rdi
24375 addq $32, %rsp
24376 RESTORE_XMM
24377+ pax_force_retaddr 0, 1
24378 ret
24379 ENDPROC(efi_call1)
24380
24381@@ -60,6 +63,7 @@ ENTRY(efi_call2)
24382 call *%rdi
24383 addq $32, %rsp
24384 RESTORE_XMM
24385+ pax_force_retaddr 0, 1
24386 ret
24387 ENDPROC(efi_call2)
24388
24389@@ -71,6 +75,7 @@ ENTRY(efi_call3)
24390 call *%rdi
24391 addq $32, %rsp
24392 RESTORE_XMM
24393+ pax_force_retaddr 0, 1
24394 ret
24395 ENDPROC(efi_call3)
24396
24397@@ -83,6 +88,7 @@ ENTRY(efi_call4)
24398 call *%rdi
24399 addq $32, %rsp
24400 RESTORE_XMM
24401+ pax_force_retaddr 0, 1
24402 ret
24403 ENDPROC(efi_call4)
24404
24405@@ -96,6 +102,7 @@ ENTRY(efi_call5)
24406 call *%rdi
24407 addq $48, %rsp
24408 RESTORE_XMM
24409+ pax_force_retaddr 0, 1
24410 ret
24411 ENDPROC(efi_call5)
24412
24413@@ -112,5 +119,6 @@ ENTRY(efi_call6)
24414 call *%rdi
24415 addq $48, %rsp
24416 RESTORE_XMM
24417+ pax_force_retaddr 0, 1
24418 ret
24419 ENDPROC(efi_call6)
24420diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
24421index fe73276..70fe25a 100644
24422--- a/arch/x86/platform/mrst/mrst.c
24423+++ b/arch/x86/platform/mrst/mrst.c
24424@@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
24425 }
24426
24427 /* Reboot and power off are handled by the SCU on a MID device */
24428-static void mrst_power_off(void)
24429+static __noreturn void mrst_power_off(void)
24430 {
24431 intel_scu_ipc_simple_command(0xf1, 1);
24432+ BUG();
24433 }
24434
24435-static void mrst_reboot(void)
24436+static __noreturn void mrst_reboot(void)
24437 {
24438 intel_scu_ipc_simple_command(0xf1, 0);
24439+ BUG();
24440 }
24441
24442 /*
24443diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
24444index 5b55219..b326540 100644
24445--- a/arch/x86/platform/uv/tlb_uv.c
24446+++ b/arch/x86/platform/uv/tlb_uv.c
24447@@ -377,6 +377,8 @@ static void reset_with_ipi(struct pnmask *distribution, struct bau_control *bcp)
24448 struct bau_control *smaster = bcp->socket_master;
24449 struct reset_args reset_args;
24450
24451+ pax_track_stack();
24452+
24453 reset_args.sender = sender;
24454 cpus_clear(*mask);
24455 /* find a single cpu for each uvhub in this distribution mask */
24456diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
24457index 87bb35e..eff2da8 100644
24458--- a/arch/x86/power/cpu.c
24459+++ b/arch/x86/power/cpu.c
24460@@ -130,7 +130,7 @@ static void do_fpu_end(void)
24461 static void fix_processor_context(void)
24462 {
24463 int cpu = smp_processor_id();
24464- struct tss_struct *t = &per_cpu(init_tss, cpu);
24465+ struct tss_struct *t = init_tss + cpu;
24466
24467 set_tss_desc(cpu, t); /*
24468 * This just modifies memory; should not be
24469@@ -140,7 +140,9 @@ static void fix_processor_context(void)
24470 */
24471
24472 #ifdef CONFIG_X86_64
24473+ pax_open_kernel();
24474 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24475+ pax_close_kernel();
24476
24477 syscall_init(); /* This sets MSR_*STAR and related */
24478 #endif
24479diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
24480index 5d17950..2253fc9 100644
24481--- a/arch/x86/vdso/Makefile
24482+++ b/arch/x86/vdso/Makefile
24483@@ -137,7 +137,7 @@ quiet_cmd_vdso = VDSO $@
24484 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
24485 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
24486
24487-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24488+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24489 GCOV_PROFILE := n
24490
24491 #
24492diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
24493index 468d591..8e80a0a 100644
24494--- a/arch/x86/vdso/vdso32-setup.c
24495+++ b/arch/x86/vdso/vdso32-setup.c
24496@@ -25,6 +25,7 @@
24497 #include <asm/tlbflush.h>
24498 #include <asm/vdso.h>
24499 #include <asm/proto.h>
24500+#include <asm/mman.h>
24501
24502 enum {
24503 VDSO_DISABLED = 0,
24504@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
24505 void enable_sep_cpu(void)
24506 {
24507 int cpu = get_cpu();
24508- struct tss_struct *tss = &per_cpu(init_tss, cpu);
24509+ struct tss_struct *tss = init_tss + cpu;
24510
24511 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24512 put_cpu();
24513@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24514 gate_vma.vm_start = FIXADDR_USER_START;
24515 gate_vma.vm_end = FIXADDR_USER_END;
24516 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24517- gate_vma.vm_page_prot = __P101;
24518+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24519 /*
24520 * Make sure the vDSO gets into every core dump.
24521 * Dumping its contents makes post-mortem fully interpretable later
24522@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24523 if (compat)
24524 addr = VDSO_HIGH_BASE;
24525 else {
24526- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24527+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24528 if (IS_ERR_VALUE(addr)) {
24529 ret = addr;
24530 goto up_fail;
24531 }
24532 }
24533
24534- current->mm->context.vdso = (void *)addr;
24535+ current->mm->context.vdso = addr;
24536
24537 if (compat_uses_vma || !compat) {
24538 /*
24539@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24540 }
24541
24542 current_thread_info()->sysenter_return =
24543- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24544+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24545
24546 up_fail:
24547 if (ret)
24548- current->mm->context.vdso = NULL;
24549+ current->mm->context.vdso = 0;
24550
24551 up_write(&mm->mmap_sem);
24552
24553@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24554
24555 const char *arch_vma_name(struct vm_area_struct *vma)
24556 {
24557- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24558+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24559 return "[vdso]";
24560+
24561+#ifdef CONFIG_PAX_SEGMEXEC
24562+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24563+ return "[vdso]";
24564+#endif
24565+
24566 return NULL;
24567 }
24568
24569@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
24570 * Check to see if the corresponding task was created in compat vdso
24571 * mode.
24572 */
24573- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24574+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24575 return &gate_vma;
24576 return NULL;
24577 }
24578diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
24579index 316fbca..4638633 100644
24580--- a/arch/x86/vdso/vma.c
24581+++ b/arch/x86/vdso/vma.c
24582@@ -16,8 +16,6 @@
24583 #include <asm/vdso.h>
24584 #include <asm/page.h>
24585
24586-unsigned int __read_mostly vdso_enabled = 1;
24587-
24588 extern char vdso_start[], vdso_end[];
24589 extern unsigned short vdso_sync_cpuid;
24590
24591@@ -97,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
24592 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24593 {
24594 struct mm_struct *mm = current->mm;
24595- unsigned long addr;
24596+ unsigned long addr = 0;
24597 int ret;
24598
24599- if (!vdso_enabled)
24600- return 0;
24601-
24602 down_write(&mm->mmap_sem);
24603+
24604+#ifdef CONFIG_PAX_RANDMMAP
24605+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
24606+#endif
24607+
24608 addr = vdso_addr(mm->start_stack, vdso_size);
24609 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
24610 if (IS_ERR_VALUE(addr)) {
24611@@ -111,26 +111,18 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24612 goto up_fail;
24613 }
24614
24615- current->mm->context.vdso = (void *)addr;
24616+ mm->context.vdso = addr;
24617
24618 ret = install_special_mapping(mm, addr, vdso_size,
24619 VM_READ|VM_EXEC|
24620 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
24621 VM_ALWAYSDUMP,
24622 vdso_pages);
24623- if (ret) {
24624- current->mm->context.vdso = NULL;
24625- goto up_fail;
24626- }
24627+
24628+ if (ret)
24629+ mm->context.vdso = 0;
24630
24631 up_fail:
24632 up_write(&mm->mmap_sem);
24633 return ret;
24634 }
24635-
24636-static __init int vdso_setup(char *s)
24637-{
24638- vdso_enabled = simple_strtoul(s, NULL, 0);
24639- return 0;
24640-}
24641-__setup("vdso=", vdso_setup);
24642diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
24643index 46c8069..6330d3c 100644
24644--- a/arch/x86/xen/enlighten.c
24645+++ b/arch/x86/xen/enlighten.c
24646@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24647
24648 struct shared_info xen_dummy_shared_info;
24649
24650-void *xen_initial_gdt;
24651-
24652 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24653 __read_mostly int xen_have_vector_callback;
24654 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24655@@ -1028,7 +1026,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
24656 #endif
24657 };
24658
24659-static void xen_reboot(int reason)
24660+static __noreturn void xen_reboot(int reason)
24661 {
24662 struct sched_shutdown r = { .reason = reason };
24663
24664@@ -1036,17 +1034,17 @@ static void xen_reboot(int reason)
24665 BUG();
24666 }
24667
24668-static void xen_restart(char *msg)
24669+static __noreturn void xen_restart(char *msg)
24670 {
24671 xen_reboot(SHUTDOWN_reboot);
24672 }
24673
24674-static void xen_emergency_restart(void)
24675+static __noreturn void xen_emergency_restart(void)
24676 {
24677 xen_reboot(SHUTDOWN_reboot);
24678 }
24679
24680-static void xen_machine_halt(void)
24681+static __noreturn void xen_machine_halt(void)
24682 {
24683 xen_reboot(SHUTDOWN_poweroff);
24684 }
24685@@ -1152,7 +1150,17 @@ asmlinkage void __init xen_start_kernel(void)
24686 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24687
24688 /* Work out if we support NX */
24689- x86_configure_nx();
24690+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24691+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24692+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24693+ unsigned l, h;
24694+
24695+ __supported_pte_mask |= _PAGE_NX;
24696+ rdmsr(MSR_EFER, l, h);
24697+ l |= EFER_NX;
24698+ wrmsr(MSR_EFER, l, h);
24699+ }
24700+#endif
24701
24702 xen_setup_features();
24703
24704@@ -1183,13 +1191,6 @@ asmlinkage void __init xen_start_kernel(void)
24705
24706 machine_ops = xen_machine_ops;
24707
24708- /*
24709- * The only reliable way to retain the initial address of the
24710- * percpu gdt_page is to remember it here, so we can go and
24711- * mark it RW later, when the initial percpu area is freed.
24712- */
24713- xen_initial_gdt = &per_cpu(gdt_page, 0);
24714-
24715 xen_smp_init();
24716
24717 #ifdef CONFIG_ACPI_NUMA
24718diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
24719index 3dd53f9..5aa5df3 100644
24720--- a/arch/x86/xen/mmu.c
24721+++ b/arch/x86/xen/mmu.c
24722@@ -1768,6 +1768,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24723 convert_pfn_mfn(init_level4_pgt);
24724 convert_pfn_mfn(level3_ident_pgt);
24725 convert_pfn_mfn(level3_kernel_pgt);
24726+ convert_pfn_mfn(level3_vmalloc_start_pgt);
24727+ convert_pfn_mfn(level3_vmalloc_end_pgt);
24728+ convert_pfn_mfn(level3_vmemmap_pgt);
24729
24730 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24731 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24732@@ -1786,7 +1789,11 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24733 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24734 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24735 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24736+ set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
24737+ set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
24738+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24739 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24740+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24741 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24742 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24743
24744@@ -2000,6 +2007,7 @@ static void __init xen_post_allocator_init(void)
24745 pv_mmu_ops.set_pud = xen_set_pud;
24746 #if PAGETABLE_LEVELS == 4
24747 pv_mmu_ops.set_pgd = xen_set_pgd;
24748+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
24749 #endif
24750
24751 /* This will work as long as patching hasn't happened yet
24752@@ -2081,6 +2089,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
24753 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
24754 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
24755 .set_pgd = xen_set_pgd_hyper,
24756+ .set_pgd_batched = xen_set_pgd_hyper,
24757
24758 .alloc_pud = xen_alloc_pmd_init,
24759 .release_pud = xen_release_pmd_init,
24760diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
24761index 041d4fe..7666b7e 100644
24762--- a/arch/x86/xen/smp.c
24763+++ b/arch/x86/xen/smp.c
24764@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
24765 {
24766 BUG_ON(smp_processor_id() != 0);
24767 native_smp_prepare_boot_cpu();
24768-
24769- /* We've switched to the "real" per-cpu gdt, so make sure the
24770- old memory can be recycled */
24771- make_lowmem_page_readwrite(xen_initial_gdt);
24772-
24773 xen_filter_cpu_maps();
24774 xen_setup_vcpu_info_placement();
24775 }
24776@@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
24777 gdt = get_cpu_gdt_table(cpu);
24778
24779 ctxt->flags = VGCF_IN_KERNEL;
24780- ctxt->user_regs.ds = __USER_DS;
24781- ctxt->user_regs.es = __USER_DS;
24782+ ctxt->user_regs.ds = __KERNEL_DS;
24783+ ctxt->user_regs.es = __KERNEL_DS;
24784 ctxt->user_regs.ss = __KERNEL_DS;
24785 #ifdef CONFIG_X86_32
24786 ctxt->user_regs.fs = __KERNEL_PERCPU;
24787- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24788+ savesegment(gs, ctxt->user_regs.gs);
24789 #else
24790 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24791 #endif
24792@@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
24793 int rc;
24794
24795 per_cpu(current_task, cpu) = idle;
24796+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24797 #ifdef CONFIG_X86_32
24798 irq_ctx_init(cpu);
24799 #else
24800 clear_tsk_thread_flag(idle, TIF_FORK);
24801- per_cpu(kernel_stack, cpu) =
24802- (unsigned long)task_stack_page(idle) -
24803- KERNEL_STACK_OFFSET + THREAD_SIZE;
24804+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24805 #endif
24806 xen_setup_runstate_info(cpu);
24807 xen_setup_timer(cpu);
24808diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
24809index b040b0e..8cc4fe0 100644
24810--- a/arch/x86/xen/xen-asm_32.S
24811+++ b/arch/x86/xen/xen-asm_32.S
24812@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24813 ESP_OFFSET=4 # bytes pushed onto stack
24814
24815 /*
24816- * Store vcpu_info pointer for easy access. Do it this way to
24817- * avoid having to reload %fs
24818+ * Store vcpu_info pointer for easy access.
24819 */
24820 #ifdef CONFIG_SMP
24821- GET_THREAD_INFO(%eax)
24822- movl TI_cpu(%eax), %eax
24823- movl __per_cpu_offset(,%eax,4), %eax
24824- mov xen_vcpu(%eax), %eax
24825+ push %fs
24826+ mov $(__KERNEL_PERCPU), %eax
24827+ mov %eax, %fs
24828+ mov PER_CPU_VAR(xen_vcpu), %eax
24829+ pop %fs
24830 #else
24831 movl xen_vcpu, %eax
24832 #endif
24833diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
24834index aaa7291..3f77960 100644
24835--- a/arch/x86/xen/xen-head.S
24836+++ b/arch/x86/xen/xen-head.S
24837@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24838 #ifdef CONFIG_X86_32
24839 mov %esi,xen_start_info
24840 mov $init_thread_union+THREAD_SIZE,%esp
24841+#ifdef CONFIG_SMP
24842+ movl $cpu_gdt_table,%edi
24843+ movl $__per_cpu_load,%eax
24844+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24845+ rorl $16,%eax
24846+ movb %al,__KERNEL_PERCPU + 4(%edi)
24847+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24848+ movl $__per_cpu_end - 1,%eax
24849+ subl $__per_cpu_start,%eax
24850+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24851+#endif
24852 #else
24853 mov %rsi,xen_start_info
24854 mov $init_thread_union+THREAD_SIZE,%rsp
24855diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
24856index b095739..8c17bcd 100644
24857--- a/arch/x86/xen/xen-ops.h
24858+++ b/arch/x86/xen/xen-ops.h
24859@@ -10,8 +10,6 @@
24860 extern const char xen_hypervisor_callback[];
24861 extern const char xen_failsafe_callback[];
24862
24863-extern void *xen_initial_gdt;
24864-
24865 struct trap_info;
24866 void xen_copy_trap_info(struct trap_info *traps);
24867
24868diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
24869index 58916af..9cb880b 100644
24870--- a/block/blk-iopoll.c
24871+++ b/block/blk-iopoll.c
24872@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
24873 }
24874 EXPORT_SYMBOL(blk_iopoll_complete);
24875
24876-static void blk_iopoll_softirq(struct softirq_action *h)
24877+static void blk_iopoll_softirq(void)
24878 {
24879 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24880 int rearm = 0, budget = blk_iopoll_budget;
24881diff --git a/block/blk-map.c b/block/blk-map.c
24882index 164cd00..6d96fc1 100644
24883--- a/block/blk-map.c
24884+++ b/block/blk-map.c
24885@@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
24886 if (!len || !kbuf)
24887 return -EINVAL;
24888
24889- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24890+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24891 if (do_copy)
24892 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24893 else
24894diff --git a/block/blk-softirq.c b/block/blk-softirq.c
24895index 1366a89..e17f54b 100644
24896--- a/block/blk-softirq.c
24897+++ b/block/blk-softirq.c
24898@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
24899 * Softirq action handler - move entries to local list and loop over them
24900 * while passing them to the queue registered handler.
24901 */
24902-static void blk_done_softirq(struct softirq_action *h)
24903+static void blk_done_softirq(void)
24904 {
24905 struct list_head *cpu_list, local_list;
24906
24907diff --git a/block/bsg.c b/block/bsg.c
24908index 702f131..37808bf 100644
24909--- a/block/bsg.c
24910+++ b/block/bsg.c
24911@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
24912 struct sg_io_v4 *hdr, struct bsg_device *bd,
24913 fmode_t has_write_perm)
24914 {
24915+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24916+ unsigned char *cmdptr;
24917+
24918 if (hdr->request_len > BLK_MAX_CDB) {
24919 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24920 if (!rq->cmd)
24921 return -ENOMEM;
24922- }
24923+ cmdptr = rq->cmd;
24924+ } else
24925+ cmdptr = tmpcmd;
24926
24927- if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
24928+ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
24929 hdr->request_len))
24930 return -EFAULT;
24931
24932+ if (cmdptr != rq->cmd)
24933+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24934+
24935 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24936 if (blk_verify_command(rq->cmd, has_write_perm))
24937 return -EPERM;
24938diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
24939index 7b72502..646105c 100644
24940--- a/block/compat_ioctl.c
24941+++ b/block/compat_ioctl.c
24942@@ -340,7 +340,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
24943 err |= __get_user(f->spec1, &uf->spec1);
24944 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
24945 err |= __get_user(name, &uf->name);
24946- f->name = compat_ptr(name);
24947+ f->name = (void __force_kernel *)compat_ptr(name);
24948 if (err) {
24949 err = -EFAULT;
24950 goto out;
24951diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
24952index 4f4230b..2ac96e7 100644
24953--- a/block/scsi_ioctl.c
24954+++ b/block/scsi_ioctl.c
24955@@ -24,6 +24,7 @@
24956 #include <linux/capability.h>
24957 #include <linux/completion.h>
24958 #include <linux/cdrom.h>
24959+#include <linux/ratelimit.h>
24960 #include <linux/slab.h>
24961 #include <linux/times.h>
24962 #include <asm/uaccess.h>
24963@@ -222,8 +223,20 @@ EXPORT_SYMBOL(blk_verify_command);
24964 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24965 struct sg_io_hdr *hdr, fmode_t mode)
24966 {
24967- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24968+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24969+ unsigned char *cmdptr;
24970+
24971+ if (rq->cmd != rq->__cmd)
24972+ cmdptr = rq->cmd;
24973+ else
24974+ cmdptr = tmpcmd;
24975+
24976+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24977 return -EFAULT;
24978+
24979+ if (cmdptr != rq->cmd)
24980+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24981+
24982 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24983 return -EPERM;
24984
24985@@ -432,6 +445,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24986 int err;
24987 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24988 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24989+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24990+ unsigned char *cmdptr;
24991
24992 if (!sic)
24993 return -EINVAL;
24994@@ -465,9 +480,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24995 */
24996 err = -EFAULT;
24997 rq->cmd_len = cmdlen;
24998- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24999+
25000+ if (rq->cmd != rq->__cmd)
25001+ cmdptr = rq->cmd;
25002+ else
25003+ cmdptr = tmpcmd;
25004+
25005+ if (copy_from_user(cmdptr, sic->data, cmdlen))
25006 goto error;
25007
25008+ if (rq->cmd != cmdptr)
25009+ memcpy(rq->cmd, cmdptr, cmdlen);
25010+
25011 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
25012 goto error;
25013
25014@@ -691,6 +715,57 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
25015 }
25016 EXPORT_SYMBOL(scsi_cmd_ioctl);
25017
25018+int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
25019+{
25020+ if (bd && bd == bd->bd_contains)
25021+ return 0;
25022+
25023+ /* Actually none of these is particularly useful on a partition,
25024+ * but they are safe.
25025+ */
25026+ switch (cmd) {
25027+ case SCSI_IOCTL_GET_IDLUN:
25028+ case SCSI_IOCTL_GET_BUS_NUMBER:
25029+ case SCSI_IOCTL_GET_PCI:
25030+ case SCSI_IOCTL_PROBE_HOST:
25031+ case SG_GET_VERSION_NUM:
25032+ case SG_SET_TIMEOUT:
25033+ case SG_GET_TIMEOUT:
25034+ case SG_GET_RESERVED_SIZE:
25035+ case SG_SET_RESERVED_SIZE:
25036+ case SG_EMULATED_HOST:
25037+ return 0;
25038+ case CDROM_GET_CAPABILITY:
25039+ /* Keep this until we remove the printk below. udev sends it
25040+ * and we do not want to spam dmesg about it. CD-ROMs do
25041+ * not have partitions, so we get here only for disks.
25042+ */
25043+ return -ENOIOCTLCMD;
25044+ default:
25045+ break;
25046+ }
25047+
25048+ /* In particular, rule out all resets and host-specific ioctls. */
25049+ printk_ratelimited(KERN_WARNING
25050+ "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
25051+
25052+ return capable(CAP_SYS_RAWIO) ? 0 : -ENOIOCTLCMD;
25053+}
25054+EXPORT_SYMBOL(scsi_verify_blk_ioctl);
25055+
25056+int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
25057+ unsigned int cmd, void __user *arg)
25058+{
25059+ int ret;
25060+
25061+ ret = scsi_verify_blk_ioctl(bd, cmd);
25062+ if (ret < 0)
25063+ return ret;
25064+
25065+ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
25066+}
25067+EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
25068+
25069 static int __init blk_scsi_ioctl_init(void)
25070 {
25071 blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
25072diff --git a/crypto/cryptd.c b/crypto/cryptd.c
25073index 671d4d6..5f24030 100644
25074--- a/crypto/cryptd.c
25075+++ b/crypto/cryptd.c
25076@@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
25077
25078 struct cryptd_blkcipher_request_ctx {
25079 crypto_completion_t complete;
25080-};
25081+} __no_const;
25082
25083 struct cryptd_hash_ctx {
25084 struct crypto_shash *child;
25085@@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
25086
25087 struct cryptd_aead_request_ctx {
25088 crypto_completion_t complete;
25089-};
25090+} __no_const;
25091
25092 static void cryptd_queue_worker(struct work_struct *work);
25093
25094diff --git a/crypto/serpent.c b/crypto/serpent.c
25095index b651a55..a9ddd79b 100644
25096--- a/crypto/serpent.c
25097+++ b/crypto/serpent.c
25098@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
25099 u32 r0,r1,r2,r3,r4;
25100 int i;
25101
25102+ pax_track_stack();
25103+
25104 /* Copy key, add padding */
25105
25106 for (i = 0; i < keylen; ++i)
25107diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
25108index 5d41894..22021e4 100644
25109--- a/drivers/acpi/apei/cper.c
25110+++ b/drivers/acpi/apei/cper.c
25111@@ -38,12 +38,12 @@
25112 */
25113 u64 cper_next_record_id(void)
25114 {
25115- static atomic64_t seq;
25116+ static atomic64_unchecked_t seq;
25117
25118- if (!atomic64_read(&seq))
25119- atomic64_set(&seq, ((u64)get_seconds()) << 32);
25120+ if (!atomic64_read_unchecked(&seq))
25121+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
25122
25123- return atomic64_inc_return(&seq);
25124+ return atomic64_inc_return_unchecked(&seq);
25125 }
25126 EXPORT_SYMBOL_GPL(cper_next_record_id);
25127
25128diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
25129index 22f918b..9fafb84 100644
25130--- a/drivers/acpi/ec_sys.c
25131+++ b/drivers/acpi/ec_sys.c
25132@@ -11,6 +11,7 @@
25133 #include <linux/kernel.h>
25134 #include <linux/acpi.h>
25135 #include <linux/debugfs.h>
25136+#include <asm/uaccess.h>
25137 #include "internal.h"
25138
25139 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
25140@@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25141 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
25142 */
25143 unsigned int size = EC_SPACE_SIZE;
25144- u8 *data = (u8 *) buf;
25145+ u8 data;
25146 loff_t init_off = *off;
25147 int err = 0;
25148
25149@@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25150 size = count;
25151
25152 while (size) {
25153- err = ec_read(*off, &data[*off - init_off]);
25154+ err = ec_read(*off, &data);
25155 if (err)
25156 return err;
25157+ if (put_user(data, &buf[*off - init_off]))
25158+ return -EFAULT;
25159 *off += 1;
25160 size--;
25161 }
25162@@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25163
25164 unsigned int size = count;
25165 loff_t init_off = *off;
25166- u8 *data = (u8 *) buf;
25167 int err = 0;
25168
25169 if (*off >= EC_SPACE_SIZE)
25170@@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25171 }
25172
25173 while (size) {
25174- u8 byte_write = data[*off - init_off];
25175+ u8 byte_write;
25176+ if (get_user(byte_write, &buf[*off - init_off]))
25177+ return -EFAULT;
25178 err = ec_write(*off, byte_write);
25179 if (err)
25180 return err;
25181diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
25182index f5f9869..da87aeb 100644
25183--- a/drivers/acpi/proc.c
25184+++ b/drivers/acpi/proc.c
25185@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct file *file,
25186 size_t count, loff_t * ppos)
25187 {
25188 struct list_head *node, *next;
25189- char strbuf[5];
25190- char str[5] = "";
25191- unsigned int len = count;
25192+ char strbuf[5] = {0};
25193
25194- if (len > 4)
25195- len = 4;
25196- if (len < 0)
25197+ if (count > 4)
25198+ count = 4;
25199+ if (copy_from_user(strbuf, buffer, count))
25200 return -EFAULT;
25201-
25202- if (copy_from_user(strbuf, buffer, len))
25203- return -EFAULT;
25204- strbuf[len] = '\0';
25205- sscanf(strbuf, "%s", str);
25206+ strbuf[count] = '\0';
25207
25208 mutex_lock(&acpi_device_lock);
25209 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
25210@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct file *file,
25211 if (!dev->wakeup.flags.valid)
25212 continue;
25213
25214- if (!strncmp(dev->pnp.bus_id, str, 4)) {
25215+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
25216 if (device_can_wakeup(&dev->dev)) {
25217 bool enable = !device_may_wakeup(&dev->dev);
25218 device_set_wakeup_enable(&dev->dev, enable);
25219diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
25220index a4e0f1b..9793b28 100644
25221--- a/drivers/acpi/processor_driver.c
25222+++ b/drivers/acpi/processor_driver.c
25223@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
25224 return 0;
25225 #endif
25226
25227- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
25228+ BUG_ON(pr->id >= nr_cpu_ids);
25229
25230 /*
25231 * Buggy BIOS check
25232diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
25233index 4a3a5ae..cbee192 100644
25234--- a/drivers/ata/libata-core.c
25235+++ b/drivers/ata/libata-core.c
25236@@ -4733,7 +4733,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
25237 struct ata_port *ap;
25238 unsigned int tag;
25239
25240- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25241+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25242 ap = qc->ap;
25243
25244 qc->flags = 0;
25245@@ -4749,7 +4749,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
25246 struct ata_port *ap;
25247 struct ata_link *link;
25248
25249- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25250+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25251 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25252 ap = qc->ap;
25253 link = qc->dev->link;
25254@@ -5754,6 +5754,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25255 return;
25256
25257 spin_lock(&lock);
25258+ pax_open_kernel();
25259
25260 for (cur = ops->inherits; cur; cur = cur->inherits) {
25261 void **inherit = (void **)cur;
25262@@ -5767,8 +5768,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25263 if (IS_ERR(*pp))
25264 *pp = NULL;
25265
25266- ops->inherits = NULL;
25267+ *(struct ata_port_operations **)&ops->inherits = NULL;
25268
25269+ pax_close_kernel();
25270 spin_unlock(&lock);
25271 }
25272
25273diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
25274index ed16fbe..fc92cb8 100644
25275--- a/drivers/ata/libata-eh.c
25276+++ b/drivers/ata/libata-eh.c
25277@@ -2515,6 +2515,8 @@ void ata_eh_report(struct ata_port *ap)
25278 {
25279 struct ata_link *link;
25280
25281+ pax_track_stack();
25282+
25283 ata_for_each_link(link, ap, HOST_FIRST)
25284 ata_eh_link_report(link);
25285 }
25286diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
25287index 719bb73..79ce858 100644
25288--- a/drivers/ata/pata_arasan_cf.c
25289+++ b/drivers/ata/pata_arasan_cf.c
25290@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
25291 /* Handle platform specific quirks */
25292 if (pdata->quirk) {
25293 if (pdata->quirk & CF_BROKEN_PIO) {
25294- ap->ops->set_piomode = NULL;
25295+ pax_open_kernel();
25296+ *(void **)&ap->ops->set_piomode = NULL;
25297+ pax_close_kernel();
25298 ap->pio_mask = 0;
25299 }
25300 if (pdata->quirk & CF_BROKEN_MWDMA)
25301diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
25302index f9b983a..887b9d8 100644
25303--- a/drivers/atm/adummy.c
25304+++ b/drivers/atm/adummy.c
25305@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
25306 vcc->pop(vcc, skb);
25307 else
25308 dev_kfree_skb_any(skb);
25309- atomic_inc(&vcc->stats->tx);
25310+ atomic_inc_unchecked(&vcc->stats->tx);
25311
25312 return 0;
25313 }
25314diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
25315index f8f41e0..1f987dd 100644
25316--- a/drivers/atm/ambassador.c
25317+++ b/drivers/atm/ambassador.c
25318@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
25319 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
25320
25321 // VC layer stats
25322- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25323+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25324
25325 // free the descriptor
25326 kfree (tx_descr);
25327@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25328 dump_skb ("<<<", vc, skb);
25329
25330 // VC layer stats
25331- atomic_inc(&atm_vcc->stats->rx);
25332+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25333 __net_timestamp(skb);
25334 // end of our responsibility
25335 atm_vcc->push (atm_vcc, skb);
25336@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25337 } else {
25338 PRINTK (KERN_INFO, "dropped over-size frame");
25339 // should we count this?
25340- atomic_inc(&atm_vcc->stats->rx_drop);
25341+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25342 }
25343
25344 } else {
25345@@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
25346 }
25347
25348 if (check_area (skb->data, skb->len)) {
25349- atomic_inc(&atm_vcc->stats->tx_err);
25350+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
25351 return -ENOMEM; // ?
25352 }
25353
25354diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
25355index b22d71c..d6e1049 100644
25356--- a/drivers/atm/atmtcp.c
25357+++ b/drivers/atm/atmtcp.c
25358@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25359 if (vcc->pop) vcc->pop(vcc,skb);
25360 else dev_kfree_skb(skb);
25361 if (dev_data) return 0;
25362- atomic_inc(&vcc->stats->tx_err);
25363+ atomic_inc_unchecked(&vcc->stats->tx_err);
25364 return -ENOLINK;
25365 }
25366 size = skb->len+sizeof(struct atmtcp_hdr);
25367@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25368 if (!new_skb) {
25369 if (vcc->pop) vcc->pop(vcc,skb);
25370 else dev_kfree_skb(skb);
25371- atomic_inc(&vcc->stats->tx_err);
25372+ atomic_inc_unchecked(&vcc->stats->tx_err);
25373 return -ENOBUFS;
25374 }
25375 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
25376@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25377 if (vcc->pop) vcc->pop(vcc,skb);
25378 else dev_kfree_skb(skb);
25379 out_vcc->push(out_vcc,new_skb);
25380- atomic_inc(&vcc->stats->tx);
25381- atomic_inc(&out_vcc->stats->rx);
25382+ atomic_inc_unchecked(&vcc->stats->tx);
25383+ atomic_inc_unchecked(&out_vcc->stats->rx);
25384 return 0;
25385 }
25386
25387@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25388 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
25389 read_unlock(&vcc_sklist_lock);
25390 if (!out_vcc) {
25391- atomic_inc(&vcc->stats->tx_err);
25392+ atomic_inc_unchecked(&vcc->stats->tx_err);
25393 goto done;
25394 }
25395 skb_pull(skb,sizeof(struct atmtcp_hdr));
25396@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25397 __net_timestamp(new_skb);
25398 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
25399 out_vcc->push(out_vcc,new_skb);
25400- atomic_inc(&vcc->stats->tx);
25401- atomic_inc(&out_vcc->stats->rx);
25402+ atomic_inc_unchecked(&vcc->stats->tx);
25403+ atomic_inc_unchecked(&out_vcc->stats->rx);
25404 done:
25405 if (vcc->pop) vcc->pop(vcc,skb);
25406 else dev_kfree_skb(skb);
25407diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
25408index 9307141..d8521bf 100644
25409--- a/drivers/atm/eni.c
25410+++ b/drivers/atm/eni.c
25411@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
25412 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
25413 vcc->dev->number);
25414 length = 0;
25415- atomic_inc(&vcc->stats->rx_err);
25416+ atomic_inc_unchecked(&vcc->stats->rx_err);
25417 }
25418 else {
25419 length = ATM_CELL_SIZE-1; /* no HEC */
25420@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25421 size);
25422 }
25423 eff = length = 0;
25424- atomic_inc(&vcc->stats->rx_err);
25425+ atomic_inc_unchecked(&vcc->stats->rx_err);
25426 }
25427 else {
25428 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
25429@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25430 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
25431 vcc->dev->number,vcc->vci,length,size << 2,descr);
25432 length = eff = 0;
25433- atomic_inc(&vcc->stats->rx_err);
25434+ atomic_inc_unchecked(&vcc->stats->rx_err);
25435 }
25436 }
25437 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
25438@@ -771,7 +771,7 @@ rx_dequeued++;
25439 vcc->push(vcc,skb);
25440 pushed++;
25441 }
25442- atomic_inc(&vcc->stats->rx);
25443+ atomic_inc_unchecked(&vcc->stats->rx);
25444 }
25445 wake_up(&eni_dev->rx_wait);
25446 }
25447@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *dev)
25448 PCI_DMA_TODEVICE);
25449 if (vcc->pop) vcc->pop(vcc,skb);
25450 else dev_kfree_skb_irq(skb);
25451- atomic_inc(&vcc->stats->tx);
25452+ atomic_inc_unchecked(&vcc->stats->tx);
25453 wake_up(&eni_dev->tx_wait);
25454 dma_complete++;
25455 }
25456@@ -1568,7 +1568,7 @@ tx_complete++;
25457 /*--------------------------------- entries ---------------------------------*/
25458
25459
25460-static const char *media_name[] __devinitdata = {
25461+static const char *media_name[] __devinitconst = {
25462 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
25463 "UTP", "05?", "06?", "07?", /* 4- 7 */
25464 "TAXI","09?", "10?", "11?", /* 8-11 */
25465diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
25466index 5072f8a..fa52520d 100644
25467--- a/drivers/atm/firestream.c
25468+++ b/drivers/atm/firestream.c
25469@@ -750,7 +750,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
25470 }
25471 }
25472
25473- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25474+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25475
25476 fs_dprintk (FS_DEBUG_TXMEM, "i");
25477 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
25478@@ -817,7 +817,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25479 #endif
25480 skb_put (skb, qe->p1 & 0xffff);
25481 ATM_SKB(skb)->vcc = atm_vcc;
25482- atomic_inc(&atm_vcc->stats->rx);
25483+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25484 __net_timestamp(skb);
25485 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
25486 atm_vcc->push (atm_vcc, skb);
25487@@ -838,12 +838,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25488 kfree (pe);
25489 }
25490 if (atm_vcc)
25491- atomic_inc(&atm_vcc->stats->rx_drop);
25492+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25493 break;
25494 case 0x1f: /* Reassembly abort: no buffers. */
25495 /* Silently increment error counter. */
25496 if (atm_vcc)
25497- atomic_inc(&atm_vcc->stats->rx_drop);
25498+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25499 break;
25500 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
25501 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
25502diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
25503index 361f5ae..7fc552d 100644
25504--- a/drivers/atm/fore200e.c
25505+++ b/drivers/atm/fore200e.c
25506@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
25507 #endif
25508 /* check error condition */
25509 if (*entry->status & STATUS_ERROR)
25510- atomic_inc(&vcc->stats->tx_err);
25511+ atomic_inc_unchecked(&vcc->stats->tx_err);
25512 else
25513- atomic_inc(&vcc->stats->tx);
25514+ atomic_inc_unchecked(&vcc->stats->tx);
25515 }
25516 }
25517
25518@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25519 if (skb == NULL) {
25520 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
25521
25522- atomic_inc(&vcc->stats->rx_drop);
25523+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25524 return -ENOMEM;
25525 }
25526
25527@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25528
25529 dev_kfree_skb_any(skb);
25530
25531- atomic_inc(&vcc->stats->rx_drop);
25532+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25533 return -ENOMEM;
25534 }
25535
25536 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25537
25538 vcc->push(vcc, skb);
25539- atomic_inc(&vcc->stats->rx);
25540+ atomic_inc_unchecked(&vcc->stats->rx);
25541
25542 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25543
25544@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
25545 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
25546 fore200e->atm_dev->number,
25547 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
25548- atomic_inc(&vcc->stats->rx_err);
25549+ atomic_inc_unchecked(&vcc->stats->rx_err);
25550 }
25551 }
25552
25553@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
25554 goto retry_here;
25555 }
25556
25557- atomic_inc(&vcc->stats->tx_err);
25558+ atomic_inc_unchecked(&vcc->stats->tx_err);
25559
25560 fore200e->tx_sat++;
25561 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
25562diff --git a/drivers/atm/he.c b/drivers/atm/he.c
25563index 9a51df4..f3bb5f8 100644
25564--- a/drivers/atm/he.c
25565+++ b/drivers/atm/he.c
25566@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25567
25568 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
25569 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
25570- atomic_inc(&vcc->stats->rx_drop);
25571+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25572 goto return_host_buffers;
25573 }
25574
25575@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25576 RBRQ_LEN_ERR(he_dev->rbrq_head)
25577 ? "LEN_ERR" : "",
25578 vcc->vpi, vcc->vci);
25579- atomic_inc(&vcc->stats->rx_err);
25580+ atomic_inc_unchecked(&vcc->stats->rx_err);
25581 goto return_host_buffers;
25582 }
25583
25584@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25585 vcc->push(vcc, skb);
25586 spin_lock(&he_dev->global_lock);
25587
25588- atomic_inc(&vcc->stats->rx);
25589+ atomic_inc_unchecked(&vcc->stats->rx);
25590
25591 return_host_buffers:
25592 ++pdus_assembled;
25593@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
25594 tpd->vcc->pop(tpd->vcc, tpd->skb);
25595 else
25596 dev_kfree_skb_any(tpd->skb);
25597- atomic_inc(&tpd->vcc->stats->tx_err);
25598+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
25599 }
25600 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
25601 return;
25602@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25603 vcc->pop(vcc, skb);
25604 else
25605 dev_kfree_skb_any(skb);
25606- atomic_inc(&vcc->stats->tx_err);
25607+ atomic_inc_unchecked(&vcc->stats->tx_err);
25608 return -EINVAL;
25609 }
25610
25611@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25612 vcc->pop(vcc, skb);
25613 else
25614 dev_kfree_skb_any(skb);
25615- atomic_inc(&vcc->stats->tx_err);
25616+ atomic_inc_unchecked(&vcc->stats->tx_err);
25617 return -EINVAL;
25618 }
25619 #endif
25620@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25621 vcc->pop(vcc, skb);
25622 else
25623 dev_kfree_skb_any(skb);
25624- atomic_inc(&vcc->stats->tx_err);
25625+ atomic_inc_unchecked(&vcc->stats->tx_err);
25626 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25627 return -ENOMEM;
25628 }
25629@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25630 vcc->pop(vcc, skb);
25631 else
25632 dev_kfree_skb_any(skb);
25633- atomic_inc(&vcc->stats->tx_err);
25634+ atomic_inc_unchecked(&vcc->stats->tx_err);
25635 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25636 return -ENOMEM;
25637 }
25638@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25639 __enqueue_tpd(he_dev, tpd, cid);
25640 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25641
25642- atomic_inc(&vcc->stats->tx);
25643+ atomic_inc_unchecked(&vcc->stats->tx);
25644
25645 return 0;
25646 }
25647diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
25648index b812103..e391a49 100644
25649--- a/drivers/atm/horizon.c
25650+++ b/drivers/atm/horizon.c
25651@@ -1035,7 +1035,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
25652 {
25653 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
25654 // VC layer stats
25655- atomic_inc(&vcc->stats->rx);
25656+ atomic_inc_unchecked(&vcc->stats->rx);
25657 __net_timestamp(skb);
25658 // end of our responsibility
25659 vcc->push (vcc, skb);
25660@@ -1187,7 +1187,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
25661 dev->tx_iovec = NULL;
25662
25663 // VC layer stats
25664- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25665+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25666
25667 // free the skb
25668 hrz_kfree_skb (skb);
25669diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
25670index db06f34..dcebb61 100644
25671--- a/drivers/atm/idt77252.c
25672+++ b/drivers/atm/idt77252.c
25673@@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
25674 else
25675 dev_kfree_skb(skb);
25676
25677- atomic_inc(&vcc->stats->tx);
25678+ atomic_inc_unchecked(&vcc->stats->tx);
25679 }
25680
25681 atomic_dec(&scq->used);
25682@@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25683 if ((sb = dev_alloc_skb(64)) == NULL) {
25684 printk("%s: Can't allocate buffers for aal0.\n",
25685 card->name);
25686- atomic_add(i, &vcc->stats->rx_drop);
25687+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
25688 break;
25689 }
25690 if (!atm_charge(vcc, sb->truesize)) {
25691 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
25692 card->name);
25693- atomic_add(i - 1, &vcc->stats->rx_drop);
25694+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
25695 dev_kfree_skb(sb);
25696 break;
25697 }
25698@@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25699 ATM_SKB(sb)->vcc = vcc;
25700 __net_timestamp(sb);
25701 vcc->push(vcc, sb);
25702- atomic_inc(&vcc->stats->rx);
25703+ atomic_inc_unchecked(&vcc->stats->rx);
25704
25705 cell += ATM_CELL_PAYLOAD;
25706 }
25707@@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25708 "(CDC: %08x)\n",
25709 card->name, len, rpp->len, readl(SAR_REG_CDC));
25710 recycle_rx_pool_skb(card, rpp);
25711- atomic_inc(&vcc->stats->rx_err);
25712+ atomic_inc_unchecked(&vcc->stats->rx_err);
25713 return;
25714 }
25715 if (stat & SAR_RSQE_CRC) {
25716 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
25717 recycle_rx_pool_skb(card, rpp);
25718- atomic_inc(&vcc->stats->rx_err);
25719+ atomic_inc_unchecked(&vcc->stats->rx_err);
25720 return;
25721 }
25722 if (skb_queue_len(&rpp->queue) > 1) {
25723@@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25724 RXPRINTK("%s: Can't alloc RX skb.\n",
25725 card->name);
25726 recycle_rx_pool_skb(card, rpp);
25727- atomic_inc(&vcc->stats->rx_err);
25728+ atomic_inc_unchecked(&vcc->stats->rx_err);
25729 return;
25730 }
25731 if (!atm_charge(vcc, skb->truesize)) {
25732@@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25733 __net_timestamp(skb);
25734
25735 vcc->push(vcc, skb);
25736- atomic_inc(&vcc->stats->rx);
25737+ atomic_inc_unchecked(&vcc->stats->rx);
25738
25739 return;
25740 }
25741@@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25742 __net_timestamp(skb);
25743
25744 vcc->push(vcc, skb);
25745- atomic_inc(&vcc->stats->rx);
25746+ atomic_inc_unchecked(&vcc->stats->rx);
25747
25748 if (skb->truesize > SAR_FB_SIZE_3)
25749 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
25750@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
25751 if (vcc->qos.aal != ATM_AAL0) {
25752 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
25753 card->name, vpi, vci);
25754- atomic_inc(&vcc->stats->rx_drop);
25755+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25756 goto drop;
25757 }
25758
25759 if ((sb = dev_alloc_skb(64)) == NULL) {
25760 printk("%s: Can't allocate buffers for AAL0.\n",
25761 card->name);
25762- atomic_inc(&vcc->stats->rx_err);
25763+ atomic_inc_unchecked(&vcc->stats->rx_err);
25764 goto drop;
25765 }
25766
25767@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
25768 ATM_SKB(sb)->vcc = vcc;
25769 __net_timestamp(sb);
25770 vcc->push(vcc, sb);
25771- atomic_inc(&vcc->stats->rx);
25772+ atomic_inc_unchecked(&vcc->stats->rx);
25773
25774 drop:
25775 skb_pull(queue, 64);
25776@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25777
25778 if (vc == NULL) {
25779 printk("%s: NULL connection in send().\n", card->name);
25780- atomic_inc(&vcc->stats->tx_err);
25781+ atomic_inc_unchecked(&vcc->stats->tx_err);
25782 dev_kfree_skb(skb);
25783 return -EINVAL;
25784 }
25785 if (!test_bit(VCF_TX, &vc->flags)) {
25786 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
25787- atomic_inc(&vcc->stats->tx_err);
25788+ atomic_inc_unchecked(&vcc->stats->tx_err);
25789 dev_kfree_skb(skb);
25790 return -EINVAL;
25791 }
25792@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25793 break;
25794 default:
25795 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
25796- atomic_inc(&vcc->stats->tx_err);
25797+ atomic_inc_unchecked(&vcc->stats->tx_err);
25798 dev_kfree_skb(skb);
25799 return -EINVAL;
25800 }
25801
25802 if (skb_shinfo(skb)->nr_frags != 0) {
25803 printk("%s: No scatter-gather yet.\n", card->name);
25804- atomic_inc(&vcc->stats->tx_err);
25805+ atomic_inc_unchecked(&vcc->stats->tx_err);
25806 dev_kfree_skb(skb);
25807 return -EINVAL;
25808 }
25809@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25810
25811 err = queue_skb(card, vc, skb, oam);
25812 if (err) {
25813- atomic_inc(&vcc->stats->tx_err);
25814+ atomic_inc_unchecked(&vcc->stats->tx_err);
25815 dev_kfree_skb(skb);
25816 return err;
25817 }
25818@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
25819 skb = dev_alloc_skb(64);
25820 if (!skb) {
25821 printk("%s: Out of memory in send_oam().\n", card->name);
25822- atomic_inc(&vcc->stats->tx_err);
25823+ atomic_inc_unchecked(&vcc->stats->tx_err);
25824 return -ENOMEM;
25825 }
25826 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
25827diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
25828index cb90f7a..bd33566 100644
25829--- a/drivers/atm/iphase.c
25830+++ b/drivers/atm/iphase.c
25831@@ -1121,7 +1121,7 @@ static int rx_pkt(struct atm_dev *dev)
25832 status = (u_short) (buf_desc_ptr->desc_mode);
25833 if (status & (RX_CER | RX_PTE | RX_OFL))
25834 {
25835- atomic_inc(&vcc->stats->rx_err);
25836+ atomic_inc_unchecked(&vcc->stats->rx_err);
25837 IF_ERR(printk("IA: bad packet, dropping it");)
25838 if (status & RX_CER) {
25839 IF_ERR(printk(" cause: packet CRC error\n");)
25840@@ -1144,7 +1144,7 @@ static int rx_pkt(struct atm_dev *dev)
25841 len = dma_addr - buf_addr;
25842 if (len > iadev->rx_buf_sz) {
25843 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
25844- atomic_inc(&vcc->stats->rx_err);
25845+ atomic_inc_unchecked(&vcc->stats->rx_err);
25846 goto out_free_desc;
25847 }
25848
25849@@ -1294,7 +1294,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25850 ia_vcc = INPH_IA_VCC(vcc);
25851 if (ia_vcc == NULL)
25852 {
25853- atomic_inc(&vcc->stats->rx_err);
25854+ atomic_inc_unchecked(&vcc->stats->rx_err);
25855 dev_kfree_skb_any(skb);
25856 atm_return(vcc, atm_guess_pdu2truesize(len));
25857 goto INCR_DLE;
25858@@ -1306,7 +1306,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25859 if ((length > iadev->rx_buf_sz) || (length >
25860 (skb->len - sizeof(struct cpcs_trailer))))
25861 {
25862- atomic_inc(&vcc->stats->rx_err);
25863+ atomic_inc_unchecked(&vcc->stats->rx_err);
25864 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
25865 length, skb->len);)
25866 dev_kfree_skb_any(skb);
25867@@ -1322,7 +1322,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25868
25869 IF_RX(printk("rx_dle_intr: skb push");)
25870 vcc->push(vcc,skb);
25871- atomic_inc(&vcc->stats->rx);
25872+ atomic_inc_unchecked(&vcc->stats->rx);
25873 iadev->rx_pkt_cnt++;
25874 }
25875 INCR_DLE:
25876@@ -2802,15 +2802,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
25877 {
25878 struct k_sonet_stats *stats;
25879 stats = &PRIV(_ia_dev[board])->sonet_stats;
25880- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
25881- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
25882- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
25883- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
25884- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
25885- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
25886- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
25887- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
25888- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
25889+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
25890+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
25891+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
25892+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
25893+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
25894+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
25895+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
25896+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
25897+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
25898 }
25899 ia_cmds.status = 0;
25900 break;
25901@@ -2915,7 +2915,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25902 if ((desc == 0) || (desc > iadev->num_tx_desc))
25903 {
25904 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
25905- atomic_inc(&vcc->stats->tx);
25906+ atomic_inc_unchecked(&vcc->stats->tx);
25907 if (vcc->pop)
25908 vcc->pop(vcc, skb);
25909 else
25910@@ -3020,14 +3020,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25911 ATM_DESC(skb) = vcc->vci;
25912 skb_queue_tail(&iadev->tx_dma_q, skb);
25913
25914- atomic_inc(&vcc->stats->tx);
25915+ atomic_inc_unchecked(&vcc->stats->tx);
25916 iadev->tx_pkt_cnt++;
25917 /* Increment transaction counter */
25918 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
25919
25920 #if 0
25921 /* add flow control logic */
25922- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
25923+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
25924 if (iavcc->vc_desc_cnt > 10) {
25925 vcc->tx_quota = vcc->tx_quota * 3 / 4;
25926 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
25927diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
25928index e828c54..ae83976 100644
25929--- a/drivers/atm/lanai.c
25930+++ b/drivers/atm/lanai.c
25931@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
25932 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
25933 lanai_endtx(lanai, lvcc);
25934 lanai_free_skb(lvcc->tx.atmvcc, skb);
25935- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
25936+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
25937 }
25938
25939 /* Try to fill the buffer - don't call unless there is backlog */
25940@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
25941 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
25942 __net_timestamp(skb);
25943 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
25944- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
25945+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
25946 out:
25947 lvcc->rx.buf.ptr = end;
25948 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
25949@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25950 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
25951 "vcc %d\n", lanai->number, (unsigned int) s, vci);
25952 lanai->stats.service_rxnotaal5++;
25953- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25954+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25955 return 0;
25956 }
25957 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
25958@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25959 int bytes;
25960 read_unlock(&vcc_sklist_lock);
25961 DPRINTK("got trashed rx pdu on vci %d\n", vci);
25962- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25963+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25964 lvcc->stats.x.aal5.service_trash++;
25965 bytes = (SERVICE_GET_END(s) * 16) -
25966 (((unsigned long) lvcc->rx.buf.ptr) -
25967@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25968 }
25969 if (s & SERVICE_STREAM) {
25970 read_unlock(&vcc_sklist_lock);
25971- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25972+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25973 lvcc->stats.x.aal5.service_stream++;
25974 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
25975 "PDU on VCI %d!\n", lanai->number, vci);
25976@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25977 return 0;
25978 }
25979 DPRINTK("got rx crc error on vci %d\n", vci);
25980- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25981+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25982 lvcc->stats.x.aal5.service_rxcrc++;
25983 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
25984 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
25985diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
25986index 1c70c45..300718d 100644
25987--- a/drivers/atm/nicstar.c
25988+++ b/drivers/atm/nicstar.c
25989@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25990 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
25991 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
25992 card->index);
25993- atomic_inc(&vcc->stats->tx_err);
25994+ atomic_inc_unchecked(&vcc->stats->tx_err);
25995 dev_kfree_skb_any(skb);
25996 return -EINVAL;
25997 }
25998@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25999 if (!vc->tx) {
26000 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
26001 card->index);
26002- atomic_inc(&vcc->stats->tx_err);
26003+ atomic_inc_unchecked(&vcc->stats->tx_err);
26004 dev_kfree_skb_any(skb);
26005 return -EINVAL;
26006 }
26007@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
26008 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
26009 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
26010 card->index);
26011- atomic_inc(&vcc->stats->tx_err);
26012+ atomic_inc_unchecked(&vcc->stats->tx_err);
26013 dev_kfree_skb_any(skb);
26014 return -EINVAL;
26015 }
26016
26017 if (skb_shinfo(skb)->nr_frags != 0) {
26018 printk("nicstar%d: No scatter-gather yet.\n", card->index);
26019- atomic_inc(&vcc->stats->tx_err);
26020+ atomic_inc_unchecked(&vcc->stats->tx_err);
26021 dev_kfree_skb_any(skb);
26022 return -EINVAL;
26023 }
26024@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
26025 }
26026
26027 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
26028- atomic_inc(&vcc->stats->tx_err);
26029+ atomic_inc_unchecked(&vcc->stats->tx_err);
26030 dev_kfree_skb_any(skb);
26031 return -EIO;
26032 }
26033- atomic_inc(&vcc->stats->tx);
26034+ atomic_inc_unchecked(&vcc->stats->tx);
26035
26036 return 0;
26037 }
26038@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26039 printk
26040 ("nicstar%d: Can't allocate buffers for aal0.\n",
26041 card->index);
26042- atomic_add(i, &vcc->stats->rx_drop);
26043+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
26044 break;
26045 }
26046 if (!atm_charge(vcc, sb->truesize)) {
26047 RXPRINTK
26048 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
26049 card->index);
26050- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
26051+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
26052 dev_kfree_skb_any(sb);
26053 break;
26054 }
26055@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26056 ATM_SKB(sb)->vcc = vcc;
26057 __net_timestamp(sb);
26058 vcc->push(vcc, sb);
26059- atomic_inc(&vcc->stats->rx);
26060+ atomic_inc_unchecked(&vcc->stats->rx);
26061 cell += ATM_CELL_PAYLOAD;
26062 }
26063
26064@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26065 if (iovb == NULL) {
26066 printk("nicstar%d: Out of iovec buffers.\n",
26067 card->index);
26068- atomic_inc(&vcc->stats->rx_drop);
26069+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26070 recycle_rx_buf(card, skb);
26071 return;
26072 }
26073@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26074 small or large buffer itself. */
26075 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
26076 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
26077- atomic_inc(&vcc->stats->rx_err);
26078+ atomic_inc_unchecked(&vcc->stats->rx_err);
26079 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
26080 NS_MAX_IOVECS);
26081 NS_PRV_IOVCNT(iovb) = 0;
26082@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26083 ("nicstar%d: Expected a small buffer, and this is not one.\n",
26084 card->index);
26085 which_list(card, skb);
26086- atomic_inc(&vcc->stats->rx_err);
26087+ atomic_inc_unchecked(&vcc->stats->rx_err);
26088 recycle_rx_buf(card, skb);
26089 vc->rx_iov = NULL;
26090 recycle_iov_buf(card, iovb);
26091@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26092 ("nicstar%d: Expected a large buffer, and this is not one.\n",
26093 card->index);
26094 which_list(card, skb);
26095- atomic_inc(&vcc->stats->rx_err);
26096+ atomic_inc_unchecked(&vcc->stats->rx_err);
26097 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
26098 NS_PRV_IOVCNT(iovb));
26099 vc->rx_iov = NULL;
26100@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26101 printk(" - PDU size mismatch.\n");
26102 else
26103 printk(".\n");
26104- atomic_inc(&vcc->stats->rx_err);
26105+ atomic_inc_unchecked(&vcc->stats->rx_err);
26106 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
26107 NS_PRV_IOVCNT(iovb));
26108 vc->rx_iov = NULL;
26109@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26110 /* skb points to a small buffer */
26111 if (!atm_charge(vcc, skb->truesize)) {
26112 push_rxbufs(card, skb);
26113- atomic_inc(&vcc->stats->rx_drop);
26114+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26115 } else {
26116 skb_put(skb, len);
26117 dequeue_sm_buf(card, skb);
26118@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26119 ATM_SKB(skb)->vcc = vcc;
26120 __net_timestamp(skb);
26121 vcc->push(vcc, skb);
26122- atomic_inc(&vcc->stats->rx);
26123+ atomic_inc_unchecked(&vcc->stats->rx);
26124 }
26125 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
26126 struct sk_buff *sb;
26127@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26128 if (len <= NS_SMBUFSIZE) {
26129 if (!atm_charge(vcc, sb->truesize)) {
26130 push_rxbufs(card, sb);
26131- atomic_inc(&vcc->stats->rx_drop);
26132+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26133 } else {
26134 skb_put(sb, len);
26135 dequeue_sm_buf(card, sb);
26136@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26137 ATM_SKB(sb)->vcc = vcc;
26138 __net_timestamp(sb);
26139 vcc->push(vcc, sb);
26140- atomic_inc(&vcc->stats->rx);
26141+ atomic_inc_unchecked(&vcc->stats->rx);
26142 }
26143
26144 push_rxbufs(card, skb);
26145@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26146
26147 if (!atm_charge(vcc, skb->truesize)) {
26148 push_rxbufs(card, skb);
26149- atomic_inc(&vcc->stats->rx_drop);
26150+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26151 } else {
26152 dequeue_lg_buf(card, skb);
26153 #ifdef NS_USE_DESTRUCTORS
26154@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26155 ATM_SKB(skb)->vcc = vcc;
26156 __net_timestamp(skb);
26157 vcc->push(vcc, skb);
26158- atomic_inc(&vcc->stats->rx);
26159+ atomic_inc_unchecked(&vcc->stats->rx);
26160 }
26161
26162 push_rxbufs(card, sb);
26163@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26164 printk
26165 ("nicstar%d: Out of huge buffers.\n",
26166 card->index);
26167- atomic_inc(&vcc->stats->rx_drop);
26168+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26169 recycle_iovec_rx_bufs(card,
26170 (struct iovec *)
26171 iovb->data,
26172@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26173 card->hbpool.count++;
26174 } else
26175 dev_kfree_skb_any(hb);
26176- atomic_inc(&vcc->stats->rx_drop);
26177+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26178 } else {
26179 /* Copy the small buffer to the huge buffer */
26180 sb = (struct sk_buff *)iov->iov_base;
26181@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26182 #endif /* NS_USE_DESTRUCTORS */
26183 __net_timestamp(hb);
26184 vcc->push(vcc, hb);
26185- atomic_inc(&vcc->stats->rx);
26186+ atomic_inc_unchecked(&vcc->stats->rx);
26187 }
26188 }
26189
26190diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
26191index 5d1d076..4f31f42 100644
26192--- a/drivers/atm/solos-pci.c
26193+++ b/drivers/atm/solos-pci.c
26194@@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
26195 }
26196 atm_charge(vcc, skb->truesize);
26197 vcc->push(vcc, skb);
26198- atomic_inc(&vcc->stats->rx);
26199+ atomic_inc_unchecked(&vcc->stats->rx);
26200 break;
26201
26202 case PKT_STATUS:
26203@@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *buf)
26204 char msg[500];
26205 char item[10];
26206
26207+ pax_track_stack();
26208+
26209 len = buf->len;
26210 for (i = 0; i < len; i++){
26211 if(i % 8 == 0)
26212@@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_card *card)
26213 vcc = SKB_CB(oldskb)->vcc;
26214
26215 if (vcc) {
26216- atomic_inc(&vcc->stats->tx);
26217+ atomic_inc_unchecked(&vcc->stats->tx);
26218 solos_pop(vcc, oldskb);
26219 } else
26220 dev_kfree_skb_irq(oldskb);
26221diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
26222index 90f1ccc..04c4a1e 100644
26223--- a/drivers/atm/suni.c
26224+++ b/drivers/atm/suni.c
26225@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
26226
26227
26228 #define ADD_LIMITED(s,v) \
26229- atomic_add((v),&stats->s); \
26230- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
26231+ atomic_add_unchecked((v),&stats->s); \
26232+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
26233
26234
26235 static void suni_hz(unsigned long from_timer)
26236diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
26237index 5120a96..e2572bd 100644
26238--- a/drivers/atm/uPD98402.c
26239+++ b/drivers/atm/uPD98402.c
26240@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
26241 struct sonet_stats tmp;
26242 int error = 0;
26243
26244- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26245+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26246 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
26247 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
26248 if (zero && !error) {
26249@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
26250
26251
26252 #define ADD_LIMITED(s,v) \
26253- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
26254- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
26255- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26256+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
26257+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
26258+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26259
26260
26261 static void stat_event(struct atm_dev *dev)
26262@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
26263 if (reason & uPD98402_INT_PFM) stat_event(dev);
26264 if (reason & uPD98402_INT_PCO) {
26265 (void) GET(PCOCR); /* clear interrupt cause */
26266- atomic_add(GET(HECCT),
26267+ atomic_add_unchecked(GET(HECCT),
26268 &PRIV(dev)->sonet_stats.uncorr_hcs);
26269 }
26270 if ((reason & uPD98402_INT_RFO) &&
26271@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
26272 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
26273 uPD98402_INT_LOS),PIMR); /* enable them */
26274 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
26275- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26276- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
26277- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
26278+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26279+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
26280+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
26281 return 0;
26282 }
26283
26284diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
26285index d889f56..17eb71e 100644
26286--- a/drivers/atm/zatm.c
26287+++ b/drivers/atm/zatm.c
26288@@ -460,7 +460,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26289 }
26290 if (!size) {
26291 dev_kfree_skb_irq(skb);
26292- if (vcc) atomic_inc(&vcc->stats->rx_err);
26293+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
26294 continue;
26295 }
26296 if (!atm_charge(vcc,skb->truesize)) {
26297@@ -470,7 +470,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26298 skb->len = size;
26299 ATM_SKB(skb)->vcc = vcc;
26300 vcc->push(vcc,skb);
26301- atomic_inc(&vcc->stats->rx);
26302+ atomic_inc_unchecked(&vcc->stats->rx);
26303 }
26304 zout(pos & 0xffff,MTA(mbx));
26305 #if 0 /* probably a stupid idea */
26306@@ -734,7 +734,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
26307 skb_queue_head(&zatm_vcc->backlog,skb);
26308 break;
26309 }
26310- atomic_inc(&vcc->stats->tx);
26311+ atomic_inc_unchecked(&vcc->stats->tx);
26312 wake_up(&zatm_vcc->tx_wait);
26313 }
26314
26315diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
26316index a4760e0..51283cf 100644
26317--- a/drivers/base/devtmpfs.c
26318+++ b/drivers/base/devtmpfs.c
26319@@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir)
26320 if (!thread)
26321 return 0;
26322
26323- err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
26324+ err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
26325 if (err)
26326 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
26327 else
26328diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
26329index 84f7c7d..37cfd87 100644
26330--- a/drivers/base/power/wakeup.c
26331+++ b/drivers/base/power/wakeup.c
26332@@ -29,14 +29,14 @@ bool events_check_enabled;
26333 * They need to be modified together atomically, so it's better to use one
26334 * atomic variable to hold them both.
26335 */
26336-static atomic_t combined_event_count = ATOMIC_INIT(0);
26337+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
26338
26339 #define IN_PROGRESS_BITS (sizeof(int) * 4)
26340 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
26341
26342 static void split_counters(unsigned int *cnt, unsigned int *inpr)
26343 {
26344- unsigned int comb = atomic_read(&combined_event_count);
26345+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
26346
26347 *cnt = (comb >> IN_PROGRESS_BITS);
26348 *inpr = comb & MAX_IN_PROGRESS;
26349@@ -350,7 +350,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
26350 ws->last_time = ktime_get();
26351
26352 /* Increment the counter of events in progress. */
26353- atomic_inc(&combined_event_count);
26354+ atomic_inc_unchecked(&combined_event_count);
26355 }
26356
26357 /**
26358@@ -440,7 +440,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
26359 * Increment the counter of registered wakeup events and decrement the
26360 * couter of wakeup events in progress simultaneously.
26361 */
26362- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
26363+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
26364 }
26365
26366 /**
26367diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
26368index e086fbb..398e1fe 100644
26369--- a/drivers/block/DAC960.c
26370+++ b/drivers/block/DAC960.c
26371@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
26372 unsigned long flags;
26373 int Channel, TargetID;
26374
26375+ pax_track_stack();
26376+
26377 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
26378 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
26379 sizeof(DAC960_SCSI_Inquiry_T) +
26380diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
26381index c2f9b3e..11b8693 100644
26382--- a/drivers/block/cciss.c
26383+++ b/drivers/block/cciss.c
26384@@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
26385 int err;
26386 u32 cp;
26387
26388+ memset(&arg64, 0, sizeof(arg64));
26389+
26390 err = 0;
26391 err |=
26392 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
26393@@ -1716,7 +1718,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
26394 case CCISS_BIG_PASSTHRU:
26395 return cciss_bigpassthru(h, argp);
26396
26397- /* scsi_cmd_ioctl handles these, below, though some are not */
26398+ /* scsi_cmd_blk_ioctl handles these, below, though some are not */
26399 /* very meaningful for cciss. SG_IO is the main one people want. */
26400
26401 case SG_GET_VERSION_NUM:
26402@@ -1727,9 +1729,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
26403 case SG_EMULATED_HOST:
26404 case SG_IO:
26405 case SCSI_IOCTL_SEND_COMMAND:
26406- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
26407+ return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
26408
26409- /* scsi_cmd_ioctl would normally handle these, below, but */
26410+ /* scsi_cmd_blk_ioctl would normally handle these, below, but */
26411 /* they aren't a good fit for cciss, as CD-ROMs are */
26412 /* not supported, and we don't have any bus/target/lun */
26413 /* which we present to the kernel. */
26414@@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
26415 while (!list_empty(&h->reqQ)) {
26416 c = list_entry(h->reqQ.next, CommandList_struct, list);
26417 /* can't do anything if fifo is full */
26418- if ((h->access.fifo_full(h))) {
26419+ if ((h->access->fifo_full(h))) {
26420 dev_warn(&h->pdev->dev, "fifo full\n");
26421 break;
26422 }
26423@@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
26424 h->Qdepth--;
26425
26426 /* Tell the controller execute command */
26427- h->access.submit_command(h, c);
26428+ h->access->submit_command(h, c);
26429
26430 /* Put job onto the completed Q */
26431 addQ(&h->cmpQ, c);
26432@@ -3422,17 +3424,17 @@ startio:
26433
26434 static inline unsigned long get_next_completion(ctlr_info_t *h)
26435 {
26436- return h->access.command_completed(h);
26437+ return h->access->command_completed(h);
26438 }
26439
26440 static inline int interrupt_pending(ctlr_info_t *h)
26441 {
26442- return h->access.intr_pending(h);
26443+ return h->access->intr_pending(h);
26444 }
26445
26446 static inline long interrupt_not_for_us(ctlr_info_t *h)
26447 {
26448- return ((h->access.intr_pending(h) == 0) ||
26449+ return ((h->access->intr_pending(h) == 0) ||
26450 (h->interrupts_enabled == 0));
26451 }
26452
26453@@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info_t *h)
26454 u32 a;
26455
26456 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
26457- return h->access.command_completed(h);
26458+ return h->access->command_completed(h);
26459
26460 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
26461 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
26462@@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
26463 trans_support & CFGTBL_Trans_use_short_tags);
26464
26465 /* Change the access methods to the performant access methods */
26466- h->access = SA5_performant_access;
26467+ h->access = &SA5_performant_access;
26468 h->transMethod = CFGTBL_Trans_Performant;
26469
26470 return;
26471@@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *h)
26472 if (prod_index < 0)
26473 return -ENODEV;
26474 h->product_name = products[prod_index].product_name;
26475- h->access = *(products[prod_index].access);
26476+ h->access = products[prod_index].access;
26477
26478 if (cciss_board_disabled(h)) {
26479 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
26480@@ -5009,7 +5011,7 @@ reinit_after_soft_reset:
26481 }
26482
26483 /* make sure the board interrupts are off */
26484- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26485+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26486 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
26487 if (rc)
26488 goto clean2;
26489@@ -5061,7 +5063,7 @@ reinit_after_soft_reset:
26490 * fake ones to scoop up any residual completions.
26491 */
26492 spin_lock_irqsave(&h->lock, flags);
26493- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26494+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26495 spin_unlock_irqrestore(&h->lock, flags);
26496 free_irq(h->intr[PERF_MODE_INT], h);
26497 rc = cciss_request_irq(h, cciss_msix_discard_completions,
26498@@ -5081,9 +5083,9 @@ reinit_after_soft_reset:
26499 dev_info(&h->pdev->dev, "Board READY.\n");
26500 dev_info(&h->pdev->dev,
26501 "Waiting for stale completions to drain.\n");
26502- h->access.set_intr_mask(h, CCISS_INTR_ON);
26503+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26504 msleep(10000);
26505- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26506+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26507
26508 rc = controller_reset_failed(h->cfgtable);
26509 if (rc)
26510@@ -5106,7 +5108,7 @@ reinit_after_soft_reset:
26511 cciss_scsi_setup(h);
26512
26513 /* Turn the interrupts on so we can service requests */
26514- h->access.set_intr_mask(h, CCISS_INTR_ON);
26515+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26516
26517 /* Get the firmware version */
26518 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
26519@@ -5178,7 +5180,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
26520 kfree(flush_buf);
26521 if (return_code != IO_OK)
26522 dev_warn(&h->pdev->dev, "Error flushing cache\n");
26523- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26524+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26525 free_irq(h->intr[PERF_MODE_INT], h);
26526 }
26527
26528diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
26529index c049548..a09cb6e 100644
26530--- a/drivers/block/cciss.h
26531+++ b/drivers/block/cciss.h
26532@@ -100,7 +100,7 @@ struct ctlr_info
26533 /* information about each logical volume */
26534 drive_info_struct *drv[CISS_MAX_LUN];
26535
26536- struct access_method access;
26537+ struct access_method *access;
26538
26539 /* queue and queue Info */
26540 struct list_head reqQ;
26541diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
26542index b2fceb5..87fec83 100644
26543--- a/drivers/block/cpqarray.c
26544+++ b/drivers/block/cpqarray.c
26545@@ -404,7 +404,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26546 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
26547 goto Enomem4;
26548 }
26549- hba[i]->access.set_intr_mask(hba[i], 0);
26550+ hba[i]->access->set_intr_mask(hba[i], 0);
26551 if (request_irq(hba[i]->intr, do_ida_intr,
26552 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
26553 {
26554@@ -459,7 +459,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26555 add_timer(&hba[i]->timer);
26556
26557 /* Enable IRQ now that spinlock and rate limit timer are set up */
26558- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26559+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26560
26561 for(j=0; j<NWD; j++) {
26562 struct gendisk *disk = ida_gendisk[i][j];
26563@@ -694,7 +694,7 @@ DBGINFO(
26564 for(i=0; i<NR_PRODUCTS; i++) {
26565 if (board_id == products[i].board_id) {
26566 c->product_name = products[i].product_name;
26567- c->access = *(products[i].access);
26568+ c->access = products[i].access;
26569 break;
26570 }
26571 }
26572@@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detect(void)
26573 hba[ctlr]->intr = intr;
26574 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
26575 hba[ctlr]->product_name = products[j].product_name;
26576- hba[ctlr]->access = *(products[j].access);
26577+ hba[ctlr]->access = products[j].access;
26578 hba[ctlr]->ctlr = ctlr;
26579 hba[ctlr]->board_id = board_id;
26580 hba[ctlr]->pci_dev = NULL; /* not PCI */
26581@@ -911,6 +911,8 @@ static void do_ida_request(struct request_queue *q)
26582 struct scatterlist tmp_sg[SG_MAX];
26583 int i, dir, seg;
26584
26585+ pax_track_stack();
26586+
26587 queue_next:
26588 creq = blk_peek_request(q);
26589 if (!creq)
26590@@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
26591
26592 while((c = h->reqQ) != NULL) {
26593 /* Can't do anything if we're busy */
26594- if (h->access.fifo_full(h) == 0)
26595+ if (h->access->fifo_full(h) == 0)
26596 return;
26597
26598 /* Get the first entry from the request Q */
26599@@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
26600 h->Qdepth--;
26601
26602 /* Tell the controller to do our bidding */
26603- h->access.submit_command(h, c);
26604+ h->access->submit_command(h, c);
26605
26606 /* Get onto the completion Q */
26607 addQ(&h->cmpQ, c);
26608@@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26609 unsigned long flags;
26610 __u32 a,a1;
26611
26612- istat = h->access.intr_pending(h);
26613+ istat = h->access->intr_pending(h);
26614 /* Is this interrupt for us? */
26615 if (istat == 0)
26616 return IRQ_NONE;
26617@@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26618 */
26619 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
26620 if (istat & FIFO_NOT_EMPTY) {
26621- while((a = h->access.command_completed(h))) {
26622+ while((a = h->access->command_completed(h))) {
26623 a1 = a; a &= ~3;
26624 if ((c = h->cmpQ) == NULL)
26625 {
26626@@ -1449,11 +1451,11 @@ static int sendcmd(
26627 /*
26628 * Disable interrupt
26629 */
26630- info_p->access.set_intr_mask(info_p, 0);
26631+ info_p->access->set_intr_mask(info_p, 0);
26632 /* Make sure there is room in the command FIFO */
26633 /* Actually it should be completely empty at this time. */
26634 for (i = 200000; i > 0; i--) {
26635- temp = info_p->access.fifo_full(info_p);
26636+ temp = info_p->access->fifo_full(info_p);
26637 if (temp != 0) {
26638 break;
26639 }
26640@@ -1466,7 +1468,7 @@ DBG(
26641 /*
26642 * Send the cmd
26643 */
26644- info_p->access.submit_command(info_p, c);
26645+ info_p->access->submit_command(info_p, c);
26646 complete = pollcomplete(ctlr);
26647
26648 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
26649@@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t *host)
26650 * we check the new geometry. Then turn interrupts back on when
26651 * we're done.
26652 */
26653- host->access.set_intr_mask(host, 0);
26654+ host->access->set_intr_mask(host, 0);
26655 getgeometry(ctlr);
26656- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
26657+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
26658
26659 for(i=0; i<NWD; i++) {
26660 struct gendisk *disk = ida_gendisk[ctlr][i];
26661@@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
26662 /* Wait (up to 2 seconds) for a command to complete */
26663
26664 for (i = 200000; i > 0; i--) {
26665- done = hba[ctlr]->access.command_completed(hba[ctlr]);
26666+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
26667 if (done == 0) {
26668 udelay(10); /* a short fixed delay */
26669 } else
26670diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
26671index be73e9d..7fbf140 100644
26672--- a/drivers/block/cpqarray.h
26673+++ b/drivers/block/cpqarray.h
26674@@ -99,7 +99,7 @@ struct ctlr_info {
26675 drv_info_t drv[NWD];
26676 struct proc_dir_entry *proc;
26677
26678- struct access_method access;
26679+ struct access_method *access;
26680
26681 cmdlist_t *reqQ;
26682 cmdlist_t *cmpQ;
26683diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
26684index ef2ceed..c9cb18e 100644
26685--- a/drivers/block/drbd/drbd_int.h
26686+++ b/drivers/block/drbd/drbd_int.h
26687@@ -737,7 +737,7 @@ struct drbd_request;
26688 struct drbd_epoch {
26689 struct list_head list;
26690 unsigned int barrier_nr;
26691- atomic_t epoch_size; /* increased on every request added. */
26692+ atomic_unchecked_t epoch_size; /* increased on every request added. */
26693 atomic_t active; /* increased on every req. added, and dec on every finished. */
26694 unsigned long flags;
26695 };
26696@@ -1109,7 +1109,7 @@ struct drbd_conf {
26697 void *int_dig_in;
26698 void *int_dig_vv;
26699 wait_queue_head_t seq_wait;
26700- atomic_t packet_seq;
26701+ atomic_unchecked_t packet_seq;
26702 unsigned int peer_seq;
26703 spinlock_t peer_seq_lock;
26704 unsigned int minor;
26705@@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
26706
26707 static inline void drbd_tcp_cork(struct socket *sock)
26708 {
26709- int __user val = 1;
26710+ int val = 1;
26711 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26712- (char __user *)&val, sizeof(val));
26713+ (char __force_user *)&val, sizeof(val));
26714 }
26715
26716 static inline void drbd_tcp_uncork(struct socket *sock)
26717 {
26718- int __user val = 0;
26719+ int val = 0;
26720 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26721- (char __user *)&val, sizeof(val));
26722+ (char __force_user *)&val, sizeof(val));
26723 }
26724
26725 static inline void drbd_tcp_nodelay(struct socket *sock)
26726 {
26727- int __user val = 1;
26728+ int val = 1;
26729 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
26730- (char __user *)&val, sizeof(val));
26731+ (char __force_user *)&val, sizeof(val));
26732 }
26733
26734 static inline void drbd_tcp_quickack(struct socket *sock)
26735 {
26736- int __user val = 2;
26737+ int val = 2;
26738 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
26739- (char __user *)&val, sizeof(val));
26740+ (char __force_user *)&val, sizeof(val));
26741 }
26742
26743 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
26744diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
26745index 0358e55..bc33689 100644
26746--- a/drivers/block/drbd/drbd_main.c
26747+++ b/drivers/block/drbd/drbd_main.c
26748@@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd,
26749 p.sector = sector;
26750 p.block_id = block_id;
26751 p.blksize = blksize;
26752- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
26753+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
26754
26755 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
26756 return false;
26757@@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
26758 p.sector = cpu_to_be64(req->sector);
26759 p.block_id = (unsigned long)req;
26760 p.seq_num = cpu_to_be32(req->seq_num =
26761- atomic_add_return(1, &mdev->packet_seq));
26762+ atomic_add_return_unchecked(1, &mdev->packet_seq));
26763
26764 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
26765
26766@@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev)
26767 atomic_set(&mdev->unacked_cnt, 0);
26768 atomic_set(&mdev->local_cnt, 0);
26769 atomic_set(&mdev->net_cnt, 0);
26770- atomic_set(&mdev->packet_seq, 0);
26771+ atomic_set_unchecked(&mdev->packet_seq, 0);
26772 atomic_set(&mdev->pp_in_use, 0);
26773 atomic_set(&mdev->pp_in_use_by_net, 0);
26774 atomic_set(&mdev->rs_sect_in, 0);
26775@@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev)
26776 mdev->receiver.t_state);
26777
26778 /* no need to lock it, I'm the only thread alive */
26779- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
26780- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
26781+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
26782+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
26783 mdev->al_writ_cnt =
26784 mdev->bm_writ_cnt =
26785 mdev->read_cnt =
26786diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
26787index 0feab26..5d9b3dd 100644
26788--- a/drivers/block/drbd/drbd_nl.c
26789+++ b/drivers/block/drbd/drbd_nl.c
26790@@ -2359,7 +2359,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
26791 module_put(THIS_MODULE);
26792 }
26793
26794-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26795+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26796
26797 static unsigned short *
26798 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
26799@@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state)
26800 cn_reply->id.idx = CN_IDX_DRBD;
26801 cn_reply->id.val = CN_VAL_DRBD;
26802
26803- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26804+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26805 cn_reply->ack = 0; /* not used here. */
26806 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26807 (int)((char *)tl - (char *)reply->tag_list);
26808@@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
26809 cn_reply->id.idx = CN_IDX_DRBD;
26810 cn_reply->id.val = CN_VAL_DRBD;
26811
26812- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26813+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26814 cn_reply->ack = 0; /* not used here. */
26815 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26816 (int)((char *)tl - (char *)reply->tag_list);
26817@@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev,
26818 cn_reply->id.idx = CN_IDX_DRBD;
26819 cn_reply->id.val = CN_VAL_DRBD;
26820
26821- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
26822+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
26823 cn_reply->ack = 0; // not used here.
26824 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26825 (int)((char*)tl - (char*)reply->tag_list);
26826@@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev)
26827 cn_reply->id.idx = CN_IDX_DRBD;
26828 cn_reply->id.val = CN_VAL_DRBD;
26829
26830- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26831+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26832 cn_reply->ack = 0; /* not used here. */
26833 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26834 (int)((char *)tl - (char *)reply->tag_list);
26835diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
26836index 43beaca..4a5b1dd 100644
26837--- a/drivers/block/drbd/drbd_receiver.c
26838+++ b/drivers/block/drbd/drbd_receiver.c
26839@@ -894,7 +894,7 @@ retry:
26840 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
26841 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
26842
26843- atomic_set(&mdev->packet_seq, 0);
26844+ atomic_set_unchecked(&mdev->packet_seq, 0);
26845 mdev->peer_seq = 0;
26846
26847 drbd_thread_start(&mdev->asender);
26848@@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26849 do {
26850 next_epoch = NULL;
26851
26852- epoch_size = atomic_read(&epoch->epoch_size);
26853+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
26854
26855 switch (ev & ~EV_CLEANUP) {
26856 case EV_PUT:
26857@@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26858 rv = FE_DESTROYED;
26859 } else {
26860 epoch->flags = 0;
26861- atomic_set(&epoch->epoch_size, 0);
26862+ atomic_set_unchecked(&epoch->epoch_size, 0);
26863 /* atomic_set(&epoch->active, 0); is already zero */
26864 if (rv == FE_STILL_LIVE)
26865 rv = FE_RECYCLED;
26866@@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26867 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
26868 drbd_flush(mdev);
26869
26870- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26871+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26872 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
26873 if (epoch)
26874 break;
26875 }
26876
26877 epoch = mdev->current_epoch;
26878- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
26879+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
26880
26881 D_ASSERT(atomic_read(&epoch->active) == 0);
26882 D_ASSERT(epoch->flags == 0);
26883@@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26884 }
26885
26886 epoch->flags = 0;
26887- atomic_set(&epoch->epoch_size, 0);
26888+ atomic_set_unchecked(&epoch->epoch_size, 0);
26889 atomic_set(&epoch->active, 0);
26890
26891 spin_lock(&mdev->epoch_lock);
26892- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26893+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26894 list_add(&epoch->list, &mdev->current_epoch->list);
26895 mdev->current_epoch = epoch;
26896 mdev->epochs++;
26897@@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26898 spin_unlock(&mdev->peer_seq_lock);
26899
26900 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
26901- atomic_inc(&mdev->current_epoch->epoch_size);
26902+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
26903 return drbd_drain_block(mdev, data_size);
26904 }
26905
26906@@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26907
26908 spin_lock(&mdev->epoch_lock);
26909 e->epoch = mdev->current_epoch;
26910- atomic_inc(&e->epoch->epoch_size);
26911+ atomic_inc_unchecked(&e->epoch->epoch_size);
26912 atomic_inc(&e->epoch->active);
26913 spin_unlock(&mdev->epoch_lock);
26914
26915@@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
26916 D_ASSERT(list_empty(&mdev->done_ee));
26917
26918 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
26919- atomic_set(&mdev->current_epoch->epoch_size, 0);
26920+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
26921 D_ASSERT(list_empty(&mdev->current_epoch->list));
26922 }
26923
26924diff --git a/drivers/block/loop.c b/drivers/block/loop.c
26925index 4720c7a..2c49af1 100644
26926--- a/drivers/block/loop.c
26927+++ b/drivers/block/loop.c
26928@@ -283,7 +283,7 @@ static int __do_lo_send_write(struct file *file,
26929 mm_segment_t old_fs = get_fs();
26930
26931 set_fs(get_ds());
26932- bw = file->f_op->write(file, buf, len, &pos);
26933+ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
26934 set_fs(old_fs);
26935 if (likely(bw == len))
26936 return 0;
26937diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
26938index f533f33..6177bcb 100644
26939--- a/drivers/block/nbd.c
26940+++ b/drivers/block/nbd.c
26941@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
26942 struct kvec iov;
26943 sigset_t blocked, oldset;
26944
26945+ pax_track_stack();
26946+
26947 if (unlikely(!sock)) {
26948 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
26949 lo->disk->disk_name, (send ? "send" : "recv"));
26950@@ -572,6 +574,8 @@ static void do_nbd_request(struct request_queue *q)
26951 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
26952 unsigned int cmd, unsigned long arg)
26953 {
26954+ pax_track_stack();
26955+
26956 switch (cmd) {
26957 case NBD_DISCONNECT: {
26958 struct request sreq;
26959diff --git a/drivers/block/ub.c b/drivers/block/ub.c
26960index 0e376d4..7333b9e 100644
26961--- a/drivers/block/ub.c
26962+++ b/drivers/block/ub.c
26963@@ -1744,12 +1744,11 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
26964 static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
26965 unsigned int cmd, unsigned long arg)
26966 {
26967- struct gendisk *disk = bdev->bd_disk;
26968 void __user *usermem = (void __user *) arg;
26969 int ret;
26970
26971 mutex_lock(&ub_mutex);
26972- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
26973+ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
26974 mutex_unlock(&ub_mutex);
26975
26976 return ret;
26977diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
26978index 079c088..5d7a934 100644
26979--- a/drivers/block/virtio_blk.c
26980+++ b/drivers/block/virtio_blk.c
26981@@ -236,8 +236,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
26982 if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
26983 return -ENOTTY;
26984
26985- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
26986- (void __user *)data);
26987+ return scsi_cmd_blk_ioctl(bdev, mode, cmd,
26988+ (void __user *)data);
26989 }
26990
26991 /* We provide getgeo only to please some old bootloader/partitioning tools */
26992diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
26993index f997c27..cedb231 100644
26994--- a/drivers/cdrom/cdrom.c
26995+++ b/drivers/cdrom/cdrom.c
26996@@ -2747,12 +2747,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
26997 {
26998 void __user *argp = (void __user *)arg;
26999 int ret;
27000- struct gendisk *disk = bdev->bd_disk;
27001
27002 /*
27003 * Try the generic SCSI command ioctl's first.
27004 */
27005- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
27006+ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
27007 if (ret != -ENOTTY)
27008 return ret;
27009
27010diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
27011index 423fd56..06d3be0 100644
27012--- a/drivers/char/Kconfig
27013+++ b/drivers/char/Kconfig
27014@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
27015
27016 config DEVKMEM
27017 bool "/dev/kmem virtual device support"
27018- default y
27019+ default n
27020+ depends on !GRKERNSEC_KMEM
27021 help
27022 Say Y here if you want to support the /dev/kmem device. The
27023 /dev/kmem device is rarely used, but can be used for certain
27024@@ -596,6 +597,7 @@ config DEVPORT
27025 bool
27026 depends on !M68K
27027 depends on ISA || PCI
27028+ depends on !GRKERNSEC_KMEM
27029 default y
27030
27031 source "drivers/s390/char/Kconfig"
27032diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
27033index 2e04433..22afc64 100644
27034--- a/drivers/char/agp/frontend.c
27035+++ b/drivers/char/agp/frontend.c
27036@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
27037 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27038 return -EFAULT;
27039
27040- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27041+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27042 return -EFAULT;
27043
27044 client = agp_find_client_by_pid(reserve.pid);
27045diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
27046index 095ab90..afad0a4 100644
27047--- a/drivers/char/briq_panel.c
27048+++ b/drivers/char/briq_panel.c
27049@@ -9,6 +9,7 @@
27050 #include <linux/types.h>
27051 #include <linux/errno.h>
27052 #include <linux/tty.h>
27053+#include <linux/mutex.h>
27054 #include <linux/timer.h>
27055 #include <linux/kernel.h>
27056 #include <linux/wait.h>
27057@@ -34,6 +35,7 @@ static int vfd_is_open;
27058 static unsigned char vfd[40];
27059 static int vfd_cursor;
27060 static unsigned char ledpb, led;
27061+static DEFINE_MUTEX(vfd_mutex);
27062
27063 static void update_vfd(void)
27064 {
27065@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
27066 if (!vfd_is_open)
27067 return -EBUSY;
27068
27069+ mutex_lock(&vfd_mutex);
27070 for (;;) {
27071 char c;
27072 if (!indx)
27073 break;
27074- if (get_user(c, buf))
27075+ if (get_user(c, buf)) {
27076+ mutex_unlock(&vfd_mutex);
27077 return -EFAULT;
27078+ }
27079 if (esc) {
27080 set_led(c);
27081 esc = 0;
27082@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
27083 buf++;
27084 }
27085 update_vfd();
27086+ mutex_unlock(&vfd_mutex);
27087
27088 return len;
27089 }
27090diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
27091index f773a9d..65cd683 100644
27092--- a/drivers/char/genrtc.c
27093+++ b/drivers/char/genrtc.c
27094@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
27095 switch (cmd) {
27096
27097 case RTC_PLL_GET:
27098+ memset(&pll, 0, sizeof(pll));
27099 if (get_rtc_pll(&pll))
27100 return -EINVAL;
27101 else
27102diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
27103index 0833896..cccce52 100644
27104--- a/drivers/char/hpet.c
27105+++ b/drivers/char/hpet.c
27106@@ -572,7 +572,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
27107 }
27108
27109 static int
27110-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
27111+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
27112 struct hpet_info *info)
27113 {
27114 struct hpet_timer __iomem *timer;
27115diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
27116index 58c0e63..25aed94 100644
27117--- a/drivers/char/ipmi/ipmi_msghandler.c
27118+++ b/drivers/char/ipmi/ipmi_msghandler.c
27119@@ -415,7 +415,7 @@ struct ipmi_smi {
27120 struct proc_dir_entry *proc_dir;
27121 char proc_dir_name[10];
27122
27123- atomic_t stats[IPMI_NUM_STATS];
27124+ atomic_unchecked_t stats[IPMI_NUM_STATS];
27125
27126 /*
27127 * run_to_completion duplicate of smb_info, smi_info
27128@@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
27129
27130
27131 #define ipmi_inc_stat(intf, stat) \
27132- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
27133+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
27134 #define ipmi_get_stat(intf, stat) \
27135- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
27136+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
27137
27138 static int is_lan_addr(struct ipmi_addr *addr)
27139 {
27140@@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
27141 INIT_LIST_HEAD(&intf->cmd_rcvrs);
27142 init_waitqueue_head(&intf->waitq);
27143 for (i = 0; i < IPMI_NUM_STATS; i++)
27144- atomic_set(&intf->stats[i], 0);
27145+ atomic_set_unchecked(&intf->stats[i], 0);
27146
27147 intf->proc_dir = NULL;
27148
27149@@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
27150 struct ipmi_smi_msg smi_msg;
27151 struct ipmi_recv_msg recv_msg;
27152
27153+ pax_track_stack();
27154+
27155 si = (struct ipmi_system_interface_addr *) &addr;
27156 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
27157 si->channel = IPMI_BMC_CHANNEL;
27158diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
27159index 9397ab4..d01bee1 100644
27160--- a/drivers/char/ipmi/ipmi_si_intf.c
27161+++ b/drivers/char/ipmi/ipmi_si_intf.c
27162@@ -277,7 +277,7 @@ struct smi_info {
27163 unsigned char slave_addr;
27164
27165 /* Counters and things for the proc filesystem. */
27166- atomic_t stats[SI_NUM_STATS];
27167+ atomic_unchecked_t stats[SI_NUM_STATS];
27168
27169 struct task_struct *thread;
27170
27171@@ -286,9 +286,9 @@ struct smi_info {
27172 };
27173
27174 #define smi_inc_stat(smi, stat) \
27175- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
27176+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
27177 #define smi_get_stat(smi, stat) \
27178- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
27179+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
27180
27181 #define SI_MAX_PARMS 4
27182
27183@@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info *new_smi)
27184 atomic_set(&new_smi->req_events, 0);
27185 new_smi->run_to_completion = 0;
27186 for (i = 0; i < SI_NUM_STATS; i++)
27187- atomic_set(&new_smi->stats[i], 0);
27188+ atomic_set_unchecked(&new_smi->stats[i], 0);
27189
27190 new_smi->interrupt_disabled = 1;
27191 atomic_set(&new_smi->stop_operation, 0);
27192diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
27193index 1aeaaba..e018570 100644
27194--- a/drivers/char/mbcs.c
27195+++ b/drivers/char/mbcs.c
27196@@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *dev)
27197 return 0;
27198 }
27199
27200-static const struct cx_device_id __devinitdata mbcs_id_table[] = {
27201+static const struct cx_device_id __devinitconst mbcs_id_table[] = {
27202 {
27203 .part_num = MBCS_PART_NUM,
27204 .mfg_num = MBCS_MFG_NUM,
27205diff --git a/drivers/char/mem.c b/drivers/char/mem.c
27206index 8fc04b4..cebdeec 100644
27207--- a/drivers/char/mem.c
27208+++ b/drivers/char/mem.c
27209@@ -18,6 +18,7 @@
27210 #include <linux/raw.h>
27211 #include <linux/tty.h>
27212 #include <linux/capability.h>
27213+#include <linux/security.h>
27214 #include <linux/ptrace.h>
27215 #include <linux/device.h>
27216 #include <linux/highmem.h>
27217@@ -34,6 +35,10 @@
27218 # include <linux/efi.h>
27219 #endif
27220
27221+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27222+extern const struct file_operations grsec_fops;
27223+#endif
27224+
27225 static inline unsigned long size_inside_page(unsigned long start,
27226 unsigned long size)
27227 {
27228@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27229
27230 while (cursor < to) {
27231 if (!devmem_is_allowed(pfn)) {
27232+#ifdef CONFIG_GRKERNSEC_KMEM
27233+ gr_handle_mem_readwrite(from, to);
27234+#else
27235 printk(KERN_INFO
27236 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
27237 current->comm, from, to);
27238+#endif
27239 return 0;
27240 }
27241 cursor += PAGE_SIZE;
27242@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27243 }
27244 return 1;
27245 }
27246+#elif defined(CONFIG_GRKERNSEC_KMEM)
27247+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27248+{
27249+ return 0;
27250+}
27251 #else
27252 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27253 {
27254@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27255
27256 while (count > 0) {
27257 unsigned long remaining;
27258+ char *temp;
27259
27260 sz = size_inside_page(p, count);
27261
27262@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27263 if (!ptr)
27264 return -EFAULT;
27265
27266- remaining = copy_to_user(buf, ptr, sz);
27267+#ifdef CONFIG_PAX_USERCOPY
27268+ temp = kmalloc(sz, GFP_KERNEL);
27269+ if (!temp) {
27270+ unxlate_dev_mem_ptr(p, ptr);
27271+ return -ENOMEM;
27272+ }
27273+ memcpy(temp, ptr, sz);
27274+#else
27275+ temp = ptr;
27276+#endif
27277+
27278+ remaining = copy_to_user(buf, temp, sz);
27279+
27280+#ifdef CONFIG_PAX_USERCOPY
27281+ kfree(temp);
27282+#endif
27283+
27284 unxlate_dev_mem_ptr(p, ptr);
27285 if (remaining)
27286 return -EFAULT;
27287@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27288 size_t count, loff_t *ppos)
27289 {
27290 unsigned long p = *ppos;
27291- ssize_t low_count, read, sz;
27292+ ssize_t low_count, read, sz, err = 0;
27293 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
27294- int err = 0;
27295
27296 read = 0;
27297 if (p < (unsigned long) high_memory) {
27298@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27299 }
27300 #endif
27301 while (low_count > 0) {
27302+ char *temp;
27303+
27304 sz = size_inside_page(p, low_count);
27305
27306 /*
27307@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27308 */
27309 kbuf = xlate_dev_kmem_ptr((char *)p);
27310
27311- if (copy_to_user(buf, kbuf, sz))
27312+#ifdef CONFIG_PAX_USERCOPY
27313+ temp = kmalloc(sz, GFP_KERNEL);
27314+ if (!temp)
27315+ return -ENOMEM;
27316+ memcpy(temp, kbuf, sz);
27317+#else
27318+ temp = kbuf;
27319+#endif
27320+
27321+ err = copy_to_user(buf, temp, sz);
27322+
27323+#ifdef CONFIG_PAX_USERCOPY
27324+ kfree(temp);
27325+#endif
27326+
27327+ if (err)
27328 return -EFAULT;
27329 buf += sz;
27330 p += sz;
27331@@ -866,6 +913,9 @@ static const struct memdev {
27332 #ifdef CONFIG_CRASH_DUMP
27333 [12] = { "oldmem", 0, &oldmem_fops, NULL },
27334 #endif
27335+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27336+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
27337+#endif
27338 };
27339
27340 static int memory_open(struct inode *inode, struct file *filp)
27341diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
27342index da3cfee..a5a6606 100644
27343--- a/drivers/char/nvram.c
27344+++ b/drivers/char/nvram.c
27345@@ -248,7 +248,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
27346
27347 spin_unlock_irq(&rtc_lock);
27348
27349- if (copy_to_user(buf, contents, tmp - contents))
27350+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
27351 return -EFAULT;
27352
27353 *ppos = i;
27354diff --git a/drivers/char/random.c b/drivers/char/random.c
27355index c35a785..6d82202 100644
27356--- a/drivers/char/random.c
27357+++ b/drivers/char/random.c
27358@@ -261,8 +261,13 @@
27359 /*
27360 * Configuration information
27361 */
27362+#ifdef CONFIG_GRKERNSEC_RANDNET
27363+#define INPUT_POOL_WORDS 512
27364+#define OUTPUT_POOL_WORDS 128
27365+#else
27366 #define INPUT_POOL_WORDS 128
27367 #define OUTPUT_POOL_WORDS 32
27368+#endif
27369 #define SEC_XFER_SIZE 512
27370 #define EXTRACT_SIZE 10
27371
27372@@ -300,10 +305,17 @@ static struct poolinfo {
27373 int poolwords;
27374 int tap1, tap2, tap3, tap4, tap5;
27375 } poolinfo_table[] = {
27376+#ifdef CONFIG_GRKERNSEC_RANDNET
27377+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
27378+ { 512, 411, 308, 208, 104, 1 },
27379+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
27380+ { 128, 103, 76, 51, 25, 1 },
27381+#else
27382 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
27383 { 128, 103, 76, 51, 25, 1 },
27384 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
27385 { 32, 26, 20, 14, 7, 1 },
27386+#endif
27387 #if 0
27388 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
27389 { 2048, 1638, 1231, 819, 411, 1 },
27390@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
27391
27392 extract_buf(r, tmp);
27393 i = min_t(int, nbytes, EXTRACT_SIZE);
27394- if (copy_to_user(buf, tmp, i)) {
27395+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
27396 ret = -EFAULT;
27397 break;
27398 }
27399@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
27400 #include <linux/sysctl.h>
27401
27402 static int min_read_thresh = 8, min_write_thresh;
27403-static int max_read_thresh = INPUT_POOL_WORDS * 32;
27404+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
27405 static int max_write_thresh = INPUT_POOL_WORDS * 32;
27406 static char sysctl_bootid[16];
27407
27408diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
27409index 1ee8ce7..b778bef 100644
27410--- a/drivers/char/sonypi.c
27411+++ b/drivers/char/sonypi.c
27412@@ -55,6 +55,7 @@
27413 #include <asm/uaccess.h>
27414 #include <asm/io.h>
27415 #include <asm/system.h>
27416+#include <asm/local.h>
27417
27418 #include <linux/sonypi.h>
27419
27420@@ -491,7 +492,7 @@ static struct sonypi_device {
27421 spinlock_t fifo_lock;
27422 wait_queue_head_t fifo_proc_list;
27423 struct fasync_struct *fifo_async;
27424- int open_count;
27425+ local_t open_count;
27426 int model;
27427 struct input_dev *input_jog_dev;
27428 struct input_dev *input_key_dev;
27429@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
27430 static int sonypi_misc_release(struct inode *inode, struct file *file)
27431 {
27432 mutex_lock(&sonypi_device.lock);
27433- sonypi_device.open_count--;
27434+ local_dec(&sonypi_device.open_count);
27435 mutex_unlock(&sonypi_device.lock);
27436 return 0;
27437 }
27438@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
27439 {
27440 mutex_lock(&sonypi_device.lock);
27441 /* Flush input queue on first open */
27442- if (!sonypi_device.open_count)
27443+ if (!local_read(&sonypi_device.open_count))
27444 kfifo_reset(&sonypi_device.fifo);
27445- sonypi_device.open_count++;
27446+ local_inc(&sonypi_device.open_count);
27447 mutex_unlock(&sonypi_device.lock);
27448
27449 return 0;
27450diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
27451index 9ca5c02..7ce352c 100644
27452--- a/drivers/char/tpm/tpm.c
27453+++ b/drivers/char/tpm/tpm.c
27454@@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
27455 chip->vendor.req_complete_val)
27456 goto out_recv;
27457
27458- if ((status == chip->vendor.req_canceled)) {
27459+ if (status == chip->vendor.req_canceled) {
27460 dev_err(chip->dev, "Operation Canceled\n");
27461 rc = -ECANCELED;
27462 goto out;
27463@@ -862,6 +862,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
27464
27465 struct tpm_chip *chip = dev_get_drvdata(dev);
27466
27467+ pax_track_stack();
27468+
27469 tpm_cmd.header.in = tpm_readpubek_header;
27470 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
27471 "attempting to read the PUBEK");
27472diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
27473index 0636520..169c1d0 100644
27474--- a/drivers/char/tpm/tpm_bios.c
27475+++ b/drivers/char/tpm/tpm_bios.c
27476@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
27477 event = addr;
27478
27479 if ((event->event_type == 0 && event->event_size == 0) ||
27480- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
27481+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
27482 return NULL;
27483
27484 return addr;
27485@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
27486 return NULL;
27487
27488 if ((event->event_type == 0 && event->event_size == 0) ||
27489- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
27490+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
27491 return NULL;
27492
27493 (*pos)++;
27494@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
27495 int i;
27496
27497 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
27498- seq_putc(m, data[i]);
27499+ if (!seq_putc(m, data[i]))
27500+ return -EFAULT;
27501
27502 return 0;
27503 }
27504@@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log *log)
27505 log->bios_event_log_end = log->bios_event_log + len;
27506
27507 virt = acpi_os_map_memory(start, len);
27508+ if (!virt) {
27509+ kfree(log->bios_event_log);
27510+ log->bios_event_log = NULL;
27511+ return -EFAULT;
27512+ }
27513
27514- memcpy(log->bios_event_log, virt, len);
27515+ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
27516
27517 acpi_os_unmap_memory(virt, len);
27518 return 0;
27519diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
27520index fb68b12..0f6c6ca 100644
27521--- a/drivers/char/virtio_console.c
27522+++ b/drivers/char/virtio_console.c
27523@@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
27524 if (to_user) {
27525 ssize_t ret;
27526
27527- ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
27528+ ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
27529 if (ret)
27530 return -EFAULT;
27531 } else {
27532@@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
27533 if (!port_has_data(port) && !port->host_connected)
27534 return 0;
27535
27536- return fill_readbuf(port, ubuf, count, true);
27537+ return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
27538 }
27539
27540 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
27541diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
27542index a84250a..68c725e 100644
27543--- a/drivers/crypto/hifn_795x.c
27544+++ b/drivers/crypto/hifn_795x.c
27545@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
27546 0xCA, 0x34, 0x2B, 0x2E};
27547 struct scatterlist sg;
27548
27549+ pax_track_stack();
27550+
27551 memset(src, 0, sizeof(src));
27552 memset(ctx.key, 0, sizeof(ctx.key));
27553
27554diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
27555index db33d30..7823369 100644
27556--- a/drivers/crypto/padlock-aes.c
27557+++ b/drivers/crypto/padlock-aes.c
27558@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
27559 struct crypto_aes_ctx gen_aes;
27560 int cpu;
27561
27562+ pax_track_stack();
27563+
27564 if (key_len % 8) {
27565 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
27566 return -EINVAL;
27567diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
27568index 9a8bebc..b1e4989 100644
27569--- a/drivers/edac/amd64_edac.c
27570+++ b/drivers/edac/amd64_edac.c
27571@@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
27572 * PCI core identifies what devices are on a system during boot, and then
27573 * inquiry this table to see if this driver is for a given device found.
27574 */
27575-static const struct pci_device_id amd64_pci_table[] __devinitdata = {
27576+static const struct pci_device_id amd64_pci_table[] __devinitconst = {
27577 {
27578 .vendor = PCI_VENDOR_ID_AMD,
27579 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
27580diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
27581index e47e73b..348e0bd 100644
27582--- a/drivers/edac/amd76x_edac.c
27583+++ b/drivers/edac/amd76x_edac.c
27584@@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
27585 edac_mc_free(mci);
27586 }
27587
27588-static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
27589+static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
27590 {
27591 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27592 AMD762},
27593diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
27594index 1af531a..3a8ff27 100644
27595--- a/drivers/edac/e752x_edac.c
27596+++ b/drivers/edac/e752x_edac.c
27597@@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
27598 edac_mc_free(mci);
27599 }
27600
27601-static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
27602+static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
27603 {
27604 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27605 E7520},
27606diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
27607index 6ffb6d2..383d8d7 100644
27608--- a/drivers/edac/e7xxx_edac.c
27609+++ b/drivers/edac/e7xxx_edac.c
27610@@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
27611 edac_mc_free(mci);
27612 }
27613
27614-static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
27615+static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
27616 {
27617 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27618 E7205},
27619diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
27620index 495198a..ac08c85 100644
27621--- a/drivers/edac/edac_pci_sysfs.c
27622+++ b/drivers/edac/edac_pci_sysfs.c
27623@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
27624 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
27625 static int edac_pci_poll_msec = 1000; /* one second workq period */
27626
27627-static atomic_t pci_parity_count = ATOMIC_INIT(0);
27628-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
27629+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
27630+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
27631
27632 static struct kobject *edac_pci_top_main_kobj;
27633 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
27634@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27635 edac_printk(KERN_CRIT, EDAC_PCI,
27636 "Signaled System Error on %s\n",
27637 pci_name(dev));
27638- atomic_inc(&pci_nonparity_count);
27639+ atomic_inc_unchecked(&pci_nonparity_count);
27640 }
27641
27642 if (status & (PCI_STATUS_PARITY)) {
27643@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27644 "Master Data Parity Error on %s\n",
27645 pci_name(dev));
27646
27647- atomic_inc(&pci_parity_count);
27648+ atomic_inc_unchecked(&pci_parity_count);
27649 }
27650
27651 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27652@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27653 "Detected Parity Error on %s\n",
27654 pci_name(dev));
27655
27656- atomic_inc(&pci_parity_count);
27657+ atomic_inc_unchecked(&pci_parity_count);
27658 }
27659 }
27660
27661@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27662 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
27663 "Signaled System Error on %s\n",
27664 pci_name(dev));
27665- atomic_inc(&pci_nonparity_count);
27666+ atomic_inc_unchecked(&pci_nonparity_count);
27667 }
27668
27669 if (status & (PCI_STATUS_PARITY)) {
27670@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27671 "Master Data Parity Error on "
27672 "%s\n", pci_name(dev));
27673
27674- atomic_inc(&pci_parity_count);
27675+ atomic_inc_unchecked(&pci_parity_count);
27676 }
27677
27678 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27679@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27680 "Detected Parity Error on %s\n",
27681 pci_name(dev));
27682
27683- atomic_inc(&pci_parity_count);
27684+ atomic_inc_unchecked(&pci_parity_count);
27685 }
27686 }
27687 }
27688@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
27689 if (!check_pci_errors)
27690 return;
27691
27692- before_count = atomic_read(&pci_parity_count);
27693+ before_count = atomic_read_unchecked(&pci_parity_count);
27694
27695 /* scan all PCI devices looking for a Parity Error on devices and
27696 * bridges.
27697@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
27698 /* Only if operator has selected panic on PCI Error */
27699 if (edac_pci_get_panic_on_pe()) {
27700 /* If the count is different 'after' from 'before' */
27701- if (before_count != atomic_read(&pci_parity_count))
27702+ if (before_count != atomic_read_unchecked(&pci_parity_count))
27703 panic("EDAC: PCI Parity Error");
27704 }
27705 }
27706diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
27707index c0510b3..6e2a954 100644
27708--- a/drivers/edac/i3000_edac.c
27709+++ b/drivers/edac/i3000_edac.c
27710@@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
27711 edac_mc_free(mci);
27712 }
27713
27714-static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
27715+static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
27716 {
27717 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27718 I3000},
27719diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
27720index aa08497..7e6822a 100644
27721--- a/drivers/edac/i3200_edac.c
27722+++ b/drivers/edac/i3200_edac.c
27723@@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
27724 edac_mc_free(mci);
27725 }
27726
27727-static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
27728+static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
27729 {
27730 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27731 I3200},
27732diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
27733index 4dc3ac2..67d05a6 100644
27734--- a/drivers/edac/i5000_edac.c
27735+++ b/drivers/edac/i5000_edac.c
27736@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
27737 *
27738 * The "E500P" device is the first device supported.
27739 */
27740-static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
27741+static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
27742 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
27743 .driver_data = I5000P},
27744
27745diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
27746index bcbdeec..9886d16 100644
27747--- a/drivers/edac/i5100_edac.c
27748+++ b/drivers/edac/i5100_edac.c
27749@@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
27750 edac_mc_free(mci);
27751 }
27752
27753-static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
27754+static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
27755 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
27756 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
27757 { 0, }
27758diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
27759index 74d6ec34..baff517 100644
27760--- a/drivers/edac/i5400_edac.c
27761+++ b/drivers/edac/i5400_edac.c
27762@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
27763 *
27764 * The "E500P" device is the first device supported.
27765 */
27766-static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
27767+static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
27768 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
27769 {0,} /* 0 terminated list. */
27770 };
27771diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
27772index a76fe83..15479e6 100644
27773--- a/drivers/edac/i7300_edac.c
27774+++ b/drivers/edac/i7300_edac.c
27775@@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
27776 *
27777 * Has only 8086:360c PCI ID
27778 */
27779-static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
27780+static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
27781 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
27782 {0,} /* 0 terminated list. */
27783 };
27784diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
27785index f6cf448..3f612e9 100644
27786--- a/drivers/edac/i7core_edac.c
27787+++ b/drivers/edac/i7core_edac.c
27788@@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev_table[] = {
27789 /*
27790 * pci_device_id table for which devices we are looking for
27791 */
27792-static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
27793+static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
27794 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
27795 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
27796 {0,} /* 0 terminated list. */
27797diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
27798index 4329d39..f3022ef 100644
27799--- a/drivers/edac/i82443bxgx_edac.c
27800+++ b/drivers/edac/i82443bxgx_edac.c
27801@@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
27802
27803 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
27804
27805-static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
27806+static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
27807 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
27808 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
27809 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
27810diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
27811index 931a057..fd28340 100644
27812--- a/drivers/edac/i82860_edac.c
27813+++ b/drivers/edac/i82860_edac.c
27814@@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
27815 edac_mc_free(mci);
27816 }
27817
27818-static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
27819+static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
27820 {
27821 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27822 I82860},
27823diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
27824index 33864c6..01edc61 100644
27825--- a/drivers/edac/i82875p_edac.c
27826+++ b/drivers/edac/i82875p_edac.c
27827@@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
27828 edac_mc_free(mci);
27829 }
27830
27831-static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
27832+static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
27833 {
27834 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27835 I82875P},
27836diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
27837index a5da732..983363b 100644
27838--- a/drivers/edac/i82975x_edac.c
27839+++ b/drivers/edac/i82975x_edac.c
27840@@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
27841 edac_mc_free(mci);
27842 }
27843
27844-static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
27845+static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
27846 {
27847 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27848 I82975X
27849diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
27850index 795a320..3bbc3d3 100644
27851--- a/drivers/edac/mce_amd.h
27852+++ b/drivers/edac/mce_amd.h
27853@@ -83,7 +83,7 @@ struct amd_decoder_ops {
27854 bool (*dc_mce)(u16, u8);
27855 bool (*ic_mce)(u16, u8);
27856 bool (*nb_mce)(u16, u8);
27857-};
27858+} __no_const;
27859
27860 void amd_report_gart_errors(bool);
27861 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
27862diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
27863index b153674..ad2ba9b 100644
27864--- a/drivers/edac/r82600_edac.c
27865+++ b/drivers/edac/r82600_edac.c
27866@@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
27867 edac_mc_free(mci);
27868 }
27869
27870-static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
27871+static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
27872 {
27873 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
27874 },
27875diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
27876index b6f47de..c5acf3a 100644
27877--- a/drivers/edac/x38_edac.c
27878+++ b/drivers/edac/x38_edac.c
27879@@ -440,7 +440,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
27880 edac_mc_free(mci);
27881 }
27882
27883-static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
27884+static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
27885 {
27886 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27887 X38},
27888diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
27889index 85661b0..c784559a 100644
27890--- a/drivers/firewire/core-card.c
27891+++ b/drivers/firewire/core-card.c
27892@@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
27893
27894 void fw_core_remove_card(struct fw_card *card)
27895 {
27896- struct fw_card_driver dummy_driver = dummy_driver_template;
27897+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
27898
27899 card->driver->update_phy_reg(card, 4,
27900 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
27901diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
27902index 4799393..37bd3ab 100644
27903--- a/drivers/firewire/core-cdev.c
27904+++ b/drivers/firewire/core-cdev.c
27905@@ -1331,8 +1331,7 @@ static int init_iso_resource(struct client *client,
27906 int ret;
27907
27908 if ((request->channels == 0 && request->bandwidth == 0) ||
27909- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
27910- request->bandwidth < 0)
27911+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
27912 return -EINVAL;
27913
27914 r = kmalloc(sizeof(*r), GFP_KERNEL);
27915diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
27916index 334b82a..ea5261d 100644
27917--- a/drivers/firewire/core-transaction.c
27918+++ b/drivers/firewire/core-transaction.c
27919@@ -37,6 +37,7 @@
27920 #include <linux/timer.h>
27921 #include <linux/types.h>
27922 #include <linux/workqueue.h>
27923+#include <linux/sched.h>
27924
27925 #include <asm/byteorder.h>
27926
27927@@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
27928 struct transaction_callback_data d;
27929 struct fw_transaction t;
27930
27931+ pax_track_stack();
27932+
27933 init_timer_on_stack(&t.split_timeout_timer);
27934 init_completion(&d.done);
27935 d.payload = payload;
27936diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
27937index b45be57..5fad18b 100644
27938--- a/drivers/firewire/core.h
27939+++ b/drivers/firewire/core.h
27940@@ -101,6 +101,7 @@ struct fw_card_driver {
27941
27942 int (*stop_iso)(struct fw_iso_context *ctx);
27943 };
27944+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
27945
27946 void fw_card_initialize(struct fw_card *card,
27947 const struct fw_card_driver *driver, struct device *device);
27948diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
27949index bcb1126..2cc2121 100644
27950--- a/drivers/firmware/dmi_scan.c
27951+++ b/drivers/firmware/dmi_scan.c
27952@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
27953 }
27954 }
27955 else {
27956- /*
27957- * no iounmap() for that ioremap(); it would be a no-op, but
27958- * it's so early in setup that sucker gets confused into doing
27959- * what it shouldn't if we actually call it.
27960- */
27961 p = dmi_ioremap(0xF0000, 0x10000);
27962 if (p == NULL)
27963 goto error;
27964@@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
27965 if (buf == NULL)
27966 return -1;
27967
27968- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
27969+ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
27970
27971 iounmap(buf);
27972 return 0;
27973diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
27974index 98723cb..10ca85b 100644
27975--- a/drivers/gpio/gpio-vr41xx.c
27976+++ b/drivers/gpio/gpio-vr41xx.c
27977@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
27978 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
27979 maskl, pendl, maskh, pendh);
27980
27981- atomic_inc(&irq_err_count);
27982+ atomic_inc_unchecked(&irq_err_count);
27983
27984 return -EINVAL;
27985 }
27986diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
27987index 2410c40..2d03563 100644
27988--- a/drivers/gpu/drm/drm_crtc.c
27989+++ b/drivers/gpu/drm/drm_crtc.c
27990@@ -1374,7 +1374,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27991 */
27992 if ((out_resp->count_modes >= mode_count) && mode_count) {
27993 copied = 0;
27994- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
27995+ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
27996 list_for_each_entry(mode, &connector->modes, head) {
27997 drm_crtc_convert_to_umode(&u_mode, mode);
27998 if (copy_to_user(mode_ptr + copied,
27999@@ -1389,8 +1389,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
28000
28001 if ((out_resp->count_props >= props_count) && props_count) {
28002 copied = 0;
28003- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
28004- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
28005+ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
28006+ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
28007 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
28008 if (connector->property_ids[i] != 0) {
28009 if (put_user(connector->property_ids[i],
28010@@ -1412,7 +1412,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
28011
28012 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
28013 copied = 0;
28014- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
28015+ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
28016 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
28017 if (connector->encoder_ids[i] != 0) {
28018 if (put_user(connector->encoder_ids[i],
28019@@ -1571,7 +1571,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
28020 }
28021
28022 for (i = 0; i < crtc_req->count_connectors; i++) {
28023- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
28024+ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
28025 if (get_user(out_id, &set_connectors_ptr[i])) {
28026 ret = -EFAULT;
28027 goto out;
28028@@ -1852,7 +1852,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
28029 fb = obj_to_fb(obj);
28030
28031 num_clips = r->num_clips;
28032- clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
28033+ clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
28034
28035 if (!num_clips != !clips_ptr) {
28036 ret = -EINVAL;
28037@@ -2276,7 +2276,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
28038 out_resp->flags = property->flags;
28039
28040 if ((out_resp->count_values >= value_count) && value_count) {
28041- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
28042+ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
28043 for (i = 0; i < value_count; i++) {
28044 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
28045 ret = -EFAULT;
28046@@ -2289,7 +2289,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
28047 if (property->flags & DRM_MODE_PROP_ENUM) {
28048 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
28049 copied = 0;
28050- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
28051+ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
28052 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
28053
28054 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
28055@@ -2312,7 +2312,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
28056 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
28057 copied = 0;
28058 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
28059- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
28060+ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
28061
28062 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
28063 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
28064@@ -2373,7 +2373,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
28065 struct drm_mode_get_blob *out_resp = data;
28066 struct drm_property_blob *blob;
28067 int ret = 0;
28068- void *blob_ptr;
28069+ void __user *blob_ptr;
28070
28071 if (!drm_core_check_feature(dev, DRIVER_MODESET))
28072 return -EINVAL;
28073@@ -2387,7 +2387,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
28074 blob = obj_to_blob(obj);
28075
28076 if (out_resp->length == blob->length) {
28077- blob_ptr = (void *)(unsigned long)out_resp->data;
28078+ blob_ptr = (void __user *)(unsigned long)out_resp->data;
28079 if (copy_to_user(blob_ptr, blob->data, blob->length)){
28080 ret = -EFAULT;
28081 goto done;
28082diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
28083index f88a9b2..8f4078f 100644
28084--- a/drivers/gpu/drm/drm_crtc_helper.c
28085+++ b/drivers/gpu/drm/drm_crtc_helper.c
28086@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
28087 struct drm_crtc *tmp;
28088 int crtc_mask = 1;
28089
28090- WARN(!crtc, "checking null crtc?\n");
28091+ BUG_ON(!crtc);
28092
28093 dev = crtc->dev;
28094
28095@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
28096 struct drm_encoder *encoder;
28097 bool ret = true;
28098
28099+ pax_track_stack();
28100+
28101 crtc->enabled = drm_helper_crtc_in_use(crtc);
28102 if (!crtc->enabled)
28103 return true;
28104diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
28105index 93a112d..c8b065d 100644
28106--- a/drivers/gpu/drm/drm_drv.c
28107+++ b/drivers/gpu/drm/drm_drv.c
28108@@ -307,7 +307,7 @@ module_exit(drm_core_exit);
28109 /**
28110 * Copy and IOCTL return string to user space
28111 */
28112-static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
28113+static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
28114 {
28115 int len;
28116
28117@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
28118
28119 dev = file_priv->minor->dev;
28120 atomic_inc(&dev->ioctl_count);
28121- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
28122+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
28123 ++file_priv->ioctl_count;
28124
28125 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
28126diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
28127index 2ec7d48..be14bb1 100644
28128--- a/drivers/gpu/drm/drm_fops.c
28129+++ b/drivers/gpu/drm/drm_fops.c
28130@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device * dev)
28131 }
28132
28133 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
28134- atomic_set(&dev->counts[i], 0);
28135+ atomic_set_unchecked(&dev->counts[i], 0);
28136
28137 dev->sigdata.lock = NULL;
28138
28139@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct file *filp)
28140
28141 retcode = drm_open_helper(inode, filp, dev);
28142 if (!retcode) {
28143- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
28144- if (!dev->open_count++)
28145+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
28146+ if (local_inc_return(&dev->open_count) == 1)
28147 retcode = drm_setup(dev);
28148 }
28149 if (!retcode) {
28150@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, struct file *filp)
28151
28152 mutex_lock(&drm_global_mutex);
28153
28154- DRM_DEBUG("open_count = %d\n", dev->open_count);
28155+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
28156
28157 if (dev->driver->preclose)
28158 dev->driver->preclose(dev, file_priv);
28159@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
28160 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
28161 task_pid_nr(current),
28162 (long)old_encode_dev(file_priv->minor->device),
28163- dev->open_count);
28164+ local_read(&dev->open_count));
28165
28166 /* if the master has gone away we can't do anything with the lock */
28167 if (file_priv->minor->master)
28168@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, struct file *filp)
28169 * End inline drm_release
28170 */
28171
28172- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
28173- if (!--dev->open_count) {
28174+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
28175+ if (local_dec_and_test(&dev->open_count)) {
28176 if (atomic_read(&dev->ioctl_count)) {
28177 DRM_ERROR("Device busy: %d\n",
28178 atomic_read(&dev->ioctl_count));
28179diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
28180index c87dc96..326055d 100644
28181--- a/drivers/gpu/drm/drm_global.c
28182+++ b/drivers/gpu/drm/drm_global.c
28183@@ -36,7 +36,7 @@
28184 struct drm_global_item {
28185 struct mutex mutex;
28186 void *object;
28187- int refcount;
28188+ atomic_t refcount;
28189 };
28190
28191 static struct drm_global_item glob[DRM_GLOBAL_NUM];
28192@@ -49,7 +49,7 @@ void drm_global_init(void)
28193 struct drm_global_item *item = &glob[i];
28194 mutex_init(&item->mutex);
28195 item->object = NULL;
28196- item->refcount = 0;
28197+ atomic_set(&item->refcount, 0);
28198 }
28199 }
28200
28201@@ -59,7 +59,7 @@ void drm_global_release(void)
28202 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
28203 struct drm_global_item *item = &glob[i];
28204 BUG_ON(item->object != NULL);
28205- BUG_ON(item->refcount != 0);
28206+ BUG_ON(atomic_read(&item->refcount) != 0);
28207 }
28208 }
28209
28210@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28211 void *object;
28212
28213 mutex_lock(&item->mutex);
28214- if (item->refcount == 0) {
28215+ if (atomic_read(&item->refcount) == 0) {
28216 item->object = kzalloc(ref->size, GFP_KERNEL);
28217 if (unlikely(item->object == NULL)) {
28218 ret = -ENOMEM;
28219@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28220 goto out_err;
28221
28222 }
28223- ++item->refcount;
28224+ atomic_inc(&item->refcount);
28225 ref->object = item->object;
28226 object = item->object;
28227 mutex_unlock(&item->mutex);
28228@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
28229 struct drm_global_item *item = &glob[ref->global_type];
28230
28231 mutex_lock(&item->mutex);
28232- BUG_ON(item->refcount == 0);
28233+ BUG_ON(atomic_read(&item->refcount) == 0);
28234 BUG_ON(ref->object != item->object);
28235- if (--item->refcount == 0) {
28236+ if (atomic_dec_and_test(&item->refcount)) {
28237 ref->release(ref);
28238 item->object = NULL;
28239 }
28240diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
28241index ab1162d..42587b2 100644
28242--- a/drivers/gpu/drm/drm_info.c
28243+++ b/drivers/gpu/drm/drm_info.c
28244@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
28245 struct drm_local_map *map;
28246 struct drm_map_list *r_list;
28247
28248- /* Hardcoded from _DRM_FRAME_BUFFER,
28249- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28250- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28251- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28252+ static const char * const types[] = {
28253+ [_DRM_FRAME_BUFFER] = "FB",
28254+ [_DRM_REGISTERS] = "REG",
28255+ [_DRM_SHM] = "SHM",
28256+ [_DRM_AGP] = "AGP",
28257+ [_DRM_SCATTER_GATHER] = "SG",
28258+ [_DRM_CONSISTENT] = "PCI",
28259+ [_DRM_GEM] = "GEM" };
28260 const char *type;
28261 int i;
28262
28263@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
28264 map = r_list->map;
28265 if (!map)
28266 continue;
28267- if (map->type < 0 || map->type > 5)
28268+ if (map->type >= ARRAY_SIZE(types))
28269 type = "??";
28270 else
28271 type = types[map->type];
28272@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, void *data)
28273 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28274 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28275 vma->vm_flags & VM_IO ? 'i' : '-',
28276+#ifdef CONFIG_GRKERNSEC_HIDESYM
28277+ 0);
28278+#else
28279 vma->vm_pgoff);
28280+#endif
28281
28282 #if defined(__i386__)
28283 pgprot = pgprot_val(vma->vm_page_prot);
28284diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
28285index 4a058c7..b42cd92 100644
28286--- a/drivers/gpu/drm/drm_ioc32.c
28287+++ b/drivers/gpu/drm/drm_ioc32.c
28288@@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
28289 request = compat_alloc_user_space(nbytes);
28290 if (!access_ok(VERIFY_WRITE, request, nbytes))
28291 return -EFAULT;
28292- list = (struct drm_buf_desc *) (request + 1);
28293+ list = (struct drm_buf_desc __user *) (request + 1);
28294
28295 if (__put_user(count, &request->count)
28296 || __put_user(list, &request->list))
28297@@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
28298 request = compat_alloc_user_space(nbytes);
28299 if (!access_ok(VERIFY_WRITE, request, nbytes))
28300 return -EFAULT;
28301- list = (struct drm_buf_pub *) (request + 1);
28302+ list = (struct drm_buf_pub __user *) (request + 1);
28303
28304 if (__put_user(count, &request->count)
28305 || __put_user(list, &request->list))
28306diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
28307index 904d7e9..ab88581 100644
28308--- a/drivers/gpu/drm/drm_ioctl.c
28309+++ b/drivers/gpu/drm/drm_ioctl.c
28310@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev, void *data,
28311 stats->data[i].value =
28312 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28313 else
28314- stats->data[i].value = atomic_read(&dev->counts[i]);
28315+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28316 stats->data[i].type = dev->types[i];
28317 }
28318
28319diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
28320index 632ae24..244cf4a 100644
28321--- a/drivers/gpu/drm/drm_lock.c
28322+++ b/drivers/gpu/drm/drm_lock.c
28323@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28324 if (drm_lock_take(&master->lock, lock->context)) {
28325 master->lock.file_priv = file_priv;
28326 master->lock.lock_time = jiffies;
28327- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28328+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28329 break; /* Got lock */
28330 }
28331
28332@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28333 return -EINVAL;
28334 }
28335
28336- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28337+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28338
28339 if (drm_lock_free(&master->lock, lock->context)) {
28340 /* FIXME: Should really bail out here. */
28341diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
28342index 8f371e8..9f85d52 100644
28343--- a/drivers/gpu/drm/i810/i810_dma.c
28344+++ b/drivers/gpu/drm/i810/i810_dma.c
28345@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
28346 dma->buflist[vertex->idx],
28347 vertex->discard, vertex->used);
28348
28349- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28350- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28351+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28352+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28353 sarea_priv->last_enqueue = dev_priv->counter - 1;
28354 sarea_priv->last_dispatch = (int)hw_status[5];
28355
28356@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
28357 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28358 mc->last_render);
28359
28360- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28361- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28362+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28363+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28364 sarea_priv->last_enqueue = dev_priv->counter - 1;
28365 sarea_priv->last_dispatch = (int)hw_status[5];
28366
28367diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
28368index c9339f4..f5e1b9d 100644
28369--- a/drivers/gpu/drm/i810/i810_drv.h
28370+++ b/drivers/gpu/drm/i810/i810_drv.h
28371@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28372 int page_flipping;
28373
28374 wait_queue_head_t irq_queue;
28375- atomic_t irq_received;
28376- atomic_t irq_emitted;
28377+ atomic_unchecked_t irq_received;
28378+ atomic_unchecked_t irq_emitted;
28379
28380 int front_offset;
28381 } drm_i810_private_t;
28382diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
28383index 3c395a5..02889c2 100644
28384--- a/drivers/gpu/drm/i915/i915_debugfs.c
28385+++ b/drivers/gpu/drm/i915/i915_debugfs.c
28386@@ -497,7 +497,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
28387 I915_READ(GTIMR));
28388 }
28389 seq_printf(m, "Interrupts received: %d\n",
28390- atomic_read(&dev_priv->irq_received));
28391+ atomic_read_unchecked(&dev_priv->irq_received));
28392 for (i = 0; i < I915_NUM_RINGS; i++) {
28393 if (IS_GEN6(dev) || IS_GEN7(dev)) {
28394 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
28395@@ -1185,7 +1185,7 @@ static int i915_opregion(struct seq_file *m, void *unused)
28396 return ret;
28397
28398 if (opregion->header)
28399- seq_write(m, opregion->header, OPREGION_SIZE);
28400+ seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
28401
28402 mutex_unlock(&dev->struct_mutex);
28403
28404diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
28405index c72b590..aa86f0a 100644
28406--- a/drivers/gpu/drm/i915/i915_dma.c
28407+++ b/drivers/gpu/drm/i915/i915_dma.c
28408@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
28409 bool can_switch;
28410
28411 spin_lock(&dev->count_lock);
28412- can_switch = (dev->open_count == 0);
28413+ can_switch = (local_read(&dev->open_count) == 0);
28414 spin_unlock(&dev->count_lock);
28415 return can_switch;
28416 }
28417diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
28418index 1a2a2d1..f280182 100644
28419--- a/drivers/gpu/drm/i915/i915_drv.h
28420+++ b/drivers/gpu/drm/i915/i915_drv.h
28421@@ -222,7 +222,7 @@ struct drm_i915_display_funcs {
28422 /* render clock increase/decrease */
28423 /* display clock increase/decrease */
28424 /* pll clock increase/decrease */
28425-};
28426+} __no_const;
28427
28428 struct intel_device_info {
28429 u8 gen;
28430@@ -305,7 +305,7 @@ typedef struct drm_i915_private {
28431 int current_page;
28432 int page_flipping;
28433
28434- atomic_t irq_received;
28435+ atomic_unchecked_t irq_received;
28436
28437 /* protects the irq masks */
28438 spinlock_t irq_lock;
28439@@ -883,7 +883,7 @@ struct drm_i915_gem_object {
28440 * will be page flipped away on the next vblank. When it
28441 * reaches 0, dev_priv->pending_flip_queue will be woken up.
28442 */
28443- atomic_t pending_flip;
28444+ atomic_unchecked_t pending_flip;
28445 };
28446
28447 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
28448@@ -1263,7 +1263,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
28449 extern void intel_teardown_gmbus(struct drm_device *dev);
28450 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
28451 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
28452-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28453+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28454 {
28455 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
28456 }
28457diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28458index 4934cf8..1da9c84 100644
28459--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28460+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28461@@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
28462 i915_gem_clflush_object(obj);
28463
28464 if (obj->base.pending_write_domain)
28465- cd->flips |= atomic_read(&obj->pending_flip);
28466+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
28467
28468 /* The actual obj->write_domain will be updated with
28469 * pending_write_domain after we emit the accumulated flush for all
28470@@ -864,9 +864,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
28471
28472 static int
28473 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
28474- int count)
28475+ unsigned int count)
28476 {
28477- int i;
28478+ unsigned int i;
28479
28480 for (i = 0; i < count; i++) {
28481 char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
28482diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
28483index 73248d0..f7bac29 100644
28484--- a/drivers/gpu/drm/i915/i915_irq.c
28485+++ b/drivers/gpu/drm/i915/i915_irq.c
28486@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
28487 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
28488 struct drm_i915_master_private *master_priv;
28489
28490- atomic_inc(&dev_priv->irq_received);
28491+ atomic_inc_unchecked(&dev_priv->irq_received);
28492
28493 /* disable master interrupt before clearing iir */
28494 de_ier = I915_READ(DEIER);
28495@@ -565,7 +565,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
28496 struct drm_i915_master_private *master_priv;
28497 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
28498
28499- atomic_inc(&dev_priv->irq_received);
28500+ atomic_inc_unchecked(&dev_priv->irq_received);
28501
28502 if (IS_GEN6(dev))
28503 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
28504@@ -1229,7 +1229,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
28505 int ret = IRQ_NONE, pipe;
28506 bool blc_event = false;
28507
28508- atomic_inc(&dev_priv->irq_received);
28509+ atomic_inc_unchecked(&dev_priv->irq_received);
28510
28511 iir = I915_READ(IIR);
28512
28513@@ -1741,7 +1741,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
28514 {
28515 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28516
28517- atomic_set(&dev_priv->irq_received, 0);
28518+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28519
28520 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28521 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28522@@ -1905,7 +1905,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
28523 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28524 int pipe;
28525
28526- atomic_set(&dev_priv->irq_received, 0);
28527+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28528
28529 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28530 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28531diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
28532index 07e7cf3..c75f312 100644
28533--- a/drivers/gpu/drm/i915/intel_display.c
28534+++ b/drivers/gpu/drm/i915/intel_display.c
28535@@ -2205,7 +2205,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
28536
28537 wait_event(dev_priv->pending_flip_queue,
28538 atomic_read(&dev_priv->mm.wedged) ||
28539- atomic_read(&obj->pending_flip) == 0);
28540+ atomic_read_unchecked(&obj->pending_flip) == 0);
28541
28542 /* Big Hammer, we also need to ensure that any pending
28543 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
28544@@ -2826,7 +2826,7 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
28545 obj = to_intel_framebuffer(crtc->fb)->obj;
28546 dev_priv = crtc->dev->dev_private;
28547 wait_event(dev_priv->pending_flip_queue,
28548- atomic_read(&obj->pending_flip) == 0);
28549+ atomic_read_unchecked(&obj->pending_flip) == 0);
28550 }
28551
28552 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
28553@@ -6676,7 +6676,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
28554
28555 atomic_clear_mask(1 << intel_crtc->plane,
28556 &obj->pending_flip.counter);
28557- if (atomic_read(&obj->pending_flip) == 0)
28558+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
28559 wake_up(&dev_priv->pending_flip_queue);
28560
28561 schedule_work(&work->work);
28562@@ -6965,7 +6965,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28563 /* Block clients from rendering to the new back buffer until
28564 * the flip occurs and the object is no longer visible.
28565 */
28566- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28567+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28568
28569 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
28570 if (ret)
28571@@ -6979,7 +6979,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28572 return 0;
28573
28574 cleanup_pending:
28575- atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28576+ atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28577 cleanup_objs:
28578 drm_gem_object_unreference(&work->old_fb_obj->base);
28579 drm_gem_object_unreference(&obj->base);
28580diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
28581index 54558a0..2d97005 100644
28582--- a/drivers/gpu/drm/mga/mga_drv.h
28583+++ b/drivers/gpu/drm/mga/mga_drv.h
28584@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
28585 u32 clear_cmd;
28586 u32 maccess;
28587
28588- atomic_t vbl_received; /**< Number of vblanks received. */
28589+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
28590 wait_queue_head_t fence_queue;
28591- atomic_t last_fence_retired;
28592+ atomic_unchecked_t last_fence_retired;
28593 u32 next_fence_to_post;
28594
28595 unsigned int fb_cpp;
28596diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
28597index 2581202..f230a8d9 100644
28598--- a/drivers/gpu/drm/mga/mga_irq.c
28599+++ b/drivers/gpu/drm/mga/mga_irq.c
28600@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
28601 if (crtc != 0)
28602 return 0;
28603
28604- return atomic_read(&dev_priv->vbl_received);
28605+ return atomic_read_unchecked(&dev_priv->vbl_received);
28606 }
28607
28608
28609@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28610 /* VBLANK interrupt */
28611 if (status & MGA_VLINEPEN) {
28612 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
28613- atomic_inc(&dev_priv->vbl_received);
28614+ atomic_inc_unchecked(&dev_priv->vbl_received);
28615 drm_handle_vblank(dev, 0);
28616 handled = 1;
28617 }
28618@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28619 if ((prim_start & ~0x03) != (prim_end & ~0x03))
28620 MGA_WRITE(MGA_PRIMEND, prim_end);
28621
28622- atomic_inc(&dev_priv->last_fence_retired);
28623+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
28624 DRM_WAKEUP(&dev_priv->fence_queue);
28625 handled = 1;
28626 }
28627@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
28628 * using fences.
28629 */
28630 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
28631- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
28632+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
28633 - *sequence) <= (1 << 23)));
28634
28635 *sequence = cur_fence;
28636diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
28637index b311fab..dc11d6a 100644
28638--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
28639+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
28640@@ -201,7 +201,7 @@ struct methods {
28641 const char desc[8];
28642 void (*loadbios)(struct drm_device *, uint8_t *);
28643 const bool rw;
28644-};
28645+} __do_const;
28646
28647 static struct methods shadow_methods[] = {
28648 { "PRAMIN", load_vbios_pramin, true },
28649@@ -5489,7 +5489,7 @@ parse_bit_displayport_tbl_entry(struct drm_device *dev, struct nvbios *bios,
28650 struct bit_table {
28651 const char id;
28652 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
28653-};
28654+} __no_const;
28655
28656 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
28657
28658diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
28659index d7d51de..7c6a7f1 100644
28660--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
28661+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
28662@@ -238,7 +238,7 @@ struct nouveau_channel {
28663 struct list_head pending;
28664 uint32_t sequence;
28665 uint32_t sequence_ack;
28666- atomic_t last_sequence_irq;
28667+ atomic_unchecked_t last_sequence_irq;
28668 struct nouveau_vma vma;
28669 } fence;
28670
28671@@ -319,7 +319,7 @@ struct nouveau_exec_engine {
28672 u32 handle, u16 class);
28673 void (*set_tile_region)(struct drm_device *dev, int i);
28674 void (*tlb_flush)(struct drm_device *, int engine);
28675-};
28676+} __no_const;
28677
28678 struct nouveau_instmem_engine {
28679 void *priv;
28680@@ -341,13 +341,13 @@ struct nouveau_instmem_engine {
28681 struct nouveau_mc_engine {
28682 int (*init)(struct drm_device *dev);
28683 void (*takedown)(struct drm_device *dev);
28684-};
28685+} __no_const;
28686
28687 struct nouveau_timer_engine {
28688 int (*init)(struct drm_device *dev);
28689 void (*takedown)(struct drm_device *dev);
28690 uint64_t (*read)(struct drm_device *dev);
28691-};
28692+} __no_const;
28693
28694 struct nouveau_fb_engine {
28695 int num_tiles;
28696@@ -513,7 +513,7 @@ struct nouveau_vram_engine {
28697 void (*put)(struct drm_device *, struct nouveau_mem **);
28698
28699 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
28700-};
28701+} __no_const;
28702
28703 struct nouveau_engine {
28704 struct nouveau_instmem_engine instmem;
28705@@ -660,7 +660,7 @@ struct drm_nouveau_private {
28706 struct drm_global_reference mem_global_ref;
28707 struct ttm_bo_global_ref bo_global_ref;
28708 struct ttm_bo_device bdev;
28709- atomic_t validate_sequence;
28710+ atomic_unchecked_t validate_sequence;
28711 } ttm;
28712
28713 struct {
28714diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
28715index ae22dfa..4f09960 100644
28716--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
28717+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
28718@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_channel *chan)
28719 if (USE_REFCNT(dev))
28720 sequence = nvchan_rd32(chan, 0x48);
28721 else
28722- sequence = atomic_read(&chan->fence.last_sequence_irq);
28723+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
28724
28725 if (chan->fence.sequence_ack == sequence)
28726 goto out;
28727@@ -539,7 +539,7 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
28728 return ret;
28729 }
28730
28731- atomic_set(&chan->fence.last_sequence_irq, 0);
28732+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
28733 return 0;
28734 }
28735
28736diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
28737index 5f0bc57..eb9fac8 100644
28738--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
28739+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
28740@@ -314,7 +314,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
28741 int trycnt = 0;
28742 int ret, i;
28743
28744- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
28745+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
28746 retry:
28747 if (++trycnt > 100000) {
28748 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
28749diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
28750index 10656e4..59bf2a4 100644
28751--- a/drivers/gpu/drm/nouveau/nouveau_state.c
28752+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
28753@@ -496,7 +496,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev)
28754 bool can_switch;
28755
28756 spin_lock(&dev->count_lock);
28757- can_switch = (dev->open_count == 0);
28758+ can_switch = (local_read(&dev->open_count) == 0);
28759 spin_unlock(&dev->count_lock);
28760 return can_switch;
28761 }
28762diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c
28763index dbdea8e..cd6eeeb 100644
28764--- a/drivers/gpu/drm/nouveau/nv04_graph.c
28765+++ b/drivers/gpu/drm/nouveau/nv04_graph.c
28766@@ -554,7 +554,7 @@ static int
28767 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
28768 u32 class, u32 mthd, u32 data)
28769 {
28770- atomic_set(&chan->fence.last_sequence_irq, data);
28771+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
28772 return 0;
28773 }
28774
28775diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
28776index 570e190..084a31a 100644
28777--- a/drivers/gpu/drm/r128/r128_cce.c
28778+++ b/drivers/gpu/drm/r128/r128_cce.c
28779@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
28780
28781 /* GH: Simple idle check.
28782 */
28783- atomic_set(&dev_priv->idle_count, 0);
28784+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28785
28786 /* We don't support anything other than bus-mastering ring mode,
28787 * but the ring can be in either AGP or PCI space for the ring
28788diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
28789index 930c71b..499aded 100644
28790--- a/drivers/gpu/drm/r128/r128_drv.h
28791+++ b/drivers/gpu/drm/r128/r128_drv.h
28792@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
28793 int is_pci;
28794 unsigned long cce_buffers_offset;
28795
28796- atomic_t idle_count;
28797+ atomic_unchecked_t idle_count;
28798
28799 int page_flipping;
28800 int current_page;
28801 u32 crtc_offset;
28802 u32 crtc_offset_cntl;
28803
28804- atomic_t vbl_received;
28805+ atomic_unchecked_t vbl_received;
28806
28807 u32 color_fmt;
28808 unsigned int front_offset;
28809diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
28810index 429d5a0..7e899ed 100644
28811--- a/drivers/gpu/drm/r128/r128_irq.c
28812+++ b/drivers/gpu/drm/r128/r128_irq.c
28813@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
28814 if (crtc != 0)
28815 return 0;
28816
28817- return atomic_read(&dev_priv->vbl_received);
28818+ return atomic_read_unchecked(&dev_priv->vbl_received);
28819 }
28820
28821 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28822@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28823 /* VBLANK interrupt */
28824 if (status & R128_CRTC_VBLANK_INT) {
28825 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
28826- atomic_inc(&dev_priv->vbl_received);
28827+ atomic_inc_unchecked(&dev_priv->vbl_received);
28828 drm_handle_vblank(dev, 0);
28829 return IRQ_HANDLED;
28830 }
28831diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
28832index a9e33ce..09edd4b 100644
28833--- a/drivers/gpu/drm/r128/r128_state.c
28834+++ b/drivers/gpu/drm/r128/r128_state.c
28835@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
28836
28837 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
28838 {
28839- if (atomic_read(&dev_priv->idle_count) == 0)
28840+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
28841 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
28842 else
28843- atomic_set(&dev_priv->idle_count, 0);
28844+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28845 }
28846
28847 #endif
28848diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
28849index 14cc88a..cc7b3a5 100644
28850--- a/drivers/gpu/drm/radeon/atom.c
28851+++ b/drivers/gpu/drm/radeon/atom.c
28852@@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
28853 char name[512];
28854 int i;
28855
28856+ pax_track_stack();
28857+
28858 if (!ctx)
28859 return NULL;
28860
28861diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
28862index 5a82b6b..9e69c73 100644
28863--- a/drivers/gpu/drm/radeon/mkregtable.c
28864+++ b/drivers/gpu/drm/radeon/mkregtable.c
28865@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
28866 regex_t mask_rex;
28867 regmatch_t match[4];
28868 char buf[1024];
28869- size_t end;
28870+ long end;
28871 int len;
28872 int done = 0;
28873 int r;
28874 unsigned o;
28875 struct offset *offset;
28876 char last_reg_s[10];
28877- int last_reg;
28878+ unsigned long last_reg;
28879
28880 if (regcomp
28881 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
28882diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
28883index 184628c..30e1725 100644
28884--- a/drivers/gpu/drm/radeon/radeon.h
28885+++ b/drivers/gpu/drm/radeon/radeon.h
28886@@ -192,7 +192,7 @@ extern int sumo_get_temp(struct radeon_device *rdev);
28887 */
28888 struct radeon_fence_driver {
28889 uint32_t scratch_reg;
28890- atomic_t seq;
28891+ atomic_unchecked_t seq;
28892 uint32_t last_seq;
28893 unsigned long last_jiffies;
28894 unsigned long last_timeout;
28895@@ -962,7 +962,7 @@ struct radeon_asic {
28896 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
28897 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
28898 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
28899-};
28900+} __no_const;
28901
28902 /*
28903 * Asic structures
28904diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
28905index a098edc..d001c09 100644
28906--- a/drivers/gpu/drm/radeon/radeon_atombios.c
28907+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
28908@@ -569,6 +569,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
28909 struct radeon_gpio_rec gpio;
28910 struct radeon_hpd hpd;
28911
28912+ pax_track_stack();
28913+
28914 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
28915 return false;
28916
28917diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
28918index 50d105a..355cf8d 100644
28919--- a/drivers/gpu/drm/radeon/radeon_device.c
28920+++ b/drivers/gpu/drm/radeon/radeon_device.c
28921@@ -687,7 +687,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
28922 bool can_switch;
28923
28924 spin_lock(&dev->count_lock);
28925- can_switch = (dev->open_count == 0);
28926+ can_switch = (local_read(&dev->open_count) == 0);
28927 spin_unlock(&dev->count_lock);
28928 return can_switch;
28929 }
28930diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
28931index 07ac481..41cb437 100644
28932--- a/drivers/gpu/drm/radeon/radeon_display.c
28933+++ b/drivers/gpu/drm/radeon/radeon_display.c
28934@@ -926,6 +926,8 @@ void radeon_compute_pll_legacy(struct radeon_pll *pll,
28935 uint32_t post_div;
28936 u32 pll_out_min, pll_out_max;
28937
28938+ pax_track_stack();
28939+
28940 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
28941 freq = freq * 1000;
28942
28943diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
28944index a1b59ca..86f2d44 100644
28945--- a/drivers/gpu/drm/radeon/radeon_drv.h
28946+++ b/drivers/gpu/drm/radeon/radeon_drv.h
28947@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
28948
28949 /* SW interrupt */
28950 wait_queue_head_t swi_queue;
28951- atomic_t swi_emitted;
28952+ atomic_unchecked_t swi_emitted;
28953 int vblank_crtc;
28954 uint32_t irq_enable_reg;
28955 uint32_t r500_disp_irq_reg;
28956diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
28957index 7fd4e3e..9748ab5 100644
28958--- a/drivers/gpu/drm/radeon/radeon_fence.c
28959+++ b/drivers/gpu/drm/radeon/radeon_fence.c
28960@@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
28961 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
28962 return 0;
28963 }
28964- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
28965+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
28966 if (!rdev->cp.ready)
28967 /* FIXME: cp is not running assume everythings is done right
28968 * away
28969@@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
28970 return r;
28971 }
28972 radeon_fence_write(rdev, 0);
28973- atomic_set(&rdev->fence_drv.seq, 0);
28974+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
28975 INIT_LIST_HEAD(&rdev->fence_drv.created);
28976 INIT_LIST_HEAD(&rdev->fence_drv.emited);
28977 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
28978diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
28979index 48b7cea..342236f 100644
28980--- a/drivers/gpu/drm/radeon/radeon_ioc32.c
28981+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
28982@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
28983 request = compat_alloc_user_space(sizeof(*request));
28984 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
28985 || __put_user(req32.param, &request->param)
28986- || __put_user((void __user *)(unsigned long)req32.value,
28987+ || __put_user((unsigned long)req32.value,
28988 &request->value))
28989 return -EFAULT;
28990
28991diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
28992index 465746b..cb2b055 100644
28993--- a/drivers/gpu/drm/radeon/radeon_irq.c
28994+++ b/drivers/gpu/drm/radeon/radeon_irq.c
28995@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
28996 unsigned int ret;
28997 RING_LOCALS;
28998
28999- atomic_inc(&dev_priv->swi_emitted);
29000- ret = atomic_read(&dev_priv->swi_emitted);
29001+ atomic_inc_unchecked(&dev_priv->swi_emitted);
29002+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29003
29004 BEGIN_RING(4);
29005 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29006@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
29007 drm_radeon_private_t *dev_priv =
29008 (drm_radeon_private_t *) dev->dev_private;
29009
29010- atomic_set(&dev_priv->swi_emitted, 0);
29011+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29012 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29013
29014 dev->max_vblank_count = 0x001fffff;
29015diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
29016index 92e7ea7..147ffad 100644
29017--- a/drivers/gpu/drm/radeon/radeon_state.c
29018+++ b/drivers/gpu/drm/radeon/radeon_state.c
29019@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
29020 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29021 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29022
29023- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29024+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29025 sarea_priv->nbox * sizeof(depth_boxes[0])))
29026 return -EFAULT;
29027
29028@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
29029 {
29030 drm_radeon_private_t *dev_priv = dev->dev_private;
29031 drm_radeon_getparam_t *param = data;
29032- int value;
29033+ int value = 0;
29034
29035 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29036
29037diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
29038index 0b5468b..9c4b308 100644
29039--- a/drivers/gpu/drm/radeon/radeon_ttm.c
29040+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
29041@@ -672,8 +672,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29042 }
29043 if (unlikely(ttm_vm_ops == NULL)) {
29044 ttm_vm_ops = vma->vm_ops;
29045- radeon_ttm_vm_ops = *ttm_vm_ops;
29046- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29047+ pax_open_kernel();
29048+ memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
29049+ *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29050+ pax_close_kernel();
29051 }
29052 vma->vm_ops = &radeon_ttm_vm_ops;
29053 return 0;
29054diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
29055index a9049ed..501f284 100644
29056--- a/drivers/gpu/drm/radeon/rs690.c
29057+++ b/drivers/gpu/drm/radeon/rs690.c
29058@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
29059 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29060 rdev->pm.sideport_bandwidth.full)
29061 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29062- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29063+ read_delay_latency.full = dfixed_const(800 * 1000);
29064 read_delay_latency.full = dfixed_div(read_delay_latency,
29065 rdev->pm.igp_sideport_mclk);
29066+ a.full = dfixed_const(370);
29067+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29068 } else {
29069 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29070 rdev->pm.k8_bandwidth.full)
29071diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
29072index 727e93d..1565650 100644
29073--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
29074+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
29075@@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages(void)
29076 static int ttm_pool_mm_shrink(struct shrinker *shrink,
29077 struct shrink_control *sc)
29078 {
29079- static atomic_t start_pool = ATOMIC_INIT(0);
29080+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
29081 unsigned i;
29082- unsigned pool_offset = atomic_add_return(1, &start_pool);
29083+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
29084 struct ttm_page_pool *pool;
29085 int shrink_pages = sc->nr_to_scan;
29086
29087diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
29088index 9cf87d9..2000b7d 100644
29089--- a/drivers/gpu/drm/via/via_drv.h
29090+++ b/drivers/gpu/drm/via/via_drv.h
29091@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
29092 typedef uint32_t maskarray_t[5];
29093
29094 typedef struct drm_via_irq {
29095- atomic_t irq_received;
29096+ atomic_unchecked_t irq_received;
29097 uint32_t pending_mask;
29098 uint32_t enable_mask;
29099 wait_queue_head_t irq_queue;
29100@@ -75,7 +75,7 @@ typedef struct drm_via_private {
29101 struct timeval last_vblank;
29102 int last_vblank_valid;
29103 unsigned usec_per_vblank;
29104- atomic_t vbl_received;
29105+ atomic_unchecked_t vbl_received;
29106 drm_via_state_t hc_state;
29107 char pci_buf[VIA_PCI_BUF_SIZE];
29108 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
29109diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
29110index d391f48..10c8ca3 100644
29111--- a/drivers/gpu/drm/via/via_irq.c
29112+++ b/drivers/gpu/drm/via/via_irq.c
29113@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
29114 if (crtc != 0)
29115 return 0;
29116
29117- return atomic_read(&dev_priv->vbl_received);
29118+ return atomic_read_unchecked(&dev_priv->vbl_received);
29119 }
29120
29121 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29122@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29123
29124 status = VIA_READ(VIA_REG_INTERRUPT);
29125 if (status & VIA_IRQ_VBLANK_PENDING) {
29126- atomic_inc(&dev_priv->vbl_received);
29127- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
29128+ atomic_inc_unchecked(&dev_priv->vbl_received);
29129+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
29130 do_gettimeofday(&cur_vblank);
29131 if (dev_priv->last_vblank_valid) {
29132 dev_priv->usec_per_vblank =
29133@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29134 dev_priv->last_vblank = cur_vblank;
29135 dev_priv->last_vblank_valid = 1;
29136 }
29137- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
29138+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
29139 DRM_DEBUG("US per vblank is: %u\n",
29140 dev_priv->usec_per_vblank);
29141 }
29142@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29143
29144 for (i = 0; i < dev_priv->num_irqs; ++i) {
29145 if (status & cur_irq->pending_mask) {
29146- atomic_inc(&cur_irq->irq_received);
29147+ atomic_inc_unchecked(&cur_irq->irq_received);
29148 DRM_WAKEUP(&cur_irq->irq_queue);
29149 handled = 1;
29150 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
29151@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
29152 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29153 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
29154 masks[irq][4]));
29155- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
29156+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
29157 } else {
29158 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29159 (((cur_irq_sequence =
29160- atomic_read(&cur_irq->irq_received)) -
29161+ atomic_read_unchecked(&cur_irq->irq_received)) -
29162 *sequence) <= (1 << 23)));
29163 }
29164 *sequence = cur_irq_sequence;
29165@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
29166 }
29167
29168 for (i = 0; i < dev_priv->num_irqs; ++i) {
29169- atomic_set(&cur_irq->irq_received, 0);
29170+ atomic_set_unchecked(&cur_irq->irq_received, 0);
29171 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
29172 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
29173 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
29174@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
29175 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
29176 case VIA_IRQ_RELATIVE:
29177 irqwait->request.sequence +=
29178- atomic_read(&cur_irq->irq_received);
29179+ atomic_read_unchecked(&cur_irq->irq_received);
29180 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
29181 case VIA_IRQ_ABSOLUTE:
29182 break;
29183diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29184index 10fc01f..b4e9822 100644
29185--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29186+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29187@@ -240,7 +240,7 @@ struct vmw_private {
29188 * Fencing and IRQs.
29189 */
29190
29191- atomic_t fence_seq;
29192+ atomic_unchecked_t fence_seq;
29193 wait_queue_head_t fence_queue;
29194 wait_queue_head_t fifo_queue;
29195 atomic_t fence_queue_waiters;
29196diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
29197index 41b95ed..69ea504 100644
29198--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
29199+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
29200@@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
29201 struct drm_vmw_fence_rep fence_rep;
29202 struct drm_vmw_fence_rep __user *user_fence_rep;
29203 int ret;
29204- void *user_cmd;
29205+ void __user *user_cmd;
29206 void *cmd;
29207 uint32_t sequence;
29208 struct vmw_sw_context *sw_context = &dev_priv->ctx;
29209diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29210index 61eacc1..ee38ce8 100644
29211--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29212+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29213@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
29214 while (!vmw_lag_lt(queue, us)) {
29215 spin_lock(&queue->lock);
29216 if (list_empty(&queue->head))
29217- sequence = atomic_read(&dev_priv->fence_seq);
29218+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29219 else {
29220 fence = list_first_entry(&queue->head,
29221 struct vmw_fence, head);
29222diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29223index 635c0ff..2641bbb 100644
29224--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29225+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29226@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
29227 (unsigned int) min,
29228 (unsigned int) fifo->capabilities);
29229
29230- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29231+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29232 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29233 vmw_fence_queue_init(&fifo->fence_queue);
29234 return vmw_fifo_send_fence(dev_priv, &dummy);
29235@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
29236 if (reserveable)
29237 iowrite32(bytes, fifo_mem +
29238 SVGA_FIFO_RESERVED);
29239- return fifo_mem + (next_cmd >> 2);
29240+ return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
29241 } else {
29242 need_bounce = true;
29243 }
29244@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29245
29246 fm = vmw_fifo_reserve(dev_priv, bytes);
29247 if (unlikely(fm == NULL)) {
29248- *sequence = atomic_read(&dev_priv->fence_seq);
29249+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29250 ret = -ENOMEM;
29251 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29252 false, 3*HZ);
29253@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29254 }
29255
29256 do {
29257- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29258+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29259 } while (*sequence == 0);
29260
29261 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29262diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29263index e92298a..f68f2d6 100644
29264--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29265+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29266@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
29267 * emitted. Then the fence is stale and signaled.
29268 */
29269
29270- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29271+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29272 > VMW_FENCE_WRAP);
29273
29274 return ret;
29275@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
29276
29277 if (fifo_idle)
29278 down_read(&fifo_state->rwsem);
29279- signal_seq = atomic_read(&dev_priv->fence_seq);
29280+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29281 ret = 0;
29282
29283 for (;;) {
29284diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29285index dfe32e6..dd18a00 100644
29286--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29287+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29288@@ -843,7 +843,6 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29289 struct vmw_framebuffer *vfb = NULL;
29290 struct vmw_surface *surface = NULL;
29291 struct vmw_dma_buffer *bo = NULL;
29292- u64 required_size;
29293 int ret;
29294
29295 /**
29296@@ -852,8 +851,9 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29297 * requested framebuffer.
29298 */
29299
29300- required_size = mode_cmd->pitch * mode_cmd->height;
29301- if (unlikely(required_size > (u64) dev_priv->vram_size)) {
29302+ if (!vmw_kms_validate_mode_vram(dev_priv,
29303+ mode_cmd->pitch,
29304+ mode_cmd->height)) {
29305 DRM_ERROR("VRAM size is too small for requested mode.\n");
29306 return NULL;
29307 }
29308diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
29309index c72f1c0..18376f1 100644
29310--- a/drivers/gpu/vga/vgaarb.c
29311+++ b/drivers/gpu/vga/vgaarb.c
29312@@ -993,14 +993,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
29313 uc = &priv->cards[i];
29314 }
29315
29316- if (!uc)
29317- return -EINVAL;
29318+ if (!uc) {
29319+ ret_val = -EINVAL;
29320+ goto done;
29321+ }
29322
29323- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
29324- return -EINVAL;
29325+ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
29326+ ret_val = -EINVAL;
29327+ goto done;
29328+ }
29329
29330- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
29331- return -EINVAL;
29332+ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
29333+ ret_val = -EINVAL;
29334+ goto done;
29335+ }
29336
29337 vga_put(pdev, io_state);
29338
29339diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
29340index e9c8f80..427d61e 100644
29341--- a/drivers/hid/hid-core.c
29342+++ b/drivers/hid/hid-core.c
29343@@ -1951,7 +1951,7 @@ static bool hid_ignore(struct hid_device *hdev)
29344
29345 int hid_add_device(struct hid_device *hdev)
29346 {
29347- static atomic_t id = ATOMIC_INIT(0);
29348+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29349 int ret;
29350
29351 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29352@@ -1966,7 +1966,7 @@ int hid_add_device(struct hid_device *hdev)
29353 /* XXX hack, any other cleaner solution after the driver core
29354 * is converted to allow more than 20 bytes as the device name? */
29355 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29356- hdev->vendor, hdev->product, atomic_inc_return(&id));
29357+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29358
29359 hid_debug_register(hdev, dev_name(&hdev->dev));
29360 ret = device_add(&hdev->dev);
29361diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
29362index 7c1188b..5a64357 100644
29363--- a/drivers/hid/usbhid/hiddev.c
29364+++ b/drivers/hid/usbhid/hiddev.c
29365@@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
29366 break;
29367
29368 case HIDIOCAPPLICATION:
29369- if (arg < 0 || arg >= hid->maxapplication)
29370+ if (arg >= hid->maxapplication)
29371 break;
29372
29373 for (i = 0; i < hid->maxcollection; i++)
29374diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
29375index 66f6729..2d6de0a 100644
29376--- a/drivers/hwmon/acpi_power_meter.c
29377+++ b/drivers/hwmon/acpi_power_meter.c
29378@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
29379 return res;
29380
29381 temp /= 1000;
29382- if (temp < 0)
29383- return -EINVAL;
29384
29385 mutex_lock(&resource->lock);
29386 resource->trip[attr->index - 7] = temp;
29387diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
29388index fe4104c..346febb 100644
29389--- a/drivers/hwmon/sht15.c
29390+++ b/drivers/hwmon/sht15.c
29391@@ -166,7 +166,7 @@ struct sht15_data {
29392 int supply_uV;
29393 bool supply_uV_valid;
29394 struct work_struct update_supply_work;
29395- atomic_t interrupt_handled;
29396+ atomic_unchecked_t interrupt_handled;
29397 };
29398
29399 /**
29400@@ -509,13 +509,13 @@ static int sht15_measurement(struct sht15_data *data,
29401 return ret;
29402
29403 gpio_direction_input(data->pdata->gpio_data);
29404- atomic_set(&data->interrupt_handled, 0);
29405+ atomic_set_unchecked(&data->interrupt_handled, 0);
29406
29407 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29408 if (gpio_get_value(data->pdata->gpio_data) == 0) {
29409 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
29410 /* Only relevant if the interrupt hasn't occurred. */
29411- if (!atomic_read(&data->interrupt_handled))
29412+ if (!atomic_read_unchecked(&data->interrupt_handled))
29413 schedule_work(&data->read_work);
29414 }
29415 ret = wait_event_timeout(data->wait_queue,
29416@@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
29417
29418 /* First disable the interrupt */
29419 disable_irq_nosync(irq);
29420- atomic_inc(&data->interrupt_handled);
29421+ atomic_inc_unchecked(&data->interrupt_handled);
29422 /* Then schedule a reading work struct */
29423 if (data->state != SHT15_READING_NOTHING)
29424 schedule_work(&data->read_work);
29425@@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
29426 * If not, then start the interrupt again - care here as could
29427 * have gone low in meantime so verify it hasn't!
29428 */
29429- atomic_set(&data->interrupt_handled, 0);
29430+ atomic_set_unchecked(&data->interrupt_handled, 0);
29431 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29432 /* If still not occurred or another handler has been scheduled */
29433 if (gpio_get_value(data->pdata->gpio_data)
29434- || atomic_read(&data->interrupt_handled))
29435+ || atomic_read_unchecked(&data->interrupt_handled))
29436 return;
29437 }
29438
29439diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
29440index 378fcb5..5e91fa8 100644
29441--- a/drivers/i2c/busses/i2c-amd756-s4882.c
29442+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
29443@@ -43,7 +43,7 @@
29444 extern struct i2c_adapter amd756_smbus;
29445
29446 static struct i2c_adapter *s4882_adapter;
29447-static struct i2c_algorithm *s4882_algo;
29448+static i2c_algorithm_no_const *s4882_algo;
29449
29450 /* Wrapper access functions for multiplexed SMBus */
29451 static DEFINE_MUTEX(amd756_lock);
29452diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
29453index 29015eb..af2d8e9 100644
29454--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
29455+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
29456@@ -41,7 +41,7 @@
29457 extern struct i2c_adapter *nforce2_smbus;
29458
29459 static struct i2c_adapter *s4985_adapter;
29460-static struct i2c_algorithm *s4985_algo;
29461+static i2c_algorithm_no_const *s4985_algo;
29462
29463 /* Wrapper access functions for multiplexed SMBus */
29464 static DEFINE_MUTEX(nforce2_lock);
29465diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
29466index d7a4833..7fae376 100644
29467--- a/drivers/i2c/i2c-mux.c
29468+++ b/drivers/i2c/i2c-mux.c
29469@@ -28,7 +28,7 @@
29470 /* multiplexer per channel data */
29471 struct i2c_mux_priv {
29472 struct i2c_adapter adap;
29473- struct i2c_algorithm algo;
29474+ i2c_algorithm_no_const algo;
29475
29476 struct i2c_adapter *parent;
29477 void *mux_dev; /* the mux chip/device */
29478diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
29479index 57d00ca..0145194 100644
29480--- a/drivers/ide/aec62xx.c
29481+++ b/drivers/ide/aec62xx.c
29482@@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_port_ops = {
29483 .cable_detect = atp86x_cable_detect,
29484 };
29485
29486-static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
29487+static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
29488 { /* 0: AEC6210 */
29489 .name = DRV_NAME,
29490 .init_chipset = init_chipset_aec62xx,
29491diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
29492index 2c8016a..911a27c 100644
29493--- a/drivers/ide/alim15x3.c
29494+++ b/drivers/ide/alim15x3.c
29495@@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_ops = {
29496 .dma_sff_read_status = ide_dma_sff_read_status,
29497 };
29498
29499-static const struct ide_port_info ali15x3_chipset __devinitdata = {
29500+static const struct ide_port_info ali15x3_chipset __devinitconst = {
29501 .name = DRV_NAME,
29502 .init_chipset = init_chipset_ali15x3,
29503 .init_hwif = init_hwif_ali15x3,
29504diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
29505index 3747b25..56fc995 100644
29506--- a/drivers/ide/amd74xx.c
29507+++ b/drivers/ide/amd74xx.c
29508@@ -223,7 +223,7 @@ static const struct ide_port_ops amd_port_ops = {
29509 .udma_mask = udma, \
29510 }
29511
29512-static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
29513+static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
29514 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
29515 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
29516 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
29517diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
29518index 15f0ead..cb43480 100644
29519--- a/drivers/ide/atiixp.c
29520+++ b/drivers/ide/atiixp.c
29521@@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_port_ops = {
29522 .cable_detect = atiixp_cable_detect,
29523 };
29524
29525-static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
29526+static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
29527 { /* 0: IXP200/300/400/700 */
29528 .name = DRV_NAME,
29529 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
29530diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
29531index 5f80312..d1fc438 100644
29532--- a/drivers/ide/cmd64x.c
29533+++ b/drivers/ide/cmd64x.c
29534@@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
29535 .dma_sff_read_status = ide_dma_sff_read_status,
29536 };
29537
29538-static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
29539+static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
29540 { /* 0: CMD643 */
29541 .name = DRV_NAME,
29542 .init_chipset = init_chipset_cmd64x,
29543diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
29544index 2c1e5f7..1444762 100644
29545--- a/drivers/ide/cs5520.c
29546+++ b/drivers/ide/cs5520.c
29547@@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_port_ops = {
29548 .set_dma_mode = cs5520_set_dma_mode,
29549 };
29550
29551-static const struct ide_port_info cyrix_chipset __devinitdata = {
29552+static const struct ide_port_info cyrix_chipset __devinitconst = {
29553 .name = DRV_NAME,
29554 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
29555 .port_ops = &cs5520_port_ops,
29556diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
29557index 4dc4eb9..49b40ad 100644
29558--- a/drivers/ide/cs5530.c
29559+++ b/drivers/ide/cs5530.c
29560@@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_port_ops = {
29561 .udma_filter = cs5530_udma_filter,
29562 };
29563
29564-static const struct ide_port_info cs5530_chipset __devinitdata = {
29565+static const struct ide_port_info cs5530_chipset __devinitconst = {
29566 .name = DRV_NAME,
29567 .init_chipset = init_chipset_cs5530,
29568 .init_hwif = init_hwif_cs5530,
29569diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
29570index 5059faf..18d4c85 100644
29571--- a/drivers/ide/cs5535.c
29572+++ b/drivers/ide/cs5535.c
29573@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
29574 .cable_detect = cs5535_cable_detect,
29575 };
29576
29577-static const struct ide_port_info cs5535_chipset __devinitdata = {
29578+static const struct ide_port_info cs5535_chipset __devinitconst = {
29579 .name = DRV_NAME,
29580 .port_ops = &cs5535_port_ops,
29581 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
29582diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
29583index 67cbcfa..37ea151 100644
29584--- a/drivers/ide/cy82c693.c
29585+++ b/drivers/ide/cy82c693.c
29586@@ -163,7 +163,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
29587 .set_dma_mode = cy82c693_set_dma_mode,
29588 };
29589
29590-static const struct ide_port_info cy82c693_chipset __devinitdata = {
29591+static const struct ide_port_info cy82c693_chipset __devinitconst = {
29592 .name = DRV_NAME,
29593 .init_iops = init_iops_cy82c693,
29594 .port_ops = &cy82c693_port_ops,
29595diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
29596index 58c51cd..4aec3b8 100644
29597--- a/drivers/ide/hpt366.c
29598+++ b/drivers/ide/hpt366.c
29599@@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings = {
29600 }
29601 };
29602
29603-static const struct hpt_info hpt36x __devinitdata = {
29604+static const struct hpt_info hpt36x __devinitconst = {
29605 .chip_name = "HPT36x",
29606 .chip_type = HPT36x,
29607 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
29608@@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __devinitdata = {
29609 .timings = &hpt36x_timings
29610 };
29611
29612-static const struct hpt_info hpt370 __devinitdata = {
29613+static const struct hpt_info hpt370 __devinitconst = {
29614 .chip_name = "HPT370",
29615 .chip_type = HPT370,
29616 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29617@@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __devinitdata = {
29618 .timings = &hpt37x_timings
29619 };
29620
29621-static const struct hpt_info hpt370a __devinitdata = {
29622+static const struct hpt_info hpt370a __devinitconst = {
29623 .chip_name = "HPT370A",
29624 .chip_type = HPT370A,
29625 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29626@@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __devinitdata = {
29627 .timings = &hpt37x_timings
29628 };
29629
29630-static const struct hpt_info hpt374 __devinitdata = {
29631+static const struct hpt_info hpt374 __devinitconst = {
29632 .chip_name = "HPT374",
29633 .chip_type = HPT374,
29634 .udma_mask = ATA_UDMA5,
29635@@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __devinitdata = {
29636 .timings = &hpt37x_timings
29637 };
29638
29639-static const struct hpt_info hpt372 __devinitdata = {
29640+static const struct hpt_info hpt372 __devinitconst = {
29641 .chip_name = "HPT372",
29642 .chip_type = HPT372,
29643 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29644@@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __devinitdata = {
29645 .timings = &hpt37x_timings
29646 };
29647
29648-static const struct hpt_info hpt372a __devinitdata = {
29649+static const struct hpt_info hpt372a __devinitconst = {
29650 .chip_name = "HPT372A",
29651 .chip_type = HPT372A,
29652 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29653@@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __devinitdata = {
29654 .timings = &hpt37x_timings
29655 };
29656
29657-static const struct hpt_info hpt302 __devinitdata = {
29658+static const struct hpt_info hpt302 __devinitconst = {
29659 .chip_name = "HPT302",
29660 .chip_type = HPT302,
29661 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29662@@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __devinitdata = {
29663 .timings = &hpt37x_timings
29664 };
29665
29666-static const struct hpt_info hpt371 __devinitdata = {
29667+static const struct hpt_info hpt371 __devinitconst = {
29668 .chip_name = "HPT371",
29669 .chip_type = HPT371,
29670 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29671@@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __devinitdata = {
29672 .timings = &hpt37x_timings
29673 };
29674
29675-static const struct hpt_info hpt372n __devinitdata = {
29676+static const struct hpt_info hpt372n __devinitconst = {
29677 .chip_name = "HPT372N",
29678 .chip_type = HPT372N,
29679 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29680@@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __devinitdata = {
29681 .timings = &hpt37x_timings
29682 };
29683
29684-static const struct hpt_info hpt302n __devinitdata = {
29685+static const struct hpt_info hpt302n __devinitconst = {
29686 .chip_name = "HPT302N",
29687 .chip_type = HPT302N,
29688 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29689@@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __devinitdata = {
29690 .timings = &hpt37x_timings
29691 };
29692
29693-static const struct hpt_info hpt371n __devinitdata = {
29694+static const struct hpt_info hpt371n __devinitconst = {
29695 .chip_name = "HPT371N",
29696 .chip_type = HPT371N,
29697 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29698@@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
29699 .dma_sff_read_status = ide_dma_sff_read_status,
29700 };
29701
29702-static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
29703+static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
29704 { /* 0: HPT36x */
29705 .name = DRV_NAME,
29706 .init_chipset = init_chipset_hpt366,
29707diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
29708index 04b0956..f5b47dc 100644
29709--- a/drivers/ide/ide-cd.c
29710+++ b/drivers/ide/ide-cd.c
29711@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
29712 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
29713 if ((unsigned long)buf & alignment
29714 || blk_rq_bytes(rq) & q->dma_pad_mask
29715- || object_is_on_stack(buf))
29716+ || object_starts_on_stack(buf))
29717 drive->dma = 0;
29718 }
29719 }
29720diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
29721index 61fdf54..2834ea6 100644
29722--- a/drivers/ide/ide-floppy.c
29723+++ b/drivers/ide/ide-floppy.c
29724@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
29725 u8 pc_buf[256], header_len, desc_cnt;
29726 int i, rc = 1, blocks, length;
29727
29728+ pax_track_stack();
29729+
29730 ide_debug_log(IDE_DBG_FUNC, "enter");
29731
29732 drive->bios_cyl = 0;
29733diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
29734index d267b7a..a22ca84 100644
29735--- a/drivers/ide/ide-floppy_ioctl.c
29736+++ b/drivers/ide/ide-floppy_ioctl.c
29737@@ -292,8 +292,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
29738 * and CDROM_SEND_PACKET (legacy) ioctls
29739 */
29740 if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
29741- err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
29742- mode, cmd, argp);
29743+ err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
29744
29745 if (err == -ENOTTY)
29746 err = generic_ide_ioctl(drive, bdev, cmd, arg);
29747diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
29748index a743e68..1cfd674 100644
29749--- a/drivers/ide/ide-pci-generic.c
29750+++ b/drivers/ide/ide-pci-generic.c
29751@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
29752 .udma_mask = ATA_UDMA6, \
29753 }
29754
29755-static const struct ide_port_info generic_chipsets[] __devinitdata = {
29756+static const struct ide_port_info generic_chipsets[] __devinitconst = {
29757 /* 0: Unknown */
29758 DECLARE_GENERIC_PCI_DEV(0),
29759
29760diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
29761index 560e66d..d5dd180 100644
29762--- a/drivers/ide/it8172.c
29763+++ b/drivers/ide/it8172.c
29764@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
29765 .set_dma_mode = it8172_set_dma_mode,
29766 };
29767
29768-static const struct ide_port_info it8172_port_info __devinitdata = {
29769+static const struct ide_port_info it8172_port_info __devinitconst = {
29770 .name = DRV_NAME,
29771 .port_ops = &it8172_port_ops,
29772 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
29773diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
29774index 46816ba..1847aeb 100644
29775--- a/drivers/ide/it8213.c
29776+++ b/drivers/ide/it8213.c
29777@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
29778 .cable_detect = it8213_cable_detect,
29779 };
29780
29781-static const struct ide_port_info it8213_chipset __devinitdata = {
29782+static const struct ide_port_info it8213_chipset __devinitconst = {
29783 .name = DRV_NAME,
29784 .enablebits = { {0x41, 0x80, 0x80} },
29785 .port_ops = &it8213_port_ops,
29786diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
29787index 2e3169f..c5611db 100644
29788--- a/drivers/ide/it821x.c
29789+++ b/drivers/ide/it821x.c
29790@@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_port_ops = {
29791 .cable_detect = it821x_cable_detect,
29792 };
29793
29794-static const struct ide_port_info it821x_chipset __devinitdata = {
29795+static const struct ide_port_info it821x_chipset __devinitconst = {
29796 .name = DRV_NAME,
29797 .init_chipset = init_chipset_it821x,
29798 .init_hwif = init_hwif_it821x,
29799diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
29800index 74c2c4a..efddd7d 100644
29801--- a/drivers/ide/jmicron.c
29802+++ b/drivers/ide/jmicron.c
29803@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
29804 .cable_detect = jmicron_cable_detect,
29805 };
29806
29807-static const struct ide_port_info jmicron_chipset __devinitdata = {
29808+static const struct ide_port_info jmicron_chipset __devinitconst = {
29809 .name = DRV_NAME,
29810 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
29811 .port_ops = &jmicron_port_ops,
29812diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
29813index 95327a2..73f78d8 100644
29814--- a/drivers/ide/ns87415.c
29815+++ b/drivers/ide/ns87415.c
29816@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
29817 .dma_sff_read_status = superio_dma_sff_read_status,
29818 };
29819
29820-static const struct ide_port_info ns87415_chipset __devinitdata = {
29821+static const struct ide_port_info ns87415_chipset __devinitconst = {
29822 .name = DRV_NAME,
29823 .init_hwif = init_hwif_ns87415,
29824 .tp_ops = &ns87415_tp_ops,
29825diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
29826index 1a53a4c..39edc66 100644
29827--- a/drivers/ide/opti621.c
29828+++ b/drivers/ide/opti621.c
29829@@ -131,7 +131,7 @@ static const struct ide_port_ops opti621_port_ops = {
29830 .set_pio_mode = opti621_set_pio_mode,
29831 };
29832
29833-static const struct ide_port_info opti621_chipset __devinitdata = {
29834+static const struct ide_port_info opti621_chipset __devinitconst = {
29835 .name = DRV_NAME,
29836 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
29837 .port_ops = &opti621_port_ops,
29838diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
29839index 9546fe2..2e5ceb6 100644
29840--- a/drivers/ide/pdc202xx_new.c
29841+++ b/drivers/ide/pdc202xx_new.c
29842@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
29843 .udma_mask = udma, \
29844 }
29845
29846-static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
29847+static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
29848 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
29849 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
29850 };
29851diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
29852index 3a35ec6..5634510 100644
29853--- a/drivers/ide/pdc202xx_old.c
29854+++ b/drivers/ide/pdc202xx_old.c
29855@@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
29856 .max_sectors = sectors, \
29857 }
29858
29859-static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
29860+static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
29861 { /* 0: PDC20246 */
29862 .name = DRV_NAME,
29863 .init_chipset = init_chipset_pdc202xx,
29864diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
29865index b59d04c..368c2a7 100644
29866--- a/drivers/ide/piix.c
29867+++ b/drivers/ide/piix.c
29868@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
29869 .udma_mask = udma, \
29870 }
29871
29872-static const struct ide_port_info piix_pci_info[] __devinitdata = {
29873+static const struct ide_port_info piix_pci_info[] __devinitconst = {
29874 /* 0: MPIIX */
29875 { /*
29876 * MPIIX actually has only a single IDE channel mapped to
29877diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
29878index a6414a8..c04173e 100644
29879--- a/drivers/ide/rz1000.c
29880+++ b/drivers/ide/rz1000.c
29881@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
29882 }
29883 }
29884
29885-static const struct ide_port_info rz1000_chipset __devinitdata = {
29886+static const struct ide_port_info rz1000_chipset __devinitconst = {
29887 .name = DRV_NAME,
29888 .host_flags = IDE_HFLAG_NO_DMA,
29889 };
29890diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
29891index 356b9b5..d4758eb 100644
29892--- a/drivers/ide/sc1200.c
29893+++ b/drivers/ide/sc1200.c
29894@@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
29895 .dma_sff_read_status = ide_dma_sff_read_status,
29896 };
29897
29898-static const struct ide_port_info sc1200_chipset __devinitdata = {
29899+static const struct ide_port_info sc1200_chipset __devinitconst = {
29900 .name = DRV_NAME,
29901 .port_ops = &sc1200_port_ops,
29902 .dma_ops = &sc1200_dma_ops,
29903diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
29904index b7f5b0c..9701038 100644
29905--- a/drivers/ide/scc_pata.c
29906+++ b/drivers/ide/scc_pata.c
29907@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
29908 .dma_sff_read_status = scc_dma_sff_read_status,
29909 };
29910
29911-static const struct ide_port_info scc_chipset __devinitdata = {
29912+static const struct ide_port_info scc_chipset __devinitconst = {
29913 .name = "sccIDE",
29914 .init_iops = init_iops_scc,
29915 .init_dma = scc_init_dma,
29916diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
29917index 35fb8da..24d72ef 100644
29918--- a/drivers/ide/serverworks.c
29919+++ b/drivers/ide/serverworks.c
29920@@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_port_ops = {
29921 .cable_detect = svwks_cable_detect,
29922 };
29923
29924-static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
29925+static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
29926 { /* 0: OSB4 */
29927 .name = DRV_NAME,
29928 .init_chipset = init_chipset_svwks,
29929diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
29930index ab3db61..afed580 100644
29931--- a/drivers/ide/setup-pci.c
29932+++ b/drivers/ide/setup-pci.c
29933@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
29934 int ret, i, n_ports = dev2 ? 4 : 2;
29935 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
29936
29937+ pax_track_stack();
29938+
29939 for (i = 0; i < n_ports / 2; i++) {
29940 ret = ide_setup_pci_controller(pdev[i], d, !i);
29941 if (ret < 0)
29942diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
29943index ddeda44..46f7e30 100644
29944--- a/drivers/ide/siimage.c
29945+++ b/drivers/ide/siimage.c
29946@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
29947 .udma_mask = ATA_UDMA6, \
29948 }
29949
29950-static const struct ide_port_info siimage_chipsets[] __devinitdata = {
29951+static const struct ide_port_info siimage_chipsets[] __devinitconst = {
29952 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
29953 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
29954 };
29955diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
29956index 4a00225..09e61b4 100644
29957--- a/drivers/ide/sis5513.c
29958+++ b/drivers/ide/sis5513.c
29959@@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
29960 .cable_detect = sis_cable_detect,
29961 };
29962
29963-static const struct ide_port_info sis5513_chipset __devinitdata = {
29964+static const struct ide_port_info sis5513_chipset __devinitconst = {
29965 .name = DRV_NAME,
29966 .init_chipset = init_chipset_sis5513,
29967 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
29968diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
29969index f21dc2a..d051cd2 100644
29970--- a/drivers/ide/sl82c105.c
29971+++ b/drivers/ide/sl82c105.c
29972@@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
29973 .dma_sff_read_status = ide_dma_sff_read_status,
29974 };
29975
29976-static const struct ide_port_info sl82c105_chipset __devinitdata = {
29977+static const struct ide_port_info sl82c105_chipset __devinitconst = {
29978 .name = DRV_NAME,
29979 .init_chipset = init_chipset_sl82c105,
29980 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
29981diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
29982index 864ffe0..863a5e9 100644
29983--- a/drivers/ide/slc90e66.c
29984+++ b/drivers/ide/slc90e66.c
29985@@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
29986 .cable_detect = slc90e66_cable_detect,
29987 };
29988
29989-static const struct ide_port_info slc90e66_chipset __devinitdata = {
29990+static const struct ide_port_info slc90e66_chipset __devinitconst = {
29991 .name = DRV_NAME,
29992 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
29993 .port_ops = &slc90e66_port_ops,
29994diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
29995index e444d24..ba577de 100644
29996--- a/drivers/ide/tc86c001.c
29997+++ b/drivers/ide/tc86c001.c
29998@@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
29999 .dma_sff_read_status = ide_dma_sff_read_status,
30000 };
30001
30002-static const struct ide_port_info tc86c001_chipset __devinitdata = {
30003+static const struct ide_port_info tc86c001_chipset __devinitconst = {
30004 .name = DRV_NAME,
30005 .init_hwif = init_hwif_tc86c001,
30006 .port_ops = &tc86c001_port_ops,
30007diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
30008index e53a1b7..d11aff7 100644
30009--- a/drivers/ide/triflex.c
30010+++ b/drivers/ide/triflex.c
30011@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
30012 .set_dma_mode = triflex_set_mode,
30013 };
30014
30015-static const struct ide_port_info triflex_device __devinitdata = {
30016+static const struct ide_port_info triflex_device __devinitconst = {
30017 .name = DRV_NAME,
30018 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
30019 .port_ops = &triflex_port_ops,
30020diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
30021index 4b42ca0..e494a98 100644
30022--- a/drivers/ide/trm290.c
30023+++ b/drivers/ide/trm290.c
30024@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
30025 .dma_check = trm290_dma_check,
30026 };
30027
30028-static const struct ide_port_info trm290_chipset __devinitdata = {
30029+static const struct ide_port_info trm290_chipset __devinitconst = {
30030 .name = DRV_NAME,
30031 .init_hwif = init_hwif_trm290,
30032 .tp_ops = &trm290_tp_ops,
30033diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
30034index f46f49c..eb77678 100644
30035--- a/drivers/ide/via82cxxx.c
30036+++ b/drivers/ide/via82cxxx.c
30037@@ -403,7 +403,7 @@ static const struct ide_port_ops via_port_ops = {
30038 .cable_detect = via82cxxx_cable_detect,
30039 };
30040
30041-static const struct ide_port_info via82cxxx_chipset __devinitdata = {
30042+static const struct ide_port_info via82cxxx_chipset __devinitconst = {
30043 .name = DRV_NAME,
30044 .init_chipset = init_chipset_via82cxxx,
30045 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
30046diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
30047index fc0f2bd..ac2f8a5 100644
30048--- a/drivers/infiniband/core/cm.c
30049+++ b/drivers/infiniband/core/cm.c
30050@@ -113,7 +113,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
30051
30052 struct cm_counter_group {
30053 struct kobject obj;
30054- atomic_long_t counter[CM_ATTR_COUNT];
30055+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30056 };
30057
30058 struct cm_counter_attribute {
30059@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm_work *work,
30060 struct ib_mad_send_buf *msg = NULL;
30061 int ret;
30062
30063- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30064+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30065 counter[CM_REQ_COUNTER]);
30066
30067 /* Quick state check to discard duplicate REQs. */
30068@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
30069 if (!cm_id_priv)
30070 return;
30071
30072- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30073+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30074 counter[CM_REP_COUNTER]);
30075 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30076 if (ret)
30077@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work *work)
30078 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30079 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30080 spin_unlock_irq(&cm_id_priv->lock);
30081- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30082+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30083 counter[CM_RTU_COUNTER]);
30084 goto out;
30085 }
30086@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_work *work)
30087 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30088 dreq_msg->local_comm_id);
30089 if (!cm_id_priv) {
30090- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30091+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30092 counter[CM_DREQ_COUNTER]);
30093 cm_issue_drep(work->port, work->mad_recv_wc);
30094 return -EINVAL;
30095@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_work *work)
30096 case IB_CM_MRA_REP_RCVD:
30097 break;
30098 case IB_CM_TIMEWAIT:
30099- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30100+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30101 counter[CM_DREQ_COUNTER]);
30102 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30103 goto unlock;
30104@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_work *work)
30105 cm_free_msg(msg);
30106 goto deref;
30107 case IB_CM_DREQ_RCVD:
30108- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30109+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30110 counter[CM_DREQ_COUNTER]);
30111 goto unlock;
30112 default:
30113@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work *work)
30114 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30115 cm_id_priv->msg, timeout)) {
30116 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30117- atomic_long_inc(&work->port->
30118+ atomic_long_inc_unchecked(&work->port->
30119 counter_group[CM_RECV_DUPLICATES].
30120 counter[CM_MRA_COUNTER]);
30121 goto out;
30122@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work *work)
30123 break;
30124 case IB_CM_MRA_REQ_RCVD:
30125 case IB_CM_MRA_REP_RCVD:
30126- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30127+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30128 counter[CM_MRA_COUNTER]);
30129 /* fall through */
30130 default:
30131@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work *work)
30132 case IB_CM_LAP_IDLE:
30133 break;
30134 case IB_CM_MRA_LAP_SENT:
30135- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30136+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30137 counter[CM_LAP_COUNTER]);
30138 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30139 goto unlock;
30140@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work *work)
30141 cm_free_msg(msg);
30142 goto deref;
30143 case IB_CM_LAP_RCVD:
30144- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30145+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30146 counter[CM_LAP_COUNTER]);
30147 goto unlock;
30148 default:
30149@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
30150 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30151 if (cur_cm_id_priv) {
30152 spin_unlock_irq(&cm.lock);
30153- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30154+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30155 counter[CM_SIDR_REQ_COUNTER]);
30156 goto out; /* Duplicate message. */
30157 }
30158@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
30159 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30160 msg->retries = 1;
30161
30162- atomic_long_add(1 + msg->retries,
30163+ atomic_long_add_unchecked(1 + msg->retries,
30164 &port->counter_group[CM_XMIT].counter[attr_index]);
30165 if (msg->retries)
30166- atomic_long_add(msg->retries,
30167+ atomic_long_add_unchecked(msg->retries,
30168 &port->counter_group[CM_XMIT_RETRIES].
30169 counter[attr_index]);
30170
30171@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
30172 }
30173
30174 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30175- atomic_long_inc(&port->counter_group[CM_RECV].
30176+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30177 counter[attr_id - CM_ATTR_ID_OFFSET]);
30178
30179 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30180@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
30181 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30182
30183 return sprintf(buf, "%ld\n",
30184- atomic_long_read(&group->counter[cm_attr->index]));
30185+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30186 }
30187
30188 static const struct sysfs_ops cm_counter_ops = {
30189diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
30190index ca4c5dc..572d1ae 100644
30191--- a/drivers/infiniband/core/cma.c
30192+++ b/drivers/infiniband/core/cma.c
30193@@ -2492,6 +2492,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
30194
30195 req.private_data_len = sizeof(struct cma_hdr) +
30196 conn_param->private_data_len;
30197+ if (req.private_data_len < conn_param->private_data_len)
30198+ return -EINVAL;
30199+
30200 req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
30201 if (!req.private_data)
30202 return -ENOMEM;
30203@@ -2541,6 +2544,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
30204 memset(&req, 0, sizeof req);
30205 offset = cma_user_data_offset(id_priv->id.ps);
30206 req.private_data_len = offset + conn_param->private_data_len;
30207+ if (req.private_data_len < conn_param->private_data_len)
30208+ return -EINVAL;
30209+
30210 private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
30211 if (!private_data)
30212 return -ENOMEM;
30213diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
30214index 4507043..14ad522 100644
30215--- a/drivers/infiniband/core/fmr_pool.c
30216+++ b/drivers/infiniband/core/fmr_pool.c
30217@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30218
30219 struct task_struct *thread;
30220
30221- atomic_t req_ser;
30222- atomic_t flush_ser;
30223+ atomic_unchecked_t req_ser;
30224+ atomic_unchecked_t flush_ser;
30225
30226 wait_queue_head_t force_wait;
30227 };
30228@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30229 struct ib_fmr_pool *pool = pool_ptr;
30230
30231 do {
30232- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30233+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30234 ib_fmr_batch_release(pool);
30235
30236- atomic_inc(&pool->flush_ser);
30237+ atomic_inc_unchecked(&pool->flush_ser);
30238 wake_up_interruptible(&pool->force_wait);
30239
30240 if (pool->flush_function)
30241@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30242 }
30243
30244 set_current_state(TASK_INTERRUPTIBLE);
30245- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30246+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30247 !kthread_should_stop())
30248 schedule();
30249 __set_current_state(TASK_RUNNING);
30250@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
30251 pool->dirty_watermark = params->dirty_watermark;
30252 pool->dirty_len = 0;
30253 spin_lock_init(&pool->pool_lock);
30254- atomic_set(&pool->req_ser, 0);
30255- atomic_set(&pool->flush_ser, 0);
30256+ atomic_set_unchecked(&pool->req_ser, 0);
30257+ atomic_set_unchecked(&pool->flush_ser, 0);
30258 init_waitqueue_head(&pool->force_wait);
30259
30260 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30261@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
30262 }
30263 spin_unlock_irq(&pool->pool_lock);
30264
30265- serial = atomic_inc_return(&pool->req_ser);
30266+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30267 wake_up_process(pool->thread);
30268
30269 if (wait_event_interruptible(pool->force_wait,
30270- atomic_read(&pool->flush_ser) - serial >= 0))
30271+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30272 return -EINTR;
30273
30274 return 0;
30275@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
30276 } else {
30277 list_add_tail(&fmr->list, &pool->dirty_list);
30278 if (++pool->dirty_len >= pool->dirty_watermark) {
30279- atomic_inc(&pool->req_ser);
30280+ atomic_inc_unchecked(&pool->req_ser);
30281 wake_up_process(pool->thread);
30282 }
30283 }
30284diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
30285index 40c8353..946b0e4 100644
30286--- a/drivers/infiniband/hw/cxgb4/mem.c
30287+++ b/drivers/infiniband/hw/cxgb4/mem.c
30288@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30289 int err;
30290 struct fw_ri_tpte tpt;
30291 u32 stag_idx;
30292- static atomic_t key;
30293+ static atomic_unchecked_t key;
30294
30295 if (c4iw_fatal_error(rdev))
30296 return -EIO;
30297@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30298 &rdev->resource.tpt_fifo_lock);
30299 if (!stag_idx)
30300 return -ENOMEM;
30301- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30302+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30303 }
30304 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30305 __func__, stag_state, type, pdid, stag_idx);
30306diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
30307index 31ae1b1..2f5b038 100644
30308--- a/drivers/infiniband/hw/ipath/ipath_fs.c
30309+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
30310@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
30311 struct infinipath_counters counters;
30312 struct ipath_devdata *dd;
30313
30314+ pax_track_stack();
30315+
30316 dd = file->f_path.dentry->d_inode->i_private;
30317 dd->ipath_f_read_counters(dd, &counters);
30318
30319diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
30320index 79b3dbc..96e5fcc 100644
30321--- a/drivers/infiniband/hw/ipath/ipath_rc.c
30322+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
30323@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30324 struct ib_atomic_eth *ateth;
30325 struct ipath_ack_entry *e;
30326 u64 vaddr;
30327- atomic64_t *maddr;
30328+ atomic64_unchecked_t *maddr;
30329 u64 sdata;
30330 u32 rkey;
30331 u8 next;
30332@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30333 IB_ACCESS_REMOTE_ATOMIC)))
30334 goto nack_acc_unlck;
30335 /* Perform atomic OP and save result. */
30336- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30337+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30338 sdata = be64_to_cpu(ateth->swap_data);
30339 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30340 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30341- (u64) atomic64_add_return(sdata, maddr) - sdata :
30342+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30343 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30344 be64_to_cpu(ateth->compare_data),
30345 sdata);
30346diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
30347index 1f95bba..9530f87 100644
30348--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
30349+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
30350@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
30351 unsigned long flags;
30352 struct ib_wc wc;
30353 u64 sdata;
30354- atomic64_t *maddr;
30355+ atomic64_unchecked_t *maddr;
30356 enum ib_wc_status send_status;
30357
30358 /*
30359@@ -382,11 +382,11 @@ again:
30360 IB_ACCESS_REMOTE_ATOMIC)))
30361 goto acc_err;
30362 /* Perform atomic OP and save result. */
30363- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30364+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30365 sdata = wqe->wr.wr.atomic.compare_add;
30366 *(u64 *) sqp->s_sge.sge.vaddr =
30367 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30368- (u64) atomic64_add_return(sdata, maddr) - sdata :
30369+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30370 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30371 sdata, wqe->wr.wr.atomic.swap);
30372 goto send_comp;
30373diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
30374index 2d668c6..3312bb7 100644
30375--- a/drivers/infiniband/hw/nes/nes.c
30376+++ b/drivers/infiniband/hw/nes/nes.c
30377@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
30378 LIST_HEAD(nes_adapter_list);
30379 static LIST_HEAD(nes_dev_list);
30380
30381-atomic_t qps_destroyed;
30382+atomic_unchecked_t qps_destroyed;
30383
30384 static unsigned int ee_flsh_adapter;
30385 static unsigned int sysfs_nonidx_addr;
30386@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
30387 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30388 struct nes_adapter *nesadapter = nesdev->nesadapter;
30389
30390- atomic_inc(&qps_destroyed);
30391+ atomic_inc_unchecked(&qps_destroyed);
30392
30393 /* Free the control structures */
30394
30395diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
30396index 6fe7987..68637b5 100644
30397--- a/drivers/infiniband/hw/nes/nes.h
30398+++ b/drivers/infiniband/hw/nes/nes.h
30399@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30400 extern unsigned int wqm_quanta;
30401 extern struct list_head nes_adapter_list;
30402
30403-extern atomic_t cm_connects;
30404-extern atomic_t cm_accepts;
30405-extern atomic_t cm_disconnects;
30406-extern atomic_t cm_closes;
30407-extern atomic_t cm_connecteds;
30408-extern atomic_t cm_connect_reqs;
30409-extern atomic_t cm_rejects;
30410-extern atomic_t mod_qp_timouts;
30411-extern atomic_t qps_created;
30412-extern atomic_t qps_destroyed;
30413-extern atomic_t sw_qps_destroyed;
30414+extern atomic_unchecked_t cm_connects;
30415+extern atomic_unchecked_t cm_accepts;
30416+extern atomic_unchecked_t cm_disconnects;
30417+extern atomic_unchecked_t cm_closes;
30418+extern atomic_unchecked_t cm_connecteds;
30419+extern atomic_unchecked_t cm_connect_reqs;
30420+extern atomic_unchecked_t cm_rejects;
30421+extern atomic_unchecked_t mod_qp_timouts;
30422+extern atomic_unchecked_t qps_created;
30423+extern atomic_unchecked_t qps_destroyed;
30424+extern atomic_unchecked_t sw_qps_destroyed;
30425 extern u32 mh_detected;
30426 extern u32 mh_pauses_sent;
30427 extern u32 cm_packets_sent;
30428@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30429 extern u32 cm_packets_received;
30430 extern u32 cm_packets_dropped;
30431 extern u32 cm_packets_retrans;
30432-extern atomic_t cm_listens_created;
30433-extern atomic_t cm_listens_destroyed;
30434+extern atomic_unchecked_t cm_listens_created;
30435+extern atomic_unchecked_t cm_listens_destroyed;
30436 extern u32 cm_backlog_drops;
30437-extern atomic_t cm_loopbacks;
30438-extern atomic_t cm_nodes_created;
30439-extern atomic_t cm_nodes_destroyed;
30440-extern atomic_t cm_accel_dropped_pkts;
30441-extern atomic_t cm_resets_recvd;
30442+extern atomic_unchecked_t cm_loopbacks;
30443+extern atomic_unchecked_t cm_nodes_created;
30444+extern atomic_unchecked_t cm_nodes_destroyed;
30445+extern atomic_unchecked_t cm_accel_dropped_pkts;
30446+extern atomic_unchecked_t cm_resets_recvd;
30447
30448 extern u32 int_mod_timer_init;
30449 extern u32 int_mod_cq_depth_256;
30450diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
30451index a237547..28a9819 100644
30452--- a/drivers/infiniband/hw/nes/nes_cm.c
30453+++ b/drivers/infiniband/hw/nes/nes_cm.c
30454@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30455 u32 cm_packets_retrans;
30456 u32 cm_packets_created;
30457 u32 cm_packets_received;
30458-atomic_t cm_listens_created;
30459-atomic_t cm_listens_destroyed;
30460+atomic_unchecked_t cm_listens_created;
30461+atomic_unchecked_t cm_listens_destroyed;
30462 u32 cm_backlog_drops;
30463-atomic_t cm_loopbacks;
30464-atomic_t cm_nodes_created;
30465-atomic_t cm_nodes_destroyed;
30466-atomic_t cm_accel_dropped_pkts;
30467-atomic_t cm_resets_recvd;
30468+atomic_unchecked_t cm_loopbacks;
30469+atomic_unchecked_t cm_nodes_created;
30470+atomic_unchecked_t cm_nodes_destroyed;
30471+atomic_unchecked_t cm_accel_dropped_pkts;
30472+atomic_unchecked_t cm_resets_recvd;
30473
30474 static inline int mini_cm_accelerated(struct nes_cm_core *,
30475 struct nes_cm_node *);
30476@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30477
30478 static struct nes_cm_core *g_cm_core;
30479
30480-atomic_t cm_connects;
30481-atomic_t cm_accepts;
30482-atomic_t cm_disconnects;
30483-atomic_t cm_closes;
30484-atomic_t cm_connecteds;
30485-atomic_t cm_connect_reqs;
30486-atomic_t cm_rejects;
30487+atomic_unchecked_t cm_connects;
30488+atomic_unchecked_t cm_accepts;
30489+atomic_unchecked_t cm_disconnects;
30490+atomic_unchecked_t cm_closes;
30491+atomic_unchecked_t cm_connecteds;
30492+atomic_unchecked_t cm_connect_reqs;
30493+atomic_unchecked_t cm_rejects;
30494
30495
30496 /**
30497@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
30498 kfree(listener);
30499 listener = NULL;
30500 ret = 0;
30501- atomic_inc(&cm_listens_destroyed);
30502+ atomic_inc_unchecked(&cm_listens_destroyed);
30503 } else {
30504 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30505 }
30506@@ -1242,7 +1242,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
30507 cm_node->rem_mac);
30508
30509 add_hte_node(cm_core, cm_node);
30510- atomic_inc(&cm_nodes_created);
30511+ atomic_inc_unchecked(&cm_nodes_created);
30512
30513 return cm_node;
30514 }
30515@@ -1300,7 +1300,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
30516 }
30517
30518 atomic_dec(&cm_core->node_cnt);
30519- atomic_inc(&cm_nodes_destroyed);
30520+ atomic_inc_unchecked(&cm_nodes_destroyed);
30521 nesqp = cm_node->nesqp;
30522 if (nesqp) {
30523 nesqp->cm_node = NULL;
30524@@ -1367,7 +1367,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
30525
30526 static void drop_packet(struct sk_buff *skb)
30527 {
30528- atomic_inc(&cm_accel_dropped_pkts);
30529+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30530 dev_kfree_skb_any(skb);
30531 }
30532
30533@@ -1430,7 +1430,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
30534 {
30535
30536 int reset = 0; /* whether to send reset in case of err.. */
30537- atomic_inc(&cm_resets_recvd);
30538+ atomic_inc_unchecked(&cm_resets_recvd);
30539 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30540 " refcnt=%d\n", cm_node, cm_node->state,
30541 atomic_read(&cm_node->ref_count));
30542@@ -2059,7 +2059,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
30543 rem_ref_cm_node(cm_node->cm_core, cm_node);
30544 return NULL;
30545 }
30546- atomic_inc(&cm_loopbacks);
30547+ atomic_inc_unchecked(&cm_loopbacks);
30548 loopbackremotenode->loopbackpartner = cm_node;
30549 loopbackremotenode->tcp_cntxt.rcv_wscale =
30550 NES_CM_DEFAULT_RCV_WND_SCALE;
30551@@ -2334,7 +2334,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
30552 add_ref_cm_node(cm_node);
30553 } else if (cm_node->state == NES_CM_STATE_TSA) {
30554 rem_ref_cm_node(cm_core, cm_node);
30555- atomic_inc(&cm_accel_dropped_pkts);
30556+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30557 dev_kfree_skb_any(skb);
30558 break;
30559 }
30560@@ -2640,7 +2640,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30561
30562 if ((cm_id) && (cm_id->event_handler)) {
30563 if (issue_disconn) {
30564- atomic_inc(&cm_disconnects);
30565+ atomic_inc_unchecked(&cm_disconnects);
30566 cm_event.event = IW_CM_EVENT_DISCONNECT;
30567 cm_event.status = disconn_status;
30568 cm_event.local_addr = cm_id->local_addr;
30569@@ -2662,7 +2662,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30570 }
30571
30572 if (issue_close) {
30573- atomic_inc(&cm_closes);
30574+ atomic_inc_unchecked(&cm_closes);
30575 nes_disconnect(nesqp, 1);
30576
30577 cm_id->provider_data = nesqp;
30578@@ -2793,7 +2793,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30579
30580 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30581 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30582- atomic_inc(&cm_accepts);
30583+ atomic_inc_unchecked(&cm_accepts);
30584
30585 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30586 netdev_refcnt_read(nesvnic->netdev));
30587@@ -3003,7 +3003,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
30588
30589 struct nes_cm_core *cm_core;
30590
30591- atomic_inc(&cm_rejects);
30592+ atomic_inc_unchecked(&cm_rejects);
30593 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30594 loopback = cm_node->loopbackpartner;
30595 cm_core = cm_node->cm_core;
30596@@ -3069,7 +3069,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30597 ntohl(cm_id->local_addr.sin_addr.s_addr),
30598 ntohs(cm_id->local_addr.sin_port));
30599
30600- atomic_inc(&cm_connects);
30601+ atomic_inc_unchecked(&cm_connects);
30602 nesqp->active_conn = 1;
30603
30604 /* cache the cm_id in the qp */
30605@@ -3175,7 +3175,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
30606 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30607 return err;
30608 }
30609- atomic_inc(&cm_listens_created);
30610+ atomic_inc_unchecked(&cm_listens_created);
30611 }
30612
30613 cm_id->add_ref(cm_id);
30614@@ -3280,7 +3280,7 @@ static void cm_event_connected(struct nes_cm_event *event)
30615 if (nesqp->destroyed) {
30616 return;
30617 }
30618- atomic_inc(&cm_connecteds);
30619+ atomic_inc_unchecked(&cm_connecteds);
30620 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30621 " local port 0x%04X. jiffies = %lu.\n",
30622 nesqp->hwqp.qp_id,
30623@@ -3495,7 +3495,7 @@ static void cm_event_reset(struct nes_cm_event *event)
30624
30625 cm_id->add_ref(cm_id);
30626 ret = cm_id->event_handler(cm_id, &cm_event);
30627- atomic_inc(&cm_closes);
30628+ atomic_inc_unchecked(&cm_closes);
30629 cm_event.event = IW_CM_EVENT_CLOSE;
30630 cm_event.status = 0;
30631 cm_event.provider_data = cm_id->provider_data;
30632@@ -3531,7 +3531,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
30633 return;
30634 cm_id = cm_node->cm_id;
30635
30636- atomic_inc(&cm_connect_reqs);
30637+ atomic_inc_unchecked(&cm_connect_reqs);
30638 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30639 cm_node, cm_id, jiffies);
30640
30641@@ -3569,7 +3569,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
30642 return;
30643 cm_id = cm_node->cm_id;
30644
30645- atomic_inc(&cm_connect_reqs);
30646+ atomic_inc_unchecked(&cm_connect_reqs);
30647 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30648 cm_node, cm_id, jiffies);
30649
30650diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
30651index 9d7ffeb..a95dd7d 100644
30652--- a/drivers/infiniband/hw/nes/nes_nic.c
30653+++ b/drivers/infiniband/hw/nes/nes_nic.c
30654@@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
30655 target_stat_values[++index] = mh_detected;
30656 target_stat_values[++index] = mh_pauses_sent;
30657 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30658- target_stat_values[++index] = atomic_read(&cm_connects);
30659- target_stat_values[++index] = atomic_read(&cm_accepts);
30660- target_stat_values[++index] = atomic_read(&cm_disconnects);
30661- target_stat_values[++index] = atomic_read(&cm_connecteds);
30662- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30663- target_stat_values[++index] = atomic_read(&cm_rejects);
30664- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30665- target_stat_values[++index] = atomic_read(&qps_created);
30666- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30667- target_stat_values[++index] = atomic_read(&qps_destroyed);
30668- target_stat_values[++index] = atomic_read(&cm_closes);
30669+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30670+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30671+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30672+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30673+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30674+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30675+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30676+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30677+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30678+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30679+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30680 target_stat_values[++index] = cm_packets_sent;
30681 target_stat_values[++index] = cm_packets_bounced;
30682 target_stat_values[++index] = cm_packets_created;
30683 target_stat_values[++index] = cm_packets_received;
30684 target_stat_values[++index] = cm_packets_dropped;
30685 target_stat_values[++index] = cm_packets_retrans;
30686- target_stat_values[++index] = atomic_read(&cm_listens_created);
30687- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30688+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30689+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30690 target_stat_values[++index] = cm_backlog_drops;
30691- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30692- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30693- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30694- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30695- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30696+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30697+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30698+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30699+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30700+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30701 target_stat_values[++index] = nesadapter->free_4kpbl;
30702 target_stat_values[++index] = nesadapter->free_256pbl;
30703 target_stat_values[++index] = int_mod_timer_init;
30704diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
30705index 9f2f7d4..6d2fee2 100644
30706--- a/drivers/infiniband/hw/nes/nes_verbs.c
30707+++ b/drivers/infiniband/hw/nes/nes_verbs.c
30708@@ -46,9 +46,9 @@
30709
30710 #include <rdma/ib_umem.h>
30711
30712-atomic_t mod_qp_timouts;
30713-atomic_t qps_created;
30714-atomic_t sw_qps_destroyed;
30715+atomic_unchecked_t mod_qp_timouts;
30716+atomic_unchecked_t qps_created;
30717+atomic_unchecked_t sw_qps_destroyed;
30718
30719 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30720
30721@@ -1131,7 +1131,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
30722 if (init_attr->create_flags)
30723 return ERR_PTR(-EINVAL);
30724
30725- atomic_inc(&qps_created);
30726+ atomic_inc_unchecked(&qps_created);
30727 switch (init_attr->qp_type) {
30728 case IB_QPT_RC:
30729 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30730@@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
30731 struct iw_cm_event cm_event;
30732 int ret;
30733
30734- atomic_inc(&sw_qps_destroyed);
30735+ atomic_inc_unchecked(&sw_qps_destroyed);
30736 nesqp->destroyed = 1;
30737
30738 /* Blow away the connection if it exists. */
30739diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
30740index c9624ea..e025b66 100644
30741--- a/drivers/infiniband/hw/qib/qib.h
30742+++ b/drivers/infiniband/hw/qib/qib.h
30743@@ -51,6 +51,7 @@
30744 #include <linux/completion.h>
30745 #include <linux/kref.h>
30746 #include <linux/sched.h>
30747+#include <linux/slab.h>
30748
30749 #include "qib_common.h"
30750 #include "qib_verbs.h"
30751diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
30752index c351aa4..e6967c2 100644
30753--- a/drivers/input/gameport/gameport.c
30754+++ b/drivers/input/gameport/gameport.c
30755@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
30756 */
30757 static void gameport_init_port(struct gameport *gameport)
30758 {
30759- static atomic_t gameport_no = ATOMIC_INIT(0);
30760+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
30761
30762 __module_get(THIS_MODULE);
30763
30764 mutex_init(&gameport->drv_mutex);
30765 device_initialize(&gameport->dev);
30766 dev_set_name(&gameport->dev, "gameport%lu",
30767- (unsigned long)atomic_inc_return(&gameport_no) - 1);
30768+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
30769 gameport->dev.bus = &gameport_bus;
30770 gameport->dev.release = gameport_release_port;
30771 if (gameport->parent)
30772diff --git a/drivers/input/input.c b/drivers/input/input.c
30773index da38d97..2aa0b79 100644
30774--- a/drivers/input/input.c
30775+++ b/drivers/input/input.c
30776@@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struct input_dev *dev)
30777 */
30778 int input_register_device(struct input_dev *dev)
30779 {
30780- static atomic_t input_no = ATOMIC_INIT(0);
30781+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
30782 struct input_handler *handler;
30783 const char *path;
30784 int error;
30785@@ -1851,7 +1851,7 @@ int input_register_device(struct input_dev *dev)
30786 dev->setkeycode = input_default_setkeycode;
30787
30788 dev_set_name(&dev->dev, "input%ld",
30789- (unsigned long) atomic_inc_return(&input_no) - 1);
30790+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
30791
30792 error = device_add(&dev->dev);
30793 if (error)
30794diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
30795index b8d8611..15f8d2c 100644
30796--- a/drivers/input/joystick/sidewinder.c
30797+++ b/drivers/input/joystick/sidewinder.c
30798@@ -30,6 +30,7 @@
30799 #include <linux/kernel.h>
30800 #include <linux/module.h>
30801 #include <linux/slab.h>
30802+#include <linux/sched.h>
30803 #include <linux/init.h>
30804 #include <linux/input.h>
30805 #include <linux/gameport.h>
30806@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
30807 unsigned char buf[SW_LENGTH];
30808 int i;
30809
30810+ pax_track_stack();
30811+
30812 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
30813
30814 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
30815diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
30816index d728875..844c89b 100644
30817--- a/drivers/input/joystick/xpad.c
30818+++ b/drivers/input/joystick/xpad.c
30819@@ -710,7 +710,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
30820
30821 static int xpad_led_probe(struct usb_xpad *xpad)
30822 {
30823- static atomic_t led_seq = ATOMIC_INIT(0);
30824+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
30825 long led_no;
30826 struct xpad_led *led;
30827 struct led_classdev *led_cdev;
30828@@ -723,7 +723,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
30829 if (!led)
30830 return -ENOMEM;
30831
30832- led_no = (long)atomic_inc_return(&led_seq) - 1;
30833+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
30834
30835 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
30836 led->xpad = xpad;
30837diff --git a/drivers/input/misc/cma3000_d0x.c b/drivers/input/misc/cma3000_d0x.c
30838index 1633b63..09f8f20 100644
30839--- a/drivers/input/misc/cma3000_d0x.c
30840+++ b/drivers/input/misc/cma3000_d0x.c
30841@@ -114,8 +114,8 @@ static void decode_mg(struct cma3000_accl_data *data, int *datax,
30842 static irqreturn_t cma3000_thread_irq(int irq, void *dev_id)
30843 {
30844 struct cma3000_accl_data *data = dev_id;
30845- int datax, datay, dataz;
30846- u8 ctrl, mode, range, intr_status;
30847+ int datax, datay, dataz, intr_status;
30848+ u8 ctrl, mode, range;
30849
30850 intr_status = CMA3000_READ(data, CMA3000_INTSTATUS, "interrupt status");
30851 if (intr_status < 0)
30852diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
30853index 0110b5a..d3ad144 100644
30854--- a/drivers/input/mousedev.c
30855+++ b/drivers/input/mousedev.c
30856@@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
30857
30858 spin_unlock_irq(&client->packet_lock);
30859
30860- if (copy_to_user(buffer, data, count))
30861+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
30862 return -EFAULT;
30863
30864 return count;
30865diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
30866index ba70058..571d25d 100644
30867--- a/drivers/input/serio/serio.c
30868+++ b/drivers/input/serio/serio.c
30869@@ -497,7 +497,7 @@ static void serio_release_port(struct device *dev)
30870 */
30871 static void serio_init_port(struct serio *serio)
30872 {
30873- static atomic_t serio_no = ATOMIC_INIT(0);
30874+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
30875
30876 __module_get(THIS_MODULE);
30877
30878@@ -508,7 +508,7 @@ static void serio_init_port(struct serio *serio)
30879 mutex_init(&serio->drv_mutex);
30880 device_initialize(&serio->dev);
30881 dev_set_name(&serio->dev, "serio%ld",
30882- (long)atomic_inc_return(&serio_no) - 1);
30883+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
30884 serio->dev.bus = &serio_bus;
30885 serio->dev.release = serio_release_port;
30886 serio->dev.groups = serio_device_attr_groups;
30887diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
30888index e44933d..9ba484a 100644
30889--- a/drivers/isdn/capi/capi.c
30890+++ b/drivers/isdn/capi/capi.c
30891@@ -83,8 +83,8 @@ struct capiminor {
30892
30893 struct capi20_appl *ap;
30894 u32 ncci;
30895- atomic_t datahandle;
30896- atomic_t msgid;
30897+ atomic_unchecked_t datahandle;
30898+ atomic_unchecked_t msgid;
30899
30900 struct tty_port port;
30901 int ttyinstop;
30902@@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
30903 capimsg_setu16(s, 2, mp->ap->applid);
30904 capimsg_setu8 (s, 4, CAPI_DATA_B3);
30905 capimsg_setu8 (s, 5, CAPI_RESP);
30906- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
30907+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
30908 capimsg_setu32(s, 8, mp->ncci);
30909 capimsg_setu16(s, 12, datahandle);
30910 }
30911@@ -518,14 +518,14 @@ static void handle_minor_send(struct capiminor *mp)
30912 mp->outbytes -= len;
30913 spin_unlock_bh(&mp->outlock);
30914
30915- datahandle = atomic_inc_return(&mp->datahandle);
30916+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
30917 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
30918 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30919 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30920 capimsg_setu16(skb->data, 2, mp->ap->applid);
30921 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
30922 capimsg_setu8 (skb->data, 5, CAPI_REQ);
30923- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
30924+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
30925 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
30926 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
30927 capimsg_setu16(skb->data, 16, len); /* Data length */
30928diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
30929index db621db..825ea1a 100644
30930--- a/drivers/isdn/gigaset/common.c
30931+++ b/drivers/isdn/gigaset/common.c
30932@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
30933 cs->commands_pending = 0;
30934 cs->cur_at_seq = 0;
30935 cs->gotfwver = -1;
30936- cs->open_count = 0;
30937+ local_set(&cs->open_count, 0);
30938 cs->dev = NULL;
30939 cs->tty = NULL;
30940 cs->tty_dev = NULL;
30941diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
30942index 212efaf..f187c6b 100644
30943--- a/drivers/isdn/gigaset/gigaset.h
30944+++ b/drivers/isdn/gigaset/gigaset.h
30945@@ -35,6 +35,7 @@
30946 #include <linux/tty_driver.h>
30947 #include <linux/list.h>
30948 #include <linux/atomic.h>
30949+#include <asm/local.h>
30950
30951 #define GIG_VERSION {0, 5, 0, 0}
30952 #define GIG_COMPAT {0, 4, 0, 0}
30953@@ -433,7 +434,7 @@ struct cardstate {
30954 spinlock_t cmdlock;
30955 unsigned curlen, cmdbytes;
30956
30957- unsigned open_count;
30958+ local_t open_count;
30959 struct tty_struct *tty;
30960 struct tasklet_struct if_wake_tasklet;
30961 unsigned control_state;
30962diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
30963index e35058b..5898a8b 100644
30964--- a/drivers/isdn/gigaset/interface.c
30965+++ b/drivers/isdn/gigaset/interface.c
30966@@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
30967 }
30968 tty->driver_data = cs;
30969
30970- ++cs->open_count;
30971-
30972- if (cs->open_count == 1) {
30973+ if (local_inc_return(&cs->open_count) == 1) {
30974 spin_lock_irqsave(&cs->lock, flags);
30975 cs->tty = tty;
30976 spin_unlock_irqrestore(&cs->lock, flags);
30977@@ -192,10 +190,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
30978
30979 if (!cs->connected)
30980 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30981- else if (!cs->open_count)
30982+ else if (!local_read(&cs->open_count))
30983 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30984 else {
30985- if (!--cs->open_count) {
30986+ if (!local_dec_return(&cs->open_count)) {
30987 spin_lock_irqsave(&cs->lock, flags);
30988 cs->tty = NULL;
30989 spin_unlock_irqrestore(&cs->lock, flags);
30990@@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *tty,
30991 if (!cs->connected) {
30992 gig_dbg(DEBUG_IF, "not connected");
30993 retval = -ENODEV;
30994- } else if (!cs->open_count)
30995+ } else if (!local_read(&cs->open_count))
30996 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30997 else {
30998 retval = 0;
30999@@ -360,7 +358,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
31000 retval = -ENODEV;
31001 goto done;
31002 }
31003- if (!cs->open_count) {
31004+ if (!local_read(&cs->open_count)) {
31005 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31006 retval = -ENODEV;
31007 goto done;
31008@@ -413,7 +411,7 @@ static int if_write_room(struct tty_struct *tty)
31009 if (!cs->connected) {
31010 gig_dbg(DEBUG_IF, "not connected");
31011 retval = -ENODEV;
31012- } else if (!cs->open_count)
31013+ } else if (!local_read(&cs->open_count))
31014 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31015 else if (cs->mstate != MS_LOCKED) {
31016 dev_warn(cs->dev, "can't write to unlocked device\n");
31017@@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
31018
31019 if (!cs->connected)
31020 gig_dbg(DEBUG_IF, "not connected");
31021- else if (!cs->open_count)
31022+ else if (!local_read(&cs->open_count))
31023 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31024 else if (cs->mstate != MS_LOCKED)
31025 dev_warn(cs->dev, "can't write to unlocked device\n");
31026@@ -471,7 +469,7 @@ static void if_throttle(struct tty_struct *tty)
31027
31028 if (!cs->connected)
31029 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31030- else if (!cs->open_count)
31031+ else if (!local_read(&cs->open_count))
31032 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31033 else
31034 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31035@@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_struct *tty)
31036
31037 if (!cs->connected)
31038 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31039- else if (!cs->open_count)
31040+ else if (!local_read(&cs->open_count))
31041 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31042 else
31043 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31044@@ -526,7 +524,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
31045 goto out;
31046 }
31047
31048- if (!cs->open_count) {
31049+ if (!local_read(&cs->open_count)) {
31050 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31051 goto out;
31052 }
31053diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
31054index 2a57da59..e7a12ed 100644
31055--- a/drivers/isdn/hardware/avm/b1.c
31056+++ b/drivers/isdn/hardware/avm/b1.c
31057@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
31058 }
31059 if (left) {
31060 if (t4file->user) {
31061- if (copy_from_user(buf, dp, left))
31062+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31063 return -EFAULT;
31064 } else {
31065 memcpy(buf, dp, left);
31066@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
31067 }
31068 if (left) {
31069 if (config->user) {
31070- if (copy_from_user(buf, dp, left))
31071+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31072 return -EFAULT;
31073 } else {
31074 memcpy(buf, dp, left);
31075diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
31076index f130724..c373c68 100644
31077--- a/drivers/isdn/hardware/eicon/capidtmf.c
31078+++ b/drivers/isdn/hardware/eicon/capidtmf.c
31079@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
31080 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31081 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31082
31083+ pax_track_stack();
31084
31085 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31086 {
31087diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
31088index 4d425c6..a9be6c4 100644
31089--- a/drivers/isdn/hardware/eicon/capifunc.c
31090+++ b/drivers/isdn/hardware/eicon/capifunc.c
31091@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31092 IDI_SYNC_REQ req;
31093 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31094
31095+ pax_track_stack();
31096+
31097 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31098
31099 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31100diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
31101index 3029234..ef0d9e2 100644
31102--- a/drivers/isdn/hardware/eicon/diddfunc.c
31103+++ b/drivers/isdn/hardware/eicon/diddfunc.c
31104@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
31105 IDI_SYNC_REQ req;
31106 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31107
31108+ pax_track_stack();
31109+
31110 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31111
31112 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31113diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
31114index 0bbee78..a0d0a01 100644
31115--- a/drivers/isdn/hardware/eicon/divasfunc.c
31116+++ b/drivers/isdn/hardware/eicon/divasfunc.c
31117@@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
31118 IDI_SYNC_REQ req;
31119 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31120
31121+ pax_track_stack();
31122+
31123 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31124
31125 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31126diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
31127index 85784a7..a19ca98 100644
31128--- a/drivers/isdn/hardware/eicon/divasync.h
31129+++ b/drivers/isdn/hardware/eicon/divasync.h
31130@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
31131 } diva_didd_add_adapter_t;
31132 typedef struct _diva_didd_remove_adapter {
31133 IDI_CALL p_request;
31134-} diva_didd_remove_adapter_t;
31135+} __no_const diva_didd_remove_adapter_t;
31136 typedef struct _diva_didd_read_adapter_array {
31137 void * buffer;
31138 dword length;
31139diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
31140index db87d51..7d09acf 100644
31141--- a/drivers/isdn/hardware/eicon/idifunc.c
31142+++ b/drivers/isdn/hardware/eicon/idifunc.c
31143@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
31144 IDI_SYNC_REQ req;
31145 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31146
31147+ pax_track_stack();
31148+
31149 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31150
31151 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31152diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
31153index a339598..b6a8bfc 100644
31154--- a/drivers/isdn/hardware/eicon/message.c
31155+++ b/drivers/isdn/hardware/eicon/message.c
31156@@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
31157 dword d;
31158 word w;
31159
31160+ pax_track_stack();
31161+
31162 a = plci->adapter;
31163 Id = ((word)plci->Id<<8)|a->Id;
31164 PUT_WORD(&SS_Ind[4],0x0000);
31165@@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
31166 word j, n, w;
31167 dword d;
31168
31169+ pax_track_stack();
31170+
31171
31172 for(i=0;i<8;i++) bp_parms[i].length = 0;
31173 for(i=0;i<2;i++) global_config[i].length = 0;
31174@@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
31175 const byte llc3[] = {4,3,2,2,6,6,0};
31176 const byte header[] = {0,2,3,3,0,0,0};
31177
31178+ pax_track_stack();
31179+
31180 for(i=0;i<8;i++) bp_parms[i].length = 0;
31181 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31182 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31183@@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
31184 word appl_number_group_type[MAX_APPL];
31185 PLCI *auxplci;
31186
31187+ pax_track_stack();
31188+
31189 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31190
31191 if(!a->group_optimization_enabled)
31192diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
31193index a564b75..f3cf8b5 100644
31194--- a/drivers/isdn/hardware/eicon/mntfunc.c
31195+++ b/drivers/isdn/hardware/eicon/mntfunc.c
31196@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
31197 IDI_SYNC_REQ req;
31198 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31199
31200+ pax_track_stack();
31201+
31202 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31203
31204 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31205diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
31206index a3bd163..8956575 100644
31207--- a/drivers/isdn/hardware/eicon/xdi_adapter.h
31208+++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
31209@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
31210 typedef struct _diva_os_idi_adapter_interface {
31211 diva_init_card_proc_t cleanup_adapter_proc;
31212 diva_cmd_card_proc_t cmd_proc;
31213-} diva_os_idi_adapter_interface_t;
31214+} __no_const diva_os_idi_adapter_interface_t;
31215
31216 typedef struct _diva_os_xdi_adapter {
31217 struct list_head link;
31218diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
31219index 6ed82ad..b05ac05 100644
31220--- a/drivers/isdn/i4l/isdn_common.c
31221+++ b/drivers/isdn/i4l/isdn_common.c
31222@@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
31223 } iocpar;
31224 void __user *argp = (void __user *)arg;
31225
31226+ pax_track_stack();
31227+
31228 #define name iocpar.name
31229 #define bname iocpar.bname
31230 #define iocts iocpar.iocts
31231diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
31232index 1f355bb..43f1fea 100644
31233--- a/drivers/isdn/icn/icn.c
31234+++ b/drivers/isdn/icn/icn.c
31235@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
31236 if (count > len)
31237 count = len;
31238 if (user) {
31239- if (copy_from_user(msg, buf, count))
31240+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31241 return -EFAULT;
31242 } else
31243 memcpy(msg, buf, count);
31244diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
31245index 2535933..09a8e86 100644
31246--- a/drivers/lguest/core.c
31247+++ b/drivers/lguest/core.c
31248@@ -92,9 +92,17 @@ static __init int map_switcher(void)
31249 * it's worked so far. The end address needs +1 because __get_vm_area
31250 * allocates an extra guard page, so we need space for that.
31251 */
31252+
31253+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31254+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31255+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31256+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31257+#else
31258 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31259 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31260 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31261+#endif
31262+
31263 if (!switcher_vma) {
31264 err = -ENOMEM;
31265 printk("lguest: could not map switcher pages high\n");
31266@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31267 * Now the Switcher is mapped at the right address, we can't fail!
31268 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
31269 */
31270- memcpy(switcher_vma->addr, start_switcher_text,
31271+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31272 end_switcher_text - start_switcher_text);
31273
31274 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31275diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
31276index 65af42f..530c87a 100644
31277--- a/drivers/lguest/x86/core.c
31278+++ b/drivers/lguest/x86/core.c
31279@@ -59,7 +59,7 @@ static struct {
31280 /* Offset from where switcher.S was compiled to where we've copied it */
31281 static unsigned long switcher_offset(void)
31282 {
31283- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31284+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31285 }
31286
31287 /* This cpu's struct lguest_pages. */
31288@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
31289 * These copies are pretty cheap, so we do them unconditionally: */
31290 /* Save the current Host top-level page directory.
31291 */
31292+
31293+#ifdef CONFIG_PAX_PER_CPU_PGD
31294+ pages->state.host_cr3 = read_cr3();
31295+#else
31296 pages->state.host_cr3 = __pa(current->mm->pgd);
31297+#endif
31298+
31299 /*
31300 * Set up the Guest's page tables to see this CPU's pages (and no
31301 * other CPU's pages).
31302@@ -472,7 +478,7 @@ void __init lguest_arch_host_init(void)
31303 * compiled-in switcher code and the high-mapped copy we just made.
31304 */
31305 for (i = 0; i < IDT_ENTRIES; i++)
31306- default_idt_entries[i] += switcher_offset();
31307+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31308
31309 /*
31310 * Set up the Switcher's per-cpu areas.
31311@@ -555,7 +561,7 @@ void __init lguest_arch_host_init(void)
31312 * it will be undisturbed when we switch. To change %cs and jump we
31313 * need this structure to feed to Intel's "lcall" instruction.
31314 */
31315- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31316+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31317 lguest_entry.segment = LGUEST_CS;
31318
31319 /*
31320diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
31321index 40634b0..4f5855e 100644
31322--- a/drivers/lguest/x86/switcher_32.S
31323+++ b/drivers/lguest/x86/switcher_32.S
31324@@ -87,6 +87,7 @@
31325 #include <asm/page.h>
31326 #include <asm/segment.h>
31327 #include <asm/lguest.h>
31328+#include <asm/processor-flags.h>
31329
31330 // We mark the start of the code to copy
31331 // It's placed in .text tho it's never run here
31332@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31333 // Changes type when we load it: damn Intel!
31334 // For after we switch over our page tables
31335 // That entry will be read-only: we'd crash.
31336+
31337+#ifdef CONFIG_PAX_KERNEXEC
31338+ mov %cr0, %edx
31339+ xor $X86_CR0_WP, %edx
31340+ mov %edx, %cr0
31341+#endif
31342+
31343 movl $(GDT_ENTRY_TSS*8), %edx
31344 ltr %dx
31345
31346@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31347 // Let's clear it again for our return.
31348 // The GDT descriptor of the Host
31349 // Points to the table after two "size" bytes
31350- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31351+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31352 // Clear "used" from type field (byte 5, bit 2)
31353- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31354+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31355+
31356+#ifdef CONFIG_PAX_KERNEXEC
31357+ mov %cr0, %eax
31358+ xor $X86_CR0_WP, %eax
31359+ mov %eax, %cr0
31360+#endif
31361
31362 // Once our page table's switched, the Guest is live!
31363 // The Host fades as we run this final step.
31364@@ -295,13 +309,12 @@ deliver_to_host:
31365 // I consulted gcc, and it gave
31366 // These instructions, which I gladly credit:
31367 leal (%edx,%ebx,8), %eax
31368- movzwl (%eax),%edx
31369- movl 4(%eax), %eax
31370- xorw %ax, %ax
31371- orl %eax, %edx
31372+ movl 4(%eax), %edx
31373+ movw (%eax), %dx
31374 // Now the address of the handler's in %edx
31375 // We call it now: its "iret" drops us home.
31376- jmp *%edx
31377+ ljmp $__KERNEL_CS, $1f
31378+1: jmp *%edx
31379
31380 // Every interrupt can come to us here
31381 // But we must truly tell each apart.
31382diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
31383index 4daf9e5..b8d1d0f 100644
31384--- a/drivers/macintosh/macio_asic.c
31385+++ b/drivers/macintosh/macio_asic.c
31386@@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
31387 * MacIO is matched against any Apple ID, it's probe() function
31388 * will then decide wether it applies or not
31389 */
31390-static const struct pci_device_id __devinitdata pci_ids [] = { {
31391+static const struct pci_device_id __devinitconst pci_ids [] = { {
31392 .vendor = PCI_VENDOR_ID_APPLE,
31393 .device = PCI_ANY_ID,
31394 .subvendor = PCI_ANY_ID,
31395diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
31396index 2e9a3ca..c2fb229 100644
31397--- a/drivers/md/dm-ioctl.c
31398+++ b/drivers/md/dm-ioctl.c
31399@@ -1578,7 +1578,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
31400 cmd == DM_LIST_VERSIONS_CMD)
31401 return 0;
31402
31403- if ((cmd == DM_DEV_CREATE_CMD)) {
31404+ if (cmd == DM_DEV_CREATE_CMD) {
31405 if (!*param->name) {
31406 DMWARN("name not supplied when creating device");
31407 return -EINVAL;
31408diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
31409index 9bfd057..01180bc 100644
31410--- a/drivers/md/dm-raid1.c
31411+++ b/drivers/md/dm-raid1.c
31412@@ -40,7 +40,7 @@ enum dm_raid1_error {
31413
31414 struct mirror {
31415 struct mirror_set *ms;
31416- atomic_t error_count;
31417+ atomic_unchecked_t error_count;
31418 unsigned long error_type;
31419 struct dm_dev *dev;
31420 sector_t offset;
31421@@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
31422 struct mirror *m;
31423
31424 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31425- if (!atomic_read(&m->error_count))
31426+ if (!atomic_read_unchecked(&m->error_count))
31427 return m;
31428
31429 return NULL;
31430@@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
31431 * simple way to tell if a device has encountered
31432 * errors.
31433 */
31434- atomic_inc(&m->error_count);
31435+ atomic_inc_unchecked(&m->error_count);
31436
31437 if (test_and_set_bit(error_type, &m->error_type))
31438 return;
31439@@ -408,7 +408,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
31440 struct mirror *m = get_default_mirror(ms);
31441
31442 do {
31443- if (likely(!atomic_read(&m->error_count)))
31444+ if (likely(!atomic_read_unchecked(&m->error_count)))
31445 return m;
31446
31447 if (m-- == ms->mirror)
31448@@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
31449 {
31450 struct mirror *default_mirror = get_default_mirror(m->ms);
31451
31452- return !atomic_read(&default_mirror->error_count);
31453+ return !atomic_read_unchecked(&default_mirror->error_count);
31454 }
31455
31456 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31457@@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
31458 */
31459 if (likely(region_in_sync(ms, region, 1)))
31460 m = choose_mirror(ms, bio->bi_sector);
31461- else if (m && atomic_read(&m->error_count))
31462+ else if (m && atomic_read_unchecked(&m->error_count))
31463 m = NULL;
31464
31465 if (likely(m))
31466@@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
31467 }
31468
31469 ms->mirror[mirror].ms = ms;
31470- atomic_set(&(ms->mirror[mirror].error_count), 0);
31471+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31472 ms->mirror[mirror].error_type = 0;
31473 ms->mirror[mirror].offset = offset;
31474
31475@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_target *ti)
31476 */
31477 static char device_status_char(struct mirror *m)
31478 {
31479- if (!atomic_read(&(m->error_count)))
31480+ if (!atomic_read_unchecked(&(m->error_count)))
31481 return 'A';
31482
31483 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31484diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
31485index 3d80cf0..b77cc47 100644
31486--- a/drivers/md/dm-stripe.c
31487+++ b/drivers/md/dm-stripe.c
31488@@ -20,7 +20,7 @@ struct stripe {
31489 struct dm_dev *dev;
31490 sector_t physical_start;
31491
31492- atomic_t error_count;
31493+ atomic_unchecked_t error_count;
31494 };
31495
31496 struct stripe_c {
31497@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
31498 kfree(sc);
31499 return r;
31500 }
31501- atomic_set(&(sc->stripe[i].error_count), 0);
31502+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31503 }
31504
31505 ti->private = sc;
31506@@ -314,7 +314,7 @@ static int stripe_status(struct dm_target *ti,
31507 DMEMIT("%d ", sc->stripes);
31508 for (i = 0; i < sc->stripes; i++) {
31509 DMEMIT("%s ", sc->stripe[i].dev->name);
31510- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31511+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31512 'D' : 'A';
31513 }
31514 buffer[i] = '\0';
31515@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
31516 */
31517 for (i = 0; i < sc->stripes; i++)
31518 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31519- atomic_inc(&(sc->stripe[i].error_count));
31520- if (atomic_read(&(sc->stripe[i].error_count)) <
31521+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31522+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31523 DM_IO_ERROR_THRESHOLD)
31524 schedule_work(&sc->trigger_event);
31525 }
31526diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
31527index bc04518..7a83b81 100644
31528--- a/drivers/md/dm-table.c
31529+++ b/drivers/md/dm-table.c
31530@@ -389,7 +389,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
31531 if (!dev_size)
31532 return 0;
31533
31534- if ((start >= dev_size) || (start + len > dev_size)) {
31535+ if ((start >= dev_size) || (len > dev_size - start)) {
31536 DMWARN("%s: %s too small for target: "
31537 "start=%llu, len=%llu, dev_size=%llu",
31538 dm_device_name(ti->table->md), bdevname(bdev, b),
31539diff --git a/drivers/md/dm.c b/drivers/md/dm.c
31540index 52b39f3..83a8b6b 100644
31541--- a/drivers/md/dm.c
31542+++ b/drivers/md/dm.c
31543@@ -165,9 +165,9 @@ struct mapped_device {
31544 /*
31545 * Event handling.
31546 */
31547- atomic_t event_nr;
31548+ atomic_unchecked_t event_nr;
31549 wait_queue_head_t eventq;
31550- atomic_t uevent_seq;
31551+ atomic_unchecked_t uevent_seq;
31552 struct list_head uevent_list;
31553 spinlock_t uevent_lock; /* Protect access to uevent_list */
31554
31555@@ -1843,8 +1843,8 @@ static struct mapped_device *alloc_dev(int minor)
31556 rwlock_init(&md->map_lock);
31557 atomic_set(&md->holders, 1);
31558 atomic_set(&md->open_count, 0);
31559- atomic_set(&md->event_nr, 0);
31560- atomic_set(&md->uevent_seq, 0);
31561+ atomic_set_unchecked(&md->event_nr, 0);
31562+ atomic_set_unchecked(&md->uevent_seq, 0);
31563 INIT_LIST_HEAD(&md->uevent_list);
31564 spin_lock_init(&md->uevent_lock);
31565
31566@@ -1978,7 +1978,7 @@ static void event_callback(void *context)
31567
31568 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31569
31570- atomic_inc(&md->event_nr);
31571+ atomic_inc_unchecked(&md->event_nr);
31572 wake_up(&md->eventq);
31573 }
31574
31575@@ -2614,18 +2614,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
31576
31577 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31578 {
31579- return atomic_add_return(1, &md->uevent_seq);
31580+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31581 }
31582
31583 uint32_t dm_get_event_nr(struct mapped_device *md)
31584 {
31585- return atomic_read(&md->event_nr);
31586+ return atomic_read_unchecked(&md->event_nr);
31587 }
31588
31589 int dm_wait_event(struct mapped_device *md, int event_nr)
31590 {
31591 return wait_event_interruptible(md->eventq,
31592- (event_nr != atomic_read(&md->event_nr)));
31593+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31594 }
31595
31596 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31597diff --git a/drivers/md/md.c b/drivers/md/md.c
31598index 5c95ccb..217fa57 100644
31599--- a/drivers/md/md.c
31600+++ b/drivers/md/md.c
31601@@ -280,10 +280,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
31602 * start build, activate spare
31603 */
31604 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31605-static atomic_t md_event_count;
31606+static atomic_unchecked_t md_event_count;
31607 void md_new_event(mddev_t *mddev)
31608 {
31609- atomic_inc(&md_event_count);
31610+ atomic_inc_unchecked(&md_event_count);
31611 wake_up(&md_event_waiters);
31612 }
31613 EXPORT_SYMBOL_GPL(md_new_event);
31614@@ -293,7 +293,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31615 */
31616 static void md_new_event_inintr(mddev_t *mddev)
31617 {
31618- atomic_inc(&md_event_count);
31619+ atomic_inc_unchecked(&md_event_count);
31620 wake_up(&md_event_waiters);
31621 }
31622
31623@@ -1531,7 +1531,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
31624
31625 rdev->preferred_minor = 0xffff;
31626 rdev->data_offset = le64_to_cpu(sb->data_offset);
31627- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31628+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31629
31630 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31631 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31632@@ -1748,7 +1748,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
31633 else
31634 sb->resync_offset = cpu_to_le64(0);
31635
31636- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31637+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31638
31639 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31640 sb->size = cpu_to_le64(mddev->dev_sectors);
31641@@ -2643,7 +2643,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
31642 static ssize_t
31643 errors_show(mdk_rdev_t *rdev, char *page)
31644 {
31645- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31646+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31647 }
31648
31649 static ssize_t
31650@@ -2652,7 +2652,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
31651 char *e;
31652 unsigned long n = simple_strtoul(buf, &e, 10);
31653 if (*buf && (*e == 0 || *e == '\n')) {
31654- atomic_set(&rdev->corrected_errors, n);
31655+ atomic_set_unchecked(&rdev->corrected_errors, n);
31656 return len;
31657 }
31658 return -EINVAL;
31659@@ -3042,8 +3042,8 @@ int md_rdev_init(mdk_rdev_t *rdev)
31660 rdev->sb_loaded = 0;
31661 rdev->bb_page = NULL;
31662 atomic_set(&rdev->nr_pending, 0);
31663- atomic_set(&rdev->read_errors, 0);
31664- atomic_set(&rdev->corrected_errors, 0);
31665+ atomic_set_unchecked(&rdev->read_errors, 0);
31666+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31667
31668 INIT_LIST_HEAD(&rdev->same_set);
31669 init_waitqueue_head(&rdev->blocked_wait);
31670@@ -6667,7 +6667,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31671
31672 spin_unlock(&pers_lock);
31673 seq_printf(seq, "\n");
31674- seq->poll_event = atomic_read(&md_event_count);
31675+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31676 return 0;
31677 }
31678 if (v == (void*)2) {
31679@@ -6756,7 +6756,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31680 chunk_kb ? "KB" : "B");
31681 if (bitmap->file) {
31682 seq_printf(seq, ", file: ");
31683- seq_path(seq, &bitmap->file->f_path, " \t\n");
31684+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31685 }
31686
31687 seq_printf(seq, "\n");
31688@@ -6787,7 +6787,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
31689 return error;
31690
31691 seq = file->private_data;
31692- seq->poll_event = atomic_read(&md_event_count);
31693+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31694 return error;
31695 }
31696
31697@@ -6801,7 +6801,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
31698 /* always allow read */
31699 mask = POLLIN | POLLRDNORM;
31700
31701- if (seq->poll_event != atomic_read(&md_event_count))
31702+ if (seq->poll_event != atomic_read_unchecked(&md_event_count))
31703 mask |= POLLERR | POLLPRI;
31704 return mask;
31705 }
31706@@ -6845,7 +6845,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
31707 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31708 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31709 (int)part_stat_read(&disk->part0, sectors[1]) -
31710- atomic_read(&disk->sync_io);
31711+ atomic_read_unchecked(&disk->sync_io);
31712 /* sync IO will cause sync_io to increase before the disk_stats
31713 * as sync_io is counted when a request starts, and
31714 * disk_stats is counted when it completes.
31715diff --git a/drivers/md/md.h b/drivers/md/md.h
31716index 0a309dc..7e01d7f 100644
31717--- a/drivers/md/md.h
31718+++ b/drivers/md/md.h
31719@@ -124,13 +124,13 @@ struct mdk_rdev_s
31720 * only maintained for arrays that
31721 * support hot removal
31722 */
31723- atomic_t read_errors; /* number of consecutive read errors that
31724+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
31725 * we have tried to ignore.
31726 */
31727 struct timespec last_read_error; /* monotonic time since our
31728 * last read error
31729 */
31730- atomic_t corrected_errors; /* number of corrected read errors,
31731+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
31732 * for reporting to userspace and storing
31733 * in superblock.
31734 */
31735@@ -415,7 +415,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
31736
31737 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
31738 {
31739- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31740+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31741 }
31742
31743 struct mdk_personality
31744diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
31745index 606fc04..f1ff8dc 100644
31746--- a/drivers/md/raid1.c
31747+++ b/drivers/md/raid1.c
31748@@ -1550,7 +1550,7 @@ static int fix_sync_read_error(r1bio_t *r1_bio)
31749 if (r1_sync_page_io(rdev, sect, s,
31750 bio->bi_io_vec[idx].bv_page,
31751 READ) != 0)
31752- atomic_add(s, &rdev->corrected_errors);
31753+ atomic_add_unchecked(s, &rdev->corrected_errors);
31754 }
31755 sectors -= s;
31756 sect += s;
31757@@ -1763,7 +1763,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
31758 test_bit(In_sync, &rdev->flags)) {
31759 if (r1_sync_page_io(rdev, sect, s,
31760 conf->tmppage, READ)) {
31761- atomic_add(s, &rdev->corrected_errors);
31762+ atomic_add_unchecked(s, &rdev->corrected_errors);
31763 printk(KERN_INFO
31764 "md/raid1:%s: read error corrected "
31765 "(%d sectors at %llu on %s)\n",
31766diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
31767index 1d44228..98db57d 100644
31768--- a/drivers/md/raid10.c
31769+++ b/drivers/md/raid10.c
31770@@ -1423,7 +1423,7 @@ static void end_sync_read(struct bio *bio, int error)
31771 /* The write handler will notice the lack of
31772 * R10BIO_Uptodate and record any errors etc
31773 */
31774- atomic_add(r10_bio->sectors,
31775+ atomic_add_unchecked(r10_bio->sectors,
31776 &conf->mirrors[d].rdev->corrected_errors);
31777
31778 /* for reconstruct, we always reschedule after a read.
31779@@ -1723,7 +1723,7 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31780 {
31781 struct timespec cur_time_mon;
31782 unsigned long hours_since_last;
31783- unsigned int read_errors = atomic_read(&rdev->read_errors);
31784+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
31785
31786 ktime_get_ts(&cur_time_mon);
31787
31788@@ -1745,9 +1745,9 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31789 * overflowing the shift of read_errors by hours_since_last.
31790 */
31791 if (hours_since_last >= 8 * sizeof(read_errors))
31792- atomic_set(&rdev->read_errors, 0);
31793+ atomic_set_unchecked(&rdev->read_errors, 0);
31794 else
31795- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
31796+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
31797 }
31798
31799 static int r10_sync_page_io(mdk_rdev_t *rdev, sector_t sector,
31800@@ -1797,8 +1797,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31801 return;
31802
31803 check_decay_read_errors(mddev, rdev);
31804- atomic_inc(&rdev->read_errors);
31805- if (atomic_read(&rdev->read_errors) > max_read_errors) {
31806+ atomic_inc_unchecked(&rdev->read_errors);
31807+ if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
31808 char b[BDEVNAME_SIZE];
31809 bdevname(rdev->bdev, b);
31810
31811@@ -1806,7 +1806,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31812 "md/raid10:%s: %s: Raid device exceeded "
31813 "read_error threshold [cur %d:max %d]\n",
31814 mdname(mddev), b,
31815- atomic_read(&rdev->read_errors), max_read_errors);
31816+ atomic_read_unchecked(&rdev->read_errors), max_read_errors);
31817 printk(KERN_NOTICE
31818 "md/raid10:%s: %s: Failing raid device\n",
31819 mdname(mddev), b);
31820@@ -1951,7 +1951,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31821 (unsigned long long)(
31822 sect + rdev->data_offset),
31823 bdevname(rdev->bdev, b));
31824- atomic_add(s, &rdev->corrected_errors);
31825+ atomic_add_unchecked(s, &rdev->corrected_errors);
31826 }
31827
31828 rdev_dec_pending(rdev, mddev);
31829diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
31830index b6200c3..02e8702 100644
31831--- a/drivers/md/raid5.c
31832+++ b/drivers/md/raid5.c
31833@@ -1616,19 +1616,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
31834 (unsigned long long)(sh->sector
31835 + rdev->data_offset),
31836 bdevname(rdev->bdev, b));
31837- atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
31838+ atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
31839 clear_bit(R5_ReadError, &sh->dev[i].flags);
31840 clear_bit(R5_ReWrite, &sh->dev[i].flags);
31841 }
31842- if (atomic_read(&conf->disks[i].rdev->read_errors))
31843- atomic_set(&conf->disks[i].rdev->read_errors, 0);
31844+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
31845+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
31846 } else {
31847 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
31848 int retry = 0;
31849 rdev = conf->disks[i].rdev;
31850
31851 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
31852- atomic_inc(&rdev->read_errors);
31853+ atomic_inc_unchecked(&rdev->read_errors);
31854 if (conf->mddev->degraded >= conf->max_degraded)
31855 printk_ratelimited(
31856 KERN_WARNING
31857@@ -1648,7 +1648,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
31858 (unsigned long long)(sh->sector
31859 + rdev->data_offset),
31860 bdn);
31861- else if (atomic_read(&rdev->read_errors)
31862+ else if (atomic_read_unchecked(&rdev->read_errors)
31863 > conf->max_nr_stripes)
31864 printk(KERN_WARNING
31865 "md/raid:%s: Too many read errors, failing device %s.\n",
31866@@ -1978,6 +1978,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
31867 sector_t r_sector;
31868 struct stripe_head sh2;
31869
31870+ pax_track_stack();
31871
31872 chunk_offset = sector_div(new_sector, sectors_per_chunk);
31873 stripe = new_sector;
31874diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
31875index 1d1d8d2..6c6837a 100644
31876--- a/drivers/media/common/saa7146_hlp.c
31877+++ b/drivers/media/common/saa7146_hlp.c
31878@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
31879
31880 int x[32], y[32], w[32], h[32];
31881
31882+ pax_track_stack();
31883+
31884 /* clear out memory */
31885 memset(&line_list[0], 0x00, sizeof(u32)*32);
31886 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
31887diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
31888index 573d540..16f78f3 100644
31889--- a/drivers/media/dvb/ddbridge/ddbridge-core.c
31890+++ b/drivers/media/dvb/ddbridge/ddbridge-core.c
31891@@ -1675,7 +1675,7 @@ static struct ddb_info ddb_v6 = {
31892 .subvendor = _subvend, .subdevice = _subdev, \
31893 .driver_data = (unsigned long)&_driverdata }
31894
31895-static const struct pci_device_id ddb_id_tbl[] __devinitdata = {
31896+static const struct pci_device_id ddb_id_tbl[] __devinitconst = {
31897 DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
31898 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
31899 DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
31900diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31901index 7ea517b..252fe54 100644
31902--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31903+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31904@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
31905 u8 buf[HOST_LINK_BUF_SIZE];
31906 int i;
31907
31908+ pax_track_stack();
31909+
31910 dprintk("%s\n", __func__);
31911
31912 /* check if we have space for a link buf in the rx_buffer */
31913@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
31914 unsigned long timeout;
31915 int written;
31916
31917+ pax_track_stack();
31918+
31919 dprintk("%s\n", __func__);
31920
31921 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
31922diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
31923index a7d876f..8c21b61 100644
31924--- a/drivers/media/dvb/dvb-core/dvb_demux.h
31925+++ b/drivers/media/dvb/dvb-core/dvb_demux.h
31926@@ -73,7 +73,7 @@ struct dvb_demux_feed {
31927 union {
31928 dmx_ts_cb ts;
31929 dmx_section_cb sec;
31930- } cb;
31931+ } __no_const cb;
31932
31933 struct dvb_demux *demux;
31934 void *priv;
31935diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
31936index f732877..d38c35a 100644
31937--- a/drivers/media/dvb/dvb-core/dvbdev.c
31938+++ b/drivers/media/dvb/dvb-core/dvbdev.c
31939@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
31940 const struct dvb_device *template, void *priv, int type)
31941 {
31942 struct dvb_device *dvbdev;
31943- struct file_operations *dvbdevfops;
31944+ file_operations_no_const *dvbdevfops;
31945 struct device *clsdev;
31946 int minor;
31947 int id;
31948diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
31949index acb5fb2..2413f1d 100644
31950--- a/drivers/media/dvb/dvb-usb/cxusb.c
31951+++ b/drivers/media/dvb/dvb-usb/cxusb.c
31952@@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
31953 struct dib0700_adapter_state {
31954 int (*set_param_save) (struct dvb_frontend *,
31955 struct dvb_frontend_parameters *);
31956-};
31957+} __no_const;
31958
31959 static int dib7070_set_param_override(struct dvb_frontend *fe,
31960 struct dvb_frontend_parameters *fep)
31961diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
31962index a224e94..503b76a 100644
31963--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
31964+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
31965@@ -478,6 +478,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
31966 if (!buf)
31967 return -ENOMEM;
31968
31969+ pax_track_stack();
31970+
31971 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
31972 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
31973 hx.addr, hx.len, hx.chk);
31974diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
31975index 058b231..183d2b3 100644
31976--- a/drivers/media/dvb/dvb-usb/dw2102.c
31977+++ b/drivers/media/dvb/dvb-usb/dw2102.c
31978@@ -95,7 +95,7 @@ struct su3000_state {
31979
31980 struct s6x0_state {
31981 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
31982-};
31983+} __no_const;
31984
31985 /* debug */
31986 static int dvb_usb_dw2102_debug;
31987diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
31988index 37b1469..28a6f6f 100644
31989--- a/drivers/media/dvb/dvb-usb/lmedm04.c
31990+++ b/drivers/media/dvb/dvb-usb/lmedm04.c
31991@@ -742,6 +742,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
31992 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
31993 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
31994
31995+ pax_track_stack();
31996
31997 data[0] = 0x8a;
31998 len_in = 1;
31999@@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_device *dev)
32000 int ret = 0, len_in;
32001 u8 data[512] = {0};
32002
32003+ pax_track_stack();
32004+
32005 data[0] = 0x0a;
32006 len_in = 1;
32007 info("FRM Firmware Cold Reset");
32008diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
32009index ba91735..4261d84 100644
32010--- a/drivers/media/dvb/frontends/dib3000.h
32011+++ b/drivers/media/dvb/frontends/dib3000.h
32012@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
32013 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
32014 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
32015 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
32016-};
32017+} __no_const;
32018
32019 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
32020 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
32021diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c
32022index 90bf573..e8463da 100644
32023--- a/drivers/media/dvb/frontends/ds3000.c
32024+++ b/drivers/media/dvb/frontends/ds3000.c
32025@@ -1210,7 +1210,7 @@ static int ds3000_set_frontend(struct dvb_frontend *fe,
32026
32027 for (i = 0; i < 30 ; i++) {
32028 ds3000_read_status(fe, &status);
32029- if (status && FE_HAS_LOCK)
32030+ if (status & FE_HAS_LOCK)
32031 break;
32032
32033 msleep(10);
32034diff --git a/drivers/media/dvb/frontends/mb86a16.c b/drivers/media/dvb/frontends/mb86a16.c
32035index c283112..7f367a7 100644
32036--- a/drivers/media/dvb/frontends/mb86a16.c
32037+++ b/drivers/media/dvb/frontends/mb86a16.c
32038@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16_state *state)
32039 int ret = -1;
32040 int sync;
32041
32042+ pax_track_stack();
32043+
32044 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32045
32046 fcp = 3000;
32047diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
32048index c709ce6..b3fe620 100644
32049--- a/drivers/media/dvb/frontends/or51211.c
32050+++ b/drivers/media/dvb/frontends/or51211.c
32051@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
32052 u8 tudata[585];
32053 int i;
32054
32055+ pax_track_stack();
32056+
32057 dprintk("Firmware is %zd bytes\n",fw->size);
32058
32059 /* Get eprom data */
32060diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
32061index 0564192..75b16f5 100644
32062--- a/drivers/media/dvb/ngene/ngene-cards.c
32063+++ b/drivers/media/dvb/ngene/ngene-cards.c
32064@@ -477,7 +477,7 @@ static struct ngene_info ngene_info_m780 = {
32065
32066 /****************************************************************************/
32067
32068-static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
32069+static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
32070 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
32071 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
32072 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
32073diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
32074index 16a089f..ab1667d 100644
32075--- a/drivers/media/radio/radio-cadet.c
32076+++ b/drivers/media/radio/radio-cadet.c
32077@@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
32078 unsigned char readbuf[RDS_BUFFER];
32079 int i = 0;
32080
32081+ if (count > RDS_BUFFER)
32082+ return -EFAULT;
32083 mutex_lock(&dev->lock);
32084 if (dev->rdsstat == 0) {
32085 dev->rdsstat = 1;
32086diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
32087index 9cde353..8c6a1c3 100644
32088--- a/drivers/media/video/au0828/au0828.h
32089+++ b/drivers/media/video/au0828/au0828.h
32090@@ -191,7 +191,7 @@ struct au0828_dev {
32091
32092 /* I2C */
32093 struct i2c_adapter i2c_adap;
32094- struct i2c_algorithm i2c_algo;
32095+ i2c_algorithm_no_const i2c_algo;
32096 struct i2c_client i2c_client;
32097 u32 i2c_rc;
32098
32099diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
32100index 9e2f870..22e3a08 100644
32101--- a/drivers/media/video/cx18/cx18-driver.c
32102+++ b/drivers/media/video/cx18/cx18-driver.c
32103@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
32104 struct i2c_client c;
32105 u8 eedata[256];
32106
32107+ pax_track_stack();
32108+
32109 memset(&c, 0, sizeof(c));
32110 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32111 c.adapter = &cx->i2c_adap[0];
32112diff --git a/drivers/media/video/cx23885/cx23885-input.c b/drivers/media/video/cx23885/cx23885-input.c
32113index ce765e3..f9e1b04 100644
32114--- a/drivers/media/video/cx23885/cx23885-input.c
32115+++ b/drivers/media/video/cx23885/cx23885-input.c
32116@@ -53,6 +53,8 @@ static void cx23885_input_process_measurements(struct cx23885_dev *dev,
32117 bool handle = false;
32118 struct ir_raw_event ir_core_event[64];
32119
32120+ pax_track_stack();
32121+
32122 do {
32123 num = 0;
32124 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32125diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
32126index 68d1240..46b32eb 100644
32127--- a/drivers/media/video/cx88/cx88-alsa.c
32128+++ b/drivers/media/video/cx88/cx88-alsa.c
32129@@ -766,7 +766,7 @@ static struct snd_kcontrol_new snd_cx88_alc_switch = {
32130 * Only boards with eeprom and byte 1 at eeprom=1 have it
32131 */
32132
32133-static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
32134+static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
32135 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
32136 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
32137 {0, }
32138diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32139index 9515f3a..c9ecb85 100644
32140--- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32141+++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32142@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
32143 u8 *eeprom;
32144 struct tveeprom tvdata;
32145
32146+ pax_track_stack();
32147+
32148 memset(&tvdata,0,sizeof(tvdata));
32149
32150 eeprom = pvr2_eeprom_fetch(hdw);
32151diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
32152index 305e6aa..0143317 100644
32153--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
32154+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
32155@@ -196,7 +196,7 @@ struct pvr2_hdw {
32156
32157 /* I2C stuff */
32158 struct i2c_adapter i2c_adap;
32159- struct i2c_algorithm i2c_algo;
32160+ i2c_algorithm_no_const i2c_algo;
32161 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
32162 int i2c_cx25840_hack_state;
32163 int i2c_linked;
32164diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
32165index f9f29cc..5a2e330 100644
32166--- a/drivers/media/video/saa7134/saa6752hs.c
32167+++ b/drivers/media/video/saa7134/saa6752hs.c
32168@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
32169 unsigned char localPAT[256];
32170 unsigned char localPMT[256];
32171
32172+ pax_track_stack();
32173+
32174 /* Set video format - must be done first as it resets other settings */
32175 set_reg8(client, 0x41, h->video_format);
32176
32177diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
32178index 62fac7f..f29e0b9 100644
32179--- a/drivers/media/video/saa7164/saa7164-cmd.c
32180+++ b/drivers/media/video/saa7164/saa7164-cmd.c
32181@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
32182 u8 tmp[512];
32183 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32184
32185+ pax_track_stack();
32186+
32187 /* While any outstand message on the bus exists... */
32188 do {
32189
32190@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
32191 u8 tmp[512];
32192 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32193
32194+ pax_track_stack();
32195+
32196 while (loop) {
32197
32198 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
32199diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
32200index 84cd1b6..f741e07 100644
32201--- a/drivers/media/video/timblogiw.c
32202+++ b/drivers/media/video/timblogiw.c
32203@@ -744,7 +744,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
32204
32205 /* Platform device functions */
32206
32207-static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
32208+static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
32209 .vidioc_querycap = timblogiw_querycap,
32210 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
32211 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
32212@@ -766,7 +766,7 @@ static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
32213 .vidioc_enum_framesizes = timblogiw_enum_framesizes,
32214 };
32215
32216-static __devinitconst struct v4l2_file_operations timblogiw_fops = {
32217+static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
32218 .owner = THIS_MODULE,
32219 .open = timblogiw_open,
32220 .release = timblogiw_close,
32221diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
32222index f344411..6ae9974 100644
32223--- a/drivers/media/video/usbvision/usbvision-core.c
32224+++ b/drivers/media/video/usbvision/usbvision-core.c
32225@@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_compress(struct usb_usbvision *usbvision
32226 unsigned char rv, gv, bv;
32227 static unsigned char *Y, *U, *V;
32228
32229+ pax_track_stack();
32230+
32231 frame = usbvision->cur_frame;
32232 image_size = frame->frmwidth * frame->frmheight;
32233 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
32234diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
32235index f300dea..04834ba 100644
32236--- a/drivers/media/video/videobuf-dma-sg.c
32237+++ b/drivers/media/video/videobuf-dma-sg.c
32238@@ -607,6 +607,8 @@ void *videobuf_sg_alloc(size_t size)
32239 {
32240 struct videobuf_queue q;
32241
32242+ pax_track_stack();
32243+
32244 /* Required to make generic handler to call __videobuf_alloc */
32245 q.int_ops = &sg_ops;
32246
32247diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
32248index 7956a10..f39232f 100644
32249--- a/drivers/message/fusion/mptbase.c
32250+++ b/drivers/message/fusion/mptbase.c
32251@@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
32252 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
32253 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
32254
32255+#ifdef CONFIG_GRKERNSEC_HIDESYM
32256+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
32257+#else
32258 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
32259 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
32260+#endif
32261+
32262 /*
32263 * Rounding UP to nearest 4-kB boundary here...
32264 */
32265diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
32266index 7596aec..f7ae9aa 100644
32267--- a/drivers/message/fusion/mptsas.c
32268+++ b/drivers/message/fusion/mptsas.c
32269@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
32270 return 0;
32271 }
32272
32273+static inline void
32274+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32275+{
32276+ if (phy_info->port_details) {
32277+ phy_info->port_details->rphy = rphy;
32278+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32279+ ioc->name, rphy));
32280+ }
32281+
32282+ if (rphy) {
32283+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32284+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32285+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32286+ ioc->name, rphy, rphy->dev.release));
32287+ }
32288+}
32289+
32290 /* no mutex */
32291 static void
32292 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
32293@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
32294 return NULL;
32295 }
32296
32297-static inline void
32298-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32299-{
32300- if (phy_info->port_details) {
32301- phy_info->port_details->rphy = rphy;
32302- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32303- ioc->name, rphy));
32304- }
32305-
32306- if (rphy) {
32307- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32308- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32309- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32310- ioc->name, rphy, rphy->dev.release));
32311- }
32312-}
32313-
32314 static inline struct sas_port *
32315 mptsas_get_port(struct mptsas_phyinfo *phy_info)
32316 {
32317diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
32318index ce61a57..3da8862 100644
32319--- a/drivers/message/fusion/mptscsih.c
32320+++ b/drivers/message/fusion/mptscsih.c
32321@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
32322
32323 h = shost_priv(SChost);
32324
32325- if (h) {
32326- if (h->info_kbuf == NULL)
32327- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32328- return h->info_kbuf;
32329- h->info_kbuf[0] = '\0';
32330+ if (!h)
32331+ return NULL;
32332
32333- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32334- h->info_kbuf[size-1] = '\0';
32335- }
32336+ if (h->info_kbuf == NULL)
32337+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32338+ return h->info_kbuf;
32339+ h->info_kbuf[0] = '\0';
32340+
32341+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32342+ h->info_kbuf[size-1] = '\0';
32343
32344 return h->info_kbuf;
32345 }
32346diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
32347index 098de2b..fbb922c 100644
32348--- a/drivers/message/i2o/i2o_config.c
32349+++ b/drivers/message/i2o/i2o_config.c
32350@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned long arg)
32351 struct i2o_message *msg;
32352 unsigned int iop;
32353
32354+ pax_track_stack();
32355+
32356 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
32357 return -EFAULT;
32358
32359diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
32360index 07dbeaf..5533142 100644
32361--- a/drivers/message/i2o/i2o_proc.c
32362+++ b/drivers/message/i2o/i2o_proc.c
32363@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
32364 "Array Controller Device"
32365 };
32366
32367-static char *chtostr(u8 * chars, int n)
32368-{
32369- char tmp[256];
32370- tmp[0] = 0;
32371- return strncat(tmp, (char *)chars, n);
32372-}
32373-
32374 static int i2o_report_query_status(struct seq_file *seq, int block_status,
32375 char *group)
32376 {
32377@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
32378
32379 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
32380 seq_printf(seq, "%-#8x", ddm_table.module_id);
32381- seq_printf(seq, "%-29s",
32382- chtostr(ddm_table.module_name_version, 28));
32383+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
32384 seq_printf(seq, "%9d ", ddm_table.data_size);
32385 seq_printf(seq, "%8d", ddm_table.code_size);
32386
32387@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
32388
32389 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
32390 seq_printf(seq, "%-#8x", dst->module_id);
32391- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
32392- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
32393+ seq_printf(seq, "%-.28s", dst->module_name_version);
32394+ seq_printf(seq, "%-.8s", dst->date);
32395 seq_printf(seq, "%8d ", dst->module_size);
32396 seq_printf(seq, "%8d ", dst->mpb_size);
32397 seq_printf(seq, "0x%04x", dst->module_flags);
32398@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
32399 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
32400 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
32401 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
32402- seq_printf(seq, "Vendor info : %s\n",
32403- chtostr((u8 *) (work32 + 2), 16));
32404- seq_printf(seq, "Product info : %s\n",
32405- chtostr((u8 *) (work32 + 6), 16));
32406- seq_printf(seq, "Description : %s\n",
32407- chtostr((u8 *) (work32 + 10), 16));
32408- seq_printf(seq, "Product rev. : %s\n",
32409- chtostr((u8 *) (work32 + 14), 8));
32410+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
32411+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
32412+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
32413+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
32414
32415 seq_printf(seq, "Serial number : ");
32416 print_serial_number(seq, (u8 *) (work32 + 16),
32417@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
32418 }
32419
32420 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
32421- seq_printf(seq, "Module name : %s\n",
32422- chtostr(result.module_name, 24));
32423- seq_printf(seq, "Module revision : %s\n",
32424- chtostr(result.module_rev, 8));
32425+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
32426+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
32427
32428 seq_printf(seq, "Serial number : ");
32429 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
32430@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
32431 return 0;
32432 }
32433
32434- seq_printf(seq, "Device name : %s\n",
32435- chtostr(result.device_name, 64));
32436- seq_printf(seq, "Service name : %s\n",
32437- chtostr(result.service_name, 64));
32438- seq_printf(seq, "Physical name : %s\n",
32439- chtostr(result.physical_location, 64));
32440- seq_printf(seq, "Instance number : %s\n",
32441- chtostr(result.instance_number, 4));
32442+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
32443+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
32444+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
32445+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
32446
32447 return 0;
32448 }
32449diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
32450index a8c08f3..155fe3d 100644
32451--- a/drivers/message/i2o/iop.c
32452+++ b/drivers/message/i2o/iop.c
32453@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
32454
32455 spin_lock_irqsave(&c->context_list_lock, flags);
32456
32457- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
32458- atomic_inc(&c->context_list_counter);
32459+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
32460+ atomic_inc_unchecked(&c->context_list_counter);
32461
32462- entry->context = atomic_read(&c->context_list_counter);
32463+ entry->context = atomic_read_unchecked(&c->context_list_counter);
32464
32465 list_add(&entry->list, &c->context_list);
32466
32467@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
32468
32469 #if BITS_PER_LONG == 64
32470 spin_lock_init(&c->context_list_lock);
32471- atomic_set(&c->context_list_counter, 0);
32472+ atomic_set_unchecked(&c->context_list_counter, 0);
32473 INIT_LIST_HEAD(&c->context_list);
32474 #endif
32475
32476diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
32477index a20e1c4..4f57255 100644
32478--- a/drivers/mfd/ab3100-core.c
32479+++ b/drivers/mfd/ab3100-core.c
32480@@ -809,7 +809,7 @@ struct ab_family_id {
32481 char *name;
32482 };
32483
32484-static const struct ab_family_id ids[] __devinitdata = {
32485+static const struct ab_family_id ids[] __devinitconst = {
32486 /* AB3100 */
32487 {
32488 .id = 0xc0,
32489diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
32490index f12720d..3c251fd 100644
32491--- a/drivers/mfd/abx500-core.c
32492+++ b/drivers/mfd/abx500-core.c
32493@@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
32494
32495 struct abx500_device_entry {
32496 struct list_head list;
32497- struct abx500_ops ops;
32498+ abx500_ops_no_const ops;
32499 struct device *dev;
32500 };
32501
32502diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
32503index 5c2a06a..8fa077c 100644
32504--- a/drivers/mfd/janz-cmodio.c
32505+++ b/drivers/mfd/janz-cmodio.c
32506@@ -13,6 +13,7 @@
32507
32508 #include <linux/kernel.h>
32509 #include <linux/module.h>
32510+#include <linux/slab.h>
32511 #include <linux/init.h>
32512 #include <linux/pci.h>
32513 #include <linux/interrupt.h>
32514diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
32515index 5fe5de1..af64f53 100644
32516--- a/drivers/mfd/wm8350-i2c.c
32517+++ b/drivers/mfd/wm8350-i2c.c
32518@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
32519 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
32520 int ret;
32521
32522+ pax_track_stack();
32523+
32524 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
32525 return -EINVAL;
32526
32527diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
32528index 8b51cd6..f628f8d 100644
32529--- a/drivers/misc/lis3lv02d/lis3lv02d.c
32530+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
32531@@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
32532 * the lid is closed. This leads to interrupts as soon as a little move
32533 * is done.
32534 */
32535- atomic_inc(&lis3_dev.count);
32536+ atomic_inc_unchecked(&lis3_dev.count);
32537
32538 wake_up_interruptible(&lis3_dev.misc_wait);
32539 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
32540@@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
32541 if (lis3_dev.pm_dev)
32542 pm_runtime_get_sync(lis3_dev.pm_dev);
32543
32544- atomic_set(&lis3_dev.count, 0);
32545+ atomic_set_unchecked(&lis3_dev.count, 0);
32546 return 0;
32547 }
32548
32549@@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
32550 add_wait_queue(&lis3_dev.misc_wait, &wait);
32551 while (true) {
32552 set_current_state(TASK_INTERRUPTIBLE);
32553- data = atomic_xchg(&lis3_dev.count, 0);
32554+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
32555 if (data)
32556 break;
32557
32558@@ -585,7 +585,7 @@ out:
32559 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
32560 {
32561 poll_wait(file, &lis3_dev.misc_wait, wait);
32562- if (atomic_read(&lis3_dev.count))
32563+ if (atomic_read_unchecked(&lis3_dev.count))
32564 return POLLIN | POLLRDNORM;
32565 return 0;
32566 }
32567diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
32568index a193958..4d7ecd2 100644
32569--- a/drivers/misc/lis3lv02d/lis3lv02d.h
32570+++ b/drivers/misc/lis3lv02d/lis3lv02d.h
32571@@ -265,7 +265,7 @@ struct lis3lv02d {
32572 struct input_polled_dev *idev; /* input device */
32573 struct platform_device *pdev; /* platform device */
32574 struct regulator_bulk_data regulators[2];
32575- atomic_t count; /* interrupt count after last read */
32576+ atomic_unchecked_t count; /* interrupt count after last read */
32577 union axis_conversion ac; /* hw -> logical axis */
32578 int mapped_btns[3];
32579
32580diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
32581index 2f30bad..c4c13d0 100644
32582--- a/drivers/misc/sgi-gru/gruhandles.c
32583+++ b/drivers/misc/sgi-gru/gruhandles.c
32584@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
32585 unsigned long nsec;
32586
32587 nsec = CLKS2NSEC(clks);
32588- atomic_long_inc(&mcs_op_statistics[op].count);
32589- atomic_long_add(nsec, &mcs_op_statistics[op].total);
32590+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
32591+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
32592 if (mcs_op_statistics[op].max < nsec)
32593 mcs_op_statistics[op].max = nsec;
32594 }
32595diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
32596index 7768b87..f8aac38 100644
32597--- a/drivers/misc/sgi-gru/gruprocfs.c
32598+++ b/drivers/misc/sgi-gru/gruprocfs.c
32599@@ -32,9 +32,9 @@
32600
32601 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
32602
32603-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
32604+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
32605 {
32606- unsigned long val = atomic_long_read(v);
32607+ unsigned long val = atomic_long_read_unchecked(v);
32608
32609 seq_printf(s, "%16lu %s\n", val, id);
32610 }
32611@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
32612
32613 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
32614 for (op = 0; op < mcsop_last; op++) {
32615- count = atomic_long_read(&mcs_op_statistics[op].count);
32616- total = atomic_long_read(&mcs_op_statistics[op].total);
32617+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
32618+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
32619 max = mcs_op_statistics[op].max;
32620 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
32621 count ? total / count : 0, max);
32622diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
32623index 5c3ce24..4915ccb 100644
32624--- a/drivers/misc/sgi-gru/grutables.h
32625+++ b/drivers/misc/sgi-gru/grutables.h
32626@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
32627 * GRU statistics.
32628 */
32629 struct gru_stats_s {
32630- atomic_long_t vdata_alloc;
32631- atomic_long_t vdata_free;
32632- atomic_long_t gts_alloc;
32633- atomic_long_t gts_free;
32634- atomic_long_t gms_alloc;
32635- atomic_long_t gms_free;
32636- atomic_long_t gts_double_allocate;
32637- atomic_long_t assign_context;
32638- atomic_long_t assign_context_failed;
32639- atomic_long_t free_context;
32640- atomic_long_t load_user_context;
32641- atomic_long_t load_kernel_context;
32642- atomic_long_t lock_kernel_context;
32643- atomic_long_t unlock_kernel_context;
32644- atomic_long_t steal_user_context;
32645- atomic_long_t steal_kernel_context;
32646- atomic_long_t steal_context_failed;
32647- atomic_long_t nopfn;
32648- atomic_long_t asid_new;
32649- atomic_long_t asid_next;
32650- atomic_long_t asid_wrap;
32651- atomic_long_t asid_reuse;
32652- atomic_long_t intr;
32653- atomic_long_t intr_cbr;
32654- atomic_long_t intr_tfh;
32655- atomic_long_t intr_spurious;
32656- atomic_long_t intr_mm_lock_failed;
32657- atomic_long_t call_os;
32658- atomic_long_t call_os_wait_queue;
32659- atomic_long_t user_flush_tlb;
32660- atomic_long_t user_unload_context;
32661- atomic_long_t user_exception;
32662- atomic_long_t set_context_option;
32663- atomic_long_t check_context_retarget_intr;
32664- atomic_long_t check_context_unload;
32665- atomic_long_t tlb_dropin;
32666- atomic_long_t tlb_preload_page;
32667- atomic_long_t tlb_dropin_fail_no_asid;
32668- atomic_long_t tlb_dropin_fail_upm;
32669- atomic_long_t tlb_dropin_fail_invalid;
32670- atomic_long_t tlb_dropin_fail_range_active;
32671- atomic_long_t tlb_dropin_fail_idle;
32672- atomic_long_t tlb_dropin_fail_fmm;
32673- atomic_long_t tlb_dropin_fail_no_exception;
32674- atomic_long_t tfh_stale_on_fault;
32675- atomic_long_t mmu_invalidate_range;
32676- atomic_long_t mmu_invalidate_page;
32677- atomic_long_t flush_tlb;
32678- atomic_long_t flush_tlb_gru;
32679- atomic_long_t flush_tlb_gru_tgh;
32680- atomic_long_t flush_tlb_gru_zero_asid;
32681+ atomic_long_unchecked_t vdata_alloc;
32682+ atomic_long_unchecked_t vdata_free;
32683+ atomic_long_unchecked_t gts_alloc;
32684+ atomic_long_unchecked_t gts_free;
32685+ atomic_long_unchecked_t gms_alloc;
32686+ atomic_long_unchecked_t gms_free;
32687+ atomic_long_unchecked_t gts_double_allocate;
32688+ atomic_long_unchecked_t assign_context;
32689+ atomic_long_unchecked_t assign_context_failed;
32690+ atomic_long_unchecked_t free_context;
32691+ atomic_long_unchecked_t load_user_context;
32692+ atomic_long_unchecked_t load_kernel_context;
32693+ atomic_long_unchecked_t lock_kernel_context;
32694+ atomic_long_unchecked_t unlock_kernel_context;
32695+ atomic_long_unchecked_t steal_user_context;
32696+ atomic_long_unchecked_t steal_kernel_context;
32697+ atomic_long_unchecked_t steal_context_failed;
32698+ atomic_long_unchecked_t nopfn;
32699+ atomic_long_unchecked_t asid_new;
32700+ atomic_long_unchecked_t asid_next;
32701+ atomic_long_unchecked_t asid_wrap;
32702+ atomic_long_unchecked_t asid_reuse;
32703+ atomic_long_unchecked_t intr;
32704+ atomic_long_unchecked_t intr_cbr;
32705+ atomic_long_unchecked_t intr_tfh;
32706+ atomic_long_unchecked_t intr_spurious;
32707+ atomic_long_unchecked_t intr_mm_lock_failed;
32708+ atomic_long_unchecked_t call_os;
32709+ atomic_long_unchecked_t call_os_wait_queue;
32710+ atomic_long_unchecked_t user_flush_tlb;
32711+ atomic_long_unchecked_t user_unload_context;
32712+ atomic_long_unchecked_t user_exception;
32713+ atomic_long_unchecked_t set_context_option;
32714+ atomic_long_unchecked_t check_context_retarget_intr;
32715+ atomic_long_unchecked_t check_context_unload;
32716+ atomic_long_unchecked_t tlb_dropin;
32717+ atomic_long_unchecked_t tlb_preload_page;
32718+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
32719+ atomic_long_unchecked_t tlb_dropin_fail_upm;
32720+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
32721+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
32722+ atomic_long_unchecked_t tlb_dropin_fail_idle;
32723+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
32724+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
32725+ atomic_long_unchecked_t tfh_stale_on_fault;
32726+ atomic_long_unchecked_t mmu_invalidate_range;
32727+ atomic_long_unchecked_t mmu_invalidate_page;
32728+ atomic_long_unchecked_t flush_tlb;
32729+ atomic_long_unchecked_t flush_tlb_gru;
32730+ atomic_long_unchecked_t flush_tlb_gru_tgh;
32731+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
32732
32733- atomic_long_t copy_gpa;
32734- atomic_long_t read_gpa;
32735+ atomic_long_unchecked_t copy_gpa;
32736+ atomic_long_unchecked_t read_gpa;
32737
32738- atomic_long_t mesq_receive;
32739- atomic_long_t mesq_receive_none;
32740- atomic_long_t mesq_send;
32741- atomic_long_t mesq_send_failed;
32742- atomic_long_t mesq_noop;
32743- atomic_long_t mesq_send_unexpected_error;
32744- atomic_long_t mesq_send_lb_overflow;
32745- atomic_long_t mesq_send_qlimit_reached;
32746- atomic_long_t mesq_send_amo_nacked;
32747- atomic_long_t mesq_send_put_nacked;
32748- atomic_long_t mesq_page_overflow;
32749- atomic_long_t mesq_qf_locked;
32750- atomic_long_t mesq_qf_noop_not_full;
32751- atomic_long_t mesq_qf_switch_head_failed;
32752- atomic_long_t mesq_qf_unexpected_error;
32753- atomic_long_t mesq_noop_unexpected_error;
32754- atomic_long_t mesq_noop_lb_overflow;
32755- atomic_long_t mesq_noop_qlimit_reached;
32756- atomic_long_t mesq_noop_amo_nacked;
32757- atomic_long_t mesq_noop_put_nacked;
32758- atomic_long_t mesq_noop_page_overflow;
32759+ atomic_long_unchecked_t mesq_receive;
32760+ atomic_long_unchecked_t mesq_receive_none;
32761+ atomic_long_unchecked_t mesq_send;
32762+ atomic_long_unchecked_t mesq_send_failed;
32763+ atomic_long_unchecked_t mesq_noop;
32764+ atomic_long_unchecked_t mesq_send_unexpected_error;
32765+ atomic_long_unchecked_t mesq_send_lb_overflow;
32766+ atomic_long_unchecked_t mesq_send_qlimit_reached;
32767+ atomic_long_unchecked_t mesq_send_amo_nacked;
32768+ atomic_long_unchecked_t mesq_send_put_nacked;
32769+ atomic_long_unchecked_t mesq_page_overflow;
32770+ atomic_long_unchecked_t mesq_qf_locked;
32771+ atomic_long_unchecked_t mesq_qf_noop_not_full;
32772+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
32773+ atomic_long_unchecked_t mesq_qf_unexpected_error;
32774+ atomic_long_unchecked_t mesq_noop_unexpected_error;
32775+ atomic_long_unchecked_t mesq_noop_lb_overflow;
32776+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
32777+ atomic_long_unchecked_t mesq_noop_amo_nacked;
32778+ atomic_long_unchecked_t mesq_noop_put_nacked;
32779+ atomic_long_unchecked_t mesq_noop_page_overflow;
32780
32781 };
32782
32783@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
32784 tghop_invalidate, mcsop_last};
32785
32786 struct mcs_op_statistic {
32787- atomic_long_t count;
32788- atomic_long_t total;
32789+ atomic_long_unchecked_t count;
32790+ atomic_long_unchecked_t total;
32791 unsigned long max;
32792 };
32793
32794@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
32795
32796 #define STAT(id) do { \
32797 if (gru_options & OPT_STATS) \
32798- atomic_long_inc(&gru_stats.id); \
32799+ atomic_long_inc_unchecked(&gru_stats.id); \
32800 } while (0)
32801
32802 #ifdef CONFIG_SGI_GRU_DEBUG
32803diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
32804index 851b2f2..a4ec097 100644
32805--- a/drivers/misc/sgi-xp/xp.h
32806+++ b/drivers/misc/sgi-xp/xp.h
32807@@ -289,7 +289,7 @@ struct xpc_interface {
32808 xpc_notify_func, void *);
32809 void (*received) (short, int, void *);
32810 enum xp_retval (*partid_to_nasids) (short, void *);
32811-};
32812+} __no_const;
32813
32814 extern struct xpc_interface xpc_interface;
32815
32816diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
32817index b94d5f7..7f494c5 100644
32818--- a/drivers/misc/sgi-xp/xpc.h
32819+++ b/drivers/misc/sgi-xp/xpc.h
32820@@ -835,6 +835,7 @@ struct xpc_arch_operations {
32821 void (*received_payload) (struct xpc_channel *, void *);
32822 void (*notify_senders_of_disconnect) (struct xpc_channel *);
32823 };
32824+typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
32825
32826 /* struct xpc_partition act_state values (for XPC HB) */
32827
32828@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
32829 /* found in xpc_main.c */
32830 extern struct device *xpc_part;
32831 extern struct device *xpc_chan;
32832-extern struct xpc_arch_operations xpc_arch_ops;
32833+extern xpc_arch_operations_no_const xpc_arch_ops;
32834 extern int xpc_disengage_timelimit;
32835 extern int xpc_disengage_timedout;
32836 extern int xpc_activate_IRQ_rcvd;
32837diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
32838index 8d082b4..aa749ae 100644
32839--- a/drivers/misc/sgi-xp/xpc_main.c
32840+++ b/drivers/misc/sgi-xp/xpc_main.c
32841@@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
32842 .notifier_call = xpc_system_die,
32843 };
32844
32845-struct xpc_arch_operations xpc_arch_ops;
32846+xpc_arch_operations_no_const xpc_arch_ops;
32847
32848 /*
32849 * Timer function to enforce the timelimit on the partition disengage.
32850diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
32851index 26c5286..292d261 100644
32852--- a/drivers/mmc/host/sdhci-pci.c
32853+++ b/drivers/mmc/host/sdhci-pci.c
32854@@ -542,7 +542,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
32855 .probe = via_probe,
32856 };
32857
32858-static const struct pci_device_id pci_ids[] __devinitdata = {
32859+static const struct pci_device_id pci_ids[] __devinitconst = {
32860 {
32861 .vendor = PCI_VENDOR_ID_RICOH,
32862 .device = PCI_DEVICE_ID_RICOH_R5C822,
32863diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
32864index e1e122f..d99a6ea 100644
32865--- a/drivers/mtd/chips/cfi_cmdset_0001.c
32866+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
32867@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
32868 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
32869 unsigned long timeo = jiffies + HZ;
32870
32871+ pax_track_stack();
32872+
32873 /* Prevent setting state FL_SYNCING for chip in suspended state. */
32874 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
32875 goto sleep;
32876@@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
32877 unsigned long initial_adr;
32878 int initial_len = len;
32879
32880+ pax_track_stack();
32881+
32882 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
32883 adr += chip->start;
32884 initial_adr = adr;
32885@@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
32886 int retries = 3;
32887 int ret;
32888
32889+ pax_track_stack();
32890+
32891 adr += chip->start;
32892
32893 retry:
32894diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
32895index 179814a..abe9d60 100644
32896--- a/drivers/mtd/chips/cfi_cmdset_0020.c
32897+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
32898@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
32899 unsigned long cmd_addr;
32900 struct cfi_private *cfi = map->fldrv_priv;
32901
32902+ pax_track_stack();
32903+
32904 adr += chip->start;
32905
32906 /* Ensure cmd read/writes are aligned. */
32907@@ -429,6 +431,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
32908 DECLARE_WAITQUEUE(wait, current);
32909 int wbufsize, z;
32910
32911+ pax_track_stack();
32912+
32913 /* M58LW064A requires bus alignment for buffer wriets -- saw */
32914 if (adr & (map_bankwidth(map)-1))
32915 return -EINVAL;
32916@@ -743,6 +747,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
32917 DECLARE_WAITQUEUE(wait, current);
32918 int ret = 0;
32919
32920+ pax_track_stack();
32921+
32922 adr += chip->start;
32923
32924 /* Let's determine this according to the interleave only once */
32925@@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
32926 unsigned long timeo = jiffies + HZ;
32927 DECLARE_WAITQUEUE(wait, current);
32928
32929+ pax_track_stack();
32930+
32931 adr += chip->start;
32932
32933 /* Let's determine this according to the interleave only once */
32934@@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
32935 unsigned long timeo = jiffies + HZ;
32936 DECLARE_WAITQUEUE(wait, current);
32937
32938+ pax_track_stack();
32939+
32940 adr += chip->start;
32941
32942 /* Let's determine this according to the interleave only once */
32943diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
32944index f7fbf60..9866457 100644
32945--- a/drivers/mtd/devices/doc2000.c
32946+++ b/drivers/mtd/devices/doc2000.c
32947@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
32948
32949 /* The ECC will not be calculated correctly if less than 512 is written */
32950 /* DBB-
32951- if (len != 0x200 && eccbuf)
32952+ if (len != 0x200)
32953 printk(KERN_WARNING
32954 "ECC needs a full sector write (adr: %lx size %lx)\n",
32955 (long) to, (long) len);
32956diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
32957index 241192f..d0c35a3 100644
32958--- a/drivers/mtd/devices/doc2001.c
32959+++ b/drivers/mtd/devices/doc2001.c
32960@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
32961 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
32962
32963 /* Don't allow read past end of device */
32964- if (from >= this->totlen)
32965+ if (from >= this->totlen || !len)
32966 return -EINVAL;
32967
32968 /* Don't allow a single read to cross a 512-byte block boundary */
32969diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
32970index 037b399..225a71d 100644
32971--- a/drivers/mtd/ftl.c
32972+++ b/drivers/mtd/ftl.c
32973@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
32974 loff_t offset;
32975 uint16_t srcunitswap = cpu_to_le16(srcunit);
32976
32977+ pax_track_stack();
32978+
32979 eun = &part->EUNInfo[srcunit];
32980 xfer = &part->XferInfo[xferunit];
32981 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
32982diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
32983index d7592e6..31c505c 100644
32984--- a/drivers/mtd/inftlcore.c
32985+++ b/drivers/mtd/inftlcore.c
32986@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
32987 struct inftl_oob oob;
32988 size_t retlen;
32989
32990+ pax_track_stack();
32991+
32992 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
32993 "pending=%d)\n", inftl, thisVUC, pendingblock);
32994
32995diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
32996index 104052e..6232be5 100644
32997--- a/drivers/mtd/inftlmount.c
32998+++ b/drivers/mtd/inftlmount.c
32999@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
33000 struct INFTLPartition *ip;
33001 size_t retlen;
33002
33003+ pax_track_stack();
33004+
33005 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
33006
33007 /*
33008diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
33009index dbfe17b..c7b0918 100644
33010--- a/drivers/mtd/lpddr/qinfo_probe.c
33011+++ b/drivers/mtd/lpddr/qinfo_probe.c
33012@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
33013 {
33014 map_word pfow_val[4];
33015
33016+ pax_track_stack();
33017+
33018 /* Check identification string */
33019 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
33020 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
33021diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
33022index 49e20a4..60fbfa5 100644
33023--- a/drivers/mtd/mtdchar.c
33024+++ b/drivers/mtd/mtdchar.c
33025@@ -554,6 +554,8 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
33026 u_long size;
33027 struct mtd_info_user info;
33028
33029+ pax_track_stack();
33030+
33031 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
33032
33033 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
33034diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
33035index d527621..2491fab 100644
33036--- a/drivers/mtd/nand/denali.c
33037+++ b/drivers/mtd/nand/denali.c
33038@@ -26,6 +26,7 @@
33039 #include <linux/pci.h>
33040 #include <linux/mtd/mtd.h>
33041 #include <linux/module.h>
33042+#include <linux/slab.h>
33043
33044 #include "denali.h"
33045
33046diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
33047index b155666..611b801 100644
33048--- a/drivers/mtd/nftlcore.c
33049+++ b/drivers/mtd/nftlcore.c
33050@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
33051 int inplace = 1;
33052 size_t retlen;
33053
33054+ pax_track_stack();
33055+
33056 memset(BlockMap, 0xff, sizeof(BlockMap));
33057 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
33058
33059diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
33060index e3cd1ff..0ea79a3 100644
33061--- a/drivers/mtd/nftlmount.c
33062+++ b/drivers/mtd/nftlmount.c
33063@@ -24,6 +24,7 @@
33064 #include <asm/errno.h>
33065 #include <linux/delay.h>
33066 #include <linux/slab.h>
33067+#include <linux/sched.h>
33068 #include <linux/mtd/mtd.h>
33069 #include <linux/mtd/nand.h>
33070 #include <linux/mtd/nftl.h>
33071@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
33072 struct mtd_info *mtd = nftl->mbd.mtd;
33073 unsigned int i;
33074
33075+ pax_track_stack();
33076+
33077 /* Assume logical EraseSize == physical erasesize for starting the scan.
33078 We'll sort it out later if we find a MediaHeader which says otherwise */
33079 /* Actually, we won't. The new DiskOnChip driver has already scanned
33080diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
33081index 6c3fb5a..c542a81 100644
33082--- a/drivers/mtd/ubi/build.c
33083+++ b/drivers/mtd/ubi/build.c
33084@@ -1311,7 +1311,7 @@ module_exit(ubi_exit);
33085 static int __init bytes_str_to_int(const char *str)
33086 {
33087 char *endp;
33088- unsigned long result;
33089+ unsigned long result, scale = 1;
33090
33091 result = simple_strtoul(str, &endp, 0);
33092 if (str == endp || result >= INT_MAX) {
33093@@ -1322,11 +1322,11 @@ static int __init bytes_str_to_int(const char *str)
33094
33095 switch (*endp) {
33096 case 'G':
33097- result *= 1024;
33098+ scale *= 1024;
33099 case 'M':
33100- result *= 1024;
33101+ scale *= 1024;
33102 case 'K':
33103- result *= 1024;
33104+ scale *= 1024;
33105 if (endp[1] == 'i' && endp[2] == 'B')
33106 endp += 2;
33107 case '\0':
33108@@ -1337,7 +1337,13 @@ static int __init bytes_str_to_int(const char *str)
33109 return -EINVAL;
33110 }
33111
33112- return result;
33113+ if ((intoverflow_t)result*scale >= INT_MAX) {
33114+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
33115+ str);
33116+ return -EINVAL;
33117+ }
33118+
33119+ return result*scale;
33120 }
33121
33122 /**
33123diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
33124index d4f7dda..d627d46 100644
33125--- a/drivers/net/atlx/atl2.c
33126+++ b/drivers/net/atlx/atl2.c
33127@@ -2857,7 +2857,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
33128 */
33129
33130 #define ATL2_PARAM(X, desc) \
33131- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
33132+ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
33133 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
33134 MODULE_PARM_DESC(X, desc);
33135 #else
33136diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
33137index 87aecdf..ec23470 100644
33138--- a/drivers/net/bna/bfa_ioc_ct.c
33139+++ b/drivers/net/bna/bfa_ioc_ct.c
33140@@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct bfa_ioc *ioc);
33141 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
33142 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
33143
33144-static struct bfa_ioc_hwif nw_hwif_ct;
33145+static struct bfa_ioc_hwif nw_hwif_ct = {
33146+ .ioc_pll_init = bfa_ioc_ct_pll_init,
33147+ .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
33148+ .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
33149+ .ioc_reg_init = bfa_ioc_ct_reg_init,
33150+ .ioc_map_port = bfa_ioc_ct_map_port,
33151+ .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
33152+ .ioc_notify_fail = bfa_ioc_ct_notify_fail,
33153+ .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
33154+ .ioc_sync_start = bfa_ioc_ct_sync_start,
33155+ .ioc_sync_join = bfa_ioc_ct_sync_join,
33156+ .ioc_sync_leave = bfa_ioc_ct_sync_leave,
33157+ .ioc_sync_ack = bfa_ioc_ct_sync_ack,
33158+ .ioc_sync_complete = bfa_ioc_ct_sync_complete
33159+};
33160
33161 /**
33162 * Called from bfa_ioc_attach() to map asic specific calls.
33163@@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
33164 void
33165 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
33166 {
33167- nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
33168- nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
33169- nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
33170- nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
33171- nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
33172- nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
33173- nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
33174- nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
33175- nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
33176- nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
33177- nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
33178- nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
33179- nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
33180-
33181 ioc->ioc_hwif = &nw_hwif_ct;
33182 }
33183
33184diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
33185index 8e35b25..c39f205 100644
33186--- a/drivers/net/bna/bnad.c
33187+++ b/drivers/net/bna/bnad.c
33188@@ -1673,7 +1673,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
33189 struct bna_intr_info *intr_info =
33190 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
33191 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
33192- struct bna_tx_event_cbfn tx_cbfn;
33193+ static struct bna_tx_event_cbfn tx_cbfn = {
33194+ /* Initialize the tx event handlers */
33195+ .tcb_setup_cbfn = bnad_cb_tcb_setup,
33196+ .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
33197+ .tx_stall_cbfn = bnad_cb_tx_stall,
33198+ .tx_resume_cbfn = bnad_cb_tx_resume,
33199+ .tx_cleanup_cbfn = bnad_cb_tx_cleanup
33200+ };
33201 struct bna_tx *tx;
33202 unsigned long flags;
33203
33204@@ -1682,13 +1689,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
33205 tx_config->txq_depth = bnad->txq_depth;
33206 tx_config->tx_type = BNA_TX_T_REGULAR;
33207
33208- /* Initialize the tx event handlers */
33209- tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
33210- tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
33211- tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
33212- tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
33213- tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
33214-
33215 /* Get BNA's resource requirement for one tx object */
33216 spin_lock_irqsave(&bnad->bna_lock, flags);
33217 bna_tx_res_req(bnad->num_txq_per_tx,
33218@@ -1819,21 +1819,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx_id)
33219 struct bna_intr_info *intr_info =
33220 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
33221 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
33222- struct bna_rx_event_cbfn rx_cbfn;
33223+ static struct bna_rx_event_cbfn rx_cbfn = {
33224+ /* Initialize the Rx event handlers */
33225+ .rcb_setup_cbfn = bnad_cb_rcb_setup,
33226+ .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
33227+ .ccb_setup_cbfn = bnad_cb_ccb_setup,
33228+ .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
33229+ .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
33230+ .rx_post_cbfn = bnad_cb_rx_post
33231+ };
33232 struct bna_rx *rx;
33233 unsigned long flags;
33234
33235 /* Initialize the Rx object configuration */
33236 bnad_init_rx_config(bnad, rx_config);
33237
33238- /* Initialize the Rx event handlers */
33239- rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
33240- rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
33241- rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
33242- rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
33243- rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
33244- rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
33245-
33246 /* Get BNA's resource requirement for one Rx object */
33247 spin_lock_irqsave(&bnad->bna_lock, flags);
33248 bna_rx_res_req(rx_config, res_info);
33249diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
33250index 4b2b570..31033f4 100644
33251--- a/drivers/net/bnx2.c
33252+++ b/drivers/net/bnx2.c
33253@@ -5877,6 +5877,8 @@ bnx2_test_nvram(struct bnx2 *bp)
33254 int rc = 0;
33255 u32 magic, csum;
33256
33257+ pax_track_stack();
33258+
33259 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
33260 goto test_nvram_done;
33261
33262diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
33263index cf3e479..5dc0ecc 100644
33264--- a/drivers/net/bnx2x/bnx2x_ethtool.c
33265+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
33266@@ -1943,6 +1943,8 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
33267 int i, rc;
33268 u32 magic, crc;
33269
33270+ pax_track_stack();
33271+
33272 if (BP_NOMCP(bp))
33273 return 0;
33274
33275diff --git a/drivers/net/bnx2x/bnx2x_sp.h b/drivers/net/bnx2x/bnx2x_sp.h
33276index 9a517c2..a50cfcb 100644
33277--- a/drivers/net/bnx2x/bnx2x_sp.h
33278+++ b/drivers/net/bnx2x/bnx2x_sp.h
33279@@ -449,7 +449,7 @@ struct bnx2x_rx_mode_obj {
33280
33281 int (*wait_comp)(struct bnx2x *bp,
33282 struct bnx2x_rx_mode_ramrod_params *p);
33283-};
33284+} __no_const;
33285
33286 /********************** Set multicast group ***********************************/
33287
33288diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
33289index c5f5479..2e8c260 100644
33290--- a/drivers/net/cxgb3/l2t.h
33291+++ b/drivers/net/cxgb3/l2t.h
33292@@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
33293 */
33294 struct l2t_skb_cb {
33295 arp_failure_handler_func arp_failure_handler;
33296-};
33297+} __no_const;
33298
33299 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
33300
33301diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
33302index b4efa29..c5f2703 100644
33303--- a/drivers/net/cxgb4/cxgb4_main.c
33304+++ b/drivers/net/cxgb4/cxgb4_main.c
33305@@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct adapter *adap)
33306 unsigned int nchan = adap->params.nports;
33307 struct msix_entry entries[MAX_INGQ + 1];
33308
33309+ pax_track_stack();
33310+
33311 for (i = 0; i < ARRAY_SIZE(entries); ++i)
33312 entries[i].entry = i;
33313
33314diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
33315index d1ec111..12735bc 100644
33316--- a/drivers/net/cxgb4/t4_hw.c
33317+++ b/drivers/net/cxgb4/t4_hw.c
33318@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
33319 u8 vpd[VPD_LEN], csum;
33320 unsigned int vpdr_len, kw_offset, id_len;
33321
33322+ pax_track_stack();
33323+
33324 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
33325 if (ret < 0)
33326 return ret;
33327diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
33328index 536b3a5..e6f8dcc 100644
33329--- a/drivers/net/e1000e/82571.c
33330+++ b/drivers/net/e1000e/82571.c
33331@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
33332 {
33333 struct e1000_hw *hw = &adapter->hw;
33334 struct e1000_mac_info *mac = &hw->mac;
33335- struct e1000_mac_operations *func = &mac->ops;
33336+ e1000_mac_operations_no_const *func = &mac->ops;
33337 u32 swsm = 0;
33338 u32 swsm2 = 0;
33339 bool force_clear_smbi = false;
33340diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
33341index e4f4225..24da2ea 100644
33342--- a/drivers/net/e1000e/es2lan.c
33343+++ b/drivers/net/e1000e/es2lan.c
33344@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
33345 {
33346 struct e1000_hw *hw = &adapter->hw;
33347 struct e1000_mac_info *mac = &hw->mac;
33348- struct e1000_mac_operations *func = &mac->ops;
33349+ e1000_mac_operations_no_const *func = &mac->ops;
33350
33351 /* Set media type */
33352 switch (adapter->pdev->device) {
33353diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
33354index 2967039..ca8c40c 100644
33355--- a/drivers/net/e1000e/hw.h
33356+++ b/drivers/net/e1000e/hw.h
33357@@ -778,6 +778,7 @@ struct e1000_mac_operations {
33358 void (*write_vfta)(struct e1000_hw *, u32, u32);
33359 s32 (*read_mac_addr)(struct e1000_hw *);
33360 };
33361+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33362
33363 /*
33364 * When to use various PHY register access functions:
33365@@ -818,6 +819,7 @@ struct e1000_phy_operations {
33366 void (*power_up)(struct e1000_hw *);
33367 void (*power_down)(struct e1000_hw *);
33368 };
33369+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33370
33371 /* Function pointers for the NVM. */
33372 struct e1000_nvm_operations {
33373@@ -829,9 +831,10 @@ struct e1000_nvm_operations {
33374 s32 (*validate)(struct e1000_hw *);
33375 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
33376 };
33377+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33378
33379 struct e1000_mac_info {
33380- struct e1000_mac_operations ops;
33381+ e1000_mac_operations_no_const ops;
33382 u8 addr[ETH_ALEN];
33383 u8 perm_addr[ETH_ALEN];
33384
33385@@ -872,7 +875,7 @@ struct e1000_mac_info {
33386 };
33387
33388 struct e1000_phy_info {
33389- struct e1000_phy_operations ops;
33390+ e1000_phy_operations_no_const ops;
33391
33392 enum e1000_phy_type type;
33393
33394@@ -906,7 +909,7 @@ struct e1000_phy_info {
33395 };
33396
33397 struct e1000_nvm_info {
33398- struct e1000_nvm_operations ops;
33399+ e1000_nvm_operations_no_const ops;
33400
33401 enum e1000_nvm_type type;
33402 enum e1000_nvm_override override;
33403diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
33404index fa8677c..196356f 100644
33405--- a/drivers/net/fealnx.c
33406+++ b/drivers/net/fealnx.c
33407@@ -150,7 +150,7 @@ struct chip_info {
33408 int flags;
33409 };
33410
33411-static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
33412+static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
33413 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33414 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
33415 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33416diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
33417index 2a5a34d..be871cc 100644
33418--- a/drivers/net/hamradio/6pack.c
33419+++ b/drivers/net/hamradio/6pack.c
33420@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
33421 unsigned char buf[512];
33422 int count1;
33423
33424+ pax_track_stack();
33425+
33426 if (!count)
33427 return;
33428
33429diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
33430index 4519a13..f97fcd0 100644
33431--- a/drivers/net/igb/e1000_hw.h
33432+++ b/drivers/net/igb/e1000_hw.h
33433@@ -314,6 +314,7 @@ struct e1000_mac_operations {
33434 s32 (*read_mac_addr)(struct e1000_hw *);
33435 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
33436 };
33437+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33438
33439 struct e1000_phy_operations {
33440 s32 (*acquire)(struct e1000_hw *);
33441@@ -330,6 +331,7 @@ struct e1000_phy_operations {
33442 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
33443 s32 (*write_reg)(struct e1000_hw *, u32, u16);
33444 };
33445+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33446
33447 struct e1000_nvm_operations {
33448 s32 (*acquire)(struct e1000_hw *);
33449@@ -339,6 +341,7 @@ struct e1000_nvm_operations {
33450 s32 (*update)(struct e1000_hw *);
33451 s32 (*validate)(struct e1000_hw *);
33452 };
33453+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33454
33455 struct e1000_info {
33456 s32 (*get_invariants)(struct e1000_hw *);
33457@@ -350,7 +353,7 @@ struct e1000_info {
33458 extern const struct e1000_info e1000_82575_info;
33459
33460 struct e1000_mac_info {
33461- struct e1000_mac_operations ops;
33462+ e1000_mac_operations_no_const ops;
33463
33464 u8 addr[6];
33465 u8 perm_addr[6];
33466@@ -388,7 +391,7 @@ struct e1000_mac_info {
33467 };
33468
33469 struct e1000_phy_info {
33470- struct e1000_phy_operations ops;
33471+ e1000_phy_operations_no_const ops;
33472
33473 enum e1000_phy_type type;
33474
33475@@ -423,7 +426,7 @@ struct e1000_phy_info {
33476 };
33477
33478 struct e1000_nvm_info {
33479- struct e1000_nvm_operations ops;
33480+ e1000_nvm_operations_no_const ops;
33481 enum e1000_nvm_type type;
33482 enum e1000_nvm_override override;
33483
33484@@ -468,6 +471,7 @@ struct e1000_mbx_operations {
33485 s32 (*check_for_ack)(struct e1000_hw *, u16);
33486 s32 (*check_for_rst)(struct e1000_hw *, u16);
33487 };
33488+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33489
33490 struct e1000_mbx_stats {
33491 u32 msgs_tx;
33492@@ -479,7 +483,7 @@ struct e1000_mbx_stats {
33493 };
33494
33495 struct e1000_mbx_info {
33496- struct e1000_mbx_operations ops;
33497+ e1000_mbx_operations_no_const ops;
33498 struct e1000_mbx_stats stats;
33499 u32 timeout;
33500 u32 usec_delay;
33501diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
33502index d7ed58f..64cde36 100644
33503--- a/drivers/net/igbvf/vf.h
33504+++ b/drivers/net/igbvf/vf.h
33505@@ -189,9 +189,10 @@ struct e1000_mac_operations {
33506 s32 (*read_mac_addr)(struct e1000_hw *);
33507 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
33508 };
33509+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33510
33511 struct e1000_mac_info {
33512- struct e1000_mac_operations ops;
33513+ e1000_mac_operations_no_const ops;
33514 u8 addr[6];
33515 u8 perm_addr[6];
33516
33517@@ -213,6 +214,7 @@ struct e1000_mbx_operations {
33518 s32 (*check_for_ack)(struct e1000_hw *);
33519 s32 (*check_for_rst)(struct e1000_hw *);
33520 };
33521+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33522
33523 struct e1000_mbx_stats {
33524 u32 msgs_tx;
33525@@ -224,7 +226,7 @@ struct e1000_mbx_stats {
33526 };
33527
33528 struct e1000_mbx_info {
33529- struct e1000_mbx_operations ops;
33530+ e1000_mbx_operations_no_const ops;
33531 struct e1000_mbx_stats stats;
33532 u32 timeout;
33533 u32 usec_delay;
33534diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
33535index 6a130eb..1aeb9e4 100644
33536--- a/drivers/net/ixgb/ixgb_main.c
33537+++ b/drivers/net/ixgb/ixgb_main.c
33538@@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev)
33539 u32 rctl;
33540 int i;
33541
33542+ pax_track_stack();
33543+
33544 /* Check for Promiscuous and All Multicast modes */
33545
33546 rctl = IXGB_READ_REG(hw, RCTL);
33547diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
33548index dd7fbeb..44b9bbf 100644
33549--- a/drivers/net/ixgb/ixgb_param.c
33550+++ b/drivers/net/ixgb/ixgb_param.c
33551@@ -261,6 +261,9 @@ void __devinit
33552 ixgb_check_options(struct ixgb_adapter *adapter)
33553 {
33554 int bd = adapter->bd_number;
33555+
33556+ pax_track_stack();
33557+
33558 if (bd >= IXGB_MAX_NIC) {
33559 pr_notice("Warning: no configuration for board #%i\n", bd);
33560 pr_notice("Using defaults for all values\n");
33561diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
33562index e0d970e..1cfdea5 100644
33563--- a/drivers/net/ixgbe/ixgbe_type.h
33564+++ b/drivers/net/ixgbe/ixgbe_type.h
33565@@ -2642,6 +2642,7 @@ struct ixgbe_eeprom_operations {
33566 s32 (*update_checksum)(struct ixgbe_hw *);
33567 u16 (*calc_checksum)(struct ixgbe_hw *);
33568 };
33569+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
33570
33571 struct ixgbe_mac_operations {
33572 s32 (*init_hw)(struct ixgbe_hw *);
33573@@ -2703,6 +2704,7 @@ struct ixgbe_mac_operations {
33574 /* Manageability interface */
33575 s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8);
33576 };
33577+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33578
33579 struct ixgbe_phy_operations {
33580 s32 (*identify)(struct ixgbe_hw *);
33581@@ -2722,9 +2724,10 @@ struct ixgbe_phy_operations {
33582 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
33583 s32 (*check_overtemp)(struct ixgbe_hw *);
33584 };
33585+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
33586
33587 struct ixgbe_eeprom_info {
33588- struct ixgbe_eeprom_operations ops;
33589+ ixgbe_eeprom_operations_no_const ops;
33590 enum ixgbe_eeprom_type type;
33591 u32 semaphore_delay;
33592 u16 word_size;
33593@@ -2734,7 +2737,7 @@ struct ixgbe_eeprom_info {
33594
33595 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
33596 struct ixgbe_mac_info {
33597- struct ixgbe_mac_operations ops;
33598+ ixgbe_mac_operations_no_const ops;
33599 enum ixgbe_mac_type type;
33600 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33601 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33602@@ -2762,7 +2765,7 @@ struct ixgbe_mac_info {
33603 };
33604
33605 struct ixgbe_phy_info {
33606- struct ixgbe_phy_operations ops;
33607+ ixgbe_phy_operations_no_const ops;
33608 struct mdio_if_info mdio;
33609 enum ixgbe_phy_type type;
33610 u32 id;
33611@@ -2790,6 +2793,7 @@ struct ixgbe_mbx_operations {
33612 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
33613 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
33614 };
33615+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33616
33617 struct ixgbe_mbx_stats {
33618 u32 msgs_tx;
33619@@ -2801,7 +2805,7 @@ struct ixgbe_mbx_stats {
33620 };
33621
33622 struct ixgbe_mbx_info {
33623- struct ixgbe_mbx_operations ops;
33624+ ixgbe_mbx_operations_no_const ops;
33625 struct ixgbe_mbx_stats stats;
33626 u32 timeout;
33627 u32 usec_delay;
33628diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
33629index 10306b4..28df758 100644
33630--- a/drivers/net/ixgbevf/vf.h
33631+++ b/drivers/net/ixgbevf/vf.h
33632@@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
33633 s32 (*clear_vfta)(struct ixgbe_hw *);
33634 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
33635 };
33636+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33637
33638 enum ixgbe_mac_type {
33639 ixgbe_mac_unknown = 0,
33640@@ -79,7 +80,7 @@ enum ixgbe_mac_type {
33641 };
33642
33643 struct ixgbe_mac_info {
33644- struct ixgbe_mac_operations ops;
33645+ ixgbe_mac_operations_no_const ops;
33646 u8 addr[6];
33647 u8 perm_addr[6];
33648
33649@@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
33650 s32 (*check_for_ack)(struct ixgbe_hw *);
33651 s32 (*check_for_rst)(struct ixgbe_hw *);
33652 };
33653+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33654
33655 struct ixgbe_mbx_stats {
33656 u32 msgs_tx;
33657@@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
33658 };
33659
33660 struct ixgbe_mbx_info {
33661- struct ixgbe_mbx_operations ops;
33662+ ixgbe_mbx_operations_no_const ops;
33663 struct ixgbe_mbx_stats stats;
33664 u32 timeout;
33665 u32 udelay;
33666diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
33667index 27418d3..adf15bb 100644
33668--- a/drivers/net/ksz884x.c
33669+++ b/drivers/net/ksz884x.c
33670@@ -6533,6 +6533,8 @@ static void netdev_get_ethtool_stats(struct net_device *dev,
33671 int rc;
33672 u64 counter[TOTAL_PORT_COUNTER_NUM];
33673
33674+ pax_track_stack();
33675+
33676 mutex_lock(&hw_priv->lock);
33677 n = SWITCH_PORT_NUM;
33678 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
33679diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
33680index f0ee35d..3831c8a 100644
33681--- a/drivers/net/mlx4/main.c
33682+++ b/drivers/net/mlx4/main.c
33683@@ -40,6 +40,7 @@
33684 #include <linux/dma-mapping.h>
33685 #include <linux/slab.h>
33686 #include <linux/io-mapping.h>
33687+#include <linux/sched.h>
33688
33689 #include <linux/mlx4/device.h>
33690 #include <linux/mlx4/doorbell.h>
33691@@ -762,6 +763,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
33692 u64 icm_size;
33693 int err;
33694
33695+ pax_track_stack();
33696+
33697 err = mlx4_QUERY_FW(dev);
33698 if (err) {
33699 if (err == -EACCES)
33700diff --git a/drivers/net/niu.c b/drivers/net/niu.c
33701index ed47585..5e5be8f 100644
33702--- a/drivers/net/niu.c
33703+++ b/drivers/net/niu.c
33704@@ -9061,6 +9061,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
33705 int i, num_irqs, err;
33706 u8 first_ldg;
33707
33708+ pax_track_stack();
33709+
33710 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
33711 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
33712 ldg_num_map[i] = first_ldg + i;
33713diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
33714index 80b6f36..5cd8938 100644
33715--- a/drivers/net/pcnet32.c
33716+++ b/drivers/net/pcnet32.c
33717@@ -270,7 +270,7 @@ struct pcnet32_private {
33718 struct sk_buff **rx_skbuff;
33719 dma_addr_t *tx_dma_addr;
33720 dma_addr_t *rx_dma_addr;
33721- struct pcnet32_access a;
33722+ struct pcnet32_access *a;
33723 spinlock_t lock; /* Guard lock */
33724 unsigned int cur_rx, cur_tx; /* The next free ring entry */
33725 unsigned int rx_ring_size; /* current rx ring size */
33726@@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct net_device *dev)
33727 u16 val;
33728
33729 netif_wake_queue(dev);
33730- val = lp->a.read_csr(ioaddr, CSR3);
33731+ val = lp->a->read_csr(ioaddr, CSR3);
33732 val &= 0x00ff;
33733- lp->a.write_csr(ioaddr, CSR3, val);
33734+ lp->a->write_csr(ioaddr, CSR3, val);
33735 napi_enable(&lp->napi);
33736 }
33737
33738@@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
33739 r = mii_link_ok(&lp->mii_if);
33740 } else if (lp->chip_version >= PCNET32_79C970A) {
33741 ulong ioaddr = dev->base_addr; /* card base I/O address */
33742- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
33743+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
33744 } else { /* can not detect link on really old chips */
33745 r = 1;
33746 }
33747@@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
33748 pcnet32_netif_stop(dev);
33749
33750 spin_lock_irqsave(&lp->lock, flags);
33751- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33752+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33753
33754 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
33755
33756@@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
33757 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33758 {
33759 struct pcnet32_private *lp = netdev_priv(dev);
33760- struct pcnet32_access *a = &lp->a; /* access to registers */
33761+ struct pcnet32_access *a = lp->a; /* access to registers */
33762 ulong ioaddr = dev->base_addr; /* card base I/O address */
33763 struct sk_buff *skb; /* sk buff */
33764 int x, i; /* counters */
33765@@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33766 pcnet32_netif_stop(dev);
33767
33768 spin_lock_irqsave(&lp->lock, flags);
33769- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33770+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33771
33772 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
33773
33774 /* Reset the PCNET32 */
33775- lp->a.reset(ioaddr);
33776- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33777+ lp->a->reset(ioaddr);
33778+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33779
33780 /* switch pcnet32 to 32bit mode */
33781- lp->a.write_bcr(ioaddr, 20, 2);
33782+ lp->a->write_bcr(ioaddr, 20, 2);
33783
33784 /* purge & init rings but don't actually restart */
33785 pcnet32_restart(dev, 0x0000);
33786
33787- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33788+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33789
33790 /* Initialize Transmit buffers. */
33791 size = data_len + 15;
33792@@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33793
33794 /* set int loopback in CSR15 */
33795 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
33796- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
33797+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
33798
33799 teststatus = cpu_to_le16(0x8000);
33800- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33801+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33802
33803 /* Check status of descriptors */
33804 for (x = 0; x < numbuffs; x++) {
33805@@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33806 }
33807 }
33808
33809- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33810+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33811 wmb();
33812 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
33813 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
33814@@ -1015,7 +1015,7 @@ clean_up:
33815 pcnet32_restart(dev, CSR0_NORMAL);
33816 } else {
33817 pcnet32_purge_rx_ring(dev);
33818- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33819+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33820 }
33821 spin_unlock_irqrestore(&lp->lock, flags);
33822
33823@@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct net_device *dev,
33824 enum ethtool_phys_id_state state)
33825 {
33826 struct pcnet32_private *lp = netdev_priv(dev);
33827- struct pcnet32_access *a = &lp->a;
33828+ struct pcnet32_access *a = lp->a;
33829 ulong ioaddr = dev->base_addr;
33830 unsigned long flags;
33831 int i;
33832@@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
33833 {
33834 int csr5;
33835 struct pcnet32_private *lp = netdev_priv(dev);
33836- struct pcnet32_access *a = &lp->a;
33837+ struct pcnet32_access *a = lp->a;
33838 ulong ioaddr = dev->base_addr;
33839 int ticks;
33840
33841@@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33842 spin_lock_irqsave(&lp->lock, flags);
33843 if (pcnet32_tx(dev)) {
33844 /* reset the chip to clear the error condition, then restart */
33845- lp->a.reset(ioaddr);
33846- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33847+ lp->a->reset(ioaddr);
33848+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33849 pcnet32_restart(dev, CSR0_START);
33850 netif_wake_queue(dev);
33851 }
33852@@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33853 __napi_complete(napi);
33854
33855 /* clear interrupt masks */
33856- val = lp->a.read_csr(ioaddr, CSR3);
33857+ val = lp->a->read_csr(ioaddr, CSR3);
33858 val &= 0x00ff;
33859- lp->a.write_csr(ioaddr, CSR3, val);
33860+ lp->a->write_csr(ioaddr, CSR3, val);
33861
33862 /* Set interrupt enable. */
33863- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
33864+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
33865
33866 spin_unlock_irqrestore(&lp->lock, flags);
33867 }
33868@@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33869 int i, csr0;
33870 u16 *buff = ptr;
33871 struct pcnet32_private *lp = netdev_priv(dev);
33872- struct pcnet32_access *a = &lp->a;
33873+ struct pcnet32_access *a = lp->a;
33874 ulong ioaddr = dev->base_addr;
33875 unsigned long flags;
33876
33877@@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33878 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
33879 if (lp->phymask & (1 << j)) {
33880 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
33881- lp->a.write_bcr(ioaddr, 33,
33882+ lp->a->write_bcr(ioaddr, 33,
33883 (j << 5) | i);
33884- *buff++ = lp->a.read_bcr(ioaddr, 34);
33885+ *buff++ = lp->a->read_bcr(ioaddr, 34);
33886 }
33887 }
33888 }
33889@@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33890 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
33891 lp->options |= PCNET32_PORT_FD;
33892
33893- lp->a = *a;
33894+ lp->a = a;
33895
33896 /* prior to register_netdev, dev->name is not yet correct */
33897 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
33898@@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33899 if (lp->mii) {
33900 /* lp->phycount and lp->phymask are set to 0 by memset above */
33901
33902- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33903+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33904 /* scan for PHYs */
33905 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33906 unsigned short id1, id2;
33907@@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33908 pr_info("Found PHY %04x:%04x at address %d\n",
33909 id1, id2, i);
33910 }
33911- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33912+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33913 if (lp->phycount > 1)
33914 lp->options |= PCNET32_PORT_MII;
33915 }
33916@@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_device *dev)
33917 }
33918
33919 /* Reset the PCNET32 */
33920- lp->a.reset(ioaddr);
33921+ lp->a->reset(ioaddr);
33922
33923 /* switch pcnet32 to 32bit mode */
33924- lp->a.write_bcr(ioaddr, 20, 2);
33925+ lp->a->write_bcr(ioaddr, 20, 2);
33926
33927 netif_printk(lp, ifup, KERN_DEBUG, dev,
33928 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
33929@@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_device *dev)
33930 (u32) (lp->init_dma_addr));
33931
33932 /* set/reset autoselect bit */
33933- val = lp->a.read_bcr(ioaddr, 2) & ~2;
33934+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
33935 if (lp->options & PCNET32_PORT_ASEL)
33936 val |= 2;
33937- lp->a.write_bcr(ioaddr, 2, val);
33938+ lp->a->write_bcr(ioaddr, 2, val);
33939
33940 /* handle full duplex setting */
33941 if (lp->mii_if.full_duplex) {
33942- val = lp->a.read_bcr(ioaddr, 9) & ~3;
33943+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
33944 if (lp->options & PCNET32_PORT_FD) {
33945 val |= 1;
33946 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
33947@@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_device *dev)
33948 if (lp->chip_version == 0x2627)
33949 val |= 3;
33950 }
33951- lp->a.write_bcr(ioaddr, 9, val);
33952+ lp->a->write_bcr(ioaddr, 9, val);
33953 }
33954
33955 /* set/reset GPSI bit in test register */
33956- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
33957+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
33958 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
33959 val |= 0x10;
33960- lp->a.write_csr(ioaddr, 124, val);
33961+ lp->a->write_csr(ioaddr, 124, val);
33962
33963 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
33964 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
33965@@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_device *dev)
33966 * duplex, and/or enable auto negotiation, and clear DANAS
33967 */
33968 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
33969- lp->a.write_bcr(ioaddr, 32,
33970- lp->a.read_bcr(ioaddr, 32) | 0x0080);
33971+ lp->a->write_bcr(ioaddr, 32,
33972+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
33973 /* disable Auto Negotiation, set 10Mpbs, HD */
33974- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
33975+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
33976 if (lp->options & PCNET32_PORT_FD)
33977 val |= 0x10;
33978 if (lp->options & PCNET32_PORT_100)
33979 val |= 0x08;
33980- lp->a.write_bcr(ioaddr, 32, val);
33981+ lp->a->write_bcr(ioaddr, 32, val);
33982 } else {
33983 if (lp->options & PCNET32_PORT_ASEL) {
33984- lp->a.write_bcr(ioaddr, 32,
33985- lp->a.read_bcr(ioaddr,
33986+ lp->a->write_bcr(ioaddr, 32,
33987+ lp->a->read_bcr(ioaddr,
33988 32) | 0x0080);
33989 /* enable auto negotiate, setup, disable fd */
33990- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
33991+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
33992 val |= 0x20;
33993- lp->a.write_bcr(ioaddr, 32, val);
33994+ lp->a->write_bcr(ioaddr, 32, val);
33995 }
33996 }
33997 } else {
33998@@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_device *dev)
33999 * There is really no good other way to handle multiple PHYs
34000 * other than turning off all automatics
34001 */
34002- val = lp->a.read_bcr(ioaddr, 2);
34003- lp->a.write_bcr(ioaddr, 2, val & ~2);
34004- val = lp->a.read_bcr(ioaddr, 32);
34005- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
34006+ val = lp->a->read_bcr(ioaddr, 2);
34007+ lp->a->write_bcr(ioaddr, 2, val & ~2);
34008+ val = lp->a->read_bcr(ioaddr, 32);
34009+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
34010
34011 if (!(lp->options & PCNET32_PORT_ASEL)) {
34012 /* setup ecmd */
34013@@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_device *dev)
34014 ethtool_cmd_speed_set(&ecmd,
34015 (lp->options & PCNET32_PORT_100) ?
34016 SPEED_100 : SPEED_10);
34017- bcr9 = lp->a.read_bcr(ioaddr, 9);
34018+ bcr9 = lp->a->read_bcr(ioaddr, 9);
34019
34020 if (lp->options & PCNET32_PORT_FD) {
34021 ecmd.duplex = DUPLEX_FULL;
34022@@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_device *dev)
34023 ecmd.duplex = DUPLEX_HALF;
34024 bcr9 |= ~(1 << 0);
34025 }
34026- lp->a.write_bcr(ioaddr, 9, bcr9);
34027+ lp->a->write_bcr(ioaddr, 9, bcr9);
34028 }
34029
34030 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
34031@@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_device *dev)
34032
34033 #ifdef DO_DXSUFLO
34034 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
34035- val = lp->a.read_csr(ioaddr, CSR3);
34036+ val = lp->a->read_csr(ioaddr, CSR3);
34037 val |= 0x40;
34038- lp->a.write_csr(ioaddr, CSR3, val);
34039+ lp->a->write_csr(ioaddr, CSR3, val);
34040 }
34041 #endif
34042
34043@@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_device *dev)
34044 napi_enable(&lp->napi);
34045
34046 /* Re-initialize the PCNET32, and start it when done. */
34047- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
34048- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
34049+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
34050+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
34051
34052- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34053- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
34054+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34055+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
34056
34057 netif_start_queue(dev);
34058
34059@@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_device *dev)
34060
34061 i = 0;
34062 while (i++ < 100)
34063- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
34064+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
34065 break;
34066 /*
34067 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
34068 * reports that doing so triggers a bug in the '974.
34069 */
34070- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
34071+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
34072
34073 netif_printk(lp, ifup, KERN_DEBUG, dev,
34074 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
34075 i,
34076 (u32) (lp->init_dma_addr),
34077- lp->a.read_csr(ioaddr, CSR0));
34078+ lp->a->read_csr(ioaddr, CSR0));
34079
34080 spin_unlock_irqrestore(&lp->lock, flags);
34081
34082@@ -2218,7 +2218,7 @@ err_free_ring:
34083 * Switch back to 16bit mode to avoid problems with dumb
34084 * DOS packet driver after a warm reboot
34085 */
34086- lp->a.write_bcr(ioaddr, 20, 4);
34087+ lp->a->write_bcr(ioaddr, 20, 4);
34088
34089 err_free_irq:
34090 spin_unlock_irqrestore(&lp->lock, flags);
34091@@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
34092
34093 /* wait for stop */
34094 for (i = 0; i < 100; i++)
34095- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
34096+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
34097 break;
34098
34099 if (i >= 100)
34100@@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
34101 return;
34102
34103 /* ReInit Ring */
34104- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
34105+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
34106 i = 0;
34107 while (i++ < 1000)
34108- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
34109+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
34110 break;
34111
34112- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
34113+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
34114 }
34115
34116 static void pcnet32_tx_timeout(struct net_device *dev)
34117@@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
34118 /* Transmitter timeout, serious problems. */
34119 if (pcnet32_debug & NETIF_MSG_DRV)
34120 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
34121- dev->name, lp->a.read_csr(ioaddr, CSR0));
34122- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34123+ dev->name, lp->a->read_csr(ioaddr, CSR0));
34124+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34125 dev->stats.tx_errors++;
34126 if (netif_msg_tx_err(lp)) {
34127 int i;
34128@@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
34129
34130 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
34131 "%s() called, csr0 %4.4x\n",
34132- __func__, lp->a.read_csr(ioaddr, CSR0));
34133+ __func__, lp->a->read_csr(ioaddr, CSR0));
34134
34135 /* Default status -- will not enable Successful-TxDone
34136 * interrupt when that option is available to us.
34137@@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
34138 dev->stats.tx_bytes += skb->len;
34139
34140 /* Trigger an immediate send poll. */
34141- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
34142+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
34143
34144 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
34145 lp->tx_full = 1;
34146@@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
34147
34148 spin_lock(&lp->lock);
34149
34150- csr0 = lp->a.read_csr(ioaddr, CSR0);
34151+ csr0 = lp->a->read_csr(ioaddr, CSR0);
34152 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
34153 if (csr0 == 0xffff)
34154 break; /* PCMCIA remove happened */
34155 /* Acknowledge all of the current interrupt sources ASAP. */
34156- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
34157+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
34158
34159 netif_printk(lp, intr, KERN_DEBUG, dev,
34160 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
34161- csr0, lp->a.read_csr(ioaddr, CSR0));
34162+ csr0, lp->a->read_csr(ioaddr, CSR0));
34163
34164 /* Log misc errors. */
34165 if (csr0 & 0x4000)
34166@@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
34167 if (napi_schedule_prep(&lp->napi)) {
34168 u16 val;
34169 /* set interrupt masks */
34170- val = lp->a.read_csr(ioaddr, CSR3);
34171+ val = lp->a->read_csr(ioaddr, CSR3);
34172 val |= 0x5f00;
34173- lp->a.write_csr(ioaddr, CSR3, val);
34174+ lp->a->write_csr(ioaddr, CSR3, val);
34175
34176 __napi_schedule(&lp->napi);
34177 break;
34178 }
34179- csr0 = lp->a.read_csr(ioaddr, CSR0);
34180+ csr0 = lp->a->read_csr(ioaddr, CSR0);
34181 }
34182
34183 netif_printk(lp, intr, KERN_DEBUG, dev,
34184 "exiting interrupt, csr0=%#4.4x\n",
34185- lp->a.read_csr(ioaddr, CSR0));
34186+ lp->a->read_csr(ioaddr, CSR0));
34187
34188 spin_unlock(&lp->lock);
34189
34190@@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_device *dev)
34191
34192 spin_lock_irqsave(&lp->lock, flags);
34193
34194- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
34195+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
34196
34197 netif_printk(lp, ifdown, KERN_DEBUG, dev,
34198 "Shutting down ethercard, status was %2.2x\n",
34199- lp->a.read_csr(ioaddr, CSR0));
34200+ lp->a->read_csr(ioaddr, CSR0));
34201
34202 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
34203- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34204+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34205
34206 /*
34207 * Switch back to 16bit mode to avoid problems with dumb
34208 * DOS packet driver after a warm reboot
34209 */
34210- lp->a.write_bcr(ioaddr, 20, 4);
34211+ lp->a->write_bcr(ioaddr, 20, 4);
34212
34213 spin_unlock_irqrestore(&lp->lock, flags);
34214
34215@@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
34216 unsigned long flags;
34217
34218 spin_lock_irqsave(&lp->lock, flags);
34219- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
34220+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
34221 spin_unlock_irqrestore(&lp->lock, flags);
34222
34223 return &dev->stats;
34224@@ -2577,10 +2577,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
34225 if (dev->flags & IFF_ALLMULTI) {
34226 ib->filter[0] = cpu_to_le32(~0U);
34227 ib->filter[1] = cpu_to_le32(~0U);
34228- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
34229- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34230- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34231- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34232+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
34233+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34234+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34235+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34236 return;
34237 }
34238 /* clear the multicast filter */
34239@@ -2594,7 +2594,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
34240 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
34241 }
34242 for (i = 0; i < 4; i++)
34243- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
34244+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
34245 le16_to_cpu(mcast_table[i]));
34246 }
34247
34248@@ -2609,28 +2609,28 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
34249
34250 spin_lock_irqsave(&lp->lock, flags);
34251 suspended = pcnet32_suspend(dev, &flags, 0);
34252- csr15 = lp->a.read_csr(ioaddr, CSR15);
34253+ csr15 = lp->a->read_csr(ioaddr, CSR15);
34254 if (dev->flags & IFF_PROMISC) {
34255 /* Log any net taps. */
34256 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
34257 lp->init_block->mode =
34258 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
34259 7);
34260- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
34261+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
34262 } else {
34263 lp->init_block->mode =
34264 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
34265- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34266+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34267 pcnet32_load_multicast(dev);
34268 }
34269
34270 if (suspended) {
34271 int csr5;
34272 /* clear SUSPEND (SPND) - CSR5 bit 0 */
34273- csr5 = lp->a.read_csr(ioaddr, CSR5);
34274- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34275+ csr5 = lp->a->read_csr(ioaddr, CSR5);
34276+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34277 } else {
34278- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34279+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34280 pcnet32_restart(dev, CSR0_NORMAL);
34281 netif_wake_queue(dev);
34282 }
34283@@ -2648,8 +2648,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
34284 if (!lp->mii)
34285 return 0;
34286
34287- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34288- val_out = lp->a.read_bcr(ioaddr, 34);
34289+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34290+ val_out = lp->a->read_bcr(ioaddr, 34);
34291
34292 return val_out;
34293 }
34294@@ -2663,8 +2663,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
34295 if (!lp->mii)
34296 return;
34297
34298- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34299- lp->a.write_bcr(ioaddr, 34, val);
34300+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34301+ lp->a->write_bcr(ioaddr, 34, val);
34302 }
34303
34304 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34305@@ -2741,7 +2741,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34306 curr_link = mii_link_ok(&lp->mii_if);
34307 } else {
34308 ulong ioaddr = dev->base_addr; /* card base I/O address */
34309- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34310+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34311 }
34312 if (!curr_link) {
34313 if (prev_link || verbose) {
34314@@ -2764,13 +2764,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34315 (ecmd.duplex == DUPLEX_FULL)
34316 ? "full" : "half");
34317 }
34318- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
34319+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
34320 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
34321 if (lp->mii_if.full_duplex)
34322 bcr9 |= (1 << 0);
34323 else
34324 bcr9 &= ~(1 << 0);
34325- lp->a.write_bcr(dev->base_addr, 9, bcr9);
34326+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
34327 }
34328 } else {
34329 netif_info(lp, link, dev, "link up\n");
34330diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
34331index edfa15d..002bfa9 100644
34332--- a/drivers/net/ppp_generic.c
34333+++ b/drivers/net/ppp_generic.c
34334@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34335 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
34336 struct ppp_stats stats;
34337 struct ppp_comp_stats cstats;
34338- char *vers;
34339
34340 switch (cmd) {
34341 case SIOCGPPPSTATS:
34342@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34343 break;
34344
34345 case SIOCGPPPVER:
34346- vers = PPP_VERSION;
34347- if (copy_to_user(addr, vers, strlen(vers) + 1))
34348+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
34349 break;
34350 err = 0;
34351 break;
34352diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
34353index 6d657ca..d1be94b 100644
34354--- a/drivers/net/r8169.c
34355+++ b/drivers/net/r8169.c
34356@@ -663,12 +663,12 @@ struct rtl8169_private {
34357 struct mdio_ops {
34358 void (*write)(void __iomem *, int, int);
34359 int (*read)(void __iomem *, int);
34360- } mdio_ops;
34361+ } __no_const mdio_ops;
34362
34363 struct pll_power_ops {
34364 void (*down)(struct rtl8169_private *);
34365 void (*up)(struct rtl8169_private *);
34366- } pll_power_ops;
34367+ } __no_const pll_power_ops;
34368
34369 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
34370 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
34371diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
34372index 3c0f131..17f8b02 100644
34373--- a/drivers/net/sis190.c
34374+++ b/drivers/net/sis190.c
34375@@ -1624,7 +1624,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
34376 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
34377 struct net_device *dev)
34378 {
34379- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
34380+ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
34381 struct sis190_private *tp = netdev_priv(dev);
34382 struct pci_dev *isa_bridge;
34383 u8 reg, tmp8;
34384diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
34385index 4793df8..44c9849 100644
34386--- a/drivers/net/sundance.c
34387+++ b/drivers/net/sundance.c
34388@@ -218,7 +218,7 @@ enum {
34389 struct pci_id_info {
34390 const char *name;
34391 };
34392-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34393+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34394 {"D-Link DFE-550TX FAST Ethernet Adapter"},
34395 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
34396 {"D-Link DFE-580TX 4 port Server Adapter"},
34397diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
34398index 2ea456d..3ad9523 100644
34399--- a/drivers/net/tg3.h
34400+++ b/drivers/net/tg3.h
34401@@ -134,6 +134,7 @@
34402 #define CHIPREV_ID_5750_A0 0x4000
34403 #define CHIPREV_ID_5750_A1 0x4001
34404 #define CHIPREV_ID_5750_A3 0x4003
34405+#define CHIPREV_ID_5750_C1 0x4201
34406 #define CHIPREV_ID_5750_C2 0x4202
34407 #define CHIPREV_ID_5752_A0_HW 0x5000
34408 #define CHIPREV_ID_5752_A0 0x6000
34409diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
34410index 515f122..41dd273 100644
34411--- a/drivers/net/tokenring/abyss.c
34412+++ b/drivers/net/tokenring/abyss.c
34413@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
34414
34415 static int __init abyss_init (void)
34416 {
34417- abyss_netdev_ops = tms380tr_netdev_ops;
34418+ pax_open_kernel();
34419+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34420
34421- abyss_netdev_ops.ndo_open = abyss_open;
34422- abyss_netdev_ops.ndo_stop = abyss_close;
34423+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
34424+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
34425+ pax_close_kernel();
34426
34427 return pci_register_driver(&abyss_driver);
34428 }
34429diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
34430index 6153cfd..cf69c1c 100644
34431--- a/drivers/net/tokenring/madgemc.c
34432+++ b/drivers/net/tokenring/madgemc.c
34433@@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver = {
34434
34435 static int __init madgemc_init (void)
34436 {
34437- madgemc_netdev_ops = tms380tr_netdev_ops;
34438- madgemc_netdev_ops.ndo_open = madgemc_open;
34439- madgemc_netdev_ops.ndo_stop = madgemc_close;
34440+ pax_open_kernel();
34441+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34442+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
34443+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
34444+ pax_close_kernel();
34445
34446 return mca_register_driver (&madgemc_driver);
34447 }
34448diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
34449index 8d362e6..f91cc52 100644
34450--- a/drivers/net/tokenring/proteon.c
34451+++ b/drivers/net/tokenring/proteon.c
34452@@ -353,9 +353,11 @@ static int __init proteon_init(void)
34453 struct platform_device *pdev;
34454 int i, num = 0, err = 0;
34455
34456- proteon_netdev_ops = tms380tr_netdev_ops;
34457- proteon_netdev_ops.ndo_open = proteon_open;
34458- proteon_netdev_ops.ndo_stop = tms380tr_close;
34459+ pax_open_kernel();
34460+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34461+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
34462+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
34463+ pax_close_kernel();
34464
34465 err = platform_driver_register(&proteon_driver);
34466 if (err)
34467diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
34468index 46db5c5..37c1536 100644
34469--- a/drivers/net/tokenring/skisa.c
34470+++ b/drivers/net/tokenring/skisa.c
34471@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
34472 struct platform_device *pdev;
34473 int i, num = 0, err = 0;
34474
34475- sk_isa_netdev_ops = tms380tr_netdev_ops;
34476- sk_isa_netdev_ops.ndo_open = sk_isa_open;
34477- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34478+ pax_open_kernel();
34479+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34480+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
34481+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34482+ pax_close_kernel();
34483
34484 err = platform_driver_register(&sk_isa_driver);
34485 if (err)
34486diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
34487index ce90efc..2676f89 100644
34488--- a/drivers/net/tulip/de2104x.c
34489+++ b/drivers/net/tulip/de2104x.c
34490@@ -1795,6 +1795,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
34491 struct de_srom_info_leaf *il;
34492 void *bufp;
34493
34494+ pax_track_stack();
34495+
34496 /* download entire eeprom */
34497 for (i = 0; i < DE_EEPROM_WORDS; i++)
34498 ((__le16 *)ee_data)[i] =
34499diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
34500index 959b410..c97fac2 100644
34501--- a/drivers/net/tulip/de4x5.c
34502+++ b/drivers/net/tulip/de4x5.c
34503@@ -5397,7 +5397,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34504 for (i=0; i<ETH_ALEN; i++) {
34505 tmp.addr[i] = dev->dev_addr[i];
34506 }
34507- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34508+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34509 break;
34510
34511 case DE4X5_SET_HWADDR: /* Set the hardware address */
34512@@ -5437,7 +5437,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34513 spin_lock_irqsave(&lp->lock, flags);
34514 memcpy(&statbuf, &lp->pktStats, ioc->len);
34515 spin_unlock_irqrestore(&lp->lock, flags);
34516- if (copy_to_user(ioc->data, &statbuf, ioc->len))
34517+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34518 return -EFAULT;
34519 break;
34520 }
34521diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
34522index fa5eee9..e074432 100644
34523--- a/drivers/net/tulip/eeprom.c
34524+++ b/drivers/net/tulip/eeprom.c
34525@@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
34526 {NULL}};
34527
34528
34529-static const char *block_name[] __devinitdata = {
34530+static const char *block_name[] __devinitconst = {
34531 "21140 non-MII",
34532 "21140 MII PHY",
34533 "21142 Serial PHY",
34534diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
34535index 862eadf..3eee1e6 100644
34536--- a/drivers/net/tulip/winbond-840.c
34537+++ b/drivers/net/tulip/winbond-840.c
34538@@ -236,7 +236,7 @@ struct pci_id_info {
34539 int drv_flags; /* Driver use, intended as capability flags. */
34540 };
34541
34542-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34543+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34544 { /* Sometime a Level-One switch card. */
34545 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
34546 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
34547diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
34548index 304fe78..db112fa 100644
34549--- a/drivers/net/usb/hso.c
34550+++ b/drivers/net/usb/hso.c
34551@@ -71,7 +71,7 @@
34552 #include <asm/byteorder.h>
34553 #include <linux/serial_core.h>
34554 #include <linux/serial.h>
34555-
34556+#include <asm/local.h>
34557
34558 #define MOD_AUTHOR "Option Wireless"
34559 #define MOD_DESCRIPTION "USB High Speed Option driver"
34560@@ -257,7 +257,7 @@ struct hso_serial {
34561
34562 /* from usb_serial_port */
34563 struct tty_struct *tty;
34564- int open_count;
34565+ local_t open_count;
34566 spinlock_t serial_lock;
34567
34568 int (*write_data) (struct hso_serial *serial);
34569@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
34570 struct urb *urb;
34571
34572 urb = serial->rx_urb[0];
34573- if (serial->open_count > 0) {
34574+ if (local_read(&serial->open_count) > 0) {
34575 count = put_rxbuf_data(urb, serial);
34576 if (count == -1)
34577 return;
34578@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
34579 DUMP1(urb->transfer_buffer, urb->actual_length);
34580
34581 /* Anyone listening? */
34582- if (serial->open_count == 0)
34583+ if (local_read(&serial->open_count) == 0)
34584 return;
34585
34586 if (status == 0) {
34587@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34588 spin_unlock_irq(&serial->serial_lock);
34589
34590 /* check for port already opened, if not set the termios */
34591- serial->open_count++;
34592- if (serial->open_count == 1) {
34593+ if (local_inc_return(&serial->open_count) == 1) {
34594 serial->rx_state = RX_IDLE;
34595 /* Force default termio settings */
34596 _hso_serial_set_termios(tty, NULL);
34597@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34598 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
34599 if (result) {
34600 hso_stop_serial_device(serial->parent);
34601- serial->open_count--;
34602+ local_dec(&serial->open_count);
34603 kref_put(&serial->parent->ref, hso_serial_ref_free);
34604 }
34605 } else {
34606@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
34607
34608 /* reset the rts and dtr */
34609 /* do the actual close */
34610- serial->open_count--;
34611+ local_dec(&serial->open_count);
34612
34613- if (serial->open_count <= 0) {
34614- serial->open_count = 0;
34615+ if (local_read(&serial->open_count) <= 0) {
34616+ local_set(&serial->open_count, 0);
34617 spin_lock_irq(&serial->serial_lock);
34618 if (serial->tty == tty) {
34619 serial->tty->driver_data = NULL;
34620@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
34621
34622 /* the actual setup */
34623 spin_lock_irqsave(&serial->serial_lock, flags);
34624- if (serial->open_count)
34625+ if (local_read(&serial->open_count))
34626 _hso_serial_set_termios(tty, old);
34627 else
34628 tty->termios = old;
34629@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *urb)
34630 D1("Pending read interrupt on port %d\n", i);
34631 spin_lock(&serial->serial_lock);
34632 if (serial->rx_state == RX_IDLE &&
34633- serial->open_count > 0) {
34634+ local_read(&serial->open_count) > 0) {
34635 /* Setup and send a ctrl req read on
34636 * port i */
34637 if (!serial->rx_urb_filled[0]) {
34638@@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interface *iface)
34639 /* Start all serial ports */
34640 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
34641 if (serial_table[i] && (serial_table[i]->interface == iface)) {
34642- if (dev2ser(serial_table[i])->open_count) {
34643+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
34644 result =
34645 hso_start_serial_device(serial_table[i], GFP_NOIO);
34646 hso_kick_transmit(dev2ser(serial_table[i]));
34647diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34648index 27400ed..c796e05 100644
34649--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
34650+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34651@@ -601,8 +601,7 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
34652 * Return with error code if any of the queue indices
34653 * is out of range
34654 */
34655- if (p->ring_index[i] < 0 ||
34656- p->ring_index[i] >= adapter->num_rx_queues)
34657+ if (p->ring_index[i] >= adapter->num_rx_queues)
34658 return -EINVAL;
34659 }
34660
34661diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
34662index dd36258..e47fd31 100644
34663--- a/drivers/net/vxge/vxge-config.h
34664+++ b/drivers/net/vxge/vxge-config.h
34665@@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
34666 void (*link_down)(struct __vxge_hw_device *devh);
34667 void (*crit_err)(struct __vxge_hw_device *devh,
34668 enum vxge_hw_event type, u64 ext_data);
34669-};
34670+} __no_const;
34671
34672 /*
34673 * struct __vxge_hw_blockpool_entry - Block private data structure
34674diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
34675index 178348a2..18bb433 100644
34676--- a/drivers/net/vxge/vxge-main.c
34677+++ b/drivers/net/vxge/vxge-main.c
34678@@ -100,6 +100,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
34679 struct sk_buff *completed[NR_SKB_COMPLETED];
34680 int more;
34681
34682+ pax_track_stack();
34683+
34684 do {
34685 more = 0;
34686 skb_ptr = completed;
34687@@ -1915,6 +1917,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
34688 u8 mtable[256] = {0}; /* CPU to vpath mapping */
34689 int index;
34690
34691+ pax_track_stack();
34692+
34693 /*
34694 * Filling
34695 * - itable with bucket numbers
34696diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
34697index 4a518a3..936b334 100644
34698--- a/drivers/net/vxge/vxge-traffic.h
34699+++ b/drivers/net/vxge/vxge-traffic.h
34700@@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
34701 struct vxge_hw_mempool_dma *dma_object,
34702 u32 index,
34703 u32 is_last);
34704-};
34705+} __no_const;
34706
34707 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
34708 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
34709diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
34710index 56aeb01..547f71f 100644
34711--- a/drivers/net/wan/hdlc_x25.c
34712+++ b/drivers/net/wan/hdlc_x25.c
34713@@ -134,16 +134,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
34714
34715 static int x25_open(struct net_device *dev)
34716 {
34717- struct lapb_register_struct cb;
34718+ static struct lapb_register_struct cb = {
34719+ .connect_confirmation = x25_connected,
34720+ .connect_indication = x25_connected,
34721+ .disconnect_confirmation = x25_disconnected,
34722+ .disconnect_indication = x25_disconnected,
34723+ .data_indication = x25_data_indication,
34724+ .data_transmit = x25_data_transmit
34725+ };
34726 int result;
34727
34728- cb.connect_confirmation = x25_connected;
34729- cb.connect_indication = x25_connected;
34730- cb.disconnect_confirmation = x25_disconnected;
34731- cb.disconnect_indication = x25_disconnected;
34732- cb.data_indication = x25_data_indication;
34733- cb.data_transmit = x25_data_transmit;
34734-
34735 result = lapb_register(dev, &cb);
34736 if (result != LAPB_OK)
34737 return result;
34738diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
34739index 1fda46c..f2858f2 100644
34740--- a/drivers/net/wimax/i2400m/usb-fw.c
34741+++ b/drivers/net/wimax/i2400m/usb-fw.c
34742@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
34743 int do_autopm = 1;
34744 DECLARE_COMPLETION_ONSTACK(notif_completion);
34745
34746+ pax_track_stack();
34747+
34748 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
34749 i2400m, ack, ack_size);
34750 BUG_ON(_ack == i2400m->bm_ack_buf);
34751diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
34752index e1b3e3c..e413f18 100644
34753--- a/drivers/net/wireless/airo.c
34754+++ b/drivers/net/wireless/airo.c
34755@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
34756 BSSListElement * loop_net;
34757 BSSListElement * tmp_net;
34758
34759+ pax_track_stack();
34760+
34761 /* Blow away current list of scan results */
34762 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
34763 list_move_tail (&loop_net->list, &ai->network_free_list);
34764@@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
34765 WepKeyRid wkr;
34766 int rc;
34767
34768+ pax_track_stack();
34769+
34770 memset( &mySsid, 0, sizeof( mySsid ) );
34771 kfree (ai->flash);
34772 ai->flash = NULL;
34773@@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct inode *inode,
34774 __le32 *vals = stats.vals;
34775 int len;
34776
34777+ pax_track_stack();
34778+
34779 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34780 return -ENOMEM;
34781 data = file->private_data;
34782@@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
34783 /* If doLoseSync is not 1, we won't do a Lose Sync */
34784 int doLoseSync = -1;
34785
34786+ pax_track_stack();
34787+
34788 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34789 return -ENOMEM;
34790 data = file->private_data;
34791@@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_device *dev,
34792 int i;
34793 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
34794
34795+ pax_track_stack();
34796+
34797 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
34798 if (!qual)
34799 return -ENOMEM;
34800@@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
34801 CapabilityRid cap_rid;
34802 __le32 *vals = stats_rid.vals;
34803
34804+ pax_track_stack();
34805+
34806 /* Get stats out of the card */
34807 clear_bit(JOB_WSTATS, &local->jobs);
34808 if (local->power.event) {
34809diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
34810index 17c4b56..00d836f 100644
34811--- a/drivers/net/wireless/ath/ath.h
34812+++ b/drivers/net/wireless/ath/ath.h
34813@@ -121,6 +121,7 @@ struct ath_ops {
34814 void (*write_flush) (void *);
34815 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
34816 };
34817+typedef struct ath_ops __no_const ath_ops_no_const;
34818
34819 struct ath_common;
34820 struct ath_bus_ops;
34821diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
34822index ccca724..7afbadc 100644
34823--- a/drivers/net/wireless/ath/ath5k/debug.c
34824+++ b/drivers/net/wireless/ath/ath5k/debug.c
34825@@ -203,6 +203,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
34826 unsigned int v;
34827 u64 tsf;
34828
34829+ pax_track_stack();
34830+
34831 v = ath5k_hw_reg_read(ah, AR5K_BEACON);
34832 len += snprintf(buf + len, sizeof(buf) - len,
34833 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
34834@@ -321,6 +323,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
34835 unsigned int len = 0;
34836 unsigned int i;
34837
34838+ pax_track_stack();
34839+
34840 len += snprintf(buf + len, sizeof(buf) - len,
34841 "DEBUG LEVEL: 0x%08x\n\n", ah->debug.level);
34842
34843@@ -492,6 +496,8 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
34844 unsigned int len = 0;
34845 u32 filt = ath5k_hw_get_rx_filter(ah);
34846
34847+ pax_track_stack();
34848+
34849 len += snprintf(buf + len, sizeof(buf) - len, "bssid-mask: %pM\n",
34850 ah->bssidmask);
34851 len += snprintf(buf + len, sizeof(buf) - len, "filter-flags: 0x%x ",
34852@@ -548,6 +554,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
34853 unsigned int len = 0;
34854 int i;
34855
34856+ pax_track_stack();
34857+
34858 len += snprintf(buf + len, sizeof(buf) - len,
34859 "RX\n---------------------\n");
34860 len += snprintf(buf + len, sizeof(buf) - len, "CRC\t%u\t(%u%%)\n",
34861@@ -665,6 +673,8 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
34862 char buf[700];
34863 unsigned int len = 0;
34864
34865+ pax_track_stack();
34866+
34867 len += snprintf(buf + len, sizeof(buf) - len,
34868 "HW has PHY error counters:\t%s\n",
34869 ah->ah_capabilities.cap_has_phyerr_counters ?
34870@@ -829,6 +839,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34871 struct ath5k_buf *bf, *bf0;
34872 int i, n;
34873
34874+ pax_track_stack();
34875+
34876 len += snprintf(buf + len, sizeof(buf) - len,
34877 "available txbuffers: %d\n", ah->txbuf_len);
34878
34879diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34880index 7c2aaad..ad14dee 100644
34881--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34882+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34883@@ -758,6 +758,8 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah)
34884 int i, im, j;
34885 int nmeasurement;
34886
34887+ pax_track_stack();
34888+
34889 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
34890 if (ah->txchainmask & (1 << i))
34891 num_chains++;
34892diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34893index f80d1d6..08b773d 100644
34894--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34895+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34896@@ -406,6 +406,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
34897 int theta_low_bin = 0;
34898 int i;
34899
34900+ pax_track_stack();
34901+
34902 /* disregard any bin that contains <= 16 samples */
34903 thresh_accum_cnt = 16;
34904 scale_factor = 5;
34905diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
34906index d1eb896..8b67cd4 100644
34907--- a/drivers/net/wireless/ath/ath9k/debug.c
34908+++ b/drivers/net/wireless/ath/ath9k/debug.c
34909@@ -387,6 +387,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
34910 char buf[512];
34911 unsigned int len = 0;
34912
34913+ pax_track_stack();
34914+
34915 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
34916 len += snprintf(buf + len, sizeof(buf) - len,
34917 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
34918@@ -477,6 +479,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
34919 u8 addr[ETH_ALEN];
34920 u32 tmp;
34921
34922+ pax_track_stack();
34923+
34924 len += snprintf(buf + len, sizeof(buf) - len,
34925 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
34926 wiphy_name(sc->hw->wiphy),
34927diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34928index d3ff33c..309398e 100644
34929--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34930+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34931@@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
34932 unsigned int len = 0;
34933 int ret = 0;
34934
34935+ pax_track_stack();
34936+
34937 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34938
34939 ath9k_htc_ps_wakeup(priv);
34940@@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
34941 unsigned int len = 0;
34942 int ret = 0;
34943
34944+ pax_track_stack();
34945+
34946 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34947
34948 ath9k_htc_ps_wakeup(priv);
34949@@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
34950 unsigned int len = 0;
34951 int ret = 0;
34952
34953+ pax_track_stack();
34954+
34955 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34956
34957 ath9k_htc_ps_wakeup(priv);
34958@@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
34959 char buf[512];
34960 unsigned int len = 0;
34961
34962+ pax_track_stack();
34963+
34964 len += snprintf(buf + len, sizeof(buf) - len,
34965 "%20s : %10u\n", "Buffers queued",
34966 priv->debug.tx_stats.buf_queued);
34967@@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
34968 char buf[512];
34969 unsigned int len = 0;
34970
34971+ pax_track_stack();
34972+
34973 spin_lock_bh(&priv->tx.tx_lock);
34974
34975 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
34976@@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34977 char buf[512];
34978 unsigned int len = 0;
34979
34980+ pax_track_stack();
34981+
34982 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
34983 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
34984
34985diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
34986index c798890..c19a8fb 100644
34987--- a/drivers/net/wireless/ath/ath9k/hw.h
34988+++ b/drivers/net/wireless/ath/ath9k/hw.h
34989@@ -588,7 +588,7 @@ struct ath_hw_private_ops {
34990
34991 /* ANI */
34992 void (*ani_cache_ini_regs)(struct ath_hw *ah);
34993-};
34994+} __no_const;
34995
34996 /**
34997 * struct ath_hw_ops - callbacks used by hardware code and driver code
34998@@ -639,7 +639,7 @@ struct ath_hw_ops {
34999 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
35000 struct ath_hw_antcomb_conf *antconf);
35001
35002-};
35003+} __no_const;
35004
35005 struct ath_nf_limits {
35006 s16 max;
35007@@ -652,7 +652,7 @@ struct ath_nf_limits {
35008 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
35009
35010 struct ath_hw {
35011- struct ath_ops reg_ops;
35012+ ath_ops_no_const reg_ops;
35013
35014 struct ieee80211_hw *hw;
35015 struct ath_common common;
35016diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
35017index ef9ad79..f5f8d80 100644
35018--- a/drivers/net/wireless/ipw2x00/ipw2100.c
35019+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
35020@@ -2102,6 +2102,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
35021 int err;
35022 DECLARE_SSID_BUF(ssid);
35023
35024+ pax_track_stack();
35025+
35026 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
35027
35028 if (ssid_len)
35029@@ -5451,6 +5453,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
35030 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
35031 int err;
35032
35033+ pax_track_stack();
35034+
35035 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
35036 idx, keylen, len);
35037
35038diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
35039index 32a9966..de69787 100644
35040--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
35041+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
35042@@ -1565,6 +1565,8 @@ static void libipw_process_probe_response(struct libipw_device
35043 unsigned long flags;
35044 DECLARE_SSID_BUF(ssid);
35045
35046+ pax_track_stack();
35047+
35048 LIBIPW_DEBUG_SCAN("'%s' (%pM"
35049 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
35050 print_ssid(ssid, info_element->data, info_element->len),
35051diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
35052index 66ee1562..b90412b 100644
35053--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
35054+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
35055@@ -3687,7 +3687,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
35056 */
35057 if (iwl3945_mod_params.disable_hw_scan) {
35058 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
35059- iwl3945_hw_ops.hw_scan = NULL;
35060+ pax_open_kernel();
35061+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
35062+ pax_close_kernel();
35063 }
35064
35065 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
35066diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
35067index 3789ff4..22ab151 100644
35068--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
35069+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
35070@@ -920,6 +920,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
35071 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
35072 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
35073
35074+ pax_track_stack();
35075+
35076 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
35077
35078 /* Treat uninitialized rate scaling data same as non-existing. */
35079@@ -2931,6 +2933,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
35080 container_of(lq_sta, struct iwl_station_priv, lq_sta);
35081 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
35082
35083+ pax_track_stack();
35084+
35085 /* Override starting rate (index 0) if needed for debug purposes */
35086 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
35087
35088diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
35089index f9a407e..a6f2bb7 100644
35090--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
35091+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
35092@@ -68,8 +68,8 @@ do { \
35093 } while (0)
35094
35095 #else
35096-#define IWL_DEBUG(__priv, level, fmt, args...)
35097-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
35098+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
35099+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
35100 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
35101 const void *p, u32 len)
35102 {}
35103diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
35104index ec1485b..900c3bd 100644
35105--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
35106+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
35107@@ -561,6 +561,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
35108 int pos = 0;
35109 const size_t bufsz = sizeof(buf);
35110
35111+ pax_track_stack();
35112+
35113 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
35114 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
35115 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
35116@@ -693,6 +695,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
35117 char buf[256 * NUM_IWL_RXON_CTX];
35118 const size_t bufsz = sizeof(buf);
35119
35120+ pax_track_stack();
35121+
35122 for_each_context(priv, ctx) {
35123 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
35124 ctx->ctxid);
35125diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
35126index 0a0cc96..fd49ad8 100644
35127--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
35128+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
35129@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
35130 int buf_len = 512;
35131 size_t len = 0;
35132
35133+ pax_track_stack();
35134+
35135 if (*ppos != 0)
35136 return 0;
35137 if (count < sizeof(buf))
35138diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
35139index 031cd89..bdc8435 100644
35140--- a/drivers/net/wireless/mac80211_hwsim.c
35141+++ b/drivers/net/wireless/mac80211_hwsim.c
35142@@ -1670,9 +1670,11 @@ static int __init init_mac80211_hwsim(void)
35143 return -EINVAL;
35144
35145 if (fake_hw_scan) {
35146- mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
35147- mac80211_hwsim_ops.sw_scan_start = NULL;
35148- mac80211_hwsim_ops.sw_scan_complete = NULL;
35149+ pax_open_kernel();
35150+ *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
35151+ *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
35152+ *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
35153+ pax_close_kernel();
35154 }
35155
35156 spin_lock_init(&hwsim_radio_lock);
35157diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
35158index 2215c3c..64e6a47 100644
35159--- a/drivers/net/wireless/mwifiex/main.h
35160+++ b/drivers/net/wireless/mwifiex/main.h
35161@@ -560,7 +560,7 @@ struct mwifiex_if_ops {
35162
35163 void (*update_mp_end_port) (struct mwifiex_adapter *, u16);
35164 void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
35165-};
35166+} __no_const;
35167
35168 struct mwifiex_adapter {
35169 struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
35170diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
35171index 29f9389..f6d2ce0 100644
35172--- a/drivers/net/wireless/rndis_wlan.c
35173+++ b/drivers/net/wireless/rndis_wlan.c
35174@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
35175
35176 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
35177
35178- if (rts_threshold < 0 || rts_threshold > 2347)
35179+ if (rts_threshold > 2347)
35180 rts_threshold = 2347;
35181
35182 tmp = cpu_to_le32(rts_threshold);
35183diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
35184index 3b11642..d6bb049 100644
35185--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
35186+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
35187@@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
35188 u8 rfpath;
35189 u8 num_total_rfpath = rtlphy->num_total_rfpath;
35190
35191+ pax_track_stack();
35192+
35193 precommoncmdcnt = 0;
35194 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
35195 MAX_PRECMD_CNT,
35196diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
35197index a77f1bb..c608b2b 100644
35198--- a/drivers/net/wireless/wl1251/wl1251.h
35199+++ b/drivers/net/wireless/wl1251/wl1251.h
35200@@ -266,7 +266,7 @@ struct wl1251_if_operations {
35201 void (*reset)(struct wl1251 *wl);
35202 void (*enable_irq)(struct wl1251 *wl);
35203 void (*disable_irq)(struct wl1251 *wl);
35204-};
35205+} __no_const;
35206
35207 struct wl1251 {
35208 struct ieee80211_hw *hw;
35209diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
35210index e0b3736..4b466e6 100644
35211--- a/drivers/net/wireless/wl12xx/spi.c
35212+++ b/drivers/net/wireless/wl12xx/spi.c
35213@@ -281,6 +281,8 @@ static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
35214 u32 chunk_len;
35215 int i;
35216
35217+ pax_track_stack();
35218+
35219 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
35220
35221 spi_message_init(&m);
35222diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
35223index f34b5b2..b5abb9f 100644
35224--- a/drivers/oprofile/buffer_sync.c
35225+++ b/drivers/oprofile/buffer_sync.c
35226@@ -343,7 +343,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
35227 if (cookie == NO_COOKIE)
35228 offset = pc;
35229 if (cookie == INVALID_COOKIE) {
35230- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35231+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35232 offset = pc;
35233 }
35234 if (cookie != last_cookie) {
35235@@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
35236 /* add userspace sample */
35237
35238 if (!mm) {
35239- atomic_inc(&oprofile_stats.sample_lost_no_mm);
35240+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
35241 return 0;
35242 }
35243
35244 cookie = lookup_dcookie(mm, s->eip, &offset);
35245
35246 if (cookie == INVALID_COOKIE) {
35247- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35248+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35249 return 0;
35250 }
35251
35252@@ -563,7 +563,7 @@ void sync_buffer(int cpu)
35253 /* ignore backtraces if failed to add a sample */
35254 if (state == sb_bt_start) {
35255 state = sb_bt_ignore;
35256- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
35257+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
35258 }
35259 }
35260 release_mm(mm);
35261diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
35262index dd87e86..bc0148c 100644
35263--- a/drivers/oprofile/event_buffer.c
35264+++ b/drivers/oprofile/event_buffer.c
35265@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
35266 }
35267
35268 if (buffer_pos == buffer_size) {
35269- atomic_inc(&oprofile_stats.event_lost_overflow);
35270+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
35271 return;
35272 }
35273
35274diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
35275index f8c752e..28bf4fc 100644
35276--- a/drivers/oprofile/oprof.c
35277+++ b/drivers/oprofile/oprof.c
35278@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
35279 if (oprofile_ops.switch_events())
35280 return;
35281
35282- atomic_inc(&oprofile_stats.multiplex_counter);
35283+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
35284 start_switch_worker();
35285 }
35286
35287diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
35288index 917d28e..d62d981 100644
35289--- a/drivers/oprofile/oprofile_stats.c
35290+++ b/drivers/oprofile/oprofile_stats.c
35291@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
35292 cpu_buf->sample_invalid_eip = 0;
35293 }
35294
35295- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
35296- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35297- atomic_set(&oprofile_stats.event_lost_overflow, 0);
35298- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35299- atomic_set(&oprofile_stats.multiplex_counter, 0);
35300+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35301+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35302+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35303+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35304+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35305 }
35306
35307
35308diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
35309index 38b6fc0..b5cbfce 100644
35310--- a/drivers/oprofile/oprofile_stats.h
35311+++ b/drivers/oprofile/oprofile_stats.h
35312@@ -13,11 +13,11 @@
35313 #include <linux/atomic.h>
35314
35315 struct oprofile_stat_struct {
35316- atomic_t sample_lost_no_mm;
35317- atomic_t sample_lost_no_mapping;
35318- atomic_t bt_lost_no_mapping;
35319- atomic_t event_lost_overflow;
35320- atomic_t multiplex_counter;
35321+ atomic_unchecked_t sample_lost_no_mm;
35322+ atomic_unchecked_t sample_lost_no_mapping;
35323+ atomic_unchecked_t bt_lost_no_mapping;
35324+ atomic_unchecked_t event_lost_overflow;
35325+ atomic_unchecked_t multiplex_counter;
35326 };
35327
35328 extern struct oprofile_stat_struct oprofile_stats;
35329diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
35330index 1c0b799..c11b2d2 100644
35331--- a/drivers/oprofile/oprofilefs.c
35332+++ b/drivers/oprofile/oprofilefs.c
35333@@ -193,7 +193,7 @@ static const struct file_operations atomic_ro_fops = {
35334
35335
35336 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35337- char const *name, atomic_t *val)
35338+ char const *name, atomic_unchecked_t *val)
35339 {
35340 return __oprofilefs_create_file(sb, root, name,
35341 &atomic_ro_fops, 0444, val);
35342diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
35343index 3f56bc0..707d642 100644
35344--- a/drivers/parport/procfs.c
35345+++ b/drivers/parport/procfs.c
35346@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
35347
35348 *ppos += len;
35349
35350- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35351+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35352 }
35353
35354 #ifdef CONFIG_PARPORT_1284
35355@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
35356
35357 *ppos += len;
35358
35359- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35360+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35361 }
35362 #endif /* IEEE1284.3 support. */
35363
35364diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
35365index 9fff878..ad0ad53 100644
35366--- a/drivers/pci/hotplug/cpci_hotplug.h
35367+++ b/drivers/pci/hotplug/cpci_hotplug.h
35368@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35369 int (*hardware_test) (struct slot* slot, u32 value);
35370 u8 (*get_power) (struct slot* slot);
35371 int (*set_power) (struct slot* slot, int value);
35372-};
35373+} __no_const;
35374
35375 struct cpci_hp_controller {
35376 unsigned int irq;
35377diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
35378index 76ba8a1..20ca857 100644
35379--- a/drivers/pci/hotplug/cpqphp_nvram.c
35380+++ b/drivers/pci/hotplug/cpqphp_nvram.c
35381@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
35382
35383 void compaq_nvram_init (void __iomem *rom_start)
35384 {
35385+
35386+#ifndef CONFIG_PAX_KERNEXEC
35387 if (rom_start) {
35388 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35389 }
35390+#endif
35391+
35392 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35393
35394 /* initialize our int15 lock */
35395diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
35396index cbfbab1..6a9fced 100644
35397--- a/drivers/pci/pcie/aspm.c
35398+++ b/drivers/pci/pcie/aspm.c
35399@@ -27,9 +27,9 @@
35400 #define MODULE_PARAM_PREFIX "pcie_aspm."
35401
35402 /* Note: those are not register definitions */
35403-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35404-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35405-#define ASPM_STATE_L1 (4) /* L1 state */
35406+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35407+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35408+#define ASPM_STATE_L1 (4U) /* L1 state */
35409 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35410 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35411
35412diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
35413index 6ab6bd3..72bdc69 100644
35414--- a/drivers/pci/probe.c
35415+++ b/drivers/pci/probe.c
35416@@ -136,7 +136,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
35417 u32 l, sz, mask;
35418 u16 orig_cmd;
35419
35420- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
35421+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
35422
35423 if (!dev->mmio_always_on) {
35424 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
35425diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
35426index 27911b5..5b6db88 100644
35427--- a/drivers/pci/proc.c
35428+++ b/drivers/pci/proc.c
35429@@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
35430 static int __init pci_proc_init(void)
35431 {
35432 struct pci_dev *dev = NULL;
35433+
35434+#ifdef CONFIG_GRKERNSEC_PROC_ADD
35435+#ifdef CONFIG_GRKERNSEC_PROC_USER
35436+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35437+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35438+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35439+#endif
35440+#else
35441 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35442+#endif
35443 proc_create("devices", 0, proc_bus_pci_dir,
35444 &proc_bus_pci_dev_operations);
35445 proc_initialized = 1;
35446diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
35447index 90832a9..419089a 100644
35448--- a/drivers/pci/xen-pcifront.c
35449+++ b/drivers/pci/xen-pcifront.c
35450@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_bus *bus, unsigned int devfn,
35451 struct pcifront_sd *sd = bus->sysdata;
35452 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35453
35454+ pax_track_stack();
35455+
35456 if (verbose_request)
35457 dev_info(&pdev->xdev->dev,
35458 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
35459@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci_bus *bus, unsigned int devfn,
35460 struct pcifront_sd *sd = bus->sysdata;
35461 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35462
35463+ pax_track_stack();
35464+
35465 if (verbose_request)
35466 dev_info(&pdev->xdev->dev,
35467 "write dev=%04x:%02x:%02x.%01x - "
35468@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
35469 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35470 struct msi_desc *entry;
35471
35472+ pax_track_stack();
35473+
35474 if (nvec > SH_INFO_MAX_VEC) {
35475 dev_err(&dev->dev, "too much vector for pci frontend: %x."
35476 " Increase SH_INFO_MAX_VEC.\n", nvec);
35477@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(struct pci_dev *dev)
35478 struct pcifront_sd *sd = dev->bus->sysdata;
35479 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35480
35481+ pax_track_stack();
35482+
35483 err = do_pci_op(pdev, &op);
35484
35485 /* What should do for error ? */
35486@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struct pci_dev *dev, int vector[])
35487 struct pcifront_sd *sd = dev->bus->sysdata;
35488 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35489
35490+ pax_track_stack();
35491+
35492 err = do_pci_op(pdev, &op);
35493 if (likely(!err)) {
35494 vector[0] = op.value;
35495diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
35496index 7bd829f..a3237ad 100644
35497--- a/drivers/platform/x86/thinkpad_acpi.c
35498+++ b/drivers/platform/x86/thinkpad_acpi.c
35499@@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
35500 return 0;
35501 }
35502
35503-void static hotkey_mask_warn_incomplete_mask(void)
35504+static void hotkey_mask_warn_incomplete_mask(void)
35505 {
35506 /* log only what the user can fix... */
35507 const u32 wantedmask = hotkey_driver_mask &
35508@@ -2325,11 +2325,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
35509 }
35510 }
35511
35512-static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35513- struct tp_nvram_state *newn,
35514- const u32 event_mask)
35515-{
35516-
35517 #define TPACPI_COMPARE_KEY(__scancode, __member) \
35518 do { \
35519 if ((event_mask & (1 << __scancode)) && \
35520@@ -2343,36 +2338,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35521 tpacpi_hotkey_send_key(__scancode); \
35522 } while (0)
35523
35524- void issue_volchange(const unsigned int oldvol,
35525- const unsigned int newvol)
35526- {
35527- unsigned int i = oldvol;
35528+static void issue_volchange(const unsigned int oldvol,
35529+ const unsigned int newvol,
35530+ const u32 event_mask)
35531+{
35532+ unsigned int i = oldvol;
35533
35534- while (i > newvol) {
35535- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35536- i--;
35537- }
35538- while (i < newvol) {
35539- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35540- i++;
35541- }
35542+ while (i > newvol) {
35543+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35544+ i--;
35545 }
35546+ while (i < newvol) {
35547+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35548+ i++;
35549+ }
35550+}
35551
35552- void issue_brightnesschange(const unsigned int oldbrt,
35553- const unsigned int newbrt)
35554- {
35555- unsigned int i = oldbrt;
35556+static void issue_brightnesschange(const unsigned int oldbrt,
35557+ const unsigned int newbrt,
35558+ const u32 event_mask)
35559+{
35560+ unsigned int i = oldbrt;
35561
35562- while (i > newbrt) {
35563- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35564- i--;
35565- }
35566- while (i < newbrt) {
35567- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35568- i++;
35569- }
35570+ while (i > newbrt) {
35571+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35572+ i--;
35573+ }
35574+ while (i < newbrt) {
35575+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35576+ i++;
35577 }
35578+}
35579
35580+static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35581+ struct tp_nvram_state *newn,
35582+ const u32 event_mask)
35583+{
35584 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
35585 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
35586 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
35587@@ -2406,7 +2407,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35588 oldn->volume_level != newn->volume_level) {
35589 /* recently muted, or repeated mute keypress, or
35590 * multiple presses ending in mute */
35591- issue_volchange(oldn->volume_level, newn->volume_level);
35592+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35593 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
35594 }
35595 } else {
35596@@ -2416,7 +2417,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35597 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35598 }
35599 if (oldn->volume_level != newn->volume_level) {
35600- issue_volchange(oldn->volume_level, newn->volume_level);
35601+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35602 } else if (oldn->volume_toggle != newn->volume_toggle) {
35603 /* repeated vol up/down keypress at end of scale ? */
35604 if (newn->volume_level == 0)
35605@@ -2429,7 +2430,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35606 /* handle brightness */
35607 if (oldn->brightness_level != newn->brightness_level) {
35608 issue_brightnesschange(oldn->brightness_level,
35609- newn->brightness_level);
35610+ newn->brightness_level,
35611+ event_mask);
35612 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
35613 /* repeated key presses that didn't change state */
35614 if (newn->brightness_level == 0)
35615@@ -2438,10 +2440,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35616 && !tp_features.bright_unkfw)
35617 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35618 }
35619+}
35620
35621 #undef TPACPI_COMPARE_KEY
35622 #undef TPACPI_MAY_SEND_KEY
35623-}
35624
35625 /*
35626 * Polling driver
35627diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
35628index b859d16..5cc6b1a 100644
35629--- a/drivers/pnp/pnpbios/bioscalls.c
35630+++ b/drivers/pnp/pnpbios/bioscalls.c
35631@@ -59,7 +59,7 @@ do { \
35632 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
35633 } while(0)
35634
35635-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
35636+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
35637 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
35638
35639 /*
35640@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35641
35642 cpu = get_cpu();
35643 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
35644+
35645+ pax_open_kernel();
35646 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
35647+ pax_close_kernel();
35648
35649 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
35650 spin_lock_irqsave(&pnp_bios_lock, flags);
35651@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35652 :"memory");
35653 spin_unlock_irqrestore(&pnp_bios_lock, flags);
35654
35655+ pax_open_kernel();
35656 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
35657+ pax_close_kernel();
35658+
35659 put_cpu();
35660
35661 /* If we get here and this is set then the PnP BIOS faulted on us. */
35662@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
35663 return status;
35664 }
35665
35666-void pnpbios_calls_init(union pnp_bios_install_struct *header)
35667+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
35668 {
35669 int i;
35670
35671@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35672 pnp_bios_callpoint.offset = header->fields.pm16offset;
35673 pnp_bios_callpoint.segment = PNP_CS16;
35674
35675+ pax_open_kernel();
35676+
35677 for_each_possible_cpu(i) {
35678 struct desc_struct *gdt = get_cpu_gdt_table(i);
35679 if (!gdt)
35680@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35681 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
35682 (unsigned long)__va(header->fields.pm16dseg));
35683 }
35684+
35685+ pax_close_kernel();
35686 }
35687diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
35688index b0ecacb..7c9da2e 100644
35689--- a/drivers/pnp/resource.c
35690+++ b/drivers/pnp/resource.c
35691@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
35692 return 1;
35693
35694 /* check if the resource is valid */
35695- if (*irq < 0 || *irq > 15)
35696+ if (*irq > 15)
35697 return 0;
35698
35699 /* check if the resource is reserved */
35700@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
35701 return 1;
35702
35703 /* check if the resource is valid */
35704- if (*dma < 0 || *dma == 4 || *dma > 7)
35705+ if (*dma == 4 || *dma > 7)
35706 return 0;
35707
35708 /* check if the resource is reserved */
35709diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
35710index bb16f5b..c751eef 100644
35711--- a/drivers/power/bq27x00_battery.c
35712+++ b/drivers/power/bq27x00_battery.c
35713@@ -67,7 +67,7 @@
35714 struct bq27x00_device_info;
35715 struct bq27x00_access_methods {
35716 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
35717-};
35718+} __no_const;
35719
35720 enum bq27x00_chip { BQ27000, BQ27500 };
35721
35722diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
35723index 33f5d9a..d957d3f 100644
35724--- a/drivers/regulator/max8660.c
35725+++ b/drivers/regulator/max8660.c
35726@@ -383,8 +383,10 @@ static int __devinit max8660_probe(struct i2c_client *client,
35727 max8660->shadow_regs[MAX8660_OVER1] = 5;
35728 } else {
35729 /* Otherwise devices can be toggled via software */
35730- max8660_dcdc_ops.enable = max8660_dcdc_enable;
35731- max8660_dcdc_ops.disable = max8660_dcdc_disable;
35732+ pax_open_kernel();
35733+ *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
35734+ *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
35735+ pax_close_kernel();
35736 }
35737
35738 /*
35739diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
35740index 3285d41..ab7c22a 100644
35741--- a/drivers/regulator/mc13892-regulator.c
35742+++ b/drivers/regulator/mc13892-regulator.c
35743@@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev)
35744 }
35745 mc13xxx_unlock(mc13892);
35746
35747- mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35748+ pax_open_kernel();
35749+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35750 = mc13892_vcam_set_mode;
35751- mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35752+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35753 = mc13892_vcam_get_mode;
35754+ pax_close_kernel();
35755 for (i = 0; i < pdata->num_regulators; i++) {
35756 init_data = &pdata->regulators[i];
35757 priv->regulators[i] = regulator_register(
35758diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
35759index cace6d3..f623fda 100644
35760--- a/drivers/rtc/rtc-dev.c
35761+++ b/drivers/rtc/rtc-dev.c
35762@@ -14,6 +14,7 @@
35763 #include <linux/module.h>
35764 #include <linux/rtc.h>
35765 #include <linux/sched.h>
35766+#include <linux/grsecurity.h>
35767 #include "rtc-core.h"
35768
35769 static dev_t rtc_devt;
35770@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *file,
35771 if (copy_from_user(&tm, uarg, sizeof(tm)))
35772 return -EFAULT;
35773
35774+ gr_log_timechange();
35775+
35776 return rtc_set_time(rtc, &tm);
35777
35778 case RTC_PIE_ON:
35779diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
35780index f66c33b..7ae5823 100644
35781--- a/drivers/scsi/BusLogic.c
35782+++ b/drivers/scsi/BusLogic.c
35783@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
35784 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
35785 *PrototypeHostAdapter)
35786 {
35787+ pax_track_stack();
35788+
35789 /*
35790 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
35791 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
35792diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
35793index ffb5878..e6d785c 100644
35794--- a/drivers/scsi/aacraid/aacraid.h
35795+++ b/drivers/scsi/aacraid/aacraid.h
35796@@ -492,7 +492,7 @@ struct adapter_ops
35797 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
35798 /* Administrative operations */
35799 int (*adapter_comm)(struct aac_dev * dev, int comm);
35800-};
35801+} __no_const;
35802
35803 /*
35804 * Define which interrupt handler needs to be installed
35805diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
35806index 8a0b330..b4286de 100644
35807--- a/drivers/scsi/aacraid/commctrl.c
35808+++ b/drivers/scsi/aacraid/commctrl.c
35809@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
35810 u32 actual_fibsize64, actual_fibsize = 0;
35811 int i;
35812
35813+ pax_track_stack();
35814
35815 if (dev->in_reset) {
35816 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
35817diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
35818index c7b6fed..4db0569 100644
35819--- a/drivers/scsi/aacraid/linit.c
35820+++ b/drivers/scsi/aacraid/linit.c
35821@@ -93,7 +93,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
35822 #elif defined(__devinitconst)
35823 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35824 #else
35825-static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
35826+static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35827 #endif
35828 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
35829 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
35830diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
35831index d5ff142..49c0ebb 100644
35832--- a/drivers/scsi/aic94xx/aic94xx_init.c
35833+++ b/drivers/scsi/aic94xx/aic94xx_init.c
35834@@ -1012,7 +1012,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
35835 .lldd_control_phy = asd_control_phy,
35836 };
35837
35838-static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
35839+static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
35840 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
35841 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
35842 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
35843diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
35844index a796de9..1ef20e1 100644
35845--- a/drivers/scsi/bfa/bfa.h
35846+++ b/drivers/scsi/bfa/bfa.h
35847@@ -196,7 +196,7 @@ struct bfa_hwif_s {
35848 u32 *end);
35849 int cpe_vec_q0;
35850 int rme_vec_q0;
35851-};
35852+} __no_const;
35853 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
35854
35855 struct bfa_faa_cbfn_s {
35856diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
35857index e07bd47..dbd260a 100644
35858--- a/drivers/scsi/bfa/bfa_fcpim.c
35859+++ b/drivers/scsi/bfa/bfa_fcpim.c
35860@@ -4179,7 +4179,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35861 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
35862 {
35863 struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
35864- struct bfa_itn_s *itn;
35865+ bfa_itn_s_no_const *itn;
35866
35867 itn = BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
35868 itn->isr = isr;
35869diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
35870index 1080bcb..a3b39e3 100644
35871--- a/drivers/scsi/bfa/bfa_fcpim.h
35872+++ b/drivers/scsi/bfa/bfa_fcpim.h
35873@@ -37,6 +37,7 @@ struct bfa_iotag_s {
35874 struct bfa_itn_s {
35875 bfa_isr_func_t isr;
35876 };
35877+typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
35878
35879 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35880 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
35881@@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
35882 struct list_head iotag_tio_free_q; /* free IO resources */
35883 struct list_head iotag_unused_q; /* unused IO resources*/
35884 struct bfa_iotag_s *iotag_arr;
35885- struct bfa_itn_s *itn_arr;
35886+ bfa_itn_s_no_const *itn_arr;
35887 int num_ioim_reqs;
35888 int num_fwtio_reqs;
35889 int num_itns;
35890diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
35891index d4f951f..197c350 100644
35892--- a/drivers/scsi/bfa/bfa_fcs_lport.c
35893+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
35894@@ -1700,6 +1700,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
35895 u16 len, count;
35896 u16 templen;
35897
35898+ pax_track_stack();
35899+
35900 /*
35901 * get hba attributes
35902 */
35903@@ -1977,6 +1979,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
35904 u8 count = 0;
35905 u16 templen;
35906
35907+ pax_track_stack();
35908+
35909 /*
35910 * get port attributes
35911 */
35912diff --git a/drivers/scsi/bfa/bfa_fcs_rport.c b/drivers/scsi/bfa/bfa_fcs_rport.c
35913index 52628d5..f89d033 100644
35914--- a/drivers/scsi/bfa/bfa_fcs_rport.c
35915+++ b/drivers/scsi/bfa/bfa_fcs_rport.c
35916@@ -1871,6 +1871,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fcs_rport_s *rport,
35917 struct fc_rpsc_speed_info_s speeds;
35918 struct bfa_port_attr_s pport_attr;
35919
35920+ pax_track_stack();
35921+
35922 bfa_trc(port->fcs, rx_fchs->s_id);
35923 bfa_trc(port->fcs, rx_fchs->d_id);
35924
35925diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
35926index 546d46b..642fa5b 100644
35927--- a/drivers/scsi/bfa/bfa_ioc.h
35928+++ b/drivers/scsi/bfa/bfa_ioc.h
35929@@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
35930 bfa_ioc_disable_cbfn_t disable_cbfn;
35931 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
35932 bfa_ioc_reset_cbfn_t reset_cbfn;
35933-};
35934+} __no_const;
35935
35936 /*
35937 * IOC event notification mechanism.
35938@@ -346,7 +346,7 @@ struct bfa_ioc_hwif_s {
35939 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
35940 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
35941 bfa_boolean_t (*ioc_lpu_read_stat) (struct bfa_ioc_s *ioc);
35942-};
35943+} __no_const;
35944
35945 /*
35946 * Queue element to wait for room in request queue. FIFO order is
35947diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
35948index 66fb725..0fe05ab 100644
35949--- a/drivers/scsi/bfa/bfad.c
35950+++ b/drivers/scsi/bfa/bfad.c
35951@@ -1019,6 +1019,8 @@ bfad_start_ops(struct bfad_s *bfad) {
35952 struct bfad_vport_s *vport, *vport_new;
35953 struct bfa_fcs_driver_info_s driver_info;
35954
35955+ pax_track_stack();
35956+
35957 /* Limit min/max. xfer size to [64k-32MB] */
35958 if (max_xfer_size < BFAD_MIN_SECTORS >> 1)
35959 max_xfer_size = BFAD_MIN_SECTORS >> 1;
35960diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
35961index b4f6c9a..0eb1938 100644
35962--- a/drivers/scsi/dpt_i2o.c
35963+++ b/drivers/scsi/dpt_i2o.c
35964@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
35965 dma_addr_t addr;
35966 ulong flags = 0;
35967
35968+ pax_track_stack();
35969+
35970 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
35971 // get user msg size in u32s
35972 if(get_user(size, &user_msg[0])){
35973@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
35974 s32 rcode;
35975 dma_addr_t addr;
35976
35977+ pax_track_stack();
35978+
35979 memset(msg, 0 , sizeof(msg));
35980 len = scsi_bufflen(cmd);
35981 direction = 0x00000000;
35982diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
35983index 94de889..ca4f0cf 100644
35984--- a/drivers/scsi/eata.c
35985+++ b/drivers/scsi/eata.c
35986@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
35987 struct hostdata *ha;
35988 char name[16];
35989
35990+ pax_track_stack();
35991+
35992 sprintf(name, "%s%d", driver_name, j);
35993
35994 if (!request_region(port_base, REGION_SIZE, driver_name)) {
35995diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
35996index c74c4b8..c41ca3f 100644
35997--- a/drivers/scsi/fcoe/fcoe_ctlr.c
35998+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
35999@@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
36000 } buf;
36001 int rc;
36002
36003+ pax_track_stack();
36004+
36005 fiph = (struct fip_header *)skb->data;
36006 sub = fiph->fip_subcode;
36007
36008diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
36009index 3242bca..45a83e7 100644
36010--- a/drivers/scsi/gdth.c
36011+++ b/drivers/scsi/gdth.c
36012@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
36013 unsigned long flags;
36014 gdth_ha_str *ha;
36015
36016+ pax_track_stack();
36017+
36018 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
36019 return -EFAULT;
36020 ha = gdth_find_ha(ldrv.ionode);
36021@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
36022 gdth_ha_str *ha;
36023 int rval;
36024
36025+ pax_track_stack();
36026+
36027 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
36028 res.number >= MAX_HDRIVES)
36029 return -EFAULT;
36030@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg, char *cmnd)
36031 gdth_ha_str *ha;
36032 int rval;
36033
36034+ pax_track_stack();
36035+
36036 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
36037 return -EFAULT;
36038 ha = gdth_find_ha(gen.ionode);
36039@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
36040 int i;
36041 gdth_cmd_str gdtcmd;
36042 char cmnd[MAX_COMMAND_SIZE];
36043+
36044+ pax_track_stack();
36045+
36046 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
36047
36048 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
36049diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
36050index 6527543..81e4fe2 100644
36051--- a/drivers/scsi/gdth_proc.c
36052+++ b/drivers/scsi/gdth_proc.c
36053@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
36054 u64 paddr;
36055
36056 char cmnd[MAX_COMMAND_SIZE];
36057+
36058+ pax_track_stack();
36059+
36060 memset(cmnd, 0xff, 12);
36061 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
36062
36063@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
36064 gdth_hget_str *phg;
36065 char cmnd[MAX_COMMAND_SIZE];
36066
36067+ pax_track_stack();
36068+
36069 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
36070 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
36071 if (!gdtcmd || !estr)
36072diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
36073index 351dc0b..951dc32 100644
36074--- a/drivers/scsi/hosts.c
36075+++ b/drivers/scsi/hosts.c
36076@@ -42,7 +42,7 @@
36077 #include "scsi_logging.h"
36078
36079
36080-static atomic_t scsi_host_next_hn; /* host_no for next new host */
36081+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
36082
36083
36084 static void scsi_host_cls_release(struct device *dev)
36085@@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
36086 * subtract one because we increment first then return, but we need to
36087 * know what the next host number was before increment
36088 */
36089- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
36090+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
36091 shost->dma_channel = 0xff;
36092
36093 /* These three are default values which can be overridden */
36094diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
36095index 418ce83..7ee1225 100644
36096--- a/drivers/scsi/hpsa.c
36097+++ b/drivers/scsi/hpsa.c
36098@@ -499,7 +499,7 @@ static inline u32 next_command(struct ctlr_info *h)
36099 u32 a;
36100
36101 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
36102- return h->access.command_completed(h);
36103+ return h->access->command_completed(h);
36104
36105 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
36106 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
36107@@ -2956,7 +2956,7 @@ static void start_io(struct ctlr_info *h)
36108 while (!list_empty(&h->reqQ)) {
36109 c = list_entry(h->reqQ.next, struct CommandList, list);
36110 /* can't do anything if fifo is full */
36111- if ((h->access.fifo_full(h))) {
36112+ if ((h->access->fifo_full(h))) {
36113 dev_warn(&h->pdev->dev, "fifo full\n");
36114 break;
36115 }
36116@@ -2966,7 +2966,7 @@ static void start_io(struct ctlr_info *h)
36117 h->Qdepth--;
36118
36119 /* Tell the controller execute command */
36120- h->access.submit_command(h, c);
36121+ h->access->submit_command(h, c);
36122
36123 /* Put job onto the completed Q */
36124 addQ(&h->cmpQ, c);
36125@@ -2975,17 +2975,17 @@ static void start_io(struct ctlr_info *h)
36126
36127 static inline unsigned long get_next_completion(struct ctlr_info *h)
36128 {
36129- return h->access.command_completed(h);
36130+ return h->access->command_completed(h);
36131 }
36132
36133 static inline bool interrupt_pending(struct ctlr_info *h)
36134 {
36135- return h->access.intr_pending(h);
36136+ return h->access->intr_pending(h);
36137 }
36138
36139 static inline long interrupt_not_for_us(struct ctlr_info *h)
36140 {
36141- return (h->access.intr_pending(h) == 0) ||
36142+ return (h->access->intr_pending(h) == 0) ||
36143 (h->interrupts_enabled == 0);
36144 }
36145
36146@@ -3882,7 +3882,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
36147 if (prod_index < 0)
36148 return -ENODEV;
36149 h->product_name = products[prod_index].product_name;
36150- h->access = *(products[prod_index].access);
36151+ h->access = products[prod_index].access;
36152
36153 if (hpsa_board_disabled(h->pdev)) {
36154 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
36155@@ -4163,7 +4163,7 @@ reinit_after_soft_reset:
36156 }
36157
36158 /* make sure the board interrupts are off */
36159- h->access.set_intr_mask(h, HPSA_INTR_OFF);
36160+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
36161
36162 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
36163 goto clean2;
36164@@ -4197,7 +4197,7 @@ reinit_after_soft_reset:
36165 * fake ones to scoop up any residual completions.
36166 */
36167 spin_lock_irqsave(&h->lock, flags);
36168- h->access.set_intr_mask(h, HPSA_INTR_OFF);
36169+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
36170 spin_unlock_irqrestore(&h->lock, flags);
36171 free_irq(h->intr[h->intr_mode], h);
36172 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
36173@@ -4216,9 +4216,9 @@ reinit_after_soft_reset:
36174 dev_info(&h->pdev->dev, "Board READY.\n");
36175 dev_info(&h->pdev->dev,
36176 "Waiting for stale completions to drain.\n");
36177- h->access.set_intr_mask(h, HPSA_INTR_ON);
36178+ h->access->set_intr_mask(h, HPSA_INTR_ON);
36179 msleep(10000);
36180- h->access.set_intr_mask(h, HPSA_INTR_OFF);
36181+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
36182
36183 rc = controller_reset_failed(h->cfgtable);
36184 if (rc)
36185@@ -4239,7 +4239,7 @@ reinit_after_soft_reset:
36186 }
36187
36188 /* Turn the interrupts on so we can service requests */
36189- h->access.set_intr_mask(h, HPSA_INTR_ON);
36190+ h->access->set_intr_mask(h, HPSA_INTR_ON);
36191
36192 hpsa_hba_inquiry(h);
36193 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
36194@@ -4292,7 +4292,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
36195 * To write all data in the battery backed cache to disks
36196 */
36197 hpsa_flush_cache(h);
36198- h->access.set_intr_mask(h, HPSA_INTR_OFF);
36199+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
36200 free_irq(h->intr[h->intr_mode], h);
36201 #ifdef CONFIG_PCI_MSI
36202 if (h->msix_vector)
36203@@ -4455,7 +4455,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
36204 return;
36205 }
36206 /* Change the access methods to the performant access methods */
36207- h->access = SA5_performant_access;
36208+ h->access = &SA5_performant_access;
36209 h->transMethod = CFGTBL_Trans_Performant;
36210 }
36211
36212diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
36213index 7f53cea..a8c7188 100644
36214--- a/drivers/scsi/hpsa.h
36215+++ b/drivers/scsi/hpsa.h
36216@@ -73,7 +73,7 @@ struct ctlr_info {
36217 unsigned int msix_vector;
36218 unsigned int msi_vector;
36219 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
36220- struct access_method access;
36221+ struct access_method *access;
36222
36223 /* queue and queue Info */
36224 struct list_head reqQ;
36225diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
36226index f2df059..a3a9930 100644
36227--- a/drivers/scsi/ips.h
36228+++ b/drivers/scsi/ips.h
36229@@ -1027,7 +1027,7 @@ typedef struct {
36230 int (*intr)(struct ips_ha *);
36231 void (*enableint)(struct ips_ha *);
36232 uint32_t (*statupd)(struct ips_ha *);
36233-} ips_hw_func_t;
36234+} __no_const ips_hw_func_t;
36235
36236 typedef struct ips_ha {
36237 uint8_t ha_id[IPS_MAX_CHANNELS+1];
36238diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
36239index d261e98..1e00f35 100644
36240--- a/drivers/scsi/libfc/fc_exch.c
36241+++ b/drivers/scsi/libfc/fc_exch.c
36242@@ -105,12 +105,12 @@ struct fc_exch_mgr {
36243 * all together if not used XXX
36244 */
36245 struct {
36246- atomic_t no_free_exch;
36247- atomic_t no_free_exch_xid;
36248- atomic_t xid_not_found;
36249- atomic_t xid_busy;
36250- atomic_t seq_not_found;
36251- atomic_t non_bls_resp;
36252+ atomic_unchecked_t no_free_exch;
36253+ atomic_unchecked_t no_free_exch_xid;
36254+ atomic_unchecked_t xid_not_found;
36255+ atomic_unchecked_t xid_busy;
36256+ atomic_unchecked_t seq_not_found;
36257+ atomic_unchecked_t non_bls_resp;
36258 } stats;
36259 };
36260
36261@@ -718,7 +718,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
36262 /* allocate memory for exchange */
36263 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
36264 if (!ep) {
36265- atomic_inc(&mp->stats.no_free_exch);
36266+ atomic_inc_unchecked(&mp->stats.no_free_exch);
36267 goto out;
36268 }
36269 memset(ep, 0, sizeof(*ep));
36270@@ -779,7 +779,7 @@ out:
36271 return ep;
36272 err:
36273 spin_unlock_bh(&pool->lock);
36274- atomic_inc(&mp->stats.no_free_exch_xid);
36275+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
36276 mempool_free(ep, mp->ep_pool);
36277 return NULL;
36278 }
36279@@ -922,7 +922,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36280 xid = ntohs(fh->fh_ox_id); /* we originated exch */
36281 ep = fc_exch_find(mp, xid);
36282 if (!ep) {
36283- atomic_inc(&mp->stats.xid_not_found);
36284+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36285 reject = FC_RJT_OX_ID;
36286 goto out;
36287 }
36288@@ -952,7 +952,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36289 ep = fc_exch_find(mp, xid);
36290 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
36291 if (ep) {
36292- atomic_inc(&mp->stats.xid_busy);
36293+ atomic_inc_unchecked(&mp->stats.xid_busy);
36294 reject = FC_RJT_RX_ID;
36295 goto rel;
36296 }
36297@@ -963,7 +963,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36298 }
36299 xid = ep->xid; /* get our XID */
36300 } else if (!ep) {
36301- atomic_inc(&mp->stats.xid_not_found);
36302+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36303 reject = FC_RJT_RX_ID; /* XID not found */
36304 goto out;
36305 }
36306@@ -980,7 +980,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36307 } else {
36308 sp = &ep->seq;
36309 if (sp->id != fh->fh_seq_id) {
36310- atomic_inc(&mp->stats.seq_not_found);
36311+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36312 if (f_ctl & FC_FC_END_SEQ) {
36313 /*
36314 * Update sequence_id based on incoming last
36315@@ -1430,22 +1430,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36316
36317 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36318 if (!ep) {
36319- atomic_inc(&mp->stats.xid_not_found);
36320+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36321 goto out;
36322 }
36323 if (ep->esb_stat & ESB_ST_COMPLETE) {
36324- atomic_inc(&mp->stats.xid_not_found);
36325+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36326 goto rel;
36327 }
36328 if (ep->rxid == FC_XID_UNKNOWN)
36329 ep->rxid = ntohs(fh->fh_rx_id);
36330 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36331- atomic_inc(&mp->stats.xid_not_found);
36332+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36333 goto rel;
36334 }
36335 if (ep->did != ntoh24(fh->fh_s_id) &&
36336 ep->did != FC_FID_FLOGI) {
36337- atomic_inc(&mp->stats.xid_not_found);
36338+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36339 goto rel;
36340 }
36341 sof = fr_sof(fp);
36342@@ -1454,7 +1454,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36343 sp->ssb_stat |= SSB_ST_RESP;
36344 sp->id = fh->fh_seq_id;
36345 } else if (sp->id != fh->fh_seq_id) {
36346- atomic_inc(&mp->stats.seq_not_found);
36347+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36348 goto rel;
36349 }
36350
36351@@ -1518,9 +1518,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36352 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36353
36354 if (!sp)
36355- atomic_inc(&mp->stats.xid_not_found);
36356+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36357 else
36358- atomic_inc(&mp->stats.non_bls_resp);
36359+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
36360
36361 fc_frame_free(fp);
36362 }
36363diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
36364index db9238f..4378ed2 100644
36365--- a/drivers/scsi/libsas/sas_ata.c
36366+++ b/drivers/scsi/libsas/sas_ata.c
36367@@ -368,7 +368,7 @@ static struct ata_port_operations sas_sata_ops = {
36368 .postreset = ata_std_postreset,
36369 .error_handler = ata_std_error_handler,
36370 .post_internal_cmd = sas_ata_post_internal,
36371- .qc_defer = ata_std_qc_defer,
36372+ .qc_defer = ata_std_qc_defer,
36373 .qc_prep = ata_noop_qc_prep,
36374 .qc_issue = sas_ata_qc_issue,
36375 .qc_fill_rtf = sas_ata_qc_fill_rtf,
36376diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
36377index c088a36..01c73b0 100644
36378--- a/drivers/scsi/lpfc/lpfc.h
36379+++ b/drivers/scsi/lpfc/lpfc.h
36380@@ -425,7 +425,7 @@ struct lpfc_vport {
36381 struct dentry *debug_nodelist;
36382 struct dentry *vport_debugfs_root;
36383 struct lpfc_debugfs_trc *disc_trc;
36384- atomic_t disc_trc_cnt;
36385+ atomic_unchecked_t disc_trc_cnt;
36386 #endif
36387 uint8_t stat_data_enabled;
36388 uint8_t stat_data_blocked;
36389@@ -835,8 +835,8 @@ struct lpfc_hba {
36390 struct timer_list fabric_block_timer;
36391 unsigned long bit_flags;
36392 #define FABRIC_COMANDS_BLOCKED 0
36393- atomic_t num_rsrc_err;
36394- atomic_t num_cmd_success;
36395+ atomic_unchecked_t num_rsrc_err;
36396+ atomic_unchecked_t num_cmd_success;
36397 unsigned long last_rsrc_error_time;
36398 unsigned long last_ramp_down_time;
36399 unsigned long last_ramp_up_time;
36400@@ -850,7 +850,7 @@ struct lpfc_hba {
36401 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
36402 struct dentry *debug_slow_ring_trc;
36403 struct lpfc_debugfs_trc *slow_ring_trc;
36404- atomic_t slow_ring_trc_cnt;
36405+ atomic_unchecked_t slow_ring_trc_cnt;
36406 /* iDiag debugfs sub-directory */
36407 struct dentry *idiag_root;
36408 struct dentry *idiag_pci_cfg;
36409diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
36410index a0424dd..2499b6b 100644
36411--- a/drivers/scsi/lpfc/lpfc_debugfs.c
36412+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
36413@@ -105,7 +105,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
36414
36415 #include <linux/debugfs.h>
36416
36417-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36418+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36419 static unsigned long lpfc_debugfs_start_time = 0L;
36420
36421 /* iDiag */
36422@@ -146,7 +146,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
36423 lpfc_debugfs_enable = 0;
36424
36425 len = 0;
36426- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36427+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36428 (lpfc_debugfs_max_disc_trc - 1);
36429 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36430 dtp = vport->disc_trc + i;
36431@@ -212,7 +212,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
36432 lpfc_debugfs_enable = 0;
36433
36434 len = 0;
36435- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36436+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36437 (lpfc_debugfs_max_slow_ring_trc - 1);
36438 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36439 dtp = phba->slow_ring_trc + i;
36440@@ -635,14 +635,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
36441 !vport || !vport->disc_trc)
36442 return;
36443
36444- index = atomic_inc_return(&vport->disc_trc_cnt) &
36445+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36446 (lpfc_debugfs_max_disc_trc - 1);
36447 dtp = vport->disc_trc + index;
36448 dtp->fmt = fmt;
36449 dtp->data1 = data1;
36450 dtp->data2 = data2;
36451 dtp->data3 = data3;
36452- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36453+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36454 dtp->jif = jiffies;
36455 #endif
36456 return;
36457@@ -673,14 +673,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
36458 !phba || !phba->slow_ring_trc)
36459 return;
36460
36461- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36462+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36463 (lpfc_debugfs_max_slow_ring_trc - 1);
36464 dtp = phba->slow_ring_trc + index;
36465 dtp->fmt = fmt;
36466 dtp->data1 = data1;
36467 dtp->data2 = data2;
36468 dtp->data3 = data3;
36469- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36470+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36471 dtp->jif = jiffies;
36472 #endif
36473 return;
36474@@ -3828,7 +3828,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36475 "slow_ring buffer\n");
36476 goto debug_failed;
36477 }
36478- atomic_set(&phba->slow_ring_trc_cnt, 0);
36479+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36480 memset(phba->slow_ring_trc, 0,
36481 (sizeof(struct lpfc_debugfs_trc) *
36482 lpfc_debugfs_max_slow_ring_trc));
36483@@ -3874,7 +3874,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36484 "buffer\n");
36485 goto debug_failed;
36486 }
36487- atomic_set(&vport->disc_trc_cnt, 0);
36488+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36489
36490 snprintf(name, sizeof(name), "discovery_trace");
36491 vport->debug_disc_trc =
36492diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
36493index a3c8200..31e562e 100644
36494--- a/drivers/scsi/lpfc/lpfc_init.c
36495+++ b/drivers/scsi/lpfc/lpfc_init.c
36496@@ -9969,8 +9969,10 @@ lpfc_init(void)
36497 printk(LPFC_COPYRIGHT "\n");
36498
36499 if (lpfc_enable_npiv) {
36500- lpfc_transport_functions.vport_create = lpfc_vport_create;
36501- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36502+ pax_open_kernel();
36503+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36504+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36505+ pax_close_kernel();
36506 }
36507 lpfc_transport_template =
36508 fc_attach_transport(&lpfc_transport_functions);
36509diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
36510index eadd241..26c8e0f 100644
36511--- a/drivers/scsi/lpfc/lpfc_scsi.c
36512+++ b/drivers/scsi/lpfc/lpfc_scsi.c
36513@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
36514 uint32_t evt_posted;
36515
36516 spin_lock_irqsave(&phba->hbalock, flags);
36517- atomic_inc(&phba->num_rsrc_err);
36518+ atomic_inc_unchecked(&phba->num_rsrc_err);
36519 phba->last_rsrc_error_time = jiffies;
36520
36521 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36522@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
36523 unsigned long flags;
36524 struct lpfc_hba *phba = vport->phba;
36525 uint32_t evt_posted;
36526- atomic_inc(&phba->num_cmd_success);
36527+ atomic_inc_unchecked(&phba->num_cmd_success);
36528
36529 if (vport->cfg_lun_queue_depth <= queue_depth)
36530 return;
36531@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36532 unsigned long num_rsrc_err, num_cmd_success;
36533 int i;
36534
36535- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36536- num_cmd_success = atomic_read(&phba->num_cmd_success);
36537+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36538+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36539
36540 vports = lpfc_create_vport_work_array(phba);
36541 if (vports != NULL)
36542@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36543 }
36544 }
36545 lpfc_destroy_vport_work_array(phba, vports);
36546- atomic_set(&phba->num_rsrc_err, 0);
36547- atomic_set(&phba->num_cmd_success, 0);
36548+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36549+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36550 }
36551
36552 /**
36553@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
36554 }
36555 }
36556 lpfc_destroy_vport_work_array(phba, vports);
36557- atomic_set(&phba->num_rsrc_err, 0);
36558- atomic_set(&phba->num_cmd_success, 0);
36559+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36560+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36561 }
36562
36563 /**
36564diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
36565index 2e6619e..fa64494 100644
36566--- a/drivers/scsi/megaraid/megaraid_mbox.c
36567+++ b/drivers/scsi/megaraid/megaraid_mbox.c
36568@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
36569 int rval;
36570 int i;
36571
36572+ pax_track_stack();
36573+
36574 // Allocate memory for the base list of scb for management module.
36575 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
36576
36577diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
36578index 86afb13f..c912398 100644
36579--- a/drivers/scsi/osd/osd_initiator.c
36580+++ b/drivers/scsi/osd/osd_initiator.c
36581@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(struct osd_dev *od,
36582 int nelem = ARRAY_SIZE(get_attrs), a = 0;
36583 int ret;
36584
36585+ pax_track_stack();
36586+
36587 or = osd_start_request(od, GFP_KERNEL);
36588 if (!or)
36589 return -ENOMEM;
36590diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
36591index d079f9a..d26072c 100644
36592--- a/drivers/scsi/pmcraid.c
36593+++ b/drivers/scsi/pmcraid.c
36594@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
36595 res->scsi_dev = scsi_dev;
36596 scsi_dev->hostdata = res;
36597 res->change_detected = 0;
36598- atomic_set(&res->read_failures, 0);
36599- atomic_set(&res->write_failures, 0);
36600+ atomic_set_unchecked(&res->read_failures, 0);
36601+ atomic_set_unchecked(&res->write_failures, 0);
36602 rc = 0;
36603 }
36604 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36605@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
36606
36607 /* If this was a SCSI read/write command keep count of errors */
36608 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36609- atomic_inc(&res->read_failures);
36610+ atomic_inc_unchecked(&res->read_failures);
36611 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36612- atomic_inc(&res->write_failures);
36613+ atomic_inc_unchecked(&res->write_failures);
36614
36615 if (!RES_IS_GSCSI(res->cfg_entry) &&
36616 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36617@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
36618 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36619 * hrrq_id assigned here in queuecommand
36620 */
36621- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36622+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36623 pinstance->num_hrrq;
36624 cmd->cmd_done = pmcraid_io_done;
36625
36626@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
36627 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36628 * hrrq_id assigned here in queuecommand
36629 */
36630- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36631+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36632 pinstance->num_hrrq;
36633
36634 if (request_size) {
36635@@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
36636
36637 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36638 /* add resources only after host is added into system */
36639- if (!atomic_read(&pinstance->expose_resources))
36640+ if (!atomic_read_unchecked(&pinstance->expose_resources))
36641 return;
36642
36643 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
36644@@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instance(
36645 init_waitqueue_head(&pinstance->reset_wait_q);
36646
36647 atomic_set(&pinstance->outstanding_cmds, 0);
36648- atomic_set(&pinstance->last_message_id, 0);
36649- atomic_set(&pinstance->expose_resources, 0);
36650+ atomic_set_unchecked(&pinstance->last_message_id, 0);
36651+ atomic_set_unchecked(&pinstance->expose_resources, 0);
36652
36653 INIT_LIST_HEAD(&pinstance->free_res_q);
36654 INIT_LIST_HEAD(&pinstance->used_res_q);
36655@@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
36656 /* Schedule worker thread to handle CCN and take care of adding and
36657 * removing devices to OS
36658 */
36659- atomic_set(&pinstance->expose_resources, 1);
36660+ atomic_set_unchecked(&pinstance->expose_resources, 1);
36661 schedule_work(&pinstance->worker_q);
36662 return rc;
36663
36664diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
36665index f920baf..4417389 100644
36666--- a/drivers/scsi/pmcraid.h
36667+++ b/drivers/scsi/pmcraid.h
36668@@ -749,7 +749,7 @@ struct pmcraid_instance {
36669 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
36670
36671 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
36672- atomic_t last_message_id;
36673+ atomic_unchecked_t last_message_id;
36674
36675 /* configuration table */
36676 struct pmcraid_config_table *cfg_table;
36677@@ -778,7 +778,7 @@ struct pmcraid_instance {
36678 atomic_t outstanding_cmds;
36679
36680 /* should add/delete resources to mid-layer now ?*/
36681- atomic_t expose_resources;
36682+ atomic_unchecked_t expose_resources;
36683
36684
36685
36686@@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
36687 struct pmcraid_config_table_entry_ext cfg_entry_ext;
36688 };
36689 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36690- atomic_t read_failures; /* count of failed READ commands */
36691- atomic_t write_failures; /* count of failed WRITE commands */
36692+ atomic_unchecked_t read_failures; /* count of failed READ commands */
36693+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36694
36695 /* To indicate add/delete/modify during CCN */
36696 u8 change_detected;
36697diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
36698index a03eaf4..a6b3fd9 100644
36699--- a/drivers/scsi/qla2xxx/qla_def.h
36700+++ b/drivers/scsi/qla2xxx/qla_def.h
36701@@ -2244,7 +2244,7 @@ struct isp_operations {
36702 int (*get_flash_version) (struct scsi_qla_host *, void *);
36703 int (*start_scsi) (srb_t *);
36704 int (*abort_isp) (struct scsi_qla_host *);
36705-};
36706+} __no_const;
36707
36708 /* MSI-X Support *************************************************************/
36709
36710diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
36711index 473c5c8..4e2f24a 100644
36712--- a/drivers/scsi/qla4xxx/ql4_def.h
36713+++ b/drivers/scsi/qla4xxx/ql4_def.h
36714@@ -256,7 +256,7 @@ struct ddb_entry {
36715 atomic_t retry_relogin_timer; /* Min Time between relogins
36716 * (4000 only) */
36717 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
36718- atomic_t relogin_retry_count; /* Num of times relogin has been
36719+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
36720 * retried */
36721
36722 uint16_t port;
36723diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
36724index 42ed5db..0262f9e 100644
36725--- a/drivers/scsi/qla4xxx/ql4_init.c
36726+++ b/drivers/scsi/qla4xxx/ql4_init.c
36727@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
36728 ddb_entry->fw_ddb_index = fw_ddb_index;
36729 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
36730 atomic_set(&ddb_entry->relogin_timer, 0);
36731- atomic_set(&ddb_entry->relogin_retry_count, 0);
36732+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36733 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36734 list_add_tail(&ddb_entry->list, &ha->ddb_list);
36735 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
36736@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
36737 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
36738 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
36739 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36740- atomic_set(&ddb_entry->relogin_retry_count, 0);
36741+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36742 atomic_set(&ddb_entry->relogin_timer, 0);
36743 clear_bit(DF_RELOGIN, &ddb_entry->flags);
36744 iscsi_unblock_session(ddb_entry->sess);
36745diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
36746index f2364ec..44c42b1 100644
36747--- a/drivers/scsi/qla4xxx/ql4_os.c
36748+++ b/drivers/scsi/qla4xxx/ql4_os.c
36749@@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
36750 ddb_entry->fw_ddb_device_state ==
36751 DDB_DS_SESSION_FAILED) {
36752 /* Reset retry relogin timer */
36753- atomic_inc(&ddb_entry->relogin_retry_count);
36754+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
36755 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
36756 " timed out-retrying"
36757 " relogin (%d)\n",
36758 ha->host_no,
36759 ddb_entry->fw_ddb_index,
36760- atomic_read(&ddb_entry->
36761+ atomic_read_unchecked(&ddb_entry->
36762 relogin_retry_count))
36763 );
36764 start_dpc++;
36765diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
36766index 2aeb2e9..46e3925 100644
36767--- a/drivers/scsi/scsi.c
36768+++ b/drivers/scsi/scsi.c
36769@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
36770 unsigned long timeout;
36771 int rtn = 0;
36772
36773- atomic_inc(&cmd->device->iorequest_cnt);
36774+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36775
36776 /* check if the device is still usable */
36777 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
36778diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
36779index 6888b2c..45befa1 100644
36780--- a/drivers/scsi/scsi_debug.c
36781+++ b/drivers/scsi/scsi_debug.c
36782@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
36783 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
36784 unsigned char *cmd = (unsigned char *)scp->cmnd;
36785
36786+ pax_track_stack();
36787+
36788 if ((errsts = check_readiness(scp, 1, devip)))
36789 return errsts;
36790 memset(arr, 0, sizeof(arr));
36791@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
36792 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
36793 unsigned char *cmd = (unsigned char *)scp->cmnd;
36794
36795+ pax_track_stack();
36796+
36797 if ((errsts = check_readiness(scp, 1, devip)))
36798 return errsts;
36799 memset(arr, 0, sizeof(arr));
36800diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
36801index 6d219e4..eb3ded3 100644
36802--- a/drivers/scsi/scsi_lib.c
36803+++ b/drivers/scsi/scsi_lib.c
36804@@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
36805 shost = sdev->host;
36806 scsi_init_cmd_errh(cmd);
36807 cmd->result = DID_NO_CONNECT << 16;
36808- atomic_inc(&cmd->device->iorequest_cnt);
36809+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36810
36811 /*
36812 * SCSI request completion path will do scsi_device_unbusy(),
36813@@ -1441,9 +1441,9 @@ static void scsi_softirq_done(struct request *rq)
36814
36815 INIT_LIST_HEAD(&cmd->eh_entry);
36816
36817- atomic_inc(&cmd->device->iodone_cnt);
36818+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
36819 if (cmd->result)
36820- atomic_inc(&cmd->device->ioerr_cnt);
36821+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
36822
36823 disposition = scsi_decide_disposition(cmd);
36824 if (disposition != SUCCESS &&
36825diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
36826index e0bd3f7..816b8a6 100644
36827--- a/drivers/scsi/scsi_sysfs.c
36828+++ b/drivers/scsi/scsi_sysfs.c
36829@@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
36830 char *buf) \
36831 { \
36832 struct scsi_device *sdev = to_scsi_device(dev); \
36833- unsigned long long count = atomic_read(&sdev->field); \
36834+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
36835 return snprintf(buf, 20, "0x%llx\n", count); \
36836 } \
36837 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
36838diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
36839index 84a1fdf..693b0d6 100644
36840--- a/drivers/scsi/scsi_tgt_lib.c
36841+++ b/drivers/scsi/scsi_tgt_lib.c
36842@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
36843 int err;
36844
36845 dprintk("%lx %u\n", uaddr, len);
36846- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
36847+ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
36848 if (err) {
36849 /*
36850 * TODO: need to fixup sg_tablesize, max_segment_size,
36851diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
36852index 1b21491..1b7f60e 100644
36853--- a/drivers/scsi/scsi_transport_fc.c
36854+++ b/drivers/scsi/scsi_transport_fc.c
36855@@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
36856 * Netlink Infrastructure
36857 */
36858
36859-static atomic_t fc_event_seq;
36860+static atomic_unchecked_t fc_event_seq;
36861
36862 /**
36863 * fc_get_event_number - Obtain the next sequential FC event number
36864@@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
36865 u32
36866 fc_get_event_number(void)
36867 {
36868- return atomic_add_return(1, &fc_event_seq);
36869+ return atomic_add_return_unchecked(1, &fc_event_seq);
36870 }
36871 EXPORT_SYMBOL(fc_get_event_number);
36872
36873@@ -645,7 +645,7 @@ static __init int fc_transport_init(void)
36874 {
36875 int error;
36876
36877- atomic_set(&fc_event_seq, 0);
36878+ atomic_set_unchecked(&fc_event_seq, 0);
36879
36880 error = transport_class_register(&fc_host_class);
36881 if (error)
36882@@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
36883 char *cp;
36884
36885 *val = simple_strtoul(buf, &cp, 0);
36886- if ((*cp && (*cp != '\n')) || (*val < 0))
36887+ if (*cp && (*cp != '\n'))
36888 return -EINVAL;
36889 /*
36890 * Check for overflow; dev_loss_tmo is u32
36891diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
36892index 3fd16d7..ba0871f 100644
36893--- a/drivers/scsi/scsi_transport_iscsi.c
36894+++ b/drivers/scsi/scsi_transport_iscsi.c
36895@@ -83,7 +83,7 @@ struct iscsi_internal {
36896 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
36897 };
36898
36899-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
36900+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
36901 static struct workqueue_struct *iscsi_eh_timer_workq;
36902
36903 /*
36904@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
36905 int err;
36906
36907 ihost = shost->shost_data;
36908- session->sid = atomic_add_return(1, &iscsi_session_nr);
36909+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
36910
36911 if (id == ISCSI_MAX_TARGET) {
36912 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
36913@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(void)
36914 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
36915 ISCSI_TRANSPORT_VERSION);
36916
36917- atomic_set(&iscsi_session_nr, 0);
36918+ atomic_set_unchecked(&iscsi_session_nr, 0);
36919
36920 err = class_register(&iscsi_transport_class);
36921 if (err)
36922diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
36923index 21a045e..ec89e03 100644
36924--- a/drivers/scsi/scsi_transport_srp.c
36925+++ b/drivers/scsi/scsi_transport_srp.c
36926@@ -33,7 +33,7 @@
36927 #include "scsi_transport_srp_internal.h"
36928
36929 struct srp_host_attrs {
36930- atomic_t next_port_id;
36931+ atomic_unchecked_t next_port_id;
36932 };
36933 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
36934
36935@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
36936 struct Scsi_Host *shost = dev_to_shost(dev);
36937 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
36938
36939- atomic_set(&srp_host->next_port_id, 0);
36940+ atomic_set_unchecked(&srp_host->next_port_id, 0);
36941 return 0;
36942 }
36943
36944@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
36945 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
36946 rport->roles = ids->roles;
36947
36948- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
36949+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
36950 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
36951
36952 transport_setup_device(&rport->dev);
36953diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
36954index 953773c..c7f29de 100644
36955--- a/drivers/scsi/sd.c
36956+++ b/drivers/scsi/sd.c
36957@@ -1073,6 +1073,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
36958 SCSI_LOG_IOCTL(1, printk("sd_ioctl: disk=%s, cmd=0x%x\n",
36959 disk->disk_name, cmd));
36960
36961+ error = scsi_verify_blk_ioctl(bdev, cmd);
36962+ if (error < 0)
36963+ return error;
36964+
36965 /*
36966 * If we are in the middle of error recovery, don't let anyone
36967 * else try and use this device. Also, if error recovery fails, it
36968@@ -1095,7 +1099,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
36969 error = scsi_ioctl(sdp, cmd, p);
36970 break;
36971 default:
36972- error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
36973+ error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
36974 if (error != -ENOTTY)
36975 break;
36976 error = scsi_ioctl(sdp, cmd, p);
36977@@ -1265,6 +1269,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
36978 unsigned int cmd, unsigned long arg)
36979 {
36980 struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
36981+ int ret;
36982+
36983+ ret = scsi_verify_blk_ioctl(bdev, cmd);
36984+ if (ret < 0)
36985+ return ret;
36986
36987 /*
36988 * If we are in the middle of error recovery, don't let anyone
36989@@ -1276,8 +1285,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
36990 return -ENODEV;
36991
36992 if (sdev->host->hostt->compat_ioctl) {
36993- int ret;
36994-
36995 ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
36996
36997 return ret;
36998diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
36999index 909ed9e..1ae290a 100644
37000--- a/drivers/scsi/sg.c
37001+++ b/drivers/scsi/sg.c
37002@@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
37003 sdp->disk->disk_name,
37004 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
37005 NULL,
37006- (char *)arg);
37007+ (char __user *)arg);
37008 case BLKTRACESTART:
37009 return blk_trace_startstop(sdp->device->request_queue, 1);
37010 case BLKTRACESTOP:
37011@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
37012 const struct file_operations * fops;
37013 };
37014
37015-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
37016+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
37017 {"allow_dio", &adio_fops},
37018 {"debug", &debug_fops},
37019 {"def_reserved_size", &dressz_fops},
37020@@ -2325,7 +2325,7 @@ sg_proc_init(void)
37021 {
37022 int k, mask;
37023 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
37024- struct sg_proc_leaf * leaf;
37025+ const struct sg_proc_leaf * leaf;
37026
37027 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
37028 if (!sg_proc_sgp)
37029diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
37030index b4543f5..e1b34b8 100644
37031--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
37032+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
37033@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
37034 int do_iounmap = 0;
37035 int do_disable_device = 1;
37036
37037+ pax_track_stack();
37038+
37039 memset(&sym_dev, 0, sizeof(sym_dev));
37040 memset(&nvram, 0, sizeof(nvram));
37041 sym_dev.pdev = pdev;
37042diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
37043index a18996d..fe993cb 100644
37044--- a/drivers/scsi/vmw_pvscsi.c
37045+++ b/drivers/scsi/vmw_pvscsi.c
37046@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
37047 dma_addr_t base;
37048 unsigned i;
37049
37050+ pax_track_stack();
37051+
37052 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
37053 cmd.reqRingNumPages = adapter->req_pages;
37054 cmd.cmpRingNumPages = adapter->cmp_pages;
37055diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
37056index c5f37f0..898d202 100644
37057--- a/drivers/spi/spi-dw-pci.c
37058+++ b/drivers/spi/spi-dw-pci.c
37059@@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pdev)
37060 #define spi_resume NULL
37061 #endif
37062
37063-static const struct pci_device_id pci_ids[] __devinitdata = {
37064+static const struct pci_device_id pci_ids[] __devinitconst = {
37065 /* Intel MID platform SPI controller 0 */
37066 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
37067 {},
37068diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
37069index 4d1b9f5..8408fe3 100644
37070--- a/drivers/spi/spi.c
37071+++ b/drivers/spi/spi.c
37072@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *master)
37073 EXPORT_SYMBOL_GPL(spi_bus_unlock);
37074
37075 /* portable code must never pass more than 32 bytes */
37076-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
37077+#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
37078
37079 static u8 *buf;
37080
37081diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
37082index 32ee39a..3004c3d 100644
37083--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
37084+++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
37085@@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
37086 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
37087
37088
37089-static struct net_device_ops ar6000_netdev_ops = {
37090+static net_device_ops_no_const ar6000_netdev_ops = {
37091 .ndo_init = NULL,
37092 .ndo_open = ar6000_open,
37093 .ndo_stop = ar6000_close,
37094diff --git a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
37095index 39e0873..0925710 100644
37096--- a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
37097+++ b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
37098@@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
37099 typedef struct ar6k_pal_config_s
37100 {
37101 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
37102-}ar6k_pal_config_t;
37103+} __no_const ar6k_pal_config_t;
37104
37105 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
37106 #endif /* _AR6K_PAL_H_ */
37107diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
37108index 05dada9..96171c6 100644
37109--- a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
37110+++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
37111@@ -451,14 +451,14 @@ static void brcmf_op_if(struct brcmf_if *ifp)
37112 free_netdev(ifp->net);
37113 }
37114 /* Allocate etherdev, including space for private structure */
37115- ifp->net = alloc_etherdev(sizeof(drvr_priv));
37116+ ifp->net = alloc_etherdev(sizeof(*drvr_priv));
37117 if (!ifp->net) {
37118 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
37119 ret = -ENOMEM;
37120 }
37121 if (ret == 0) {
37122 strcpy(ifp->net->name, ifp->name);
37123- memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
37124+ memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(*drvr_priv));
37125 err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
37126 if (err != 0) {
37127 BRCMF_ERROR(("%s: brcmf_net_attach failed, "
37128@@ -1279,7 +1279,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
37129 BRCMF_TRACE(("%s: Enter\n", __func__));
37130
37131 /* Allocate etherdev, including space for private structure */
37132- net = alloc_etherdev(sizeof(drvr_priv));
37133+ net = alloc_etherdev(sizeof(*drvr_priv));
37134 if (!net) {
37135 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
37136 goto fail;
37137@@ -1295,7 +1295,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
37138 /*
37139 * Save the brcmf_info into the priv
37140 */
37141- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
37142+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
37143
37144 /* Set network interface name if it was provided as module parameter */
37145 if (iface_name[0]) {
37146@@ -1352,7 +1352,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
37147 /*
37148 * Save the brcmf_info into the priv
37149 */
37150- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
37151+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
37152
37153 #if defined(CONFIG_PM_SLEEP)
37154 atomic_set(&brcmf_mmc_suspend, false);
37155diff --git a/drivers/staging/brcm80211/brcmfmac/sdio_host.h b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
37156index d345472..cedb19e 100644
37157--- a/drivers/staging/brcm80211/brcmfmac/sdio_host.h
37158+++ b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
37159@@ -263,7 +263,7 @@ struct brcmf_sdioh_driver {
37160 u16 func, uint bustype, u32 regsva, void *param);
37161 /* detach from device */
37162 void (*detach) (void *ch);
37163-};
37164+} __no_const;
37165
37166 struct sdioh_info;
37167
37168diff --git a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
37169index a01b01c..b3f721c 100644
37170--- a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
37171+++ b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
37172@@ -591,7 +591,7 @@ struct phy_func_ptr {
37173 initfn_t carrsuppr;
37174 rxsigpwrfn_t rxsigpwr;
37175 detachfn_t detach;
37176-};
37177+} __no_const;
37178
37179 struct brcms_phy {
37180 struct brcms_phy_pub pubpi_ro;
37181diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
37182index 8fb3051..a8b6c67 100644
37183--- a/drivers/staging/et131x/et1310_tx.c
37184+++ b/drivers/staging/et131x/et1310_tx.c
37185@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
37186 struct net_device_stats *stats = &etdev->net_stats;
37187
37188 if (tcb->flags & fMP_DEST_BROAD)
37189- atomic_inc(&etdev->stats.brdcstxmt);
37190+ atomic_inc_unchecked(&etdev->stats.brdcstxmt);
37191 else if (tcb->flags & fMP_DEST_MULTI)
37192- atomic_inc(&etdev->stats.multixmt);
37193+ atomic_inc_unchecked(&etdev->stats.multixmt);
37194 else
37195- atomic_inc(&etdev->stats.unixmt);
37196+ atomic_inc_unchecked(&etdev->stats.unixmt);
37197
37198 if (tcb->skb) {
37199 stats->tx_bytes += tcb->skb->len;
37200diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
37201index 408c50b..fd65e9f 100644
37202--- a/drivers/staging/et131x/et131x_adapter.h
37203+++ b/drivers/staging/et131x/et131x_adapter.h
37204@@ -106,11 +106,11 @@ struct ce_stats {
37205 * operations
37206 */
37207 u32 unircv; /* # multicast packets received */
37208- atomic_t unixmt; /* # multicast packets for Tx */
37209+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
37210 u32 multircv; /* # multicast packets received */
37211- atomic_t multixmt; /* # multicast packets for Tx */
37212+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
37213 u32 brdcstrcv; /* # broadcast packets received */
37214- atomic_t brdcstxmt; /* # broadcast packets for Tx */
37215+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
37216 u32 norcvbuf; /* # Rx packets discarded */
37217 u32 noxmtbuf; /* # Tx packets discarded */
37218
37219diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
37220index 455f47a..86205ff 100644
37221--- a/drivers/staging/hv/channel.c
37222+++ b/drivers/staging/hv/channel.c
37223@@ -447,8 +447,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
37224 int ret = 0;
37225 int t;
37226
37227- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
37228- atomic_inc(&vmbus_connection.next_gpadl_handle);
37229+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
37230+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
37231
37232 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
37233 if (ret)
37234diff --git a/drivers/staging/hv/hv.c b/drivers/staging/hv/hv.c
37235index 824f816..a800af7 100644
37236--- a/drivers/staging/hv/hv.c
37237+++ b/drivers/staging/hv/hv.c
37238@@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
37239 u64 output_address = (output) ? virt_to_phys(output) : 0;
37240 u32 output_address_hi = output_address >> 32;
37241 u32 output_address_lo = output_address & 0xFFFFFFFF;
37242- volatile void *hypercall_page = hv_context.hypercall_page;
37243+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
37244
37245 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
37246 "=a"(hv_status_lo) : "d" (control_hi),
37247diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
37248index d957fc2..43cedd9 100644
37249--- a/drivers/staging/hv/hv_mouse.c
37250+++ b/drivers/staging/hv/hv_mouse.c
37251@@ -878,8 +878,10 @@ static void reportdesc_callback(struct hv_device *dev, void *packet, u32 len)
37252 if (hid_dev) {
37253 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
37254
37255- hid_dev->ll_driver->open = mousevsc_hid_open;
37256- hid_dev->ll_driver->close = mousevsc_hid_close;
37257+ pax_open_kernel();
37258+ *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
37259+ *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
37260+ pax_close_kernel();
37261
37262 hid_dev->bus = BUS_VIRTUAL;
37263 hid_dev->vendor = input_device_ctx->device_info.vendor;
37264diff --git a/drivers/staging/hv/hyperv_vmbus.h b/drivers/staging/hv/hyperv_vmbus.h
37265index 349ad80..3f75719 100644
37266--- a/drivers/staging/hv/hyperv_vmbus.h
37267+++ b/drivers/staging/hv/hyperv_vmbus.h
37268@@ -559,7 +559,7 @@ enum vmbus_connect_state {
37269 struct vmbus_connection {
37270 enum vmbus_connect_state conn_state;
37271
37272- atomic_t next_gpadl_handle;
37273+ atomic_unchecked_t next_gpadl_handle;
37274
37275 /*
37276 * Represents channel interrupts. Each bit position represents a
37277diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
37278index dbb5201..d6047c6 100644
37279--- a/drivers/staging/hv/rndis_filter.c
37280+++ b/drivers/staging/hv/rndis_filter.c
37281@@ -43,7 +43,7 @@ struct rndis_device {
37282
37283 enum rndis_device_state state;
37284 u32 link_stat;
37285- atomic_t new_req_id;
37286+ atomic_unchecked_t new_req_id;
37287
37288 spinlock_t request_lock;
37289 struct list_head req_list;
37290@@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
37291 * template
37292 */
37293 set = &rndis_msg->msg.set_req;
37294- set->req_id = atomic_inc_return(&dev->new_req_id);
37295+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37296
37297 /* Add to the request list */
37298 spin_lock_irqsave(&dev->request_lock, flags);
37299@@ -622,7 +622,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
37300
37301 /* Setup the rndis set */
37302 halt = &request->request_msg.msg.halt_req;
37303- halt->req_id = atomic_inc_return(&dev->new_req_id);
37304+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37305
37306 /* Ignore return since this msg is optional. */
37307 rndis_filter_send_request(dev, request);
37308diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
37309index 1c949f5..7a8b104 100644
37310--- a/drivers/staging/hv/vmbus_drv.c
37311+++ b/drivers/staging/hv/vmbus_drv.c
37312@@ -660,11 +660,11 @@ int vmbus_child_device_register(struct hv_device *child_device_obj)
37313 {
37314 int ret = 0;
37315
37316- static atomic_t device_num = ATOMIC_INIT(0);
37317+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
37318
37319 /* Set the device name. Otherwise, device_register() will fail. */
37320 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
37321- atomic_inc_return(&device_num));
37322+ atomic_inc_return_unchecked(&device_num));
37323
37324 /* The new device belongs to this bus */
37325 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
37326diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
37327index 3f26f71..fb5c787 100644
37328--- a/drivers/staging/iio/ring_generic.h
37329+++ b/drivers/staging/iio/ring_generic.h
37330@@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
37331
37332 int (*is_enabled)(struct iio_ring_buffer *ring);
37333 int (*enable)(struct iio_ring_buffer *ring);
37334-};
37335+} __no_const;
37336
37337 struct iio_ring_setup_ops {
37338 int (*preenable)(struct iio_dev *);
37339diff --git a/drivers/staging/mei/interface.c b/drivers/staging/mei/interface.c
37340index cfec92d..a65dacf 100644
37341--- a/drivers/staging/mei/interface.c
37342+++ b/drivers/staging/mei/interface.c
37343@@ -332,7 +332,7 @@ int mei_send_flow_control(struct mei_device *dev, struct mei_cl *cl)
37344 mei_hdr->reserved = 0;
37345
37346 mei_flow_control = (struct hbm_flow_control *) &dev->wr_msg_buf[1];
37347- memset(mei_flow_control, 0, sizeof(mei_flow_control));
37348+ memset(mei_flow_control, 0, sizeof(*mei_flow_control));
37349 mei_flow_control->host_addr = cl->host_client_id;
37350 mei_flow_control->me_addr = cl->me_client_id;
37351 mei_flow_control->cmd.cmd = MEI_FLOW_CONTROL_CMD;
37352@@ -396,7 +396,7 @@ int mei_disconnect(struct mei_device *dev, struct mei_cl *cl)
37353
37354 mei_cli_disconnect =
37355 (struct hbm_client_disconnect_request *) &dev->wr_msg_buf[1];
37356- memset(mei_cli_disconnect, 0, sizeof(mei_cli_disconnect));
37357+ memset(mei_cli_disconnect, 0, sizeof(*mei_cli_disconnect));
37358 mei_cli_disconnect->host_addr = cl->host_client_id;
37359 mei_cli_disconnect->me_addr = cl->me_client_id;
37360 mei_cli_disconnect->cmd.cmd = CLIENT_DISCONNECT_REQ_CMD;
37361diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
37362index 8b307b4..a97ac91 100644
37363--- a/drivers/staging/octeon/ethernet-rx.c
37364+++ b/drivers/staging/octeon/ethernet-rx.c
37365@@ -420,11 +420,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37366 /* Increment RX stats for virtual ports */
37367 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37368 #ifdef CONFIG_64BIT
37369- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37370- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37371+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37372+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37373 #else
37374- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37375- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37376+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37377+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37378 #endif
37379 }
37380 netif_receive_skb(skb);
37381@@ -436,9 +436,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37382 dev->name);
37383 */
37384 #ifdef CONFIG_64BIT
37385- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37386+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37387 #else
37388- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37389+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
37390 #endif
37391 dev_kfree_skb_irq(skb);
37392 }
37393diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
37394index a8f780e..aef1098 100644
37395--- a/drivers/staging/octeon/ethernet.c
37396+++ b/drivers/staging/octeon/ethernet.c
37397@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
37398 * since the RX tasklet also increments it.
37399 */
37400 #ifdef CONFIG_64BIT
37401- atomic64_add(rx_status.dropped_packets,
37402- (atomic64_t *)&priv->stats.rx_dropped);
37403+ atomic64_add_unchecked(rx_status.dropped_packets,
37404+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37405 #else
37406- atomic_add(rx_status.dropped_packets,
37407- (atomic_t *)&priv->stats.rx_dropped);
37408+ atomic_add_unchecked(rx_status.dropped_packets,
37409+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
37410 #endif
37411 }
37412
37413diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
37414index f3c6060..56bf826 100644
37415--- a/drivers/staging/pohmelfs/inode.c
37416+++ b/drivers/staging/pohmelfs/inode.c
37417@@ -1861,7 +1861,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37418 mutex_init(&psb->mcache_lock);
37419 psb->mcache_root = RB_ROOT;
37420 psb->mcache_timeout = msecs_to_jiffies(5000);
37421- atomic_long_set(&psb->mcache_gen, 0);
37422+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
37423
37424 psb->trans_max_pages = 100;
37425
37426@@ -1876,7 +1876,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37427 INIT_LIST_HEAD(&psb->crypto_ready_list);
37428 INIT_LIST_HEAD(&psb->crypto_active_list);
37429
37430- atomic_set(&psb->trans_gen, 1);
37431+ atomic_set_unchecked(&psb->trans_gen, 1);
37432 atomic_long_set(&psb->total_inodes, 0);
37433
37434 mutex_init(&psb->state_lock);
37435diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
37436index e22665c..a2a9390 100644
37437--- a/drivers/staging/pohmelfs/mcache.c
37438+++ b/drivers/staging/pohmelfs/mcache.c
37439@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
37440 m->data = data;
37441 m->start = start;
37442 m->size = size;
37443- m->gen = atomic_long_inc_return(&psb->mcache_gen);
37444+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
37445
37446 mutex_lock(&psb->mcache_lock);
37447 err = pohmelfs_mcache_insert(psb, m);
37448diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
37449index 985b6b7..7699e05 100644
37450--- a/drivers/staging/pohmelfs/netfs.h
37451+++ b/drivers/staging/pohmelfs/netfs.h
37452@@ -571,14 +571,14 @@ struct pohmelfs_config;
37453 struct pohmelfs_sb {
37454 struct rb_root mcache_root;
37455 struct mutex mcache_lock;
37456- atomic_long_t mcache_gen;
37457+ atomic_long_unchecked_t mcache_gen;
37458 unsigned long mcache_timeout;
37459
37460 unsigned int idx;
37461
37462 unsigned int trans_retries;
37463
37464- atomic_t trans_gen;
37465+ atomic_unchecked_t trans_gen;
37466
37467 unsigned int crypto_attached_size;
37468 unsigned int crypto_align_size;
37469diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
37470index 36a2535..0591bf4 100644
37471--- a/drivers/staging/pohmelfs/trans.c
37472+++ b/drivers/staging/pohmelfs/trans.c
37473@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
37474 int err;
37475 struct netfs_cmd *cmd = t->iovec.iov_base;
37476
37477- t->gen = atomic_inc_return(&psb->trans_gen);
37478+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
37479
37480 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
37481 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
37482diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
37483index b70cb2b..4db41a7 100644
37484--- a/drivers/staging/rtl8712/rtl871x_io.h
37485+++ b/drivers/staging/rtl8712/rtl871x_io.h
37486@@ -83,7 +83,7 @@ struct _io_ops {
37487 u8 *pmem);
37488 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
37489 u8 *pmem);
37490-};
37491+} __no_const;
37492
37493 struct io_req {
37494 struct list_head list;
37495diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
37496index c7b5e8b..783d6cb 100644
37497--- a/drivers/staging/sbe-2t3e3/netdev.c
37498+++ b/drivers/staging/sbe-2t3e3/netdev.c
37499@@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
37500 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
37501
37502 if (rlen)
37503- if (copy_to_user(data, &resp, rlen))
37504+ if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
37505 return -EFAULT;
37506
37507 return 0;
37508diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
37509index be21617..0954e45 100644
37510--- a/drivers/staging/usbip/usbip_common.h
37511+++ b/drivers/staging/usbip/usbip_common.h
37512@@ -289,7 +289,7 @@ struct usbip_device {
37513 void (*shutdown)(struct usbip_device *);
37514 void (*reset)(struct usbip_device *);
37515 void (*unusable)(struct usbip_device *);
37516- } eh_ops;
37517+ } __no_const eh_ops;
37518 };
37519
37520 #if 0
37521diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
37522index 71a586e..4d8a91a 100644
37523--- a/drivers/staging/usbip/vhci.h
37524+++ b/drivers/staging/usbip/vhci.h
37525@@ -85,7 +85,7 @@ struct vhci_hcd {
37526 unsigned resuming:1;
37527 unsigned long re_timeout;
37528
37529- atomic_t seqnum;
37530+ atomic_unchecked_t seqnum;
37531
37532 /*
37533 * NOTE:
37534diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
37535index 2ee97e2..0420b86 100644
37536--- a/drivers/staging/usbip/vhci_hcd.c
37537+++ b/drivers/staging/usbip/vhci_hcd.c
37538@@ -527,7 +527,7 @@ static void vhci_tx_urb(struct urb *urb)
37539 return;
37540 }
37541
37542- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37543+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37544 if (priv->seqnum == 0xffff)
37545 dev_info(&urb->dev->dev, "seqnum max\n");
37546
37547@@ -779,7 +779,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
37548 return -ENOMEM;
37549 }
37550
37551- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37552+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37553 if (unlink->seqnum == 0xffff)
37554 pr_info("seqnum max\n");
37555
37556@@ -969,7 +969,7 @@ static int vhci_start(struct usb_hcd *hcd)
37557 vdev->rhport = rhport;
37558 }
37559
37560- atomic_set(&vhci->seqnum, 0);
37561+ atomic_set_unchecked(&vhci->seqnum, 0);
37562 spin_lock_init(&vhci->lock);
37563
37564 hcd->power_budget = 0; /* no limit */
37565diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
37566index 3872b8c..fe6d2f4 100644
37567--- a/drivers/staging/usbip/vhci_rx.c
37568+++ b/drivers/staging/usbip/vhci_rx.c
37569@@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
37570 if (!urb) {
37571 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
37572 pr_info("max seqnum %d\n",
37573- atomic_read(&the_controller->seqnum));
37574+ atomic_read_unchecked(&the_controller->seqnum));
37575 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37576 return;
37577 }
37578diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
37579index 7735027..30eed13 100644
37580--- a/drivers/staging/vt6655/hostap.c
37581+++ b/drivers/staging/vt6655/hostap.c
37582@@ -79,14 +79,13 @@ static int msglevel =MSG_LEVEL_INFO;
37583 *
37584 */
37585
37586+static net_device_ops_no_const apdev_netdev_ops;
37587+
37588 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37589 {
37590 PSDevice apdev_priv;
37591 struct net_device *dev = pDevice->dev;
37592 int ret;
37593- const struct net_device_ops apdev_netdev_ops = {
37594- .ndo_start_xmit = pDevice->tx_80211,
37595- };
37596
37597 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37598
37599@@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37600 *apdev_priv = *pDevice;
37601 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37602
37603+ /* only half broken now */
37604+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37605 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37606
37607 pDevice->apdev->type = ARPHRD_IEEE80211;
37608diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
37609index 51b5adf..098e320 100644
37610--- a/drivers/staging/vt6656/hostap.c
37611+++ b/drivers/staging/vt6656/hostap.c
37612@@ -80,14 +80,13 @@ static int msglevel =MSG_LEVEL_INFO;
37613 *
37614 */
37615
37616+static net_device_ops_no_const apdev_netdev_ops;
37617+
37618 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37619 {
37620 PSDevice apdev_priv;
37621 struct net_device *dev = pDevice->dev;
37622 int ret;
37623- const struct net_device_ops apdev_netdev_ops = {
37624- .ndo_start_xmit = pDevice->tx_80211,
37625- };
37626
37627 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37628
37629@@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37630 *apdev_priv = *pDevice;
37631 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37632
37633+ /* only half broken now */
37634+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37635 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37636
37637 pDevice->apdev->type = ARPHRD_IEEE80211;
37638diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
37639index 7843dfd..3db105f 100644
37640--- a/drivers/staging/wlan-ng/hfa384x_usb.c
37641+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
37642@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
37643
37644 struct usbctlx_completor {
37645 int (*complete) (struct usbctlx_completor *);
37646-};
37647+} __no_const;
37648
37649 static int
37650 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
37651diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
37652index 1ca66ea..76f1343 100644
37653--- a/drivers/staging/zcache/tmem.c
37654+++ b/drivers/staging/zcache/tmem.c
37655@@ -39,7 +39,7 @@
37656 * A tmem host implementation must use this function to register callbacks
37657 * for memory allocation.
37658 */
37659-static struct tmem_hostops tmem_hostops;
37660+static tmem_hostops_no_const tmem_hostops;
37661
37662 static void tmem_objnode_tree_init(void);
37663
37664@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_hostops *m)
37665 * A tmem host implementation must use this function to register
37666 * callbacks for a page-accessible memory (PAM) implementation
37667 */
37668-static struct tmem_pamops tmem_pamops;
37669+static tmem_pamops_no_const tmem_pamops;
37670
37671 void tmem_register_pamops(struct tmem_pamops *m)
37672 {
37673diff --git a/drivers/staging/zcache/tmem.h b/drivers/staging/zcache/tmem.h
37674index ed147c4..94fc3c6 100644
37675--- a/drivers/staging/zcache/tmem.h
37676+++ b/drivers/staging/zcache/tmem.h
37677@@ -180,6 +180,7 @@ struct tmem_pamops {
37678 void (*new_obj)(struct tmem_obj *);
37679 int (*replace_in_obj)(void *, struct tmem_obj *);
37680 };
37681+typedef struct tmem_pamops __no_const tmem_pamops_no_const;
37682 extern void tmem_register_pamops(struct tmem_pamops *m);
37683
37684 /* memory allocation methods provided by the host implementation */
37685@@ -189,6 +190,7 @@ struct tmem_hostops {
37686 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
37687 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
37688 };
37689+typedef struct tmem_hostops __no_const tmem_hostops_no_const;
37690 extern void tmem_register_hostops(struct tmem_hostops *m);
37691
37692 /* core tmem accessor functions */
37693diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
37694index c4ac6f6..4f90f53 100644
37695--- a/drivers/target/iscsi/iscsi_target.c
37696+++ b/drivers/target/iscsi/iscsi_target.c
37697@@ -1370,7 +1370,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
37698 * outstanding_r2ts reaches zero, go ahead and send the delayed
37699 * TASK_ABORTED status.
37700 */
37701- if (atomic_read(&se_cmd->t_transport_aborted) != 0) {
37702+ if (atomic_read_unchecked(&se_cmd->t_transport_aborted) != 0) {
37703 if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
37704 if (--cmd->outstanding_r2ts < 1) {
37705 iscsit_stop_dataout_timer(cmd);
37706diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
37707index 8badcb4..94c9ac6 100644
37708--- a/drivers/target/target_core_alua.c
37709+++ b/drivers/target/target_core_alua.c
37710@@ -723,6 +723,8 @@ static int core_alua_update_tpg_primary_metadata(
37711 char path[ALUA_METADATA_PATH_LEN];
37712 int len;
37713
37714+ pax_track_stack();
37715+
37716 memset(path, 0, ALUA_METADATA_PATH_LEN);
37717
37718 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
37719@@ -986,6 +988,8 @@ static int core_alua_update_tpg_secondary_metadata(
37720 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
37721 int len;
37722
37723+ pax_track_stack();
37724+
37725 memset(path, 0, ALUA_METADATA_PATH_LEN);
37726 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
37727
37728diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
37729index 5f91397..dcc2d25 100644
37730--- a/drivers/target/target_core_cdb.c
37731+++ b/drivers/target/target_core_cdb.c
37732@@ -933,6 +933,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
37733 int length = 0;
37734 unsigned char buf[SE_MODE_PAGE_BUF];
37735
37736+ pax_track_stack();
37737+
37738 memset(buf, 0, SE_MODE_PAGE_BUF);
37739
37740 switch (cdb[2] & 0x3f) {
37741diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
37742index b2575d8..b6b28fd 100644
37743--- a/drivers/target/target_core_configfs.c
37744+++ b/drivers/target/target_core_configfs.c
37745@@ -1267,6 +1267,8 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
37746 ssize_t len = 0;
37747 int reg_count = 0, prf_isid;
37748
37749+ pax_track_stack();
37750+
37751 if (!su_dev->se_dev_ptr)
37752 return -ENODEV;
37753
37754diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
37755index 7fd3a16..bc2fb3e 100644
37756--- a/drivers/target/target_core_pr.c
37757+++ b/drivers/target/target_core_pr.c
37758@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_registration(
37759 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
37760 u16 tpgt;
37761
37762+ pax_track_stack();
37763+
37764 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
37765 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
37766 /*
37767@@ -1867,6 +1869,8 @@ static int __core_scsi3_update_aptpl_buf(
37768 ssize_t len = 0;
37769 int reg_count = 0;
37770
37771+ pax_track_stack();
37772+
37773 memset(buf, 0, pr_aptpl_buf_len);
37774 /*
37775 * Called to clear metadata once APTPL has been deactivated.
37776@@ -1989,6 +1993,8 @@ static int __core_scsi3_write_aptpl_to_file(
37777 char path[512];
37778 int ret;
37779
37780+ pax_track_stack();
37781+
37782 memset(iov, 0, sizeof(struct iovec));
37783 memset(path, 0, 512);
37784
37785diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
37786index 5c1b8c5..0cb7d0e 100644
37787--- a/drivers/target/target_core_tmr.c
37788+++ b/drivers/target/target_core_tmr.c
37789@@ -255,7 +255,7 @@ static void core_tmr_drain_task_list(
37790 cmd->se_tfo->get_task_tag(cmd), cmd->pr_res_key,
37791 cmd->t_task_list_num,
37792 atomic_read(&cmd->t_task_cdbs_left),
37793- atomic_read(&cmd->t_task_cdbs_sent),
37794+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37795 atomic_read(&cmd->t_transport_active),
37796 atomic_read(&cmd->t_transport_stop),
37797 atomic_read(&cmd->t_transport_sent));
37798@@ -291,7 +291,7 @@ static void core_tmr_drain_task_list(
37799 pr_debug("LUN_RESET: got t_transport_active = 1 for"
37800 " task: %p, t_fe_count: %d dev: %p\n", task,
37801 fe_count, dev);
37802- atomic_set(&cmd->t_transport_aborted, 1);
37803+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37804 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37805
37806 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37807@@ -299,7 +299,7 @@ static void core_tmr_drain_task_list(
37808 }
37809 pr_debug("LUN_RESET: Got t_transport_active = 0 for task: %p,"
37810 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
37811- atomic_set(&cmd->t_transport_aborted, 1);
37812+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37813 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37814
37815 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37816diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
37817index e2added..ccb5251 100644
37818--- a/drivers/target/target_core_transport.c
37819+++ b/drivers/target/target_core_transport.c
37820@@ -1445,7 +1445,7 @@ struct se_device *transport_add_device_to_core_hba(
37821
37822 dev->queue_depth = dev_limits->queue_depth;
37823 atomic_set(&dev->depth_left, dev->queue_depth);
37824- atomic_set(&dev->dev_ordered_id, 0);
37825+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
37826
37827 se_dev_set_default_attribs(dev, dev_limits);
37828
37829@@ -1633,7 +1633,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
37830 * Used to determine when ORDERED commands should go from
37831 * Dormant to Active status.
37832 */
37833- cmd->se_ordered_id = atomic_inc_return(&cmd->se_dev->dev_ordered_id);
37834+ cmd->se_ordered_id = atomic_inc_return_unchecked(&cmd->se_dev->dev_ordered_id);
37835 smp_mb__after_atomic_inc();
37836 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
37837 cmd->se_ordered_id, cmd->sam_task_attr,
37838@@ -1960,7 +1960,7 @@ static void transport_generic_request_failure(
37839 " t_transport_active: %d t_transport_stop: %d"
37840 " t_transport_sent: %d\n", cmd->t_task_list_num,
37841 atomic_read(&cmd->t_task_cdbs_left),
37842- atomic_read(&cmd->t_task_cdbs_sent),
37843+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37844 atomic_read(&cmd->t_task_cdbs_ex_left),
37845 atomic_read(&cmd->t_transport_active),
37846 atomic_read(&cmd->t_transport_stop),
37847@@ -2460,9 +2460,9 @@ check_depth:
37848 spin_lock_irqsave(&cmd->t_state_lock, flags);
37849 atomic_set(&task->task_active, 1);
37850 atomic_set(&task->task_sent, 1);
37851- atomic_inc(&cmd->t_task_cdbs_sent);
37852+ atomic_inc_unchecked(&cmd->t_task_cdbs_sent);
37853
37854- if (atomic_read(&cmd->t_task_cdbs_sent) ==
37855+ if (atomic_read_unchecked(&cmd->t_task_cdbs_sent) ==
37856 cmd->t_task_list_num)
37857 atomic_set(&cmd->transport_sent, 1);
37858
37859@@ -4682,7 +4682,7 @@ static void transport_generic_wait_for_tasks(
37860 atomic_set(&cmd->transport_lun_stop, 0);
37861 }
37862 if (!atomic_read(&cmd->t_transport_active) ||
37863- atomic_read(&cmd->t_transport_aborted))
37864+ atomic_read_unchecked(&cmd->t_transport_aborted))
37865 goto remove;
37866
37867 atomic_set(&cmd->t_transport_stop, 1);
37868@@ -4917,7 +4917,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
37869 {
37870 int ret = 0;
37871
37872- if (atomic_read(&cmd->t_transport_aborted) != 0) {
37873+ if (atomic_read_unchecked(&cmd->t_transport_aborted) != 0) {
37874 if (!send_status ||
37875 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
37876 return 1;
37877@@ -4954,7 +4954,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
37878 */
37879 if (cmd->data_direction == DMA_TO_DEVICE) {
37880 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
37881- atomic_inc(&cmd->t_transport_aborted);
37882+ atomic_inc_unchecked(&cmd->t_transport_aborted);
37883 smp_mb__after_atomic_inc();
37884 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
37885 transport_new_cmd_failure(cmd);
37886@@ -5068,7 +5068,7 @@ static void transport_processing_shutdown(struct se_device *dev)
37887 cmd->se_tfo->get_task_tag(cmd),
37888 cmd->t_task_list_num,
37889 atomic_read(&cmd->t_task_cdbs_left),
37890- atomic_read(&cmd->t_task_cdbs_sent),
37891+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37892 atomic_read(&cmd->t_transport_active),
37893 atomic_read(&cmd->t_transport_stop),
37894 atomic_read(&cmd->t_transport_sent));
37895diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
37896index d5f923b..9c78228 100644
37897--- a/drivers/telephony/ixj.c
37898+++ b/drivers/telephony/ixj.c
37899@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
37900 bool mContinue;
37901 char *pIn, *pOut;
37902
37903+ pax_track_stack();
37904+
37905 if (!SCI_Prepare(j))
37906 return 0;
37907
37908diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
37909index 4c8b665..1d931eb 100644
37910--- a/drivers/tty/hvc/hvcs.c
37911+++ b/drivers/tty/hvc/hvcs.c
37912@@ -83,6 +83,7 @@
37913 #include <asm/hvcserver.h>
37914 #include <asm/uaccess.h>
37915 #include <asm/vio.h>
37916+#include <asm/local.h>
37917
37918 /*
37919 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
37920@@ -270,7 +271,7 @@ struct hvcs_struct {
37921 unsigned int index;
37922
37923 struct tty_struct *tty;
37924- int open_count;
37925+ local_t open_count;
37926
37927 /*
37928 * Used to tell the driver kernel_thread what operations need to take
37929@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
37930
37931 spin_lock_irqsave(&hvcsd->lock, flags);
37932
37933- if (hvcsd->open_count > 0) {
37934+ if (local_read(&hvcsd->open_count) > 0) {
37935 spin_unlock_irqrestore(&hvcsd->lock, flags);
37936 printk(KERN_INFO "HVCS: vterm state unchanged. "
37937 "The hvcs device node is still in use.\n");
37938@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
37939 if ((retval = hvcs_partner_connect(hvcsd)))
37940 goto error_release;
37941
37942- hvcsd->open_count = 1;
37943+ local_set(&hvcsd->open_count, 1);
37944 hvcsd->tty = tty;
37945 tty->driver_data = hvcsd;
37946
37947@@ -1179,7 +1180,7 @@ fast_open:
37948
37949 spin_lock_irqsave(&hvcsd->lock, flags);
37950 kref_get(&hvcsd->kref);
37951- hvcsd->open_count++;
37952+ local_inc(&hvcsd->open_count);
37953 hvcsd->todo_mask |= HVCS_SCHED_READ;
37954 spin_unlock_irqrestore(&hvcsd->lock, flags);
37955
37956@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37957 hvcsd = tty->driver_data;
37958
37959 spin_lock_irqsave(&hvcsd->lock, flags);
37960- if (--hvcsd->open_count == 0) {
37961+ if (local_dec_and_test(&hvcsd->open_count)) {
37962
37963 vio_disable_interrupts(hvcsd->vdev);
37964
37965@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37966 free_irq(irq, hvcsd);
37967 kref_put(&hvcsd->kref, destroy_hvcs_struct);
37968 return;
37969- } else if (hvcsd->open_count < 0) {
37970+ } else if (local_read(&hvcsd->open_count) < 0) {
37971 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
37972 " is missmanaged.\n",
37973- hvcsd->vdev->unit_address, hvcsd->open_count);
37974+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
37975 }
37976
37977 spin_unlock_irqrestore(&hvcsd->lock, flags);
37978@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37979
37980 spin_lock_irqsave(&hvcsd->lock, flags);
37981 /* Preserve this so that we know how many kref refs to put */
37982- temp_open_count = hvcsd->open_count;
37983+ temp_open_count = local_read(&hvcsd->open_count);
37984
37985 /*
37986 * Don't kref put inside the spinlock because the destruction
37987@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37988 hvcsd->tty->driver_data = NULL;
37989 hvcsd->tty = NULL;
37990
37991- hvcsd->open_count = 0;
37992+ local_set(&hvcsd->open_count, 0);
37993
37994 /* This will drop any buffered data on the floor which is OK in a hangup
37995 * scenario. */
37996@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct *tty,
37997 * the middle of a write operation? This is a crummy place to do this
37998 * but we want to keep it all in the spinlock.
37999 */
38000- if (hvcsd->open_count <= 0) {
38001+ if (local_read(&hvcsd->open_count) <= 0) {
38002 spin_unlock_irqrestore(&hvcsd->lock, flags);
38003 return -ENODEV;
38004 }
38005@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_struct *tty)
38006 {
38007 struct hvcs_struct *hvcsd = tty->driver_data;
38008
38009- if (!hvcsd || hvcsd->open_count <= 0)
38010+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
38011 return 0;
38012
38013 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
38014diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
38015index ef92869..f4ebd88 100644
38016--- a/drivers/tty/ipwireless/tty.c
38017+++ b/drivers/tty/ipwireless/tty.c
38018@@ -29,6 +29,7 @@
38019 #include <linux/tty_driver.h>
38020 #include <linux/tty_flip.h>
38021 #include <linux/uaccess.h>
38022+#include <asm/local.h>
38023
38024 #include "tty.h"
38025 #include "network.h"
38026@@ -51,7 +52,7 @@ struct ipw_tty {
38027 int tty_type;
38028 struct ipw_network *network;
38029 struct tty_struct *linux_tty;
38030- int open_count;
38031+ local_t open_count;
38032 unsigned int control_lines;
38033 struct mutex ipw_tty_mutex;
38034 int tx_bytes_queued;
38035@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
38036 mutex_unlock(&tty->ipw_tty_mutex);
38037 return -ENODEV;
38038 }
38039- if (tty->open_count == 0)
38040+ if (local_read(&tty->open_count) == 0)
38041 tty->tx_bytes_queued = 0;
38042
38043- tty->open_count++;
38044+ local_inc(&tty->open_count);
38045
38046 tty->linux_tty = linux_tty;
38047 linux_tty->driver_data = tty;
38048@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
38049
38050 static void do_ipw_close(struct ipw_tty *tty)
38051 {
38052- tty->open_count--;
38053-
38054- if (tty->open_count == 0) {
38055+ if (local_dec_return(&tty->open_count) == 0) {
38056 struct tty_struct *linux_tty = tty->linux_tty;
38057
38058 if (linux_tty != NULL) {
38059@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
38060 return;
38061
38062 mutex_lock(&tty->ipw_tty_mutex);
38063- if (tty->open_count == 0) {
38064+ if (local_read(&tty->open_count) == 0) {
38065 mutex_unlock(&tty->ipw_tty_mutex);
38066 return;
38067 }
38068@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
38069 return;
38070 }
38071
38072- if (!tty->open_count) {
38073+ if (!local_read(&tty->open_count)) {
38074 mutex_unlock(&tty->ipw_tty_mutex);
38075 return;
38076 }
38077@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
38078 return -ENODEV;
38079
38080 mutex_lock(&tty->ipw_tty_mutex);
38081- if (!tty->open_count) {
38082+ if (!local_read(&tty->open_count)) {
38083 mutex_unlock(&tty->ipw_tty_mutex);
38084 return -EINVAL;
38085 }
38086@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
38087 if (!tty)
38088 return -ENODEV;
38089
38090- if (!tty->open_count)
38091+ if (!local_read(&tty->open_count))
38092 return -EINVAL;
38093
38094 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
38095@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
38096 if (!tty)
38097 return 0;
38098
38099- if (!tty->open_count)
38100+ if (!local_read(&tty->open_count))
38101 return 0;
38102
38103 return tty->tx_bytes_queued;
38104@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
38105 if (!tty)
38106 return -ENODEV;
38107
38108- if (!tty->open_count)
38109+ if (!local_read(&tty->open_count))
38110 return -EINVAL;
38111
38112 return get_control_lines(tty);
38113@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
38114 if (!tty)
38115 return -ENODEV;
38116
38117- if (!tty->open_count)
38118+ if (!local_read(&tty->open_count))
38119 return -EINVAL;
38120
38121 return set_control_lines(tty, set, clear);
38122@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
38123 if (!tty)
38124 return -ENODEV;
38125
38126- if (!tty->open_count)
38127+ if (!local_read(&tty->open_count))
38128 return -EINVAL;
38129
38130 /* FIXME: Exactly how is the tty object locked here .. */
38131@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
38132 against a parallel ioctl etc */
38133 mutex_lock(&ttyj->ipw_tty_mutex);
38134 }
38135- while (ttyj->open_count)
38136+ while (local_read(&ttyj->open_count))
38137 do_ipw_close(ttyj);
38138 ipwireless_disassociate_network_ttys(network,
38139 ttyj->channel_idx);
38140diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
38141index 8a50e4e..7d9ca3d 100644
38142--- a/drivers/tty/n_gsm.c
38143+++ b/drivers/tty/n_gsm.c
38144@@ -1625,7 +1625,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
38145 kref_init(&dlci->ref);
38146 mutex_init(&dlci->mutex);
38147 dlci->fifo = &dlci->_fifo;
38148- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
38149+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
38150 kfree(dlci);
38151 return NULL;
38152 }
38153diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
38154index 39d6ab6..eb97f41 100644
38155--- a/drivers/tty/n_tty.c
38156+++ b/drivers/tty/n_tty.c
38157@@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
38158 {
38159 *ops = tty_ldisc_N_TTY;
38160 ops->owner = NULL;
38161- ops->refcount = ops->flags = 0;
38162+ atomic_set(&ops->refcount, 0);
38163+ ops->flags = 0;
38164 }
38165 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
38166diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
38167index e18604b..a7d5a11 100644
38168--- a/drivers/tty/pty.c
38169+++ b/drivers/tty/pty.c
38170@@ -773,8 +773,10 @@ static void __init unix98_pty_init(void)
38171 register_sysctl_table(pty_root_table);
38172
38173 /* Now create the /dev/ptmx special device */
38174+ pax_open_kernel();
38175 tty_default_fops(&ptmx_fops);
38176- ptmx_fops.open = ptmx_open;
38177+ *(void **)&ptmx_fops.open = ptmx_open;
38178+ pax_close_kernel();
38179
38180 cdev_init(&ptmx_cdev, &ptmx_fops);
38181 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
38182diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
38183index 6a1241c..d04ab0d 100644
38184--- a/drivers/tty/rocket.c
38185+++ b/drivers/tty/rocket.c
38186@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
38187 struct rocket_ports tmp;
38188 int board;
38189
38190+ pax_track_stack();
38191+
38192 if (!retports)
38193 return -EFAULT;
38194 memset(&tmp, 0, sizeof (tmp));
38195diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
38196index 87e7e6c..89744e0 100644
38197--- a/drivers/tty/serial/kgdboc.c
38198+++ b/drivers/tty/serial/kgdboc.c
38199@@ -23,8 +23,9 @@
38200 #define MAX_CONFIG_LEN 40
38201
38202 static struct kgdb_io kgdboc_io_ops;
38203+static struct kgdb_io kgdboc_io_ops_console;
38204
38205-/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
38206+/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
38207 static int configured = -1;
38208
38209 static char config[MAX_CONFIG_LEN];
38210@@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
38211 kgdboc_unregister_kbd();
38212 if (configured == 1)
38213 kgdb_unregister_io_module(&kgdboc_io_ops);
38214+ else if (configured == 2)
38215+ kgdb_unregister_io_module(&kgdboc_io_ops_console);
38216 }
38217
38218 static int configure_kgdboc(void)
38219@@ -156,13 +159,13 @@ static int configure_kgdboc(void)
38220 int err;
38221 char *cptr = config;
38222 struct console *cons;
38223+ int is_console = 0;
38224
38225 err = kgdboc_option_setup(config);
38226 if (err || !strlen(config) || isspace(config[0]))
38227 goto noconfig;
38228
38229 err = -ENODEV;
38230- kgdboc_io_ops.is_console = 0;
38231 kgdb_tty_driver = NULL;
38232
38233 kgdboc_use_kms = 0;
38234@@ -183,7 +186,7 @@ static int configure_kgdboc(void)
38235 int idx;
38236 if (cons->device && cons->device(cons, &idx) == p &&
38237 idx == tty_line) {
38238- kgdboc_io_ops.is_console = 1;
38239+ is_console = 1;
38240 break;
38241 }
38242 cons = cons->next;
38243@@ -193,12 +196,16 @@ static int configure_kgdboc(void)
38244 kgdb_tty_line = tty_line;
38245
38246 do_register:
38247- err = kgdb_register_io_module(&kgdboc_io_ops);
38248+ if (is_console) {
38249+ err = kgdb_register_io_module(&kgdboc_io_ops_console);
38250+ configured = 2;
38251+ } else {
38252+ err = kgdb_register_io_module(&kgdboc_io_ops);
38253+ configured = 1;
38254+ }
38255 if (err)
38256 goto noconfig;
38257
38258- configured = 1;
38259-
38260 return 0;
38261
38262 noconfig:
38263@@ -212,7 +219,7 @@ noconfig:
38264 static int __init init_kgdboc(void)
38265 {
38266 /* Already configured? */
38267- if (configured == 1)
38268+ if (configured >= 1)
38269 return 0;
38270
38271 return configure_kgdboc();
38272@@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
38273 if (config[len - 1] == '\n')
38274 config[len - 1] = '\0';
38275
38276- if (configured == 1)
38277+ if (configured >= 1)
38278 cleanup_kgdboc();
38279
38280 /* Go and configure with the new params. */
38281@@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
38282 .post_exception = kgdboc_post_exp_handler,
38283 };
38284
38285+static struct kgdb_io kgdboc_io_ops_console = {
38286+ .name = "kgdboc",
38287+ .read_char = kgdboc_get_char,
38288+ .write_char = kgdboc_put_char,
38289+ .pre_exception = kgdboc_pre_exp_handler,
38290+ .post_exception = kgdboc_post_exp_handler,
38291+ .is_console = 1
38292+};
38293+
38294 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
38295 /* This is only available if kgdboc is a built in for early debugging */
38296 static int __init kgdboc_early_init(char *opt)
38297diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
38298index cab52f4..29fc6aa 100644
38299--- a/drivers/tty/serial/mfd.c
38300+++ b/drivers/tty/serial/mfd.c
38301@@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci_dev *pdev)
38302 }
38303
38304 /* First 3 are UART ports, and the 4th is the DMA */
38305-static const struct pci_device_id pci_ids[] __devinitdata = {
38306+static const struct pci_device_id pci_ids[] __devinitconst = {
38307 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
38308 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
38309 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
38310diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
38311index 23bc743..d425c07 100644
38312--- a/drivers/tty/serial/mrst_max3110.c
38313+++ b/drivers/tty/serial/mrst_max3110.c
38314@@ -393,6 +393,8 @@ static void max3110_con_receive(struct uart_max3110 *max)
38315 int loop = 1, num, total = 0;
38316 u8 recv_buf[512], *pbuf;
38317
38318+ pax_track_stack();
38319+
38320 pbuf = recv_buf;
38321 do {
38322 num = max3110_read_multi(max, pbuf);
38323diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
38324index 1a890e2..1d8139c 100644
38325--- a/drivers/tty/tty_io.c
38326+++ b/drivers/tty/tty_io.c
38327@@ -3238,7 +3238,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
38328
38329 void tty_default_fops(struct file_operations *fops)
38330 {
38331- *fops = tty_fops;
38332+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
38333 }
38334
38335 /*
38336diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
38337index a76c808..ecbc743 100644
38338--- a/drivers/tty/tty_ldisc.c
38339+++ b/drivers/tty/tty_ldisc.c
38340@@ -75,7 +75,7 @@ static void put_ldisc(struct tty_ldisc *ld)
38341 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
38342 struct tty_ldisc_ops *ldo = ld->ops;
38343
38344- ldo->refcount--;
38345+ atomic_dec(&ldo->refcount);
38346 module_put(ldo->owner);
38347 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38348
38349@@ -110,7 +110,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
38350 spin_lock_irqsave(&tty_ldisc_lock, flags);
38351 tty_ldiscs[disc] = new_ldisc;
38352 new_ldisc->num = disc;
38353- new_ldisc->refcount = 0;
38354+ atomic_set(&new_ldisc->refcount, 0);
38355 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38356
38357 return ret;
38358@@ -138,7 +138,7 @@ int tty_unregister_ldisc(int disc)
38359 return -EINVAL;
38360
38361 spin_lock_irqsave(&tty_ldisc_lock, flags);
38362- if (tty_ldiscs[disc]->refcount)
38363+ if (atomic_read(&tty_ldiscs[disc]->refcount))
38364 ret = -EBUSY;
38365 else
38366 tty_ldiscs[disc] = NULL;
38367@@ -159,7 +159,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
38368 if (ldops) {
38369 ret = ERR_PTR(-EAGAIN);
38370 if (try_module_get(ldops->owner)) {
38371- ldops->refcount++;
38372+ atomic_inc(&ldops->refcount);
38373 ret = ldops;
38374 }
38375 }
38376@@ -172,7 +172,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
38377 unsigned long flags;
38378
38379 spin_lock_irqsave(&tty_ldisc_lock, flags);
38380- ldops->refcount--;
38381+ atomic_dec(&ldops->refcount);
38382 module_put(ldops->owner);
38383 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38384 }
38385diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
38386index 3761ccf..2c613b3 100644
38387--- a/drivers/tty/vt/keyboard.c
38388+++ b/drivers/tty/vt/keyboard.c
38389@@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
38390 kbd->kbdmode == VC_OFF) &&
38391 value != KVAL(K_SAK))
38392 return; /* SAK is allowed even in raw mode */
38393+
38394+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
38395+ {
38396+ void *func = fn_handler[value];
38397+ if (func == fn_show_state || func == fn_show_ptregs ||
38398+ func == fn_show_mem)
38399+ return;
38400+ }
38401+#endif
38402+
38403 fn_handler[value](vc);
38404 }
38405
38406diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
38407index b3915b7..e716839 100644
38408--- a/drivers/tty/vt/vt.c
38409+++ b/drivers/tty/vt/vt.c
38410@@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
38411
38412 static void notify_write(struct vc_data *vc, unsigned int unicode)
38413 {
38414- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
38415+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
38416 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
38417 }
38418
38419diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
38420index 5e096f4..0da1363 100644
38421--- a/drivers/tty/vt/vt_ioctl.c
38422+++ b/drivers/tty/vt/vt_ioctl.c
38423@@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38424 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
38425 return -EFAULT;
38426
38427- if (!capable(CAP_SYS_TTY_CONFIG))
38428- perm = 0;
38429-
38430 switch (cmd) {
38431 case KDGKBENT:
38432 key_map = key_maps[s];
38433@@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38434 val = (i ? K_HOLE : K_NOSUCHMAP);
38435 return put_user(val, &user_kbe->kb_value);
38436 case KDSKBENT:
38437+ if (!capable(CAP_SYS_TTY_CONFIG))
38438+ perm = 0;
38439+
38440 if (!perm)
38441 return -EPERM;
38442 if (!i && v == K_NOSUCHMAP) {
38443@@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38444 int i, j, k;
38445 int ret;
38446
38447- if (!capable(CAP_SYS_TTY_CONFIG))
38448- perm = 0;
38449-
38450 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
38451 if (!kbs) {
38452 ret = -ENOMEM;
38453@@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38454 kfree(kbs);
38455 return ((p && *p) ? -EOVERFLOW : 0);
38456 case KDSKBSENT:
38457+ if (!capable(CAP_SYS_TTY_CONFIG))
38458+ perm = 0;
38459+
38460 if (!perm) {
38461 ret = -EPERM;
38462 goto reterr;
38463diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
38464index d2efe82..9440ab6 100644
38465--- a/drivers/uio/uio.c
38466+++ b/drivers/uio/uio.c
38467@@ -25,6 +25,7 @@
38468 #include <linux/kobject.h>
38469 #include <linux/cdev.h>
38470 #include <linux/uio_driver.h>
38471+#include <asm/local.h>
38472
38473 #define UIO_MAX_DEVICES (1U << MINORBITS)
38474
38475@@ -32,10 +33,10 @@ struct uio_device {
38476 struct module *owner;
38477 struct device *dev;
38478 int minor;
38479- atomic_t event;
38480+ atomic_unchecked_t event;
38481 struct fasync_struct *async_queue;
38482 wait_queue_head_t wait;
38483- int vma_count;
38484+ local_t vma_count;
38485 struct uio_info *info;
38486 struct kobject *map_dir;
38487 struct kobject *portio_dir;
38488@@ -242,7 +243,7 @@ static ssize_t show_event(struct device *dev,
38489 struct device_attribute *attr, char *buf)
38490 {
38491 struct uio_device *idev = dev_get_drvdata(dev);
38492- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
38493+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
38494 }
38495
38496 static struct device_attribute uio_class_attributes[] = {
38497@@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *info)
38498 {
38499 struct uio_device *idev = info->uio_dev;
38500
38501- atomic_inc(&idev->event);
38502+ atomic_inc_unchecked(&idev->event);
38503 wake_up_interruptible(&idev->wait);
38504 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38505 }
38506@@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, struct file *filep)
38507 }
38508
38509 listener->dev = idev;
38510- listener->event_count = atomic_read(&idev->event);
38511+ listener->event_count = atomic_read_unchecked(&idev->event);
38512 filep->private_data = listener;
38513
38514 if (idev->info->open) {
38515@@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
38516 return -EIO;
38517
38518 poll_wait(filep, &idev->wait, wait);
38519- if (listener->event_count != atomic_read(&idev->event))
38520+ if (listener->event_count != atomic_read_unchecked(&idev->event))
38521 return POLLIN | POLLRDNORM;
38522 return 0;
38523 }
38524@@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
38525 do {
38526 set_current_state(TASK_INTERRUPTIBLE);
38527
38528- event_count = atomic_read(&idev->event);
38529+ event_count = atomic_read_unchecked(&idev->event);
38530 if (event_count != listener->event_count) {
38531 if (copy_to_user(buf, &event_count, count))
38532 retval = -EFAULT;
38533@@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
38534 static void uio_vma_open(struct vm_area_struct *vma)
38535 {
38536 struct uio_device *idev = vma->vm_private_data;
38537- idev->vma_count++;
38538+ local_inc(&idev->vma_count);
38539 }
38540
38541 static void uio_vma_close(struct vm_area_struct *vma)
38542 {
38543 struct uio_device *idev = vma->vm_private_data;
38544- idev->vma_count--;
38545+ local_dec(&idev->vma_count);
38546 }
38547
38548 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38549@@ -823,7 +824,7 @@ int __uio_register_device(struct module *owner,
38550 idev->owner = owner;
38551 idev->info = info;
38552 init_waitqueue_head(&idev->wait);
38553- atomic_set(&idev->event, 0);
38554+ atomic_set_unchecked(&idev->event, 0);
38555
38556 ret = uio_get_minor(idev);
38557 if (ret)
38558diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
38559index a845f8b..4f54072 100644
38560--- a/drivers/usb/atm/cxacru.c
38561+++ b/drivers/usb/atm/cxacru.c
38562@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
38563 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
38564 if (ret < 2)
38565 return -EINVAL;
38566- if (index < 0 || index > 0x7f)
38567+ if (index > 0x7f)
38568 return -EINVAL;
38569 pos += tmp;
38570
38571diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
38572index d3448ca..d2864ca 100644
38573--- a/drivers/usb/atm/usbatm.c
38574+++ b/drivers/usb/atm/usbatm.c
38575@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38576 if (printk_ratelimit())
38577 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38578 __func__, vpi, vci);
38579- atomic_inc(&vcc->stats->rx_err);
38580+ atomic_inc_unchecked(&vcc->stats->rx_err);
38581 return;
38582 }
38583
38584@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38585 if (length > ATM_MAX_AAL5_PDU) {
38586 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38587 __func__, length, vcc);
38588- atomic_inc(&vcc->stats->rx_err);
38589+ atomic_inc_unchecked(&vcc->stats->rx_err);
38590 goto out;
38591 }
38592
38593@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38594 if (sarb->len < pdu_length) {
38595 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38596 __func__, pdu_length, sarb->len, vcc);
38597- atomic_inc(&vcc->stats->rx_err);
38598+ atomic_inc_unchecked(&vcc->stats->rx_err);
38599 goto out;
38600 }
38601
38602 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38603 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38604 __func__, vcc);
38605- atomic_inc(&vcc->stats->rx_err);
38606+ atomic_inc_unchecked(&vcc->stats->rx_err);
38607 goto out;
38608 }
38609
38610@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38611 if (printk_ratelimit())
38612 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38613 __func__, length);
38614- atomic_inc(&vcc->stats->rx_drop);
38615+ atomic_inc_unchecked(&vcc->stats->rx_drop);
38616 goto out;
38617 }
38618
38619@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38620
38621 vcc->push(vcc, skb);
38622
38623- atomic_inc(&vcc->stats->rx);
38624+ atomic_inc_unchecked(&vcc->stats->rx);
38625 out:
38626 skb_trim(sarb, 0);
38627 }
38628@@ -615,7 +615,7 @@ static void usbatm_tx_process(unsigned long data)
38629 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38630
38631 usbatm_pop(vcc, skb);
38632- atomic_inc(&vcc->stats->tx);
38633+ atomic_inc_unchecked(&vcc->stats->tx);
38634
38635 skb = skb_dequeue(&instance->sndqueue);
38636 }
38637@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
38638 if (!left--)
38639 return sprintf(page,
38640 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38641- atomic_read(&atm_dev->stats.aal5.tx),
38642- atomic_read(&atm_dev->stats.aal5.tx_err),
38643- atomic_read(&atm_dev->stats.aal5.rx),
38644- atomic_read(&atm_dev->stats.aal5.rx_err),
38645- atomic_read(&atm_dev->stats.aal5.rx_drop));
38646+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38647+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38648+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38649+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38650+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38651
38652 if (!left--) {
38653 if (instance->disconnected)
38654diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
38655index 0149c09..f108812 100644
38656--- a/drivers/usb/core/devices.c
38657+++ b/drivers/usb/core/devices.c
38658@@ -126,7 +126,7 @@ static const char format_endpt[] =
38659 * time it gets called.
38660 */
38661 static struct device_connect_event {
38662- atomic_t count;
38663+ atomic_unchecked_t count;
38664 wait_queue_head_t wait;
38665 } device_event = {
38666 .count = ATOMIC_INIT(1),
38667@@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
38668
38669 void usbfs_conn_disc_event(void)
38670 {
38671- atomic_add(2, &device_event.count);
38672+ atomic_add_unchecked(2, &device_event.count);
38673 wake_up(&device_event.wait);
38674 }
38675
38676@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(struct file *file,
38677
38678 poll_wait(file, &device_event.wait, wait);
38679
38680- event_count = atomic_read(&device_event.count);
38681+ event_count = atomic_read_unchecked(&device_event.count);
38682 if (file->f_version != event_count) {
38683 file->f_version = event_count;
38684 return POLLIN | POLLRDNORM;
38685diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
38686index 0b5ec23..0da3d76 100644
38687--- a/drivers/usb/core/message.c
38688+++ b/drivers/usb/core/message.c
38689@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device *udev, int index)
38690 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
38691 if (buf) {
38692 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
38693- if (len > 0) {
38694- smallbuf = kmalloc(++len, GFP_NOIO);
38695+ if (len++ > 0) {
38696+ smallbuf = kmalloc(len, GFP_NOIO);
38697 if (!smallbuf)
38698 return buf;
38699 memcpy(smallbuf, buf, len);
38700diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
38701index 1fc8f12..20647c1 100644
38702--- a/drivers/usb/early/ehci-dbgp.c
38703+++ b/drivers/usb/early/ehci-dbgp.c
38704@@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
38705
38706 #ifdef CONFIG_KGDB
38707 static struct kgdb_io kgdbdbgp_io_ops;
38708-#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
38709+static struct kgdb_io kgdbdbgp_io_ops_console;
38710+#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
38711 #else
38712 #define dbgp_kgdb_mode (0)
38713 #endif
38714@@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
38715 .write_char = kgdbdbgp_write_char,
38716 };
38717
38718+static struct kgdb_io kgdbdbgp_io_ops_console = {
38719+ .name = "kgdbdbgp",
38720+ .read_char = kgdbdbgp_read_char,
38721+ .write_char = kgdbdbgp_write_char,
38722+ .is_console = 1
38723+};
38724+
38725 static int kgdbdbgp_wait_time;
38726
38727 static int __init kgdbdbgp_parse_config(char *str)
38728@@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(char *str)
38729 ptr++;
38730 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
38731 }
38732- kgdb_register_io_module(&kgdbdbgp_io_ops);
38733- kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
38734+ if (early_dbgp_console.index != -1)
38735+ kgdb_register_io_module(&kgdbdbgp_io_ops_console);
38736+ else
38737+ kgdb_register_io_module(&kgdbdbgp_io_ops);
38738
38739 return 0;
38740 }
38741diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
38742index d718033..6075579 100644
38743--- a/drivers/usb/host/xhci-mem.c
38744+++ b/drivers/usb/host/xhci-mem.c
38745@@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
38746 unsigned int num_tests;
38747 int i, ret;
38748
38749+ pax_track_stack();
38750+
38751 num_tests = ARRAY_SIZE(simple_test_vector);
38752 for (i = 0; i < num_tests; i++) {
38753 ret = xhci_test_trb_in_td(xhci,
38754diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
38755index d6bea3e..60b250e 100644
38756--- a/drivers/usb/wusbcore/wa-hc.h
38757+++ b/drivers/usb/wusbcore/wa-hc.h
38758@@ -192,7 +192,7 @@ struct wahc {
38759 struct list_head xfer_delayed_list;
38760 spinlock_t xfer_list_lock;
38761 struct work_struct xfer_work;
38762- atomic_t xfer_id_count;
38763+ atomic_unchecked_t xfer_id_count;
38764 };
38765
38766
38767@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
38768 INIT_LIST_HEAD(&wa->xfer_delayed_list);
38769 spin_lock_init(&wa->xfer_list_lock);
38770 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
38771- atomic_set(&wa->xfer_id_count, 1);
38772+ atomic_set_unchecked(&wa->xfer_id_count, 1);
38773 }
38774
38775 /**
38776diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
38777index 4193345..49ae93d 100644
38778--- a/drivers/usb/wusbcore/wa-xfer.c
38779+++ b/drivers/usb/wusbcore/wa-xfer.c
38780@@ -295,7 +295,7 @@ out:
38781 */
38782 static void wa_xfer_id_init(struct wa_xfer *xfer)
38783 {
38784- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
38785+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
38786 }
38787
38788 /*
38789diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
38790index c14c42b..f955cc2 100644
38791--- a/drivers/vhost/vhost.c
38792+++ b/drivers/vhost/vhost.c
38793@@ -629,7 +629,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
38794 return 0;
38795 }
38796
38797-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
38798+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
38799 {
38800 struct file *eventfp, *filep = NULL,
38801 *pollstart = NULL, *pollstop = NULL;
38802diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
38803index b0b2ac3..89a4399 100644
38804--- a/drivers/video/aty/aty128fb.c
38805+++ b/drivers/video/aty/aty128fb.c
38806@@ -148,7 +148,7 @@ enum {
38807 };
38808
38809 /* Must match above enum */
38810-static const char *r128_family[] __devinitdata = {
38811+static const char *r128_family[] __devinitconst = {
38812 "AGP",
38813 "PCI",
38814 "PRO AGP",
38815diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
38816index 5c3960d..15cf8fc 100644
38817--- a/drivers/video/fbcmap.c
38818+++ b/drivers/video/fbcmap.c
38819@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
38820 rc = -ENODEV;
38821 goto out;
38822 }
38823- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
38824- !info->fbops->fb_setcmap)) {
38825+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
38826 rc = -EINVAL;
38827 goto out1;
38828 }
38829diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
38830index ad93629..ca6a218 100644
38831--- a/drivers/video/fbmem.c
38832+++ b/drivers/video/fbmem.c
38833@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38834 image->dx += image->width + 8;
38835 }
38836 } else if (rotate == FB_ROTATE_UD) {
38837- for (x = 0; x < num && image->dx >= 0; x++) {
38838+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
38839 info->fbops->fb_imageblit(info, image);
38840 image->dx -= image->width + 8;
38841 }
38842@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38843 image->dy += image->height + 8;
38844 }
38845 } else if (rotate == FB_ROTATE_CCW) {
38846- for (x = 0; x < num && image->dy >= 0; x++) {
38847+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
38848 info->fbops->fb_imageblit(info, image);
38849 image->dy -= image->height + 8;
38850 }
38851@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
38852 int flags = info->flags;
38853 int ret = 0;
38854
38855+ pax_track_stack();
38856+
38857 if (var->activate & FB_ACTIVATE_INV_MODE) {
38858 struct fb_videomode mode1, mode2;
38859
38860@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38861 void __user *argp = (void __user *)arg;
38862 long ret = 0;
38863
38864+ pax_track_stack();
38865+
38866 switch (cmd) {
38867 case FBIOGET_VSCREENINFO:
38868 if (!lock_fb_info(info))
38869@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38870 return -EFAULT;
38871 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
38872 return -EINVAL;
38873- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
38874+ if (con2fb.framebuffer >= FB_MAX)
38875 return -EINVAL;
38876 if (!registered_fb[con2fb.framebuffer])
38877 request_module("fb%d", con2fb.framebuffer);
38878diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
38879index 5a5d092..265c5ed 100644
38880--- a/drivers/video/geode/gx1fb_core.c
38881+++ b/drivers/video/geode/gx1fb_core.c
38882@@ -29,7 +29,7 @@ static int crt_option = 1;
38883 static char panel_option[32] = "";
38884
38885 /* Modes relevant to the GX1 (taken from modedb.c) */
38886-static const struct fb_videomode __devinitdata gx1_modedb[] = {
38887+static const struct fb_videomode __devinitconst gx1_modedb[] = {
38888 /* 640x480-60 VESA */
38889 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
38890 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
38891diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
38892index 896e53d..4d87d0b 100644
38893--- a/drivers/video/gxt4500.c
38894+++ b/drivers/video/gxt4500.c
38895@@ -156,7 +156,7 @@ struct gxt4500_par {
38896 static char *mode_option;
38897
38898 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
38899-static const struct fb_videomode defaultmode __devinitdata = {
38900+static const struct fb_videomode defaultmode __devinitconst = {
38901 .refresh = 60,
38902 .xres = 1280,
38903 .yres = 1024,
38904@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
38905 return 0;
38906 }
38907
38908-static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
38909+static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
38910 .id = "IBM GXT4500P",
38911 .type = FB_TYPE_PACKED_PIXELS,
38912 .visual = FB_VISUAL_PSEUDOCOLOR,
38913diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
38914index 7672d2e..b56437f 100644
38915--- a/drivers/video/i810/i810_accel.c
38916+++ b/drivers/video/i810/i810_accel.c
38917@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
38918 }
38919 }
38920 printk("ringbuffer lockup!!!\n");
38921+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
38922 i810_report_error(mmio);
38923 par->dev_flags |= LOCKUP;
38924 info->pixmap.scan_align = 1;
38925diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
38926index 318f6fb..9a389c1 100644
38927--- a/drivers/video/i810/i810_main.c
38928+++ b/drivers/video/i810/i810_main.c
38929@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
38930 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
38931
38932 /* PCI */
38933-static const char *i810_pci_list[] __devinitdata = {
38934+static const char *i810_pci_list[] __devinitconst = {
38935 "Intel(R) 810 Framebuffer Device" ,
38936 "Intel(R) 810-DC100 Framebuffer Device" ,
38937 "Intel(R) 810E Framebuffer Device" ,
38938diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
38939index de36693..3c63fc2 100644
38940--- a/drivers/video/jz4740_fb.c
38941+++ b/drivers/video/jz4740_fb.c
38942@@ -136,7 +136,7 @@ struct jzfb {
38943 uint32_t pseudo_palette[16];
38944 };
38945
38946-static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
38947+static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
38948 .id = "JZ4740 FB",
38949 .type = FB_TYPE_PACKED_PIXELS,
38950 .visual = FB_VISUAL_TRUECOLOR,
38951diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
38952index 3c14e43..eafa544 100644
38953--- a/drivers/video/logo/logo_linux_clut224.ppm
38954+++ b/drivers/video/logo/logo_linux_clut224.ppm
38955@@ -1,1604 +1,1123 @@
38956 P3
38957-# Standard 224-color Linux logo
38958 80 80
38959 255
38960- 0 0 0 0 0 0 0 0 0 0 0 0
38961- 0 0 0 0 0 0 0 0 0 0 0 0
38962- 0 0 0 0 0 0 0 0 0 0 0 0
38963- 0 0 0 0 0 0 0 0 0 0 0 0
38964- 0 0 0 0 0 0 0 0 0 0 0 0
38965- 0 0 0 0 0 0 0 0 0 0 0 0
38966- 0 0 0 0 0 0 0 0 0 0 0 0
38967- 0 0 0 0 0 0 0 0 0 0 0 0
38968- 0 0 0 0 0 0 0 0 0 0 0 0
38969- 6 6 6 6 6 6 10 10 10 10 10 10
38970- 10 10 10 6 6 6 6 6 6 6 6 6
38971- 0 0 0 0 0 0 0 0 0 0 0 0
38972- 0 0 0 0 0 0 0 0 0 0 0 0
38973- 0 0 0 0 0 0 0 0 0 0 0 0
38974- 0 0 0 0 0 0 0 0 0 0 0 0
38975- 0 0 0 0 0 0 0 0 0 0 0 0
38976- 0 0 0 0 0 0 0 0 0 0 0 0
38977- 0 0 0 0 0 0 0 0 0 0 0 0
38978- 0 0 0 0 0 0 0 0 0 0 0 0
38979- 0 0 0 0 0 0 0 0 0 0 0 0
38980- 0 0 0 0 0 0 0 0 0 0 0 0
38981- 0 0 0 0 0 0 0 0 0 0 0 0
38982- 0 0 0 0 0 0 0 0 0 0 0 0
38983- 0 0 0 0 0 0 0 0 0 0 0 0
38984- 0 0 0 0 0 0 0 0 0 0 0 0
38985- 0 0 0 0 0 0 0 0 0 0 0 0
38986- 0 0 0 0 0 0 0 0 0 0 0 0
38987- 0 0 0 0 0 0 0 0 0 0 0 0
38988- 0 0 0 6 6 6 10 10 10 14 14 14
38989- 22 22 22 26 26 26 30 30 30 34 34 34
38990- 30 30 30 30 30 30 26 26 26 18 18 18
38991- 14 14 14 10 10 10 6 6 6 0 0 0
38992- 0 0 0 0 0 0 0 0 0 0 0 0
38993- 0 0 0 0 0 0 0 0 0 0 0 0
38994- 0 0 0 0 0 0 0 0 0 0 0 0
38995- 0 0 0 0 0 0 0 0 0 0 0 0
38996- 0 0 0 0 0 0 0 0 0 0 0 0
38997- 0 0 0 0 0 0 0 0 0 0 0 0
38998- 0 0 0 0 0 0 0 0 0 0 0 0
38999- 0 0 0 0 0 0 0 0 0 0 0 0
39000- 0 0 0 0 0 0 0 0 0 0 0 0
39001- 0 0 0 0 0 1 0 0 1 0 0 0
39002- 0 0 0 0 0 0 0 0 0 0 0 0
39003- 0 0 0 0 0 0 0 0 0 0 0 0
39004- 0 0 0 0 0 0 0 0 0 0 0 0
39005- 0 0 0 0 0 0 0 0 0 0 0 0
39006- 0 0 0 0 0 0 0 0 0 0 0 0
39007- 0 0 0 0 0 0 0 0 0 0 0 0
39008- 6 6 6 14 14 14 26 26 26 42 42 42
39009- 54 54 54 66 66 66 78 78 78 78 78 78
39010- 78 78 78 74 74 74 66 66 66 54 54 54
39011- 42 42 42 26 26 26 18 18 18 10 10 10
39012- 6 6 6 0 0 0 0 0 0 0 0 0
39013- 0 0 0 0 0 0 0 0 0 0 0 0
39014- 0 0 0 0 0 0 0 0 0 0 0 0
39015- 0 0 0 0 0 0 0 0 0 0 0 0
39016- 0 0 0 0 0 0 0 0 0 0 0 0
39017- 0 0 0 0 0 0 0 0 0 0 0 0
39018- 0 0 0 0 0 0 0 0 0 0 0 0
39019- 0 0 0 0 0 0 0 0 0 0 0 0
39020- 0 0 0 0 0 0 0 0 0 0 0 0
39021- 0 0 1 0 0 0 0 0 0 0 0 0
39022- 0 0 0 0 0 0 0 0 0 0 0 0
39023- 0 0 0 0 0 0 0 0 0 0 0 0
39024- 0 0 0 0 0 0 0 0 0 0 0 0
39025- 0 0 0 0 0 0 0 0 0 0 0 0
39026- 0 0 0 0 0 0 0 0 0 0 0 0
39027- 0 0 0 0 0 0 0 0 0 10 10 10
39028- 22 22 22 42 42 42 66 66 66 86 86 86
39029- 66 66 66 38 38 38 38 38 38 22 22 22
39030- 26 26 26 34 34 34 54 54 54 66 66 66
39031- 86 86 86 70 70 70 46 46 46 26 26 26
39032- 14 14 14 6 6 6 0 0 0 0 0 0
39033- 0 0 0 0 0 0 0 0 0 0 0 0
39034- 0 0 0 0 0 0 0 0 0 0 0 0
39035- 0 0 0 0 0 0 0 0 0 0 0 0
39036- 0 0 0 0 0 0 0 0 0 0 0 0
39037- 0 0 0 0 0 0 0 0 0 0 0 0
39038- 0 0 0 0 0 0 0 0 0 0 0 0
39039- 0 0 0 0 0 0 0 0 0 0 0 0
39040- 0 0 0 0 0 0 0 0 0 0 0 0
39041- 0 0 1 0 0 1 0 0 1 0 0 0
39042- 0 0 0 0 0 0 0 0 0 0 0 0
39043- 0 0 0 0 0 0 0 0 0 0 0 0
39044- 0 0 0 0 0 0 0 0 0 0 0 0
39045- 0 0 0 0 0 0 0 0 0 0 0 0
39046- 0 0 0 0 0 0 0 0 0 0 0 0
39047- 0 0 0 0 0 0 10 10 10 26 26 26
39048- 50 50 50 82 82 82 58 58 58 6 6 6
39049- 2 2 6 2 2 6 2 2 6 2 2 6
39050- 2 2 6 2 2 6 2 2 6 2 2 6
39051- 6 6 6 54 54 54 86 86 86 66 66 66
39052- 38 38 38 18 18 18 6 6 6 0 0 0
39053- 0 0 0 0 0 0 0 0 0 0 0 0
39054- 0 0 0 0 0 0 0 0 0 0 0 0
39055- 0 0 0 0 0 0 0 0 0 0 0 0
39056- 0 0 0 0 0 0 0 0 0 0 0 0
39057- 0 0 0 0 0 0 0 0 0 0 0 0
39058- 0 0 0 0 0 0 0 0 0 0 0 0
39059- 0 0 0 0 0 0 0 0 0 0 0 0
39060- 0 0 0 0 0 0 0 0 0 0 0 0
39061- 0 0 0 0 0 0 0 0 0 0 0 0
39062- 0 0 0 0 0 0 0 0 0 0 0 0
39063- 0 0 0 0 0 0 0 0 0 0 0 0
39064- 0 0 0 0 0 0 0 0 0 0 0 0
39065- 0 0 0 0 0 0 0 0 0 0 0 0
39066- 0 0 0 0 0 0 0 0 0 0 0 0
39067- 0 0 0 6 6 6 22 22 22 50 50 50
39068- 78 78 78 34 34 34 2 2 6 2 2 6
39069- 2 2 6 2 2 6 2 2 6 2 2 6
39070- 2 2 6 2 2 6 2 2 6 2 2 6
39071- 2 2 6 2 2 6 6 6 6 70 70 70
39072- 78 78 78 46 46 46 22 22 22 6 6 6
39073- 0 0 0 0 0 0 0 0 0 0 0 0
39074- 0 0 0 0 0 0 0 0 0 0 0 0
39075- 0 0 0 0 0 0 0 0 0 0 0 0
39076- 0 0 0 0 0 0 0 0 0 0 0 0
39077- 0 0 0 0 0 0 0 0 0 0 0 0
39078- 0 0 0 0 0 0 0 0 0 0 0 0
39079- 0 0 0 0 0 0 0 0 0 0 0 0
39080- 0 0 0 0 0 0 0 0 0 0 0 0
39081- 0 0 1 0 0 1 0 0 1 0 0 0
39082- 0 0 0 0 0 0 0 0 0 0 0 0
39083- 0 0 0 0 0 0 0 0 0 0 0 0
39084- 0 0 0 0 0 0 0 0 0 0 0 0
39085- 0 0 0 0 0 0 0 0 0 0 0 0
39086- 0 0 0 0 0 0 0 0 0 0 0 0
39087- 6 6 6 18 18 18 42 42 42 82 82 82
39088- 26 26 26 2 2 6 2 2 6 2 2 6
39089- 2 2 6 2 2 6 2 2 6 2 2 6
39090- 2 2 6 2 2 6 2 2 6 14 14 14
39091- 46 46 46 34 34 34 6 6 6 2 2 6
39092- 42 42 42 78 78 78 42 42 42 18 18 18
39093- 6 6 6 0 0 0 0 0 0 0 0 0
39094- 0 0 0 0 0 0 0 0 0 0 0 0
39095- 0 0 0 0 0 0 0 0 0 0 0 0
39096- 0 0 0 0 0 0 0 0 0 0 0 0
39097- 0 0 0 0 0 0 0 0 0 0 0 0
39098- 0 0 0 0 0 0 0 0 0 0 0 0
39099- 0 0 0 0 0 0 0 0 0 0 0 0
39100- 0 0 0 0 0 0 0 0 0 0 0 0
39101- 0 0 1 0 0 0 0 0 1 0 0 0
39102- 0 0 0 0 0 0 0 0 0 0 0 0
39103- 0 0 0 0 0 0 0 0 0 0 0 0
39104- 0 0 0 0 0 0 0 0 0 0 0 0
39105- 0 0 0 0 0 0 0 0 0 0 0 0
39106- 0 0 0 0 0 0 0 0 0 0 0 0
39107- 10 10 10 30 30 30 66 66 66 58 58 58
39108- 2 2 6 2 2 6 2 2 6 2 2 6
39109- 2 2 6 2 2 6 2 2 6 2 2 6
39110- 2 2 6 2 2 6 2 2 6 26 26 26
39111- 86 86 86 101 101 101 46 46 46 10 10 10
39112- 2 2 6 58 58 58 70 70 70 34 34 34
39113- 10 10 10 0 0 0 0 0 0 0 0 0
39114- 0 0 0 0 0 0 0 0 0 0 0 0
39115- 0 0 0 0 0 0 0 0 0 0 0 0
39116- 0 0 0 0 0 0 0 0 0 0 0 0
39117- 0 0 0 0 0 0 0 0 0 0 0 0
39118- 0 0 0 0 0 0 0 0 0 0 0 0
39119- 0 0 0 0 0 0 0 0 0 0 0 0
39120- 0 0 0 0 0 0 0 0 0 0 0 0
39121- 0 0 1 0 0 1 0 0 1 0 0 0
39122- 0 0 0 0 0 0 0 0 0 0 0 0
39123- 0 0 0 0 0 0 0 0 0 0 0 0
39124- 0 0 0 0 0 0 0 0 0 0 0 0
39125- 0 0 0 0 0 0 0 0 0 0 0 0
39126- 0 0 0 0 0 0 0 0 0 0 0 0
39127- 14 14 14 42 42 42 86 86 86 10 10 10
39128- 2 2 6 2 2 6 2 2 6 2 2 6
39129- 2 2 6 2 2 6 2 2 6 2 2 6
39130- 2 2 6 2 2 6 2 2 6 30 30 30
39131- 94 94 94 94 94 94 58 58 58 26 26 26
39132- 2 2 6 6 6 6 78 78 78 54 54 54
39133- 22 22 22 6 6 6 0 0 0 0 0 0
39134- 0 0 0 0 0 0 0 0 0 0 0 0
39135- 0 0 0 0 0 0 0 0 0 0 0 0
39136- 0 0 0 0 0 0 0 0 0 0 0 0
39137- 0 0 0 0 0 0 0 0 0 0 0 0
39138- 0 0 0 0 0 0 0 0 0 0 0 0
39139- 0 0 0 0 0 0 0 0 0 0 0 0
39140- 0 0 0 0 0 0 0 0 0 0 0 0
39141- 0 0 0 0 0 0 0 0 0 0 0 0
39142- 0 0 0 0 0 0 0 0 0 0 0 0
39143- 0 0 0 0 0 0 0 0 0 0 0 0
39144- 0 0 0 0 0 0 0 0 0 0 0 0
39145- 0 0 0 0 0 0 0 0 0 0 0 0
39146- 0 0 0 0 0 0 0 0 0 6 6 6
39147- 22 22 22 62 62 62 62 62 62 2 2 6
39148- 2 2 6 2 2 6 2 2 6 2 2 6
39149- 2 2 6 2 2 6 2 2 6 2 2 6
39150- 2 2 6 2 2 6 2 2 6 26 26 26
39151- 54 54 54 38 38 38 18 18 18 10 10 10
39152- 2 2 6 2 2 6 34 34 34 82 82 82
39153- 38 38 38 14 14 14 0 0 0 0 0 0
39154- 0 0 0 0 0 0 0 0 0 0 0 0
39155- 0 0 0 0 0 0 0 0 0 0 0 0
39156- 0 0 0 0 0 0 0 0 0 0 0 0
39157- 0 0 0 0 0 0 0 0 0 0 0 0
39158- 0 0 0 0 0 0 0 0 0 0 0 0
39159- 0 0 0 0 0 0 0 0 0 0 0 0
39160- 0 0 0 0 0 0 0 0 0 0 0 0
39161- 0 0 0 0 0 1 0 0 1 0 0 0
39162- 0 0 0 0 0 0 0 0 0 0 0 0
39163- 0 0 0 0 0 0 0 0 0 0 0 0
39164- 0 0 0 0 0 0 0 0 0 0 0 0
39165- 0 0 0 0 0 0 0 0 0 0 0 0
39166- 0 0 0 0 0 0 0 0 0 6 6 6
39167- 30 30 30 78 78 78 30 30 30 2 2 6
39168- 2 2 6 2 2 6 2 2 6 2 2 6
39169- 2 2 6 2 2 6 2 2 6 2 2 6
39170- 2 2 6 2 2 6 2 2 6 10 10 10
39171- 10 10 10 2 2 6 2 2 6 2 2 6
39172- 2 2 6 2 2 6 2 2 6 78 78 78
39173- 50 50 50 18 18 18 6 6 6 0 0 0
39174- 0 0 0 0 0 0 0 0 0 0 0 0
39175- 0 0 0 0 0 0 0 0 0 0 0 0
39176- 0 0 0 0 0 0 0 0 0 0 0 0
39177- 0 0 0 0 0 0 0 0 0 0 0 0
39178- 0 0 0 0 0 0 0 0 0 0 0 0
39179- 0 0 0 0 0 0 0 0 0 0 0 0
39180- 0 0 0 0 0 0 0 0 0 0 0 0
39181- 0 0 1 0 0 0 0 0 0 0 0 0
39182- 0 0 0 0 0 0 0 0 0 0 0 0
39183- 0 0 0 0 0 0 0 0 0 0 0 0
39184- 0 0 0 0 0 0 0 0 0 0 0 0
39185- 0 0 0 0 0 0 0 0 0 0 0 0
39186- 0 0 0 0 0 0 0 0 0 10 10 10
39187- 38 38 38 86 86 86 14 14 14 2 2 6
39188- 2 2 6 2 2 6 2 2 6 2 2 6
39189- 2 2 6 2 2 6 2 2 6 2 2 6
39190- 2 2 6 2 2 6 2 2 6 2 2 6
39191- 2 2 6 2 2 6 2 2 6 2 2 6
39192- 2 2 6 2 2 6 2 2 6 54 54 54
39193- 66 66 66 26 26 26 6 6 6 0 0 0
39194- 0 0 0 0 0 0 0 0 0 0 0 0
39195- 0 0 0 0 0 0 0 0 0 0 0 0
39196- 0 0 0 0 0 0 0 0 0 0 0 0
39197- 0 0 0 0 0 0 0 0 0 0 0 0
39198- 0 0 0 0 0 0 0 0 0 0 0 0
39199- 0 0 0 0 0 0 0 0 0 0 0 0
39200- 0 0 0 0 0 0 0 0 0 0 0 0
39201- 0 0 0 0 0 1 0 0 1 0 0 0
39202- 0 0 0 0 0 0 0 0 0 0 0 0
39203- 0 0 0 0 0 0 0 0 0 0 0 0
39204- 0 0 0 0 0 0 0 0 0 0 0 0
39205- 0 0 0 0 0 0 0 0 0 0 0 0
39206- 0 0 0 0 0 0 0 0 0 14 14 14
39207- 42 42 42 82 82 82 2 2 6 2 2 6
39208- 2 2 6 6 6 6 10 10 10 2 2 6
39209- 2 2 6 2 2 6 2 2 6 2 2 6
39210- 2 2 6 2 2 6 2 2 6 6 6 6
39211- 14 14 14 10 10 10 2 2 6 2 2 6
39212- 2 2 6 2 2 6 2 2 6 18 18 18
39213- 82 82 82 34 34 34 10 10 10 0 0 0
39214- 0 0 0 0 0 0 0 0 0 0 0 0
39215- 0 0 0 0 0 0 0 0 0 0 0 0
39216- 0 0 0 0 0 0 0 0 0 0 0 0
39217- 0 0 0 0 0 0 0 0 0 0 0 0
39218- 0 0 0 0 0 0 0 0 0 0 0 0
39219- 0 0 0 0 0 0 0 0 0 0 0 0
39220- 0 0 0 0 0 0 0 0 0 0 0 0
39221- 0 0 1 0 0 0 0 0 0 0 0 0
39222- 0 0 0 0 0 0 0 0 0 0 0 0
39223- 0 0 0 0 0 0 0 0 0 0 0 0
39224- 0 0 0 0 0 0 0 0 0 0 0 0
39225- 0 0 0 0 0 0 0 0 0 0 0 0
39226- 0 0 0 0 0 0 0 0 0 14 14 14
39227- 46 46 46 86 86 86 2 2 6 2 2 6
39228- 6 6 6 6 6 6 22 22 22 34 34 34
39229- 6 6 6 2 2 6 2 2 6 2 2 6
39230- 2 2 6 2 2 6 18 18 18 34 34 34
39231- 10 10 10 50 50 50 22 22 22 2 2 6
39232- 2 2 6 2 2 6 2 2 6 10 10 10
39233- 86 86 86 42 42 42 14 14 14 0 0 0
39234- 0 0 0 0 0 0 0 0 0 0 0 0
39235- 0 0 0 0 0 0 0 0 0 0 0 0
39236- 0 0 0 0 0 0 0 0 0 0 0 0
39237- 0 0 0 0 0 0 0 0 0 0 0 0
39238- 0 0 0 0 0 0 0 0 0 0 0 0
39239- 0 0 0 0 0 0 0 0 0 0 0 0
39240- 0 0 0 0 0 0 0 0 0 0 0 0
39241- 0 0 1 0 0 1 0 0 1 0 0 0
39242- 0 0 0 0 0 0 0 0 0 0 0 0
39243- 0 0 0 0 0 0 0 0 0 0 0 0
39244- 0 0 0 0 0 0 0 0 0 0 0 0
39245- 0 0 0 0 0 0 0 0 0 0 0 0
39246- 0 0 0 0 0 0 0 0 0 14 14 14
39247- 46 46 46 86 86 86 2 2 6 2 2 6
39248- 38 38 38 116 116 116 94 94 94 22 22 22
39249- 22 22 22 2 2 6 2 2 6 2 2 6
39250- 14 14 14 86 86 86 138 138 138 162 162 162
39251-154 154 154 38 38 38 26 26 26 6 6 6
39252- 2 2 6 2 2 6 2 2 6 2 2 6
39253- 86 86 86 46 46 46 14 14 14 0 0 0
39254- 0 0 0 0 0 0 0 0 0 0 0 0
39255- 0 0 0 0 0 0 0 0 0 0 0 0
39256- 0 0 0 0 0 0 0 0 0 0 0 0
39257- 0 0 0 0 0 0 0 0 0 0 0 0
39258- 0 0 0 0 0 0 0 0 0 0 0 0
39259- 0 0 0 0 0 0 0 0 0 0 0 0
39260- 0 0 0 0 0 0 0 0 0 0 0 0
39261- 0 0 0 0 0 0 0 0 0 0 0 0
39262- 0 0 0 0 0 0 0 0 0 0 0 0
39263- 0 0 0 0 0 0 0 0 0 0 0 0
39264- 0 0 0 0 0 0 0 0 0 0 0 0
39265- 0 0 0 0 0 0 0 0 0 0 0 0
39266- 0 0 0 0 0 0 0 0 0 14 14 14
39267- 46 46 46 86 86 86 2 2 6 14 14 14
39268-134 134 134 198 198 198 195 195 195 116 116 116
39269- 10 10 10 2 2 6 2 2 6 6 6 6
39270-101 98 89 187 187 187 210 210 210 218 218 218
39271-214 214 214 134 134 134 14 14 14 6 6 6
39272- 2 2 6 2 2 6 2 2 6 2 2 6
39273- 86 86 86 50 50 50 18 18 18 6 6 6
39274- 0 0 0 0 0 0 0 0 0 0 0 0
39275- 0 0 0 0 0 0 0 0 0 0 0 0
39276- 0 0 0 0 0 0 0 0 0 0 0 0
39277- 0 0 0 0 0 0 0 0 0 0 0 0
39278- 0 0 0 0 0 0 0 0 0 0 0 0
39279- 0 0 0 0 0 0 0 0 0 0 0 0
39280- 0 0 0 0 0 0 0 0 1 0 0 0
39281- 0 0 1 0 0 1 0 0 1 0 0 0
39282- 0 0 0 0 0 0 0 0 0 0 0 0
39283- 0 0 0 0 0 0 0 0 0 0 0 0
39284- 0 0 0 0 0 0 0 0 0 0 0 0
39285- 0 0 0 0 0 0 0 0 0 0 0 0
39286- 0 0 0 0 0 0 0 0 0 14 14 14
39287- 46 46 46 86 86 86 2 2 6 54 54 54
39288-218 218 218 195 195 195 226 226 226 246 246 246
39289- 58 58 58 2 2 6 2 2 6 30 30 30
39290-210 210 210 253 253 253 174 174 174 123 123 123
39291-221 221 221 234 234 234 74 74 74 2 2 6
39292- 2 2 6 2 2 6 2 2 6 2 2 6
39293- 70 70 70 58 58 58 22 22 22 6 6 6
39294- 0 0 0 0 0 0 0 0 0 0 0 0
39295- 0 0 0 0 0 0 0 0 0 0 0 0
39296- 0 0 0 0 0 0 0 0 0 0 0 0
39297- 0 0 0 0 0 0 0 0 0 0 0 0
39298- 0 0 0 0 0 0 0 0 0 0 0 0
39299- 0 0 0 0 0 0 0 0 0 0 0 0
39300- 0 0 0 0 0 0 0 0 0 0 0 0
39301- 0 0 0 0 0 0 0 0 0 0 0 0
39302- 0 0 0 0 0 0 0 0 0 0 0 0
39303- 0 0 0 0 0 0 0 0 0 0 0 0
39304- 0 0 0 0 0 0 0 0 0 0 0 0
39305- 0 0 0 0 0 0 0 0 0 0 0 0
39306- 0 0 0 0 0 0 0 0 0 14 14 14
39307- 46 46 46 82 82 82 2 2 6 106 106 106
39308-170 170 170 26 26 26 86 86 86 226 226 226
39309-123 123 123 10 10 10 14 14 14 46 46 46
39310-231 231 231 190 190 190 6 6 6 70 70 70
39311- 90 90 90 238 238 238 158 158 158 2 2 6
39312- 2 2 6 2 2 6 2 2 6 2 2 6
39313- 70 70 70 58 58 58 22 22 22 6 6 6
39314- 0 0 0 0 0 0 0 0 0 0 0 0
39315- 0 0 0 0 0 0 0 0 0 0 0 0
39316- 0 0 0 0 0 0 0 0 0 0 0 0
39317- 0 0 0 0 0 0 0 0 0 0 0 0
39318- 0 0 0 0 0 0 0 0 0 0 0 0
39319- 0 0 0 0 0 0 0 0 0 0 0 0
39320- 0 0 0 0 0 0 0 0 1 0 0 0
39321- 0 0 1 0 0 1 0 0 1 0 0 0
39322- 0 0 0 0 0 0 0 0 0 0 0 0
39323- 0 0 0 0 0 0 0 0 0 0 0 0
39324- 0 0 0 0 0 0 0 0 0 0 0 0
39325- 0 0 0 0 0 0 0 0 0 0 0 0
39326- 0 0 0 0 0 0 0 0 0 14 14 14
39327- 42 42 42 86 86 86 6 6 6 116 116 116
39328-106 106 106 6 6 6 70 70 70 149 149 149
39329-128 128 128 18 18 18 38 38 38 54 54 54
39330-221 221 221 106 106 106 2 2 6 14 14 14
39331- 46 46 46 190 190 190 198 198 198 2 2 6
39332- 2 2 6 2 2 6 2 2 6 2 2 6
39333- 74 74 74 62 62 62 22 22 22 6 6 6
39334- 0 0 0 0 0 0 0 0 0 0 0 0
39335- 0 0 0 0 0 0 0 0 0 0 0 0
39336- 0 0 0 0 0 0 0 0 0 0 0 0
39337- 0 0 0 0 0 0 0 0 0 0 0 0
39338- 0 0 0 0 0 0 0 0 0 0 0 0
39339- 0 0 0 0 0 0 0 0 0 0 0 0
39340- 0 0 0 0 0 0 0 0 1 0 0 0
39341- 0 0 1 0 0 0 0 0 1 0 0 0
39342- 0 0 0 0 0 0 0 0 0 0 0 0
39343- 0 0 0 0 0 0 0 0 0 0 0 0
39344- 0 0 0 0 0 0 0 0 0 0 0 0
39345- 0 0 0 0 0 0 0 0 0 0 0 0
39346- 0 0 0 0 0 0 0 0 0 14 14 14
39347- 42 42 42 94 94 94 14 14 14 101 101 101
39348-128 128 128 2 2 6 18 18 18 116 116 116
39349-118 98 46 121 92 8 121 92 8 98 78 10
39350-162 162 162 106 106 106 2 2 6 2 2 6
39351- 2 2 6 195 195 195 195 195 195 6 6 6
39352- 2 2 6 2 2 6 2 2 6 2 2 6
39353- 74 74 74 62 62 62 22 22 22 6 6 6
39354- 0 0 0 0 0 0 0 0 0 0 0 0
39355- 0 0 0 0 0 0 0 0 0 0 0 0
39356- 0 0 0 0 0 0 0 0 0 0 0 0
39357- 0 0 0 0 0 0 0 0 0 0 0 0
39358- 0 0 0 0 0 0 0 0 0 0 0 0
39359- 0 0 0 0 0 0 0 0 0 0 0 0
39360- 0 0 0 0 0 0 0 0 1 0 0 1
39361- 0 0 1 0 0 0 0 0 1 0 0 0
39362- 0 0 0 0 0 0 0 0 0 0 0 0
39363- 0 0 0 0 0 0 0 0 0 0 0 0
39364- 0 0 0 0 0 0 0 0 0 0 0 0
39365- 0 0 0 0 0 0 0 0 0 0 0 0
39366- 0 0 0 0 0 0 0 0 0 10 10 10
39367- 38 38 38 90 90 90 14 14 14 58 58 58
39368-210 210 210 26 26 26 54 38 6 154 114 10
39369-226 170 11 236 186 11 225 175 15 184 144 12
39370-215 174 15 175 146 61 37 26 9 2 2 6
39371- 70 70 70 246 246 246 138 138 138 2 2 6
39372- 2 2 6 2 2 6 2 2 6 2 2 6
39373- 70 70 70 66 66 66 26 26 26 6 6 6
39374- 0 0 0 0 0 0 0 0 0 0 0 0
39375- 0 0 0 0 0 0 0 0 0 0 0 0
39376- 0 0 0 0 0 0 0 0 0 0 0 0
39377- 0 0 0 0 0 0 0 0 0 0 0 0
39378- 0 0 0 0 0 0 0 0 0 0 0 0
39379- 0 0 0 0 0 0 0 0 0 0 0 0
39380- 0 0 0 0 0 0 0 0 0 0 0 0
39381- 0 0 0 0 0 0 0 0 0 0 0 0
39382- 0 0 0 0 0 0 0 0 0 0 0 0
39383- 0 0 0 0 0 0 0 0 0 0 0 0
39384- 0 0 0 0 0 0 0 0 0 0 0 0
39385- 0 0 0 0 0 0 0 0 0 0 0 0
39386- 0 0 0 0 0 0 0 0 0 10 10 10
39387- 38 38 38 86 86 86 14 14 14 10 10 10
39388-195 195 195 188 164 115 192 133 9 225 175 15
39389-239 182 13 234 190 10 232 195 16 232 200 30
39390-245 207 45 241 208 19 232 195 16 184 144 12
39391-218 194 134 211 206 186 42 42 42 2 2 6
39392- 2 2 6 2 2 6 2 2 6 2 2 6
39393- 50 50 50 74 74 74 30 30 30 6 6 6
39394- 0 0 0 0 0 0 0 0 0 0 0 0
39395- 0 0 0 0 0 0 0 0 0 0 0 0
39396- 0 0 0 0 0 0 0 0 0 0 0 0
39397- 0 0 0 0 0 0 0 0 0 0 0 0
39398- 0 0 0 0 0 0 0 0 0 0 0 0
39399- 0 0 0 0 0 0 0 0 0 0 0 0
39400- 0 0 0 0 0 0 0 0 0 0 0 0
39401- 0 0 0 0 0 0 0 0 0 0 0 0
39402- 0 0 0 0 0 0 0 0 0 0 0 0
39403- 0 0 0 0 0 0 0 0 0 0 0 0
39404- 0 0 0 0 0 0 0 0 0 0 0 0
39405- 0 0 0 0 0 0 0 0 0 0 0 0
39406- 0 0 0 0 0 0 0 0 0 10 10 10
39407- 34 34 34 86 86 86 14 14 14 2 2 6
39408-121 87 25 192 133 9 219 162 10 239 182 13
39409-236 186 11 232 195 16 241 208 19 244 214 54
39410-246 218 60 246 218 38 246 215 20 241 208 19
39411-241 208 19 226 184 13 121 87 25 2 2 6
39412- 2 2 6 2 2 6 2 2 6 2 2 6
39413- 50 50 50 82 82 82 34 34 34 10 10 10
39414- 0 0 0 0 0 0 0 0 0 0 0 0
39415- 0 0 0 0 0 0 0 0 0 0 0 0
39416- 0 0 0 0 0 0 0 0 0 0 0 0
39417- 0 0 0 0 0 0 0 0 0 0 0 0
39418- 0 0 0 0 0 0 0 0 0 0 0 0
39419- 0 0 0 0 0 0 0 0 0 0 0 0
39420- 0 0 0 0 0 0 0 0 0 0 0 0
39421- 0 0 0 0 0 0 0 0 0 0 0 0
39422- 0 0 0 0 0 0 0 0 0 0 0 0
39423- 0 0 0 0 0 0 0 0 0 0 0 0
39424- 0 0 0 0 0 0 0 0 0 0 0 0
39425- 0 0 0 0 0 0 0 0 0 0 0 0
39426- 0 0 0 0 0 0 0 0 0 10 10 10
39427- 34 34 34 82 82 82 30 30 30 61 42 6
39428-180 123 7 206 145 10 230 174 11 239 182 13
39429-234 190 10 238 202 15 241 208 19 246 218 74
39430-246 218 38 246 215 20 246 215 20 246 215 20
39431-226 184 13 215 174 15 184 144 12 6 6 6
39432- 2 2 6 2 2 6 2 2 6 2 2 6
39433- 26 26 26 94 94 94 42 42 42 14 14 14
39434- 0 0 0 0 0 0 0 0 0 0 0 0
39435- 0 0 0 0 0 0 0 0 0 0 0 0
39436- 0 0 0 0 0 0 0 0 0 0 0 0
39437- 0 0 0 0 0 0 0 0 0 0 0 0
39438- 0 0 0 0 0 0 0 0 0 0 0 0
39439- 0 0 0 0 0 0 0 0 0 0 0 0
39440- 0 0 0 0 0 0 0 0 0 0 0 0
39441- 0 0 0 0 0 0 0 0 0 0 0 0
39442- 0 0 0 0 0 0 0 0 0 0 0 0
39443- 0 0 0 0 0 0 0 0 0 0 0 0
39444- 0 0 0 0 0 0 0 0 0 0 0 0
39445- 0 0 0 0 0 0 0 0 0 0 0 0
39446- 0 0 0 0 0 0 0 0 0 10 10 10
39447- 30 30 30 78 78 78 50 50 50 104 69 6
39448-192 133 9 216 158 10 236 178 12 236 186 11
39449-232 195 16 241 208 19 244 214 54 245 215 43
39450-246 215 20 246 215 20 241 208 19 198 155 10
39451-200 144 11 216 158 10 156 118 10 2 2 6
39452- 2 2 6 2 2 6 2 2 6 2 2 6
39453- 6 6 6 90 90 90 54 54 54 18 18 18
39454- 6 6 6 0 0 0 0 0 0 0 0 0
39455- 0 0 0 0 0 0 0 0 0 0 0 0
39456- 0 0 0 0 0 0 0 0 0 0 0 0
39457- 0 0 0 0 0 0 0 0 0 0 0 0
39458- 0 0 0 0 0 0 0 0 0 0 0 0
39459- 0 0 0 0 0 0 0 0 0 0 0 0
39460- 0 0 0 0 0 0 0 0 0 0 0 0
39461- 0 0 0 0 0 0 0 0 0 0 0 0
39462- 0 0 0 0 0 0 0 0 0 0 0 0
39463- 0 0 0 0 0 0 0 0 0 0 0 0
39464- 0 0 0 0 0 0 0 0 0 0 0 0
39465- 0 0 0 0 0 0 0 0 0 0 0 0
39466- 0 0 0 0 0 0 0 0 0 10 10 10
39467- 30 30 30 78 78 78 46 46 46 22 22 22
39468-137 92 6 210 162 10 239 182 13 238 190 10
39469-238 202 15 241 208 19 246 215 20 246 215 20
39470-241 208 19 203 166 17 185 133 11 210 150 10
39471-216 158 10 210 150 10 102 78 10 2 2 6
39472- 6 6 6 54 54 54 14 14 14 2 2 6
39473- 2 2 6 62 62 62 74 74 74 30 30 30
39474- 10 10 10 0 0 0 0 0 0 0 0 0
39475- 0 0 0 0 0 0 0 0 0 0 0 0
39476- 0 0 0 0 0 0 0 0 0 0 0 0
39477- 0 0 0 0 0 0 0 0 0 0 0 0
39478- 0 0 0 0 0 0 0 0 0 0 0 0
39479- 0 0 0 0 0 0 0 0 0 0 0 0
39480- 0 0 0 0 0 0 0 0 0 0 0 0
39481- 0 0 0 0 0 0 0 0 0 0 0 0
39482- 0 0 0 0 0 0 0 0 0 0 0 0
39483- 0 0 0 0 0 0 0 0 0 0 0 0
39484- 0 0 0 0 0 0 0 0 0 0 0 0
39485- 0 0 0 0 0 0 0 0 0 0 0 0
39486- 0 0 0 0 0 0 0 0 0 10 10 10
39487- 34 34 34 78 78 78 50 50 50 6 6 6
39488- 94 70 30 139 102 15 190 146 13 226 184 13
39489-232 200 30 232 195 16 215 174 15 190 146 13
39490-168 122 10 192 133 9 210 150 10 213 154 11
39491-202 150 34 182 157 106 101 98 89 2 2 6
39492- 2 2 6 78 78 78 116 116 116 58 58 58
39493- 2 2 6 22 22 22 90 90 90 46 46 46
39494- 18 18 18 6 6 6 0 0 0 0 0 0
39495- 0 0 0 0 0 0 0 0 0 0 0 0
39496- 0 0 0 0 0 0 0 0 0 0 0 0
39497- 0 0 0 0 0 0 0 0 0 0 0 0
39498- 0 0 0 0 0 0 0 0 0 0 0 0
39499- 0 0 0 0 0 0 0 0 0 0 0 0
39500- 0 0 0 0 0 0 0 0 0 0 0 0
39501- 0 0 0 0 0 0 0 0 0 0 0 0
39502- 0 0 0 0 0 0 0 0 0 0 0 0
39503- 0 0 0 0 0 0 0 0 0 0 0 0
39504- 0 0 0 0 0 0 0 0 0 0 0 0
39505- 0 0 0 0 0 0 0 0 0 0 0 0
39506- 0 0 0 0 0 0 0 0 0 10 10 10
39507- 38 38 38 86 86 86 50 50 50 6 6 6
39508-128 128 128 174 154 114 156 107 11 168 122 10
39509-198 155 10 184 144 12 197 138 11 200 144 11
39510-206 145 10 206 145 10 197 138 11 188 164 115
39511-195 195 195 198 198 198 174 174 174 14 14 14
39512- 2 2 6 22 22 22 116 116 116 116 116 116
39513- 22 22 22 2 2 6 74 74 74 70 70 70
39514- 30 30 30 10 10 10 0 0 0 0 0 0
39515- 0 0 0 0 0 0 0 0 0 0 0 0
39516- 0 0 0 0 0 0 0 0 0 0 0 0
39517- 0 0 0 0 0 0 0 0 0 0 0 0
39518- 0 0 0 0 0 0 0 0 0 0 0 0
39519- 0 0 0 0 0 0 0 0 0 0 0 0
39520- 0 0 0 0 0 0 0 0 0 0 0 0
39521- 0 0 0 0 0 0 0 0 0 0 0 0
39522- 0 0 0 0 0 0 0 0 0 0 0 0
39523- 0 0 0 0 0 0 0 0 0 0 0 0
39524- 0 0 0 0 0 0 0 0 0 0 0 0
39525- 0 0 0 0 0 0 0 0 0 0 0 0
39526- 0 0 0 0 0 0 6 6 6 18 18 18
39527- 50 50 50 101 101 101 26 26 26 10 10 10
39528-138 138 138 190 190 190 174 154 114 156 107 11
39529-197 138 11 200 144 11 197 138 11 192 133 9
39530-180 123 7 190 142 34 190 178 144 187 187 187
39531-202 202 202 221 221 221 214 214 214 66 66 66
39532- 2 2 6 2 2 6 50 50 50 62 62 62
39533- 6 6 6 2 2 6 10 10 10 90 90 90
39534- 50 50 50 18 18 18 6 6 6 0 0 0
39535- 0 0 0 0 0 0 0 0 0 0 0 0
39536- 0 0 0 0 0 0 0 0 0 0 0 0
39537- 0 0 0 0 0 0 0 0 0 0 0 0
39538- 0 0 0 0 0 0 0 0 0 0 0 0
39539- 0 0 0 0 0 0 0 0 0 0 0 0
39540- 0 0 0 0 0 0 0 0 0 0 0 0
39541- 0 0 0 0 0 0 0 0 0 0 0 0
39542- 0 0 0 0 0 0 0 0 0 0 0 0
39543- 0 0 0 0 0 0 0 0 0 0 0 0
39544- 0 0 0 0 0 0 0 0 0 0 0 0
39545- 0 0 0 0 0 0 0 0 0 0 0 0
39546- 0 0 0 0 0 0 10 10 10 34 34 34
39547- 74 74 74 74 74 74 2 2 6 6 6 6
39548-144 144 144 198 198 198 190 190 190 178 166 146
39549-154 121 60 156 107 11 156 107 11 168 124 44
39550-174 154 114 187 187 187 190 190 190 210 210 210
39551-246 246 246 253 253 253 253 253 253 182 182 182
39552- 6 6 6 2 2 6 2 2 6 2 2 6
39553- 2 2 6 2 2 6 2 2 6 62 62 62
39554- 74 74 74 34 34 34 14 14 14 0 0 0
39555- 0 0 0 0 0 0 0 0 0 0 0 0
39556- 0 0 0 0 0 0 0 0 0 0 0 0
39557- 0 0 0 0 0 0 0 0 0 0 0 0
39558- 0 0 0 0 0 0 0 0 0 0 0 0
39559- 0 0 0 0 0 0 0 0 0 0 0 0
39560- 0 0 0 0 0 0 0 0 0 0 0 0
39561- 0 0 0 0 0 0 0 0 0 0 0 0
39562- 0 0 0 0 0 0 0 0 0 0 0 0
39563- 0 0 0 0 0 0 0 0 0 0 0 0
39564- 0 0 0 0 0 0 0 0 0 0 0 0
39565- 0 0 0 0 0 0 0 0 0 0 0 0
39566- 0 0 0 10 10 10 22 22 22 54 54 54
39567- 94 94 94 18 18 18 2 2 6 46 46 46
39568-234 234 234 221 221 221 190 190 190 190 190 190
39569-190 190 190 187 187 187 187 187 187 190 190 190
39570-190 190 190 195 195 195 214 214 214 242 242 242
39571-253 253 253 253 253 253 253 253 253 253 253 253
39572- 82 82 82 2 2 6 2 2 6 2 2 6
39573- 2 2 6 2 2 6 2 2 6 14 14 14
39574- 86 86 86 54 54 54 22 22 22 6 6 6
39575- 0 0 0 0 0 0 0 0 0 0 0 0
39576- 0 0 0 0 0 0 0 0 0 0 0 0
39577- 0 0 0 0 0 0 0 0 0 0 0 0
39578- 0 0 0 0 0 0 0 0 0 0 0 0
39579- 0 0 0 0 0 0 0 0 0 0 0 0
39580- 0 0 0 0 0 0 0 0 0 0 0 0
39581- 0 0 0 0 0 0 0 0 0 0 0 0
39582- 0 0 0 0 0 0 0 0 0 0 0 0
39583- 0 0 0 0 0 0 0 0 0 0 0 0
39584- 0 0 0 0 0 0 0 0 0 0 0 0
39585- 0 0 0 0 0 0 0 0 0 0 0 0
39586- 6 6 6 18 18 18 46 46 46 90 90 90
39587- 46 46 46 18 18 18 6 6 6 182 182 182
39588-253 253 253 246 246 246 206 206 206 190 190 190
39589-190 190 190 190 190 190 190 190 190 190 190 190
39590-206 206 206 231 231 231 250 250 250 253 253 253
39591-253 253 253 253 253 253 253 253 253 253 253 253
39592-202 202 202 14 14 14 2 2 6 2 2 6
39593- 2 2 6 2 2 6 2 2 6 2 2 6
39594- 42 42 42 86 86 86 42 42 42 18 18 18
39595- 6 6 6 0 0 0 0 0 0 0 0 0
39596- 0 0 0 0 0 0 0 0 0 0 0 0
39597- 0 0 0 0 0 0 0 0 0 0 0 0
39598- 0 0 0 0 0 0 0 0 0 0 0 0
39599- 0 0 0 0 0 0 0 0 0 0 0 0
39600- 0 0 0 0 0 0 0 0 0 0 0 0
39601- 0 0 0 0 0 0 0 0 0 0 0 0
39602- 0 0 0 0 0 0 0 0 0 0 0 0
39603- 0 0 0 0 0 0 0 0 0 0 0 0
39604- 0 0 0 0 0 0 0 0 0 0 0 0
39605- 0 0 0 0 0 0 0 0 0 6 6 6
39606- 14 14 14 38 38 38 74 74 74 66 66 66
39607- 2 2 6 6 6 6 90 90 90 250 250 250
39608-253 253 253 253 253 253 238 238 238 198 198 198
39609-190 190 190 190 190 190 195 195 195 221 221 221
39610-246 246 246 253 253 253 253 253 253 253 253 253
39611-253 253 253 253 253 253 253 253 253 253 253 253
39612-253 253 253 82 82 82 2 2 6 2 2 6
39613- 2 2 6 2 2 6 2 2 6 2 2 6
39614- 2 2 6 78 78 78 70 70 70 34 34 34
39615- 14 14 14 6 6 6 0 0 0 0 0 0
39616- 0 0 0 0 0 0 0 0 0 0 0 0
39617- 0 0 0 0 0 0 0 0 0 0 0 0
39618- 0 0 0 0 0 0 0 0 0 0 0 0
39619- 0 0 0 0 0 0 0 0 0 0 0 0
39620- 0 0 0 0 0 0 0 0 0 0 0 0
39621- 0 0 0 0 0 0 0 0 0 0 0 0
39622- 0 0 0 0 0 0 0 0 0 0 0 0
39623- 0 0 0 0 0 0 0 0 0 0 0 0
39624- 0 0 0 0 0 0 0 0 0 0 0 0
39625- 0 0 0 0 0 0 0 0 0 14 14 14
39626- 34 34 34 66 66 66 78 78 78 6 6 6
39627- 2 2 6 18 18 18 218 218 218 253 253 253
39628-253 253 253 253 253 253 253 253 253 246 246 246
39629-226 226 226 231 231 231 246 246 246 253 253 253
39630-253 253 253 253 253 253 253 253 253 253 253 253
39631-253 253 253 253 253 253 253 253 253 253 253 253
39632-253 253 253 178 178 178 2 2 6 2 2 6
39633- 2 2 6 2 2 6 2 2 6 2 2 6
39634- 2 2 6 18 18 18 90 90 90 62 62 62
39635- 30 30 30 10 10 10 0 0 0 0 0 0
39636- 0 0 0 0 0 0 0 0 0 0 0 0
39637- 0 0 0 0 0 0 0 0 0 0 0 0
39638- 0 0 0 0 0 0 0 0 0 0 0 0
39639- 0 0 0 0 0 0 0 0 0 0 0 0
39640- 0 0 0 0 0 0 0 0 0 0 0 0
39641- 0 0 0 0 0 0 0 0 0 0 0 0
39642- 0 0 0 0 0 0 0 0 0 0 0 0
39643- 0 0 0 0 0 0 0 0 0 0 0 0
39644- 0 0 0 0 0 0 0 0 0 0 0 0
39645- 0 0 0 0 0 0 10 10 10 26 26 26
39646- 58 58 58 90 90 90 18 18 18 2 2 6
39647- 2 2 6 110 110 110 253 253 253 253 253 253
39648-253 253 253 253 253 253 253 253 253 253 253 253
39649-250 250 250 253 253 253 253 253 253 253 253 253
39650-253 253 253 253 253 253 253 253 253 253 253 253
39651-253 253 253 253 253 253 253 253 253 253 253 253
39652-253 253 253 231 231 231 18 18 18 2 2 6
39653- 2 2 6 2 2 6 2 2 6 2 2 6
39654- 2 2 6 2 2 6 18 18 18 94 94 94
39655- 54 54 54 26 26 26 10 10 10 0 0 0
39656- 0 0 0 0 0 0 0 0 0 0 0 0
39657- 0 0 0 0 0 0 0 0 0 0 0 0
39658- 0 0 0 0 0 0 0 0 0 0 0 0
39659- 0 0 0 0 0 0 0 0 0 0 0 0
39660- 0 0 0 0 0 0 0 0 0 0 0 0
39661- 0 0 0 0 0 0 0 0 0 0 0 0
39662- 0 0 0 0 0 0 0 0 0 0 0 0
39663- 0 0 0 0 0 0 0 0 0 0 0 0
39664- 0 0 0 0 0 0 0 0 0 0 0 0
39665- 0 0 0 6 6 6 22 22 22 50 50 50
39666- 90 90 90 26 26 26 2 2 6 2 2 6
39667- 14 14 14 195 195 195 250 250 250 253 253 253
39668-253 253 253 253 253 253 253 253 253 253 253 253
39669-253 253 253 253 253 253 253 253 253 253 253 253
39670-253 253 253 253 253 253 253 253 253 253 253 253
39671-253 253 253 253 253 253 253 253 253 253 253 253
39672-250 250 250 242 242 242 54 54 54 2 2 6
39673- 2 2 6 2 2 6 2 2 6 2 2 6
39674- 2 2 6 2 2 6 2 2 6 38 38 38
39675- 86 86 86 50 50 50 22 22 22 6 6 6
39676- 0 0 0 0 0 0 0 0 0 0 0 0
39677- 0 0 0 0 0 0 0 0 0 0 0 0
39678- 0 0 0 0 0 0 0 0 0 0 0 0
39679- 0 0 0 0 0 0 0 0 0 0 0 0
39680- 0 0 0 0 0 0 0 0 0 0 0 0
39681- 0 0 0 0 0 0 0 0 0 0 0 0
39682- 0 0 0 0 0 0 0 0 0 0 0 0
39683- 0 0 0 0 0 0 0 0 0 0 0 0
39684- 0 0 0 0 0 0 0 0 0 0 0 0
39685- 6 6 6 14 14 14 38 38 38 82 82 82
39686- 34 34 34 2 2 6 2 2 6 2 2 6
39687- 42 42 42 195 195 195 246 246 246 253 253 253
39688-253 253 253 253 253 253 253 253 253 250 250 250
39689-242 242 242 242 242 242 250 250 250 253 253 253
39690-253 253 253 253 253 253 253 253 253 253 253 253
39691-253 253 253 250 250 250 246 246 246 238 238 238
39692-226 226 226 231 231 231 101 101 101 6 6 6
39693- 2 2 6 2 2 6 2 2 6 2 2 6
39694- 2 2 6 2 2 6 2 2 6 2 2 6
39695- 38 38 38 82 82 82 42 42 42 14 14 14
39696- 6 6 6 0 0 0 0 0 0 0 0 0
39697- 0 0 0 0 0 0 0 0 0 0 0 0
39698- 0 0 0 0 0 0 0 0 0 0 0 0
39699- 0 0 0 0 0 0 0 0 0 0 0 0
39700- 0 0 0 0 0 0 0 0 0 0 0 0
39701- 0 0 0 0 0 0 0 0 0 0 0 0
39702- 0 0 0 0 0 0 0 0 0 0 0 0
39703- 0 0 0 0 0 0 0 0 0 0 0 0
39704- 0 0 0 0 0 0 0 0 0 0 0 0
39705- 10 10 10 26 26 26 62 62 62 66 66 66
39706- 2 2 6 2 2 6 2 2 6 6 6 6
39707- 70 70 70 170 170 170 206 206 206 234 234 234
39708-246 246 246 250 250 250 250 250 250 238 238 238
39709-226 226 226 231 231 231 238 238 238 250 250 250
39710-250 250 250 250 250 250 246 246 246 231 231 231
39711-214 214 214 206 206 206 202 202 202 202 202 202
39712-198 198 198 202 202 202 182 182 182 18 18 18
39713- 2 2 6 2 2 6 2 2 6 2 2 6
39714- 2 2 6 2 2 6 2 2 6 2 2 6
39715- 2 2 6 62 62 62 66 66 66 30 30 30
39716- 10 10 10 0 0 0 0 0 0 0 0 0
39717- 0 0 0 0 0 0 0 0 0 0 0 0
39718- 0 0 0 0 0 0 0 0 0 0 0 0
39719- 0 0 0 0 0 0 0 0 0 0 0 0
39720- 0 0 0 0 0 0 0 0 0 0 0 0
39721- 0 0 0 0 0 0 0 0 0 0 0 0
39722- 0 0 0 0 0 0 0 0 0 0 0 0
39723- 0 0 0 0 0 0 0 0 0 0 0 0
39724- 0 0 0 0 0 0 0 0 0 0 0 0
39725- 14 14 14 42 42 42 82 82 82 18 18 18
39726- 2 2 6 2 2 6 2 2 6 10 10 10
39727- 94 94 94 182 182 182 218 218 218 242 242 242
39728-250 250 250 253 253 253 253 253 253 250 250 250
39729-234 234 234 253 253 253 253 253 253 253 253 253
39730-253 253 253 253 253 253 253 253 253 246 246 246
39731-238 238 238 226 226 226 210 210 210 202 202 202
39732-195 195 195 195 195 195 210 210 210 158 158 158
39733- 6 6 6 14 14 14 50 50 50 14 14 14
39734- 2 2 6 2 2 6 2 2 6 2 2 6
39735- 2 2 6 6 6 6 86 86 86 46 46 46
39736- 18 18 18 6 6 6 0 0 0 0 0 0
39737- 0 0 0 0 0 0 0 0 0 0 0 0
39738- 0 0 0 0 0 0 0 0 0 0 0 0
39739- 0 0 0 0 0 0 0 0 0 0 0 0
39740- 0 0 0 0 0 0 0 0 0 0 0 0
39741- 0 0 0 0 0 0 0 0 0 0 0 0
39742- 0 0 0 0 0 0 0 0 0 0 0 0
39743- 0 0 0 0 0 0 0 0 0 0 0 0
39744- 0 0 0 0 0 0 0 0 0 6 6 6
39745- 22 22 22 54 54 54 70 70 70 2 2 6
39746- 2 2 6 10 10 10 2 2 6 22 22 22
39747-166 166 166 231 231 231 250 250 250 253 253 253
39748-253 253 253 253 253 253 253 253 253 250 250 250
39749-242 242 242 253 253 253 253 253 253 253 253 253
39750-253 253 253 253 253 253 253 253 253 253 253 253
39751-253 253 253 253 253 253 253 253 253 246 246 246
39752-231 231 231 206 206 206 198 198 198 226 226 226
39753- 94 94 94 2 2 6 6 6 6 38 38 38
39754- 30 30 30 2 2 6 2 2 6 2 2 6
39755- 2 2 6 2 2 6 62 62 62 66 66 66
39756- 26 26 26 10 10 10 0 0 0 0 0 0
39757- 0 0 0 0 0 0 0 0 0 0 0 0
39758- 0 0 0 0 0 0 0 0 0 0 0 0
39759- 0 0 0 0 0 0 0 0 0 0 0 0
39760- 0 0 0 0 0 0 0 0 0 0 0 0
39761- 0 0 0 0 0 0 0 0 0 0 0 0
39762- 0 0 0 0 0 0 0 0 0 0 0 0
39763- 0 0 0 0 0 0 0 0 0 0 0 0
39764- 0 0 0 0 0 0 0 0 0 10 10 10
39765- 30 30 30 74 74 74 50 50 50 2 2 6
39766- 26 26 26 26 26 26 2 2 6 106 106 106
39767-238 238 238 253 253 253 253 253 253 253 253 253
39768-253 253 253 253 253 253 253 253 253 253 253 253
39769-253 253 253 253 253 253 253 253 253 253 253 253
39770-253 253 253 253 253 253 253 253 253 253 253 253
39771-253 253 253 253 253 253 253 253 253 253 253 253
39772-253 253 253 246 246 246 218 218 218 202 202 202
39773-210 210 210 14 14 14 2 2 6 2 2 6
39774- 30 30 30 22 22 22 2 2 6 2 2 6
39775- 2 2 6 2 2 6 18 18 18 86 86 86
39776- 42 42 42 14 14 14 0 0 0 0 0 0
39777- 0 0 0 0 0 0 0 0 0 0 0 0
39778- 0 0 0 0 0 0 0 0 0 0 0 0
39779- 0 0 0 0 0 0 0 0 0 0 0 0
39780- 0 0 0 0 0 0 0 0 0 0 0 0
39781- 0 0 0 0 0 0 0 0 0 0 0 0
39782- 0 0 0 0 0 0 0 0 0 0 0 0
39783- 0 0 0 0 0 0 0 0 0 0 0 0
39784- 0 0 0 0 0 0 0 0 0 14 14 14
39785- 42 42 42 90 90 90 22 22 22 2 2 6
39786- 42 42 42 2 2 6 18 18 18 218 218 218
39787-253 253 253 253 253 253 253 253 253 253 253 253
39788-253 253 253 253 253 253 253 253 253 253 253 253
39789-253 253 253 253 253 253 253 253 253 253 253 253
39790-253 253 253 253 253 253 253 253 253 253 253 253
39791-253 253 253 253 253 253 253 253 253 253 253 253
39792-253 253 253 253 253 253 250 250 250 221 221 221
39793-218 218 218 101 101 101 2 2 6 14 14 14
39794- 18 18 18 38 38 38 10 10 10 2 2 6
39795- 2 2 6 2 2 6 2 2 6 78 78 78
39796- 58 58 58 22 22 22 6 6 6 0 0 0
39797- 0 0 0 0 0 0 0 0 0 0 0 0
39798- 0 0 0 0 0 0 0 0 0 0 0 0
39799- 0 0 0 0 0 0 0 0 0 0 0 0
39800- 0 0 0 0 0 0 0 0 0 0 0 0
39801- 0 0 0 0 0 0 0 0 0 0 0 0
39802- 0 0 0 0 0 0 0 0 0 0 0 0
39803- 0 0 0 0 0 0 0 0 0 0 0 0
39804- 0 0 0 0 0 0 6 6 6 18 18 18
39805- 54 54 54 82 82 82 2 2 6 26 26 26
39806- 22 22 22 2 2 6 123 123 123 253 253 253
39807-253 253 253 253 253 253 253 253 253 253 253 253
39808-253 253 253 253 253 253 253 253 253 253 253 253
39809-253 253 253 253 253 253 253 253 253 253 253 253
39810-253 253 253 253 253 253 253 253 253 253 253 253
39811-253 253 253 253 253 253 253 253 253 253 253 253
39812-253 253 253 253 253 253 253 253 253 250 250 250
39813-238 238 238 198 198 198 6 6 6 38 38 38
39814- 58 58 58 26 26 26 38 38 38 2 2 6
39815- 2 2 6 2 2 6 2 2 6 46 46 46
39816- 78 78 78 30 30 30 10 10 10 0 0 0
39817- 0 0 0 0 0 0 0 0 0 0 0 0
39818- 0 0 0 0 0 0 0 0 0 0 0 0
39819- 0 0 0 0 0 0 0 0 0 0 0 0
39820- 0 0 0 0 0 0 0 0 0 0 0 0
39821- 0 0 0 0 0 0 0 0 0 0 0 0
39822- 0 0 0 0 0 0 0 0 0 0 0 0
39823- 0 0 0 0 0 0 0 0 0 0 0 0
39824- 0 0 0 0 0 0 10 10 10 30 30 30
39825- 74 74 74 58 58 58 2 2 6 42 42 42
39826- 2 2 6 22 22 22 231 231 231 253 253 253
39827-253 253 253 253 253 253 253 253 253 253 253 253
39828-253 253 253 253 253 253 253 253 253 250 250 250
39829-253 253 253 253 253 253 253 253 253 253 253 253
39830-253 253 253 253 253 253 253 253 253 253 253 253
39831-253 253 253 253 253 253 253 253 253 253 253 253
39832-253 253 253 253 253 253 253 253 253 253 253 253
39833-253 253 253 246 246 246 46 46 46 38 38 38
39834- 42 42 42 14 14 14 38 38 38 14 14 14
39835- 2 2 6 2 2 6 2 2 6 6 6 6
39836- 86 86 86 46 46 46 14 14 14 0 0 0
39837- 0 0 0 0 0 0 0 0 0 0 0 0
39838- 0 0 0 0 0 0 0 0 0 0 0 0
39839- 0 0 0 0 0 0 0 0 0 0 0 0
39840- 0 0 0 0 0 0 0 0 0 0 0 0
39841- 0 0 0 0 0 0 0 0 0 0 0 0
39842- 0 0 0 0 0 0 0 0 0 0 0 0
39843- 0 0 0 0 0 0 0 0 0 0 0 0
39844- 0 0 0 6 6 6 14 14 14 42 42 42
39845- 90 90 90 18 18 18 18 18 18 26 26 26
39846- 2 2 6 116 116 116 253 253 253 253 253 253
39847-253 253 253 253 253 253 253 253 253 253 253 253
39848-253 253 253 253 253 253 250 250 250 238 238 238
39849-253 253 253 253 253 253 253 253 253 253 253 253
39850-253 253 253 253 253 253 253 253 253 253 253 253
39851-253 253 253 253 253 253 253 253 253 253 253 253
39852-253 253 253 253 253 253 253 253 253 253 253 253
39853-253 253 253 253 253 253 94 94 94 6 6 6
39854- 2 2 6 2 2 6 10 10 10 34 34 34
39855- 2 2 6 2 2 6 2 2 6 2 2 6
39856- 74 74 74 58 58 58 22 22 22 6 6 6
39857- 0 0 0 0 0 0 0 0 0 0 0 0
39858- 0 0 0 0 0 0 0 0 0 0 0 0
39859- 0 0 0 0 0 0 0 0 0 0 0 0
39860- 0 0 0 0 0 0 0 0 0 0 0 0
39861- 0 0 0 0 0 0 0 0 0 0 0 0
39862- 0 0 0 0 0 0 0 0 0 0 0 0
39863- 0 0 0 0 0 0 0 0 0 0 0 0
39864- 0 0 0 10 10 10 26 26 26 66 66 66
39865- 82 82 82 2 2 6 38 38 38 6 6 6
39866- 14 14 14 210 210 210 253 253 253 253 253 253
39867-253 253 253 253 253 253 253 253 253 253 253 253
39868-253 253 253 253 253 253 246 246 246 242 242 242
39869-253 253 253 253 253 253 253 253 253 253 253 253
39870-253 253 253 253 253 253 253 253 253 253 253 253
39871-253 253 253 253 253 253 253 253 253 253 253 253
39872-253 253 253 253 253 253 253 253 253 253 253 253
39873-253 253 253 253 253 253 144 144 144 2 2 6
39874- 2 2 6 2 2 6 2 2 6 46 46 46
39875- 2 2 6 2 2 6 2 2 6 2 2 6
39876- 42 42 42 74 74 74 30 30 30 10 10 10
39877- 0 0 0 0 0 0 0 0 0 0 0 0
39878- 0 0 0 0 0 0 0 0 0 0 0 0
39879- 0 0 0 0 0 0 0 0 0 0 0 0
39880- 0 0 0 0 0 0 0 0 0 0 0 0
39881- 0 0 0 0 0 0 0 0 0 0 0 0
39882- 0 0 0 0 0 0 0 0 0 0 0 0
39883- 0 0 0 0 0 0 0 0 0 0 0 0
39884- 6 6 6 14 14 14 42 42 42 90 90 90
39885- 26 26 26 6 6 6 42 42 42 2 2 6
39886- 74 74 74 250 250 250 253 253 253 253 253 253
39887-253 253 253 253 253 253 253 253 253 253 253 253
39888-253 253 253 253 253 253 242 242 242 242 242 242
39889-253 253 253 253 253 253 253 253 253 253 253 253
39890-253 253 253 253 253 253 253 253 253 253 253 253
39891-253 253 253 253 253 253 253 253 253 253 253 253
39892-253 253 253 253 253 253 253 253 253 253 253 253
39893-253 253 253 253 253 253 182 182 182 2 2 6
39894- 2 2 6 2 2 6 2 2 6 46 46 46
39895- 2 2 6 2 2 6 2 2 6 2 2 6
39896- 10 10 10 86 86 86 38 38 38 10 10 10
39897- 0 0 0 0 0 0 0 0 0 0 0 0
39898- 0 0 0 0 0 0 0 0 0 0 0 0
39899- 0 0 0 0 0 0 0 0 0 0 0 0
39900- 0 0 0 0 0 0 0 0 0 0 0 0
39901- 0 0 0 0 0 0 0 0 0 0 0 0
39902- 0 0 0 0 0 0 0 0 0 0 0 0
39903- 0 0 0 0 0 0 0 0 0 0 0 0
39904- 10 10 10 26 26 26 66 66 66 82 82 82
39905- 2 2 6 22 22 22 18 18 18 2 2 6
39906-149 149 149 253 253 253 253 253 253 253 253 253
39907-253 253 253 253 253 253 253 253 253 253 253 253
39908-253 253 253 253 253 253 234 234 234 242 242 242
39909-253 253 253 253 253 253 253 253 253 253 253 253
39910-253 253 253 253 253 253 253 253 253 253 253 253
39911-253 253 253 253 253 253 253 253 253 253 253 253
39912-253 253 253 253 253 253 253 253 253 253 253 253
39913-253 253 253 253 253 253 206 206 206 2 2 6
39914- 2 2 6 2 2 6 2 2 6 38 38 38
39915- 2 2 6 2 2 6 2 2 6 2 2 6
39916- 6 6 6 86 86 86 46 46 46 14 14 14
39917- 0 0 0 0 0 0 0 0 0 0 0 0
39918- 0 0 0 0 0 0 0 0 0 0 0 0
39919- 0 0 0 0 0 0 0 0 0 0 0 0
39920- 0 0 0 0 0 0 0 0 0 0 0 0
39921- 0 0 0 0 0 0 0 0 0 0 0 0
39922- 0 0 0 0 0 0 0 0 0 0 0 0
39923- 0 0 0 0 0 0 0 0 0 6 6 6
39924- 18 18 18 46 46 46 86 86 86 18 18 18
39925- 2 2 6 34 34 34 10 10 10 6 6 6
39926-210 210 210 253 253 253 253 253 253 253 253 253
39927-253 253 253 253 253 253 253 253 253 253 253 253
39928-253 253 253 253 253 253 234 234 234 242 242 242
39929-253 253 253 253 253 253 253 253 253 253 253 253
39930-253 253 253 253 253 253 253 253 253 253 253 253
39931-253 253 253 253 253 253 253 253 253 253 253 253
39932-253 253 253 253 253 253 253 253 253 253 253 253
39933-253 253 253 253 253 253 221 221 221 6 6 6
39934- 2 2 6 2 2 6 6 6 6 30 30 30
39935- 2 2 6 2 2 6 2 2 6 2 2 6
39936- 2 2 6 82 82 82 54 54 54 18 18 18
39937- 6 6 6 0 0 0 0 0 0 0 0 0
39938- 0 0 0 0 0 0 0 0 0 0 0 0
39939- 0 0 0 0 0 0 0 0 0 0 0 0
39940- 0 0 0 0 0 0 0 0 0 0 0 0
39941- 0 0 0 0 0 0 0 0 0 0 0 0
39942- 0 0 0 0 0 0 0 0 0 0 0 0
39943- 0 0 0 0 0 0 0 0 0 10 10 10
39944- 26 26 26 66 66 66 62 62 62 2 2 6
39945- 2 2 6 38 38 38 10 10 10 26 26 26
39946-238 238 238 253 253 253 253 253 253 253 253 253
39947-253 253 253 253 253 253 253 253 253 253 253 253
39948-253 253 253 253 253 253 231 231 231 238 238 238
39949-253 253 253 253 253 253 253 253 253 253 253 253
39950-253 253 253 253 253 253 253 253 253 253 253 253
39951-253 253 253 253 253 253 253 253 253 253 253 253
39952-253 253 253 253 253 253 253 253 253 253 253 253
39953-253 253 253 253 253 253 231 231 231 6 6 6
39954- 2 2 6 2 2 6 10 10 10 30 30 30
39955- 2 2 6 2 2 6 2 2 6 2 2 6
39956- 2 2 6 66 66 66 58 58 58 22 22 22
39957- 6 6 6 0 0 0 0 0 0 0 0 0
39958- 0 0 0 0 0 0 0 0 0 0 0 0
39959- 0 0 0 0 0 0 0 0 0 0 0 0
39960- 0 0 0 0 0 0 0 0 0 0 0 0
39961- 0 0 0 0 0 0 0 0 0 0 0 0
39962- 0 0 0 0 0 0 0 0 0 0 0 0
39963- 0 0 0 0 0 0 0 0 0 10 10 10
39964- 38 38 38 78 78 78 6 6 6 2 2 6
39965- 2 2 6 46 46 46 14 14 14 42 42 42
39966-246 246 246 253 253 253 253 253 253 253 253 253
39967-253 253 253 253 253 253 253 253 253 253 253 253
39968-253 253 253 253 253 253 231 231 231 242 242 242
39969-253 253 253 253 253 253 253 253 253 253 253 253
39970-253 253 253 253 253 253 253 253 253 253 253 253
39971-253 253 253 253 253 253 253 253 253 253 253 253
39972-253 253 253 253 253 253 253 253 253 253 253 253
39973-253 253 253 253 253 253 234 234 234 10 10 10
39974- 2 2 6 2 2 6 22 22 22 14 14 14
39975- 2 2 6 2 2 6 2 2 6 2 2 6
39976- 2 2 6 66 66 66 62 62 62 22 22 22
39977- 6 6 6 0 0 0 0 0 0 0 0 0
39978- 0 0 0 0 0 0 0 0 0 0 0 0
39979- 0 0 0 0 0 0 0 0 0 0 0 0
39980- 0 0 0 0 0 0 0 0 0 0 0 0
39981- 0 0 0 0 0 0 0 0 0 0 0 0
39982- 0 0 0 0 0 0 0 0 0 0 0 0
39983- 0 0 0 0 0 0 6 6 6 18 18 18
39984- 50 50 50 74 74 74 2 2 6 2 2 6
39985- 14 14 14 70 70 70 34 34 34 62 62 62
39986-250 250 250 253 253 253 253 253 253 253 253 253
39987-253 253 253 253 253 253 253 253 253 253 253 253
39988-253 253 253 253 253 253 231 231 231 246 246 246
39989-253 253 253 253 253 253 253 253 253 253 253 253
39990-253 253 253 253 253 253 253 253 253 253 253 253
39991-253 253 253 253 253 253 253 253 253 253 253 253
39992-253 253 253 253 253 253 253 253 253 253 253 253
39993-253 253 253 253 253 253 234 234 234 14 14 14
39994- 2 2 6 2 2 6 30 30 30 2 2 6
39995- 2 2 6 2 2 6 2 2 6 2 2 6
39996- 2 2 6 66 66 66 62 62 62 22 22 22
39997- 6 6 6 0 0 0 0 0 0 0 0 0
39998- 0 0 0 0 0 0 0 0 0 0 0 0
39999- 0 0 0 0 0 0 0 0 0 0 0 0
40000- 0 0 0 0 0 0 0 0 0 0 0 0
40001- 0 0 0 0 0 0 0 0 0 0 0 0
40002- 0 0 0 0 0 0 0 0 0 0 0 0
40003- 0 0 0 0 0 0 6 6 6 18 18 18
40004- 54 54 54 62 62 62 2 2 6 2 2 6
40005- 2 2 6 30 30 30 46 46 46 70 70 70
40006-250 250 250 253 253 253 253 253 253 253 253 253
40007-253 253 253 253 253 253 253 253 253 253 253 253
40008-253 253 253 253 253 253 231 231 231 246 246 246
40009-253 253 253 253 253 253 253 253 253 253 253 253
40010-253 253 253 253 253 253 253 253 253 253 253 253
40011-253 253 253 253 253 253 253 253 253 253 253 253
40012-253 253 253 253 253 253 253 253 253 253 253 253
40013-253 253 253 253 253 253 226 226 226 10 10 10
40014- 2 2 6 6 6 6 30 30 30 2 2 6
40015- 2 2 6 2 2 6 2 2 6 2 2 6
40016- 2 2 6 66 66 66 58 58 58 22 22 22
40017- 6 6 6 0 0 0 0 0 0 0 0 0
40018- 0 0 0 0 0 0 0 0 0 0 0 0
40019- 0 0 0 0 0 0 0 0 0 0 0 0
40020- 0 0 0 0 0 0 0 0 0 0 0 0
40021- 0 0 0 0 0 0 0 0 0 0 0 0
40022- 0 0 0 0 0 0 0 0 0 0 0 0
40023- 0 0 0 0 0 0 6 6 6 22 22 22
40024- 58 58 58 62 62 62 2 2 6 2 2 6
40025- 2 2 6 2 2 6 30 30 30 78 78 78
40026-250 250 250 253 253 253 253 253 253 253 253 253
40027-253 253 253 253 253 253 253 253 253 253 253 253
40028-253 253 253 253 253 253 231 231 231 246 246 246
40029-253 253 253 253 253 253 253 253 253 253 253 253
40030-253 253 253 253 253 253 253 253 253 253 253 253
40031-253 253 253 253 253 253 253 253 253 253 253 253
40032-253 253 253 253 253 253 253 253 253 253 253 253
40033-253 253 253 253 253 253 206 206 206 2 2 6
40034- 22 22 22 34 34 34 18 14 6 22 22 22
40035- 26 26 26 18 18 18 6 6 6 2 2 6
40036- 2 2 6 82 82 82 54 54 54 18 18 18
40037- 6 6 6 0 0 0 0 0 0 0 0 0
40038- 0 0 0 0 0 0 0 0 0 0 0 0
40039- 0 0 0 0 0 0 0 0 0 0 0 0
40040- 0 0 0 0 0 0 0 0 0 0 0 0
40041- 0 0 0 0 0 0 0 0 0 0 0 0
40042- 0 0 0 0 0 0 0 0 0 0 0 0
40043- 0 0 0 0 0 0 6 6 6 26 26 26
40044- 62 62 62 106 106 106 74 54 14 185 133 11
40045-210 162 10 121 92 8 6 6 6 62 62 62
40046-238 238 238 253 253 253 253 253 253 253 253 253
40047-253 253 253 253 253 253 253 253 253 253 253 253
40048-253 253 253 253 253 253 231 231 231 246 246 246
40049-253 253 253 253 253 253 253 253 253 253 253 253
40050-253 253 253 253 253 253 253 253 253 253 253 253
40051-253 253 253 253 253 253 253 253 253 253 253 253
40052-253 253 253 253 253 253 253 253 253 253 253 253
40053-253 253 253 253 253 253 158 158 158 18 18 18
40054- 14 14 14 2 2 6 2 2 6 2 2 6
40055- 6 6 6 18 18 18 66 66 66 38 38 38
40056- 6 6 6 94 94 94 50 50 50 18 18 18
40057- 6 6 6 0 0 0 0 0 0 0 0 0
40058- 0 0 0 0 0 0 0 0 0 0 0 0
40059- 0 0 0 0 0 0 0 0 0 0 0 0
40060- 0 0 0 0 0 0 0 0 0 0 0 0
40061- 0 0 0 0 0 0 0 0 0 0 0 0
40062- 0 0 0 0 0 0 0 0 0 6 6 6
40063- 10 10 10 10 10 10 18 18 18 38 38 38
40064- 78 78 78 142 134 106 216 158 10 242 186 14
40065-246 190 14 246 190 14 156 118 10 10 10 10
40066- 90 90 90 238 238 238 253 253 253 253 253 253
40067-253 253 253 253 253 253 253 253 253 253 253 253
40068-253 253 253 253 253 253 231 231 231 250 250 250
40069-253 253 253 253 253 253 253 253 253 253 253 253
40070-253 253 253 253 253 253 253 253 253 253 253 253
40071-253 253 253 253 253 253 253 253 253 253 253 253
40072-253 253 253 253 253 253 253 253 253 246 230 190
40073-238 204 91 238 204 91 181 142 44 37 26 9
40074- 2 2 6 2 2 6 2 2 6 2 2 6
40075- 2 2 6 2 2 6 38 38 38 46 46 46
40076- 26 26 26 106 106 106 54 54 54 18 18 18
40077- 6 6 6 0 0 0 0 0 0 0 0 0
40078- 0 0 0 0 0 0 0 0 0 0 0 0
40079- 0 0 0 0 0 0 0 0 0 0 0 0
40080- 0 0 0 0 0 0 0 0 0 0 0 0
40081- 0 0 0 0 0 0 0 0 0 0 0 0
40082- 0 0 0 6 6 6 14 14 14 22 22 22
40083- 30 30 30 38 38 38 50 50 50 70 70 70
40084-106 106 106 190 142 34 226 170 11 242 186 14
40085-246 190 14 246 190 14 246 190 14 154 114 10
40086- 6 6 6 74 74 74 226 226 226 253 253 253
40087-253 253 253 253 253 253 253 253 253 253 253 253
40088-253 253 253 253 253 253 231 231 231 250 250 250
40089-253 253 253 253 253 253 253 253 253 253 253 253
40090-253 253 253 253 253 253 253 253 253 253 253 253
40091-253 253 253 253 253 253 253 253 253 253 253 253
40092-253 253 253 253 253 253 253 253 253 228 184 62
40093-241 196 14 241 208 19 232 195 16 38 30 10
40094- 2 2 6 2 2 6 2 2 6 2 2 6
40095- 2 2 6 6 6 6 30 30 30 26 26 26
40096-203 166 17 154 142 90 66 66 66 26 26 26
40097- 6 6 6 0 0 0 0 0 0 0 0 0
40098- 0 0 0 0 0 0 0 0 0 0 0 0
40099- 0 0 0 0 0 0 0 0 0 0 0 0
40100- 0 0 0 0 0 0 0 0 0 0 0 0
40101- 0 0 0 0 0 0 0 0 0 0 0 0
40102- 6 6 6 18 18 18 38 38 38 58 58 58
40103- 78 78 78 86 86 86 101 101 101 123 123 123
40104-175 146 61 210 150 10 234 174 13 246 186 14
40105-246 190 14 246 190 14 246 190 14 238 190 10
40106-102 78 10 2 2 6 46 46 46 198 198 198
40107-253 253 253 253 253 253 253 253 253 253 253 253
40108-253 253 253 253 253 253 234 234 234 242 242 242
40109-253 253 253 253 253 253 253 253 253 253 253 253
40110-253 253 253 253 253 253 253 253 253 253 253 253
40111-253 253 253 253 253 253 253 253 253 253 253 253
40112-253 253 253 253 253 253 253 253 253 224 178 62
40113-242 186 14 241 196 14 210 166 10 22 18 6
40114- 2 2 6 2 2 6 2 2 6 2 2 6
40115- 2 2 6 2 2 6 6 6 6 121 92 8
40116-238 202 15 232 195 16 82 82 82 34 34 34
40117- 10 10 10 0 0 0 0 0 0 0 0 0
40118- 0 0 0 0 0 0 0 0 0 0 0 0
40119- 0 0 0 0 0 0 0 0 0 0 0 0
40120- 0 0 0 0 0 0 0 0 0 0 0 0
40121- 0 0 0 0 0 0 0 0 0 0 0 0
40122- 14 14 14 38 38 38 70 70 70 154 122 46
40123-190 142 34 200 144 11 197 138 11 197 138 11
40124-213 154 11 226 170 11 242 186 14 246 190 14
40125-246 190 14 246 190 14 246 190 14 246 190 14
40126-225 175 15 46 32 6 2 2 6 22 22 22
40127-158 158 158 250 250 250 253 253 253 253 253 253
40128-253 253 253 253 253 253 253 253 253 253 253 253
40129-253 253 253 253 253 253 253 253 253 253 253 253
40130-253 253 253 253 253 253 253 253 253 253 253 253
40131-253 253 253 253 253 253 253 253 253 253 253 253
40132-253 253 253 250 250 250 242 242 242 224 178 62
40133-239 182 13 236 186 11 213 154 11 46 32 6
40134- 2 2 6 2 2 6 2 2 6 2 2 6
40135- 2 2 6 2 2 6 61 42 6 225 175 15
40136-238 190 10 236 186 11 112 100 78 42 42 42
40137- 14 14 14 0 0 0 0 0 0 0 0 0
40138- 0 0 0 0 0 0 0 0 0 0 0 0
40139- 0 0 0 0 0 0 0 0 0 0 0 0
40140- 0 0 0 0 0 0 0 0 0 0 0 0
40141- 0 0 0 0 0 0 0 0 0 6 6 6
40142- 22 22 22 54 54 54 154 122 46 213 154 11
40143-226 170 11 230 174 11 226 170 11 226 170 11
40144-236 178 12 242 186 14 246 190 14 246 190 14
40145-246 190 14 246 190 14 246 190 14 246 190 14
40146-241 196 14 184 144 12 10 10 10 2 2 6
40147- 6 6 6 116 116 116 242 242 242 253 253 253
40148-253 253 253 253 253 253 253 253 253 253 253 253
40149-253 253 253 253 253 253 253 253 253 253 253 253
40150-253 253 253 253 253 253 253 253 253 253 253 253
40151-253 253 253 253 253 253 253 253 253 253 253 253
40152-253 253 253 231 231 231 198 198 198 214 170 54
40153-236 178 12 236 178 12 210 150 10 137 92 6
40154- 18 14 6 2 2 6 2 2 6 2 2 6
40155- 6 6 6 70 47 6 200 144 11 236 178 12
40156-239 182 13 239 182 13 124 112 88 58 58 58
40157- 22 22 22 6 6 6 0 0 0 0 0 0
40158- 0 0 0 0 0 0 0 0 0 0 0 0
40159- 0 0 0 0 0 0 0 0 0 0 0 0
40160- 0 0 0 0 0 0 0 0 0 0 0 0
40161- 0 0 0 0 0 0 0 0 0 10 10 10
40162- 30 30 30 70 70 70 180 133 36 226 170 11
40163-239 182 13 242 186 14 242 186 14 246 186 14
40164-246 190 14 246 190 14 246 190 14 246 190 14
40165-246 190 14 246 190 14 246 190 14 246 190 14
40166-246 190 14 232 195 16 98 70 6 2 2 6
40167- 2 2 6 2 2 6 66 66 66 221 221 221
40168-253 253 253 253 253 253 253 253 253 253 253 253
40169-253 253 253 253 253 253 253 253 253 253 253 253
40170-253 253 253 253 253 253 253 253 253 253 253 253
40171-253 253 253 253 253 253 253 253 253 253 253 253
40172-253 253 253 206 206 206 198 198 198 214 166 58
40173-230 174 11 230 174 11 216 158 10 192 133 9
40174-163 110 8 116 81 8 102 78 10 116 81 8
40175-167 114 7 197 138 11 226 170 11 239 182 13
40176-242 186 14 242 186 14 162 146 94 78 78 78
40177- 34 34 34 14 14 14 6 6 6 0 0 0
40178- 0 0 0 0 0 0 0 0 0 0 0 0
40179- 0 0 0 0 0 0 0 0 0 0 0 0
40180- 0 0 0 0 0 0 0 0 0 0 0 0
40181- 0 0 0 0 0 0 0 0 0 6 6 6
40182- 30 30 30 78 78 78 190 142 34 226 170 11
40183-239 182 13 246 190 14 246 190 14 246 190 14
40184-246 190 14 246 190 14 246 190 14 246 190 14
40185-246 190 14 246 190 14 246 190 14 246 190 14
40186-246 190 14 241 196 14 203 166 17 22 18 6
40187- 2 2 6 2 2 6 2 2 6 38 38 38
40188-218 218 218 253 253 253 253 253 253 253 253 253
40189-253 253 253 253 253 253 253 253 253 253 253 253
40190-253 253 253 253 253 253 253 253 253 253 253 253
40191-253 253 253 253 253 253 253 253 253 253 253 253
40192-250 250 250 206 206 206 198 198 198 202 162 69
40193-226 170 11 236 178 12 224 166 10 210 150 10
40194-200 144 11 197 138 11 192 133 9 197 138 11
40195-210 150 10 226 170 11 242 186 14 246 190 14
40196-246 190 14 246 186 14 225 175 15 124 112 88
40197- 62 62 62 30 30 30 14 14 14 6 6 6
40198- 0 0 0 0 0 0 0 0 0 0 0 0
40199- 0 0 0 0 0 0 0 0 0 0 0 0
40200- 0 0 0 0 0 0 0 0 0 0 0 0
40201- 0 0 0 0 0 0 0 0 0 10 10 10
40202- 30 30 30 78 78 78 174 135 50 224 166 10
40203-239 182 13 246 190 14 246 190 14 246 190 14
40204-246 190 14 246 190 14 246 190 14 246 190 14
40205-246 190 14 246 190 14 246 190 14 246 190 14
40206-246 190 14 246 190 14 241 196 14 139 102 15
40207- 2 2 6 2 2 6 2 2 6 2 2 6
40208- 78 78 78 250 250 250 253 253 253 253 253 253
40209-253 253 253 253 253 253 253 253 253 253 253 253
40210-253 253 253 253 253 253 253 253 253 253 253 253
40211-253 253 253 253 253 253 253 253 253 253 253 253
40212-250 250 250 214 214 214 198 198 198 190 150 46
40213-219 162 10 236 178 12 234 174 13 224 166 10
40214-216 158 10 213 154 11 213 154 11 216 158 10
40215-226 170 11 239 182 13 246 190 14 246 190 14
40216-246 190 14 246 190 14 242 186 14 206 162 42
40217-101 101 101 58 58 58 30 30 30 14 14 14
40218- 6 6 6 0 0 0 0 0 0 0 0 0
40219- 0 0 0 0 0 0 0 0 0 0 0 0
40220- 0 0 0 0 0 0 0 0 0 0 0 0
40221- 0 0 0 0 0 0 0 0 0 10 10 10
40222- 30 30 30 74 74 74 174 135 50 216 158 10
40223-236 178 12 246 190 14 246 190 14 246 190 14
40224-246 190 14 246 190 14 246 190 14 246 190 14
40225-246 190 14 246 190 14 246 190 14 246 190 14
40226-246 190 14 246 190 14 241 196 14 226 184 13
40227- 61 42 6 2 2 6 2 2 6 2 2 6
40228- 22 22 22 238 238 238 253 253 253 253 253 253
40229-253 253 253 253 253 253 253 253 253 253 253 253
40230-253 253 253 253 253 253 253 253 253 253 253 253
40231-253 253 253 253 253 253 253 253 253 253 253 253
40232-253 253 253 226 226 226 187 187 187 180 133 36
40233-216 158 10 236 178 12 239 182 13 236 178 12
40234-230 174 11 226 170 11 226 170 11 230 174 11
40235-236 178 12 242 186 14 246 190 14 246 190 14
40236-246 190 14 246 190 14 246 186 14 239 182 13
40237-206 162 42 106 106 106 66 66 66 34 34 34
40238- 14 14 14 6 6 6 0 0 0 0 0 0
40239- 0 0 0 0 0 0 0 0 0 0 0 0
40240- 0 0 0 0 0 0 0 0 0 0 0 0
40241- 0 0 0 0 0 0 0 0 0 6 6 6
40242- 26 26 26 70 70 70 163 133 67 213 154 11
40243-236 178 12 246 190 14 246 190 14 246 190 14
40244-246 190 14 246 190 14 246 190 14 246 190 14
40245-246 190 14 246 190 14 246 190 14 246 190 14
40246-246 190 14 246 190 14 246 190 14 241 196 14
40247-190 146 13 18 14 6 2 2 6 2 2 6
40248- 46 46 46 246 246 246 253 253 253 253 253 253
40249-253 253 253 253 253 253 253 253 253 253 253 253
40250-253 253 253 253 253 253 253 253 253 253 253 253
40251-253 253 253 253 253 253 253 253 253 253 253 253
40252-253 253 253 221 221 221 86 86 86 156 107 11
40253-216 158 10 236 178 12 242 186 14 246 186 14
40254-242 186 14 239 182 13 239 182 13 242 186 14
40255-242 186 14 246 186 14 246 190 14 246 190 14
40256-246 190 14 246 190 14 246 190 14 246 190 14
40257-242 186 14 225 175 15 142 122 72 66 66 66
40258- 30 30 30 10 10 10 0 0 0 0 0 0
40259- 0 0 0 0 0 0 0 0 0 0 0 0
40260- 0 0 0 0 0 0 0 0 0 0 0 0
40261- 0 0 0 0 0 0 0 0 0 6 6 6
40262- 26 26 26 70 70 70 163 133 67 210 150 10
40263-236 178 12 246 190 14 246 190 14 246 190 14
40264-246 190 14 246 190 14 246 190 14 246 190 14
40265-246 190 14 246 190 14 246 190 14 246 190 14
40266-246 190 14 246 190 14 246 190 14 246 190 14
40267-232 195 16 121 92 8 34 34 34 106 106 106
40268-221 221 221 253 253 253 253 253 253 253 253 253
40269-253 253 253 253 253 253 253 253 253 253 253 253
40270-253 253 253 253 253 253 253 253 253 253 253 253
40271-253 253 253 253 253 253 253 253 253 253 253 253
40272-242 242 242 82 82 82 18 14 6 163 110 8
40273-216 158 10 236 178 12 242 186 14 246 190 14
40274-246 190 14 246 190 14 246 190 14 246 190 14
40275-246 190 14 246 190 14 246 190 14 246 190 14
40276-246 190 14 246 190 14 246 190 14 246 190 14
40277-246 190 14 246 190 14 242 186 14 163 133 67
40278- 46 46 46 18 18 18 6 6 6 0 0 0
40279- 0 0 0 0 0 0 0 0 0 0 0 0
40280- 0 0 0 0 0 0 0 0 0 0 0 0
40281- 0 0 0 0 0 0 0 0 0 10 10 10
40282- 30 30 30 78 78 78 163 133 67 210 150 10
40283-236 178 12 246 186 14 246 190 14 246 190 14
40284-246 190 14 246 190 14 246 190 14 246 190 14
40285-246 190 14 246 190 14 246 190 14 246 190 14
40286-246 190 14 246 190 14 246 190 14 246 190 14
40287-241 196 14 215 174 15 190 178 144 253 253 253
40288-253 253 253 253 253 253 253 253 253 253 253 253
40289-253 253 253 253 253 253 253 253 253 253 253 253
40290-253 253 253 253 253 253 253 253 253 253 253 253
40291-253 253 253 253 253 253 253 253 253 218 218 218
40292- 58 58 58 2 2 6 22 18 6 167 114 7
40293-216 158 10 236 178 12 246 186 14 246 190 14
40294-246 190 14 246 190 14 246 190 14 246 190 14
40295-246 190 14 246 190 14 246 190 14 246 190 14
40296-246 190 14 246 190 14 246 190 14 246 190 14
40297-246 190 14 246 186 14 242 186 14 190 150 46
40298- 54 54 54 22 22 22 6 6 6 0 0 0
40299- 0 0 0 0 0 0 0 0 0 0 0 0
40300- 0 0 0 0 0 0 0 0 0 0 0 0
40301- 0 0 0 0 0 0 0 0 0 14 14 14
40302- 38 38 38 86 86 86 180 133 36 213 154 11
40303-236 178 12 246 186 14 246 190 14 246 190 14
40304-246 190 14 246 190 14 246 190 14 246 190 14
40305-246 190 14 246 190 14 246 190 14 246 190 14
40306-246 190 14 246 190 14 246 190 14 246 190 14
40307-246 190 14 232 195 16 190 146 13 214 214 214
40308-253 253 253 253 253 253 253 253 253 253 253 253
40309-253 253 253 253 253 253 253 253 253 253 253 253
40310-253 253 253 253 253 253 253 253 253 253 253 253
40311-253 253 253 250 250 250 170 170 170 26 26 26
40312- 2 2 6 2 2 6 37 26 9 163 110 8
40313-219 162 10 239 182 13 246 186 14 246 190 14
40314-246 190 14 246 190 14 246 190 14 246 190 14
40315-246 190 14 246 190 14 246 190 14 246 190 14
40316-246 190 14 246 190 14 246 190 14 246 190 14
40317-246 186 14 236 178 12 224 166 10 142 122 72
40318- 46 46 46 18 18 18 6 6 6 0 0 0
40319- 0 0 0 0 0 0 0 0 0 0 0 0
40320- 0 0 0 0 0 0 0 0 0 0 0 0
40321- 0 0 0 0 0 0 6 6 6 18 18 18
40322- 50 50 50 109 106 95 192 133 9 224 166 10
40323-242 186 14 246 190 14 246 190 14 246 190 14
40324-246 190 14 246 190 14 246 190 14 246 190 14
40325-246 190 14 246 190 14 246 190 14 246 190 14
40326-246 190 14 246 190 14 246 190 14 246 190 14
40327-242 186 14 226 184 13 210 162 10 142 110 46
40328-226 226 226 253 253 253 253 253 253 253 253 253
40329-253 253 253 253 253 253 253 253 253 253 253 253
40330-253 253 253 253 253 253 253 253 253 253 253 253
40331-198 198 198 66 66 66 2 2 6 2 2 6
40332- 2 2 6 2 2 6 50 34 6 156 107 11
40333-219 162 10 239 182 13 246 186 14 246 190 14
40334-246 190 14 246 190 14 246 190 14 246 190 14
40335-246 190 14 246 190 14 246 190 14 246 190 14
40336-246 190 14 246 190 14 246 190 14 242 186 14
40337-234 174 13 213 154 11 154 122 46 66 66 66
40338- 30 30 30 10 10 10 0 0 0 0 0 0
40339- 0 0 0 0 0 0 0 0 0 0 0 0
40340- 0 0 0 0 0 0 0 0 0 0 0 0
40341- 0 0 0 0 0 0 6 6 6 22 22 22
40342- 58 58 58 154 121 60 206 145 10 234 174 13
40343-242 186 14 246 186 14 246 190 14 246 190 14
40344-246 190 14 246 190 14 246 190 14 246 190 14
40345-246 190 14 246 190 14 246 190 14 246 190 14
40346-246 190 14 246 190 14 246 190 14 246 190 14
40347-246 186 14 236 178 12 210 162 10 163 110 8
40348- 61 42 6 138 138 138 218 218 218 250 250 250
40349-253 253 253 253 253 253 253 253 253 250 250 250
40350-242 242 242 210 210 210 144 144 144 66 66 66
40351- 6 6 6 2 2 6 2 2 6 2 2 6
40352- 2 2 6 2 2 6 61 42 6 163 110 8
40353-216 158 10 236 178 12 246 190 14 246 190 14
40354-246 190 14 246 190 14 246 190 14 246 190 14
40355-246 190 14 246 190 14 246 190 14 246 190 14
40356-246 190 14 239 182 13 230 174 11 216 158 10
40357-190 142 34 124 112 88 70 70 70 38 38 38
40358- 18 18 18 6 6 6 0 0 0 0 0 0
40359- 0 0 0 0 0 0 0 0 0 0 0 0
40360- 0 0 0 0 0 0 0 0 0 0 0 0
40361- 0 0 0 0 0 0 6 6 6 22 22 22
40362- 62 62 62 168 124 44 206 145 10 224 166 10
40363-236 178 12 239 182 13 242 186 14 242 186 14
40364-246 186 14 246 190 14 246 190 14 246 190 14
40365-246 190 14 246 190 14 246 190 14 246 190 14
40366-246 190 14 246 190 14 246 190 14 246 190 14
40367-246 190 14 236 178 12 216 158 10 175 118 6
40368- 80 54 7 2 2 6 6 6 6 30 30 30
40369- 54 54 54 62 62 62 50 50 50 38 38 38
40370- 14 14 14 2 2 6 2 2 6 2 2 6
40371- 2 2 6 2 2 6 2 2 6 2 2 6
40372- 2 2 6 6 6 6 80 54 7 167 114 7
40373-213 154 11 236 178 12 246 190 14 246 190 14
40374-246 190 14 246 190 14 246 190 14 246 190 14
40375-246 190 14 242 186 14 239 182 13 239 182 13
40376-230 174 11 210 150 10 174 135 50 124 112 88
40377- 82 82 82 54 54 54 34 34 34 18 18 18
40378- 6 6 6 0 0 0 0 0 0 0 0 0
40379- 0 0 0 0 0 0 0 0 0 0 0 0
40380- 0 0 0 0 0 0 0 0 0 0 0 0
40381- 0 0 0 0 0 0 6 6 6 18 18 18
40382- 50 50 50 158 118 36 192 133 9 200 144 11
40383-216 158 10 219 162 10 224 166 10 226 170 11
40384-230 174 11 236 178 12 239 182 13 239 182 13
40385-242 186 14 246 186 14 246 190 14 246 190 14
40386-246 190 14 246 190 14 246 190 14 246 190 14
40387-246 186 14 230 174 11 210 150 10 163 110 8
40388-104 69 6 10 10 10 2 2 6 2 2 6
40389- 2 2 6 2 2 6 2 2 6 2 2 6
40390- 2 2 6 2 2 6 2 2 6 2 2 6
40391- 2 2 6 2 2 6 2 2 6 2 2 6
40392- 2 2 6 6 6 6 91 60 6 167 114 7
40393-206 145 10 230 174 11 242 186 14 246 190 14
40394-246 190 14 246 190 14 246 186 14 242 186 14
40395-239 182 13 230 174 11 224 166 10 213 154 11
40396-180 133 36 124 112 88 86 86 86 58 58 58
40397- 38 38 38 22 22 22 10 10 10 6 6 6
40398- 0 0 0 0 0 0 0 0 0 0 0 0
40399- 0 0 0 0 0 0 0 0 0 0 0 0
40400- 0 0 0 0 0 0 0 0 0 0 0 0
40401- 0 0 0 0 0 0 0 0 0 14 14 14
40402- 34 34 34 70 70 70 138 110 50 158 118 36
40403-167 114 7 180 123 7 192 133 9 197 138 11
40404-200 144 11 206 145 10 213 154 11 219 162 10
40405-224 166 10 230 174 11 239 182 13 242 186 14
40406-246 186 14 246 186 14 246 186 14 246 186 14
40407-239 182 13 216 158 10 185 133 11 152 99 6
40408-104 69 6 18 14 6 2 2 6 2 2 6
40409- 2 2 6 2 2 6 2 2 6 2 2 6
40410- 2 2 6 2 2 6 2 2 6 2 2 6
40411- 2 2 6 2 2 6 2 2 6 2 2 6
40412- 2 2 6 6 6 6 80 54 7 152 99 6
40413-192 133 9 219 162 10 236 178 12 239 182 13
40414-246 186 14 242 186 14 239 182 13 236 178 12
40415-224 166 10 206 145 10 192 133 9 154 121 60
40416- 94 94 94 62 62 62 42 42 42 22 22 22
40417- 14 14 14 6 6 6 0 0 0 0 0 0
40418- 0 0 0 0 0 0 0 0 0 0 0 0
40419- 0 0 0 0 0 0 0 0 0 0 0 0
40420- 0 0 0 0 0 0 0 0 0 0 0 0
40421- 0 0 0 0 0 0 0 0 0 6 6 6
40422- 18 18 18 34 34 34 58 58 58 78 78 78
40423-101 98 89 124 112 88 142 110 46 156 107 11
40424-163 110 8 167 114 7 175 118 6 180 123 7
40425-185 133 11 197 138 11 210 150 10 219 162 10
40426-226 170 11 236 178 12 236 178 12 234 174 13
40427-219 162 10 197 138 11 163 110 8 130 83 6
40428- 91 60 6 10 10 10 2 2 6 2 2 6
40429- 18 18 18 38 38 38 38 38 38 38 38 38
40430- 38 38 38 38 38 38 38 38 38 38 38 38
40431- 38 38 38 38 38 38 26 26 26 2 2 6
40432- 2 2 6 6 6 6 70 47 6 137 92 6
40433-175 118 6 200 144 11 219 162 10 230 174 11
40434-234 174 13 230 174 11 219 162 10 210 150 10
40435-192 133 9 163 110 8 124 112 88 82 82 82
40436- 50 50 50 30 30 30 14 14 14 6 6 6
40437- 0 0 0 0 0 0 0 0 0 0 0 0
40438- 0 0 0 0 0 0 0 0 0 0 0 0
40439- 0 0 0 0 0 0 0 0 0 0 0 0
40440- 0 0 0 0 0 0 0 0 0 0 0 0
40441- 0 0 0 0 0 0 0 0 0 0 0 0
40442- 6 6 6 14 14 14 22 22 22 34 34 34
40443- 42 42 42 58 58 58 74 74 74 86 86 86
40444-101 98 89 122 102 70 130 98 46 121 87 25
40445-137 92 6 152 99 6 163 110 8 180 123 7
40446-185 133 11 197 138 11 206 145 10 200 144 11
40447-180 123 7 156 107 11 130 83 6 104 69 6
40448- 50 34 6 54 54 54 110 110 110 101 98 89
40449- 86 86 86 82 82 82 78 78 78 78 78 78
40450- 78 78 78 78 78 78 78 78 78 78 78 78
40451- 78 78 78 82 82 82 86 86 86 94 94 94
40452-106 106 106 101 101 101 86 66 34 124 80 6
40453-156 107 11 180 123 7 192 133 9 200 144 11
40454-206 145 10 200 144 11 192 133 9 175 118 6
40455-139 102 15 109 106 95 70 70 70 42 42 42
40456- 22 22 22 10 10 10 0 0 0 0 0 0
40457- 0 0 0 0 0 0 0 0 0 0 0 0
40458- 0 0 0 0 0 0 0 0 0 0 0 0
40459- 0 0 0 0 0 0 0 0 0 0 0 0
40460- 0 0 0 0 0 0 0 0 0 0 0 0
40461- 0 0 0 0 0 0 0 0 0 0 0 0
40462- 0 0 0 0 0 0 6 6 6 10 10 10
40463- 14 14 14 22 22 22 30 30 30 38 38 38
40464- 50 50 50 62 62 62 74 74 74 90 90 90
40465-101 98 89 112 100 78 121 87 25 124 80 6
40466-137 92 6 152 99 6 152 99 6 152 99 6
40467-138 86 6 124 80 6 98 70 6 86 66 30
40468-101 98 89 82 82 82 58 58 58 46 46 46
40469- 38 38 38 34 34 34 34 34 34 34 34 34
40470- 34 34 34 34 34 34 34 34 34 34 34 34
40471- 34 34 34 34 34 34 38 38 38 42 42 42
40472- 54 54 54 82 82 82 94 86 76 91 60 6
40473-134 86 6 156 107 11 167 114 7 175 118 6
40474-175 118 6 167 114 7 152 99 6 121 87 25
40475-101 98 89 62 62 62 34 34 34 18 18 18
40476- 6 6 6 0 0 0 0 0 0 0 0 0
40477- 0 0 0 0 0 0 0 0 0 0 0 0
40478- 0 0 0 0 0 0 0 0 0 0 0 0
40479- 0 0 0 0 0 0 0 0 0 0 0 0
40480- 0 0 0 0 0 0 0 0 0 0 0 0
40481- 0 0 0 0 0 0 0 0 0 0 0 0
40482- 0 0 0 0 0 0 0 0 0 0 0 0
40483- 0 0 0 6 6 6 6 6 6 10 10 10
40484- 18 18 18 22 22 22 30 30 30 42 42 42
40485- 50 50 50 66 66 66 86 86 86 101 98 89
40486-106 86 58 98 70 6 104 69 6 104 69 6
40487-104 69 6 91 60 6 82 62 34 90 90 90
40488- 62 62 62 38 38 38 22 22 22 14 14 14
40489- 10 10 10 10 10 10 10 10 10 10 10 10
40490- 10 10 10 10 10 10 6 6 6 10 10 10
40491- 10 10 10 10 10 10 10 10 10 14 14 14
40492- 22 22 22 42 42 42 70 70 70 89 81 66
40493- 80 54 7 104 69 6 124 80 6 137 92 6
40494-134 86 6 116 81 8 100 82 52 86 86 86
40495- 58 58 58 30 30 30 14 14 14 6 6 6
40496- 0 0 0 0 0 0 0 0 0 0 0 0
40497- 0 0 0 0 0 0 0 0 0 0 0 0
40498- 0 0 0 0 0 0 0 0 0 0 0 0
40499- 0 0 0 0 0 0 0 0 0 0 0 0
40500- 0 0 0 0 0 0 0 0 0 0 0 0
40501- 0 0 0 0 0 0 0 0 0 0 0 0
40502- 0 0 0 0 0 0 0 0 0 0 0 0
40503- 0 0 0 0 0 0 0 0 0 0 0 0
40504- 0 0 0 6 6 6 10 10 10 14 14 14
40505- 18 18 18 26 26 26 38 38 38 54 54 54
40506- 70 70 70 86 86 86 94 86 76 89 81 66
40507- 89 81 66 86 86 86 74 74 74 50 50 50
40508- 30 30 30 14 14 14 6 6 6 0 0 0
40509- 0 0 0 0 0 0 0 0 0 0 0 0
40510- 0 0 0 0 0 0 0 0 0 0 0 0
40511- 0 0 0 0 0 0 0 0 0 0 0 0
40512- 6 6 6 18 18 18 34 34 34 58 58 58
40513- 82 82 82 89 81 66 89 81 66 89 81 66
40514- 94 86 66 94 86 76 74 74 74 50 50 50
40515- 26 26 26 14 14 14 6 6 6 0 0 0
40516- 0 0 0 0 0 0 0 0 0 0 0 0
40517- 0 0 0 0 0 0 0 0 0 0 0 0
40518- 0 0 0 0 0 0 0 0 0 0 0 0
40519- 0 0 0 0 0 0 0 0 0 0 0 0
40520- 0 0 0 0 0 0 0 0 0 0 0 0
40521- 0 0 0 0 0 0 0 0 0 0 0 0
40522- 0 0 0 0 0 0 0 0 0 0 0 0
40523- 0 0 0 0 0 0 0 0 0 0 0 0
40524- 0 0 0 0 0 0 0 0 0 0 0 0
40525- 6 6 6 6 6 6 14 14 14 18 18 18
40526- 30 30 30 38 38 38 46 46 46 54 54 54
40527- 50 50 50 42 42 42 30 30 30 18 18 18
40528- 10 10 10 0 0 0 0 0 0 0 0 0
40529- 0 0 0 0 0 0 0 0 0 0 0 0
40530- 0 0 0 0 0 0 0 0 0 0 0 0
40531- 0 0 0 0 0 0 0 0 0 0 0 0
40532- 0 0 0 6 6 6 14 14 14 26 26 26
40533- 38 38 38 50 50 50 58 58 58 58 58 58
40534- 54 54 54 42 42 42 30 30 30 18 18 18
40535- 10 10 10 0 0 0 0 0 0 0 0 0
40536- 0 0 0 0 0 0 0 0 0 0 0 0
40537- 0 0 0 0 0 0 0 0 0 0 0 0
40538- 0 0 0 0 0 0 0 0 0 0 0 0
40539- 0 0 0 0 0 0 0 0 0 0 0 0
40540- 0 0 0 0 0 0 0 0 0 0 0 0
40541- 0 0 0 0 0 0 0 0 0 0 0 0
40542- 0 0 0 0 0 0 0 0 0 0 0 0
40543- 0 0 0 0 0 0 0 0 0 0 0 0
40544- 0 0 0 0 0 0 0 0 0 0 0 0
40545- 0 0 0 0 0 0 0 0 0 6 6 6
40546- 6 6 6 10 10 10 14 14 14 18 18 18
40547- 18 18 18 14 14 14 10 10 10 6 6 6
40548- 0 0 0 0 0 0 0 0 0 0 0 0
40549- 0 0 0 0 0 0 0 0 0 0 0 0
40550- 0 0 0 0 0 0 0 0 0 0 0 0
40551- 0 0 0 0 0 0 0 0 0 0 0 0
40552- 0 0 0 0 0 0 0 0 0 6 6 6
40553- 14 14 14 18 18 18 22 22 22 22 22 22
40554- 18 18 18 14 14 14 10 10 10 6 6 6
40555- 0 0 0 0 0 0 0 0 0 0 0 0
40556- 0 0 0 0 0 0 0 0 0 0 0 0
40557- 0 0 0 0 0 0 0 0 0 0 0 0
40558- 0 0 0 0 0 0 0 0 0 0 0 0
40559- 0 0 0 0 0 0 0 0 0 0 0 0
40560+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40561+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40562+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40563+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40564+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40565+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40566+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40567+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40568+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40569+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40570+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40571+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40572+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40573+4 4 4 4 4 4
40574+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40575+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40576+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40577+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40578+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40579+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40580+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40581+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40582+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40583+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40584+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40585+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40586+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40587+4 4 4 4 4 4
40588+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40589+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40590+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40591+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40592+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40593+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40594+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40595+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40596+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40597+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40598+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40599+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40600+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40601+4 4 4 4 4 4
40602+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40603+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40604+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40605+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40606+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40607+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40608+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40609+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40610+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40611+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40612+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40613+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40614+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40615+4 4 4 4 4 4
40616+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40617+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40618+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40619+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40620+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40621+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40622+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40623+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40624+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40625+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40626+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40627+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40628+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40629+4 4 4 4 4 4
40630+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40631+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40632+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40633+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40634+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40635+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40636+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40637+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40638+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40639+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40640+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40641+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40642+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40643+4 4 4 4 4 4
40644+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40645+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40646+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40647+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40648+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40649+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40650+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40651+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40652+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40653+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40654+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40655+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40656+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40657+4 4 4 4 4 4
40658+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40659+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40660+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40661+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40662+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40663+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40664+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40665+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40666+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40667+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40668+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40669+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40670+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40671+4 4 4 4 4 4
40672+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40673+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40674+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40675+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40676+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40677+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40678+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40679+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40680+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40681+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40682+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40683+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40684+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40685+4 4 4 4 4 4
40686+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40687+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40688+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40689+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40690+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40691+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40692+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40693+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40694+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40695+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40696+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40697+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40698+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40699+4 4 4 4 4 4
40700+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40701+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40702+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40703+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40704+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40705+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40706+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40707+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40708+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40709+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40710+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40711+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40712+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40713+4 4 4 4 4 4
40714+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40715+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40716+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40717+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
40718+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
40719+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
40720+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
40721+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
40722+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
40723+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
40724+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
40725+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
40726+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
40727+4 4 4 4 4 4
40728+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40729+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40730+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
40731+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
40732+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
40733+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
40734+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
40735+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
40736+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
40737+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
40738+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
40739+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
40740+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
40741+4 4 4 4 4 4
40742+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40743+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40744+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
40745+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
40746+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
40747+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
40748+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
40749+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
40750+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
40751+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
40752+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
40753+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
40754+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
40755+4 4 4 4 4 4
40756+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40757+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40758+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
40759+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
40760+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
40761+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
40762+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
40763+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
40764+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
40765+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
40766+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
40767+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
40768+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40769+4 4 4 4 4 4
40770+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40771+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40772+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
40773+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
40774+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
40775+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
40776+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
40777+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
40778+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
40779+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
40780+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
40781+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
40782+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
40783+4 4 4 4 4 4
40784+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40785+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
40786+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
40787+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
40788+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
40789+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
40790+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
40791+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
40792+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
40793+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
40794+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
40795+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
40796+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
40797+4 4 4 4 4 4
40798+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40799+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
40800+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
40801+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
40802+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40803+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
40804+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
40805+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
40806+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
40807+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
40808+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
40809+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
40810+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
40811+0 0 0 4 4 4
40812+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40813+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
40814+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
40815+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
40816+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
40817+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
40818+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
40819+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
40820+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
40821+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
40822+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
40823+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
40824+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
40825+2 0 0 0 0 0
40826+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
40827+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
40828+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
40829+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
40830+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
40831+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
40832+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
40833+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
40834+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
40835+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
40836+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
40837+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
40838+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
40839+37 38 37 0 0 0
40840+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40841+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
40842+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
40843+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
40844+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
40845+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
40846+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
40847+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
40848+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
40849+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
40850+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
40851+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
40852+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
40853+85 115 134 4 0 0
40854+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
40855+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
40856+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
40857+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
40858+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
40859+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
40860+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
40861+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
40862+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
40863+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
40864+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
40865+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
40866+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
40867+60 73 81 4 0 0
40868+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
40869+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
40870+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
40871+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
40872+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
40873+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
40874+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
40875+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
40876+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
40877+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
40878+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
40879+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
40880+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
40881+16 19 21 4 0 0
40882+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
40883+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
40884+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
40885+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
40886+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
40887+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
40888+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
40889+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
40890+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
40891+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
40892+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
40893+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
40894+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
40895+4 0 0 4 3 3
40896+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
40897+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
40898+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
40899+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
40900+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
40901+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
40902+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
40903+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
40904+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
40905+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
40906+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
40907+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
40908+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
40909+3 2 2 4 4 4
40910+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
40911+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
40912+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
40913+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40914+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
40915+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
40916+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
40917+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
40918+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
40919+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
40920+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
40921+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
40922+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
40923+4 4 4 4 4 4
40924+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
40925+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
40926+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
40927+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
40928+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
40929+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
40930+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
40931+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
40932+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
40933+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
40934+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
40935+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
40936+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
40937+4 4 4 4 4 4
40938+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
40939+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
40940+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
40941+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
40942+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
40943+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40944+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
40945+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
40946+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
40947+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
40948+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
40949+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
40950+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
40951+5 5 5 5 5 5
40952+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
40953+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
40954+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
40955+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
40956+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
40957+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40958+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
40959+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
40960+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
40961+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
40962+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
40963+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
40964+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
40965+5 5 5 4 4 4
40966+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
40967+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
40968+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
40969+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
40970+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40971+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
40972+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
40973+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
40974+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
40975+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
40976+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
40977+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40978+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40979+4 4 4 4 4 4
40980+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
40981+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
40982+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
40983+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
40984+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
40985+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40986+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40987+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
40988+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
40989+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
40990+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
40991+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
40992+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40993+4 4 4 4 4 4
40994+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
40995+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
40996+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
40997+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
40998+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40999+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
41000+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
41001+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
41002+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
41003+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
41004+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
41005+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41006+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41007+4 4 4 4 4 4
41008+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
41009+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
41010+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
41011+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
41012+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41013+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41014+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41015+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
41016+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
41017+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
41018+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
41019+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41020+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41021+4 4 4 4 4 4
41022+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
41023+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
41024+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
41025+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
41026+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41027+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
41028+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
41029+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
41030+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
41031+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
41032+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41033+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41034+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41035+4 4 4 4 4 4
41036+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
41037+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
41038+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
41039+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
41040+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41041+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
41042+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
41043+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
41044+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
41045+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
41046+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
41047+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41048+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41049+4 4 4 4 4 4
41050+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
41051+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
41052+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
41053+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
41054+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41055+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
41056+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
41057+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
41058+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
41059+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
41060+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
41061+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41062+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41063+4 4 4 4 4 4
41064+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
41065+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
41066+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
41067+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41068+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
41069+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
41070+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
41071+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
41072+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
41073+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
41074+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41075+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41076+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41077+4 4 4 4 4 4
41078+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
41079+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
41080+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
41081+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41082+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41083+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
41084+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
41085+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
41086+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
41087+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
41088+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41089+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41090+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41091+4 4 4 4 4 4
41092+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
41093+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
41094+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41095+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41096+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41097+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
41098+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
41099+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
41100+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
41101+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
41102+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41103+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41104+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41105+4 4 4 4 4 4
41106+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
41107+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
41108+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41109+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41110+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41111+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
41112+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
41113+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
41114+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41115+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41116+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41117+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41118+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41119+4 4 4 4 4 4
41120+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41121+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
41122+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41123+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
41124+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
41125+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
41126+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
41127+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
41128+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41129+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41130+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41131+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41132+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41133+4 4 4 4 4 4
41134+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41135+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
41136+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41137+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
41138+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41139+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
41140+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
41141+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
41142+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41143+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41144+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41145+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41146+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41147+4 4 4 4 4 4
41148+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
41149+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
41150+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41151+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
41152+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
41153+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
41154+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
41155+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
41156+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41157+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41158+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41159+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41160+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41161+4 4 4 4 4 4
41162+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
41163+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
41164+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41165+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
41166+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
41167+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
41168+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
41169+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
41170+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41171+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41172+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41173+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41174+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41175+4 4 4 4 4 4
41176+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41177+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
41178+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41179+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
41180+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
41181+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
41182+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
41183+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
41184+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41185+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41186+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41187+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41188+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41189+4 4 4 4 4 4
41190+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
41191+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
41192+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41193+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
41194+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
41195+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
41196+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
41197+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
41198+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
41199+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41200+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41201+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41202+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41203+4 4 4 4 4 4
41204+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41205+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
41206+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
41207+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
41208+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
41209+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
41210+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
41211+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
41212+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41213+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41214+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41215+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41216+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41217+4 4 4 4 4 4
41218+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41219+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
41220+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41221+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
41222+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
41223+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
41224+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
41225+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
41226+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41227+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41228+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41229+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41230+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41231+4 4 4 4 4 4
41232+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41233+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
41234+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
41235+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
41236+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
41237+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
41238+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41239+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
41240+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41241+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41242+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41243+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41244+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41245+4 4 4 4 4 4
41246+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41247+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
41248+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
41249+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41250+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
41251+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
41252+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41253+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
41254+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41255+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41256+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41257+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41258+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41259+4 4 4 4 4 4
41260+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41261+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
41262+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
41263+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
41264+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
41265+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
41266+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
41267+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
41268+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
41269+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41270+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41271+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41272+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41273+4 4 4 4 4 4
41274+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41275+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
41276+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
41277+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
41278+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
41279+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
41280+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
41281+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
41282+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
41283+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41284+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41285+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41286+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41287+4 4 4 4 4 4
41288+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
41289+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
41290+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
41291+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
41292+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41293+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
41294+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
41295+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
41296+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
41297+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41298+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41299+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41300+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41301+4 4 4 4 4 4
41302+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41303+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
41304+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
41305+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
41306+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
41307+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
41308+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
41309+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
41310+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
41311+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41312+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41313+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41314+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41315+4 4 4 4 4 4
41316+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
41317+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
41318+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
41319+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
41320+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
41321+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
41322+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
41323+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
41324+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
41325+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
41326+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41327+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41328+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41329+4 4 4 4 4 4
41330+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
41331+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41332+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
41333+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
41334+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
41335+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
41336+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
41337+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
41338+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
41339+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
41340+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41341+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41342+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41343+4 4 4 4 4 4
41344+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41345+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41346+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41347+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41348+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41349+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41350+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41351+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41352+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41353+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41354+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41355+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41356+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41357+4 4 4 4 4 4
41358+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41359+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41360+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41361+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41362+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41363+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41364+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41365+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41366+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41367+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41368+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41369+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41370+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41371+4 4 4 4 4 4
41372+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41373+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41374+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41375+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41376+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41377+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41378+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41379+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41380+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41381+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41382+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41383+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41384+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41385+4 4 4 4 4 4
41386+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41387+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41388+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41389+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41390+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41391+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41392+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41393+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41394+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41395+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41396+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41397+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41398+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41399+4 4 4 4 4 4
41400+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41401+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41402+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41403+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41404+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41405+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41406+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41407+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41408+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41409+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41410+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41411+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41412+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41413+4 4 4 4 4 4
41414+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41415+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41416+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41417+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41418+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41419+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41420+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41421+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41422+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41423+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41424+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41425+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41426+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41427+4 4 4 4 4 4
41428+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41429+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41430+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41431+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41432+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41433+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41434+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41435+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41436+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41437+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41438+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41439+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41440+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41441+4 4 4 4 4 4
41442+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41443+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41444+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41445+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41446+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41447+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41448+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41449+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41450+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41451+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41452+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41453+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41454+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41455+4 4 4 4 4 4
41456+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41457+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41458+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41459+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41460+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41461+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41462+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41463+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41464+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41465+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41466+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41467+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41468+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41469+4 4 4 4 4 4
41470+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41471+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41472+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41473+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41474+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41475+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41476+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41477+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41478+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41479+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41480+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41481+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41482+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41483+4 4 4 4 4 4
41484+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41485+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41486+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41487+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41488+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41489+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41490+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41491+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41492+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41493+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41494+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41495+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41496+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41497+4 4 4 4 4 4
41498+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41499+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
41500+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41501+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
41502+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
41503+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
41504+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
41505+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
41506+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41507+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41508+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41509+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41510+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41511+4 4 4 4 4 4
41512+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41513+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
41514+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
41515+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
41516+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
41517+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
41518+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41519+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41520+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41521+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41522+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41523+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41524+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41525+4 4 4 4 4 4
41526+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41527+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41528+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41529+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41530+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41531+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41532+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41533+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41534+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41535+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41536+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41537+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41538+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41539+4 4 4 4 4 4
41540+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41541+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41542+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41543+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41544+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41545+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41546+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41547+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41548+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41549+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41550+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41551+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41552+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41553+4 4 4 4 4 4
41554+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41555+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41556+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41557+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41558+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41559+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41560+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41561+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41562+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41563+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41564+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41565+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41566+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41567+4 4 4 4 4 4
41568+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41569+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41570+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41571+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41572+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41573+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41574+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41575+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41576+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41577+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41578+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41579+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41580+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41581+4 4 4 4 4 4
41582+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41583+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41584+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41585+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41586+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41587+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41588+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41589+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41590+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41591+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41592+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41593+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41594+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41595+4 4 4 4 4 4
41596+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41597+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41598+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41599+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41600+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41601+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41602+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41603+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41604+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41605+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41606+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41607+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41608+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41609+4 4 4 4 4 4
41610+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41611+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41612+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41613+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41614+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41615+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41616+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41617+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41618+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41619+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41620+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41621+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41622+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41623+4 4 4 4 4 4
41624+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41625+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41626+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41627+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41628+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41629+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41630+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41631+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41632+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41633+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41634+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41635+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41636+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41637+4 4 4 4 4 4
41638+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41639+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41640+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41641+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41642+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41643+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41644+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41645+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41646+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41647+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41648+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41649+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41650+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41651+4 4 4 4 4 4
41652+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41653+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41654+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41655+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41656+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41657+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41658+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41659+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41660+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41661+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41662+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41663+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41664+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41665+4 4 4 4 4 4
41666+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41667+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41668+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41669+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41670+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41671+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41672+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41673+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41674+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41675+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41676+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41677+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41678+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41679+4 4 4 4 4 4
41680diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
41681index 087fc99..f85ed76 100644
41682--- a/drivers/video/udlfb.c
41683+++ b/drivers/video/udlfb.c
41684@@ -585,11 +585,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
41685 dlfb_urb_completion(urb);
41686
41687 error:
41688- atomic_add(bytes_sent, &dev->bytes_sent);
41689- atomic_add(bytes_identical, &dev->bytes_identical);
41690- atomic_add(width*height*2, &dev->bytes_rendered);
41691+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41692+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41693+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
41694 end_cycles = get_cycles();
41695- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41696+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41697 >> 10)), /* Kcycles */
41698 &dev->cpu_kcycles_used);
41699
41700@@ -710,11 +710,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
41701 dlfb_urb_completion(urb);
41702
41703 error:
41704- atomic_add(bytes_sent, &dev->bytes_sent);
41705- atomic_add(bytes_identical, &dev->bytes_identical);
41706- atomic_add(bytes_rendered, &dev->bytes_rendered);
41707+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41708+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41709+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
41710 end_cycles = get_cycles();
41711- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41712+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41713 >> 10)), /* Kcycles */
41714 &dev->cpu_kcycles_used);
41715 }
41716@@ -1306,7 +1306,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
41717 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41718 struct dlfb_data *dev = fb_info->par;
41719 return snprintf(buf, PAGE_SIZE, "%u\n",
41720- atomic_read(&dev->bytes_rendered));
41721+ atomic_read_unchecked(&dev->bytes_rendered));
41722 }
41723
41724 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41725@@ -1314,7 +1314,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41726 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41727 struct dlfb_data *dev = fb_info->par;
41728 return snprintf(buf, PAGE_SIZE, "%u\n",
41729- atomic_read(&dev->bytes_identical));
41730+ atomic_read_unchecked(&dev->bytes_identical));
41731 }
41732
41733 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41734@@ -1322,7 +1322,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41735 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41736 struct dlfb_data *dev = fb_info->par;
41737 return snprintf(buf, PAGE_SIZE, "%u\n",
41738- atomic_read(&dev->bytes_sent));
41739+ atomic_read_unchecked(&dev->bytes_sent));
41740 }
41741
41742 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41743@@ -1330,7 +1330,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41744 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41745 struct dlfb_data *dev = fb_info->par;
41746 return snprintf(buf, PAGE_SIZE, "%u\n",
41747- atomic_read(&dev->cpu_kcycles_used));
41748+ atomic_read_unchecked(&dev->cpu_kcycles_used));
41749 }
41750
41751 static ssize_t edid_show(
41752@@ -1387,10 +1387,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
41753 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41754 struct dlfb_data *dev = fb_info->par;
41755
41756- atomic_set(&dev->bytes_rendered, 0);
41757- atomic_set(&dev->bytes_identical, 0);
41758- atomic_set(&dev->bytes_sent, 0);
41759- atomic_set(&dev->cpu_kcycles_used, 0);
41760+ atomic_set_unchecked(&dev->bytes_rendered, 0);
41761+ atomic_set_unchecked(&dev->bytes_identical, 0);
41762+ atomic_set_unchecked(&dev->bytes_sent, 0);
41763+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
41764
41765 return count;
41766 }
41767diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
41768index 7f8472c..9842e87 100644
41769--- a/drivers/video/uvesafb.c
41770+++ b/drivers/video/uvesafb.c
41771@@ -19,6 +19,7 @@
41772 #include <linux/io.h>
41773 #include <linux/mutex.h>
41774 #include <linux/slab.h>
41775+#include <linux/moduleloader.h>
41776 #include <video/edid.h>
41777 #include <video/uvesafb.h>
41778 #ifdef CONFIG_X86
41779@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
41780 NULL,
41781 };
41782
41783- return call_usermodehelper(v86d_path, argv, envp, 1);
41784+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
41785 }
41786
41787 /*
41788@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
41789 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
41790 par->pmi_setpal = par->ypan = 0;
41791 } else {
41792+
41793+#ifdef CONFIG_PAX_KERNEXEC
41794+#ifdef CONFIG_MODULES
41795+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
41796+#endif
41797+ if (!par->pmi_code) {
41798+ par->pmi_setpal = par->ypan = 0;
41799+ return 0;
41800+ }
41801+#endif
41802+
41803 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
41804 + task->t.regs.edi);
41805+
41806+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41807+ pax_open_kernel();
41808+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
41809+ pax_close_kernel();
41810+
41811+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
41812+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
41813+#else
41814 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
41815 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
41816+#endif
41817+
41818 printk(KERN_INFO "uvesafb: protected mode interface info at "
41819 "%04x:%04x\n",
41820 (u16)task->t.regs.es, (u16)task->t.regs.edi);
41821@@ -1821,6 +1844,11 @@ out:
41822 if (par->vbe_modes)
41823 kfree(par->vbe_modes);
41824
41825+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41826+ if (par->pmi_code)
41827+ module_free_exec(NULL, par->pmi_code);
41828+#endif
41829+
41830 framebuffer_release(info);
41831 return err;
41832 }
41833@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platform_device *dev)
41834 kfree(par->vbe_state_orig);
41835 if (par->vbe_state_saved)
41836 kfree(par->vbe_state_saved);
41837+
41838+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41839+ if (par->pmi_code)
41840+ module_free_exec(NULL, par->pmi_code);
41841+#endif
41842+
41843 }
41844
41845 framebuffer_release(info);
41846diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
41847index 501b340..86bd4cf 100644
41848--- a/drivers/video/vesafb.c
41849+++ b/drivers/video/vesafb.c
41850@@ -9,6 +9,7 @@
41851 */
41852
41853 #include <linux/module.h>
41854+#include <linux/moduleloader.h>
41855 #include <linux/kernel.h>
41856 #include <linux/errno.h>
41857 #include <linux/string.h>
41858@@ -52,8 +53,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
41859 static int vram_total __initdata; /* Set total amount of memory */
41860 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
41861 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
41862-static void (*pmi_start)(void) __read_mostly;
41863-static void (*pmi_pal) (void) __read_mostly;
41864+static void (*pmi_start)(void) __read_only;
41865+static void (*pmi_pal) (void) __read_only;
41866 static int depth __read_mostly;
41867 static int vga_compat __read_mostly;
41868 /* --------------------------------------------------------------------- */
41869@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
41870 unsigned int size_vmode;
41871 unsigned int size_remap;
41872 unsigned int size_total;
41873+ void *pmi_code = NULL;
41874
41875 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
41876 return -ENODEV;
41877@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
41878 size_remap = size_total;
41879 vesafb_fix.smem_len = size_remap;
41880
41881-#ifndef __i386__
41882- screen_info.vesapm_seg = 0;
41883-#endif
41884-
41885 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
41886 printk(KERN_WARNING
41887 "vesafb: cannot reserve video memory at 0x%lx\n",
41888@@ -307,9 +305,21 @@ static int __init vesafb_probe(struct platform_device *dev)
41889 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
41890 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
41891
41892+#ifdef __i386__
41893+
41894+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41895+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
41896+ if (!pmi_code)
41897+#elif !defined(CONFIG_PAX_KERNEXEC)
41898+ if (0)
41899+#endif
41900+
41901+#endif
41902+ screen_info.vesapm_seg = 0;
41903+
41904 if (screen_info.vesapm_seg) {
41905- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
41906- screen_info.vesapm_seg,screen_info.vesapm_off);
41907+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
41908+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
41909 }
41910
41911 if (screen_info.vesapm_seg < 0xc000)
41912@@ -317,9 +327,25 @@ static int __init vesafb_probe(struct platform_device *dev)
41913
41914 if (ypan || pmi_setpal) {
41915 unsigned short *pmi_base;
41916+
41917 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
41918- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
41919- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
41920+
41921+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41922+ pax_open_kernel();
41923+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
41924+#else
41925+ pmi_code = pmi_base;
41926+#endif
41927+
41928+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
41929+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
41930+
41931+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41932+ pmi_start = ktva_ktla(pmi_start);
41933+ pmi_pal = ktva_ktla(pmi_pal);
41934+ pax_close_kernel();
41935+#endif
41936+
41937 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
41938 if (pmi_base[3]) {
41939 printk(KERN_INFO "vesafb: pmi: ports = ");
41940@@ -488,6 +514,11 @@ static int __init vesafb_probe(struct platform_device *dev)
41941 info->node, info->fix.id);
41942 return 0;
41943 err:
41944+
41945+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41946+ module_free_exec(NULL, pmi_code);
41947+#endif
41948+
41949 if (info->screen_base)
41950 iounmap(info->screen_base);
41951 framebuffer_release(info);
41952diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
41953index 88714ae..16c2e11 100644
41954--- a/drivers/video/via/via_clock.h
41955+++ b/drivers/video/via/via_clock.h
41956@@ -56,7 +56,7 @@ struct via_clock {
41957
41958 void (*set_engine_pll_state)(u8 state);
41959 void (*set_engine_pll)(struct via_pll_config config);
41960-};
41961+} __no_const;
41962
41963
41964 static inline u32 get_pll_internal_frequency(u32 ref_freq,
41965diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
41966index e058ace..2424d93 100644
41967--- a/drivers/virtio/virtio_balloon.c
41968+++ b/drivers/virtio/virtio_balloon.c
41969@@ -174,6 +174,8 @@ static void update_balloon_stats(struct virtio_balloon *vb)
41970 struct sysinfo i;
41971 int idx = 0;
41972
41973+ pax_track_stack();
41974+
41975 all_vm_events(events);
41976 si_meminfo(&i);
41977
41978diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
41979index e56c934..fc22f4b 100644
41980--- a/drivers/xen/xen-pciback/conf_space.h
41981+++ b/drivers/xen/xen-pciback/conf_space.h
41982@@ -44,15 +44,15 @@ struct config_field {
41983 struct {
41984 conf_dword_write write;
41985 conf_dword_read read;
41986- } dw;
41987+ } __no_const dw;
41988 struct {
41989 conf_word_write write;
41990 conf_word_read read;
41991- } w;
41992+ } __no_const w;
41993 struct {
41994 conf_byte_write write;
41995 conf_byte_read read;
41996- } b;
41997+ } __no_const b;
41998 } u;
41999 struct list_head list;
42000 };
42001diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
42002index e3c03db..93b0172 100644
42003--- a/fs/9p/vfs_inode.c
42004+++ b/fs/9p/vfs_inode.c
42005@@ -1288,7 +1288,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
42006 void
42007 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
42008 {
42009- char *s = nd_get_link(nd);
42010+ const char *s = nd_get_link(nd);
42011
42012 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
42013 IS_ERR(s) ? "<error>" : s);
42014diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
42015index 79e2ca7..5828ad1 100644
42016--- a/fs/Kconfig.binfmt
42017+++ b/fs/Kconfig.binfmt
42018@@ -86,7 +86,7 @@ config HAVE_AOUT
42019
42020 config BINFMT_AOUT
42021 tristate "Kernel support for a.out and ECOFF binaries"
42022- depends on HAVE_AOUT
42023+ depends on HAVE_AOUT && BROKEN
42024 ---help---
42025 A.out (Assembler.OUTput) is a set of formats for libraries and
42026 executables used in the earliest versions of UNIX. Linux used
42027diff --git a/fs/aio.c b/fs/aio.c
42028index e29ec48..f083e5e 100644
42029--- a/fs/aio.c
42030+++ b/fs/aio.c
42031@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
42032 size += sizeof(struct io_event) * nr_events;
42033 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
42034
42035- if (nr_pages < 0)
42036+ if (nr_pages <= 0)
42037 return -EINVAL;
42038
42039 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
42040@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ctx,
42041 struct aio_timeout to;
42042 int retry = 0;
42043
42044+ pax_track_stack();
42045+
42046 /* needed to zero any padding within an entry (there shouldn't be
42047 * any, but C is fun!
42048 */
42049@@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
42050 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
42051 {
42052 ssize_t ret;
42053+ struct iovec iovstack;
42054
42055 #ifdef CONFIG_COMPAT
42056 if (compat)
42057 ret = compat_rw_copy_check_uvector(type,
42058 (struct compat_iovec __user *)kiocb->ki_buf,
42059- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
42060+ kiocb->ki_nbytes, 1, &iovstack,
42061 &kiocb->ki_iovec);
42062 else
42063 #endif
42064 ret = rw_copy_check_uvector(type,
42065 (struct iovec __user *)kiocb->ki_buf,
42066- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
42067+ kiocb->ki_nbytes, 1, &iovstack,
42068 &kiocb->ki_iovec);
42069 if (ret < 0)
42070 goto out;
42071
42072+ if (kiocb->ki_iovec == &iovstack) {
42073+ kiocb->ki_inline_vec = iovstack;
42074+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
42075+ }
42076 kiocb->ki_nr_segs = kiocb->ki_nbytes;
42077 kiocb->ki_cur_seg = 0;
42078 /* ki_nbytes/left now reflect bytes instead of segs */
42079diff --git a/fs/attr.c b/fs/attr.c
42080index 538e279..046cc6d 100644
42081--- a/fs/attr.c
42082+++ b/fs/attr.c
42083@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
42084 unsigned long limit;
42085
42086 limit = rlimit(RLIMIT_FSIZE);
42087+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
42088 if (limit != RLIM_INFINITY && offset > limit)
42089 goto out_sig;
42090 if (offset > inode->i_sb->s_maxbytes)
42091diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
42092index e1fbdee..cd5ea56 100644
42093--- a/fs/autofs4/waitq.c
42094+++ b/fs/autofs4/waitq.c
42095@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
42096 {
42097 unsigned long sigpipe, flags;
42098 mm_segment_t fs;
42099- const char *data = (const char *)addr;
42100+ const char __user *data = (const char __force_user *)addr;
42101 ssize_t wr = 0;
42102
42103 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
42104diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
42105index 720d885..012e7f0 100644
42106--- a/fs/befs/linuxvfs.c
42107+++ b/fs/befs/linuxvfs.c
42108@@ -503,7 +503,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
42109 {
42110 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
42111 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
42112- char *link = nd_get_link(nd);
42113+ const char *link = nd_get_link(nd);
42114 if (!IS_ERR(link))
42115 kfree(link);
42116 }
42117diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
42118index a6395bd..a5b24c4 100644
42119--- a/fs/binfmt_aout.c
42120+++ b/fs/binfmt_aout.c
42121@@ -16,6 +16,7 @@
42122 #include <linux/string.h>
42123 #include <linux/fs.h>
42124 #include <linux/file.h>
42125+#include <linux/security.h>
42126 #include <linux/stat.h>
42127 #include <linux/fcntl.h>
42128 #include <linux/ptrace.h>
42129@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredump_params *cprm)
42130 #endif
42131 # define START_STACK(u) ((void __user *)u.start_stack)
42132
42133+ memset(&dump, 0, sizeof(dump));
42134+
42135 fs = get_fs();
42136 set_fs(KERNEL_DS);
42137 has_dumped = 1;
42138@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredump_params *cprm)
42139
42140 /* If the size of the dump file exceeds the rlimit, then see what would happen
42141 if we wrote the stack, but not the data area. */
42142+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
42143 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
42144 dump.u_dsize = 0;
42145
42146 /* Make sure we have enough room to write the stack and data areas. */
42147+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
42148 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
42149 dump.u_ssize = 0;
42150
42151@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42152 rlim = rlimit(RLIMIT_DATA);
42153 if (rlim >= RLIM_INFINITY)
42154 rlim = ~0;
42155+
42156+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
42157 if (ex.a_data + ex.a_bss > rlim)
42158 return -ENOMEM;
42159
42160@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42161 install_exec_creds(bprm);
42162 current->flags &= ~PF_FORKNOEXEC;
42163
42164+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42165+ current->mm->pax_flags = 0UL;
42166+#endif
42167+
42168+#ifdef CONFIG_PAX_PAGEEXEC
42169+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
42170+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
42171+
42172+#ifdef CONFIG_PAX_EMUTRAMP
42173+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
42174+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
42175+#endif
42176+
42177+#ifdef CONFIG_PAX_MPROTECT
42178+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
42179+ current->mm->pax_flags |= MF_PAX_MPROTECT;
42180+#endif
42181+
42182+ }
42183+#endif
42184+
42185 if (N_MAGIC(ex) == OMAGIC) {
42186 unsigned long text_addr, map_size;
42187 loff_t pos;
42188@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42189
42190 down_write(&current->mm->mmap_sem);
42191 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
42192- PROT_READ | PROT_WRITE | PROT_EXEC,
42193+ PROT_READ | PROT_WRITE,
42194 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
42195 fd_offset + ex.a_text);
42196 up_write(&current->mm->mmap_sem);
42197diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
42198index 21ac5ee..f54fdd0 100644
42199--- a/fs/binfmt_elf.c
42200+++ b/fs/binfmt_elf.c
42201@@ -32,6 +32,7 @@
42202 #include <linux/elf.h>
42203 #include <linux/utsname.h>
42204 #include <linux/coredump.h>
42205+#include <linux/xattr.h>
42206 #include <asm/uaccess.h>
42207 #include <asm/param.h>
42208 #include <asm/page.h>
42209@@ -51,6 +52,10 @@ static int elf_core_dump(struct coredump_params *cprm);
42210 #define elf_core_dump NULL
42211 #endif
42212
42213+#ifdef CONFIG_PAX_MPROTECT
42214+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
42215+#endif
42216+
42217 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
42218 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
42219 #else
42220@@ -70,6 +75,11 @@ static struct linux_binfmt elf_format = {
42221 .load_binary = load_elf_binary,
42222 .load_shlib = load_elf_library,
42223 .core_dump = elf_core_dump,
42224+
42225+#ifdef CONFIG_PAX_MPROTECT
42226+ .handle_mprotect= elf_handle_mprotect,
42227+#endif
42228+
42229 .min_coredump = ELF_EXEC_PAGESIZE,
42230 };
42231
42232@@ -77,6 +87,8 @@ static struct linux_binfmt elf_format = {
42233
42234 static int set_brk(unsigned long start, unsigned long end)
42235 {
42236+ unsigned long e = end;
42237+
42238 start = ELF_PAGEALIGN(start);
42239 end = ELF_PAGEALIGN(end);
42240 if (end > start) {
42241@@ -87,7 +99,7 @@ static int set_brk(unsigned long start, unsigned long end)
42242 if (BAD_ADDR(addr))
42243 return addr;
42244 }
42245- current->mm->start_brk = current->mm->brk = end;
42246+ current->mm->start_brk = current->mm->brk = e;
42247 return 0;
42248 }
42249
42250@@ -148,12 +160,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42251 elf_addr_t __user *u_rand_bytes;
42252 const char *k_platform = ELF_PLATFORM;
42253 const char *k_base_platform = ELF_BASE_PLATFORM;
42254- unsigned char k_rand_bytes[16];
42255+ u32 k_rand_bytes[4];
42256 int items;
42257 elf_addr_t *elf_info;
42258 int ei_index = 0;
42259 const struct cred *cred = current_cred();
42260 struct vm_area_struct *vma;
42261+ unsigned long saved_auxv[AT_VECTOR_SIZE];
42262+
42263+ pax_track_stack();
42264
42265 /*
42266 * In some cases (e.g. Hyper-Threading), we want to avoid L1
42267@@ -195,8 +210,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42268 * Generate 16 random bytes for userspace PRNG seeding.
42269 */
42270 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
42271- u_rand_bytes = (elf_addr_t __user *)
42272- STACK_ALLOC(p, sizeof(k_rand_bytes));
42273+ srandom32(k_rand_bytes[0] ^ random32());
42274+ srandom32(k_rand_bytes[1] ^ random32());
42275+ srandom32(k_rand_bytes[2] ^ random32());
42276+ srandom32(k_rand_bytes[3] ^ random32());
42277+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
42278+ u_rand_bytes = (elf_addr_t __user *) p;
42279 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
42280 return -EFAULT;
42281
42282@@ -308,9 +327,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42283 return -EFAULT;
42284 current->mm->env_end = p;
42285
42286+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
42287+
42288 /* Put the elf_info on the stack in the right place. */
42289 sp = (elf_addr_t __user *)envp + 1;
42290- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
42291+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
42292 return -EFAULT;
42293 return 0;
42294 }
42295@@ -381,10 +402,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42296 {
42297 struct elf_phdr *elf_phdata;
42298 struct elf_phdr *eppnt;
42299- unsigned long load_addr = 0;
42300+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
42301 int load_addr_set = 0;
42302 unsigned long last_bss = 0, elf_bss = 0;
42303- unsigned long error = ~0UL;
42304+ unsigned long error = -EINVAL;
42305 unsigned long total_size;
42306 int retval, i, size;
42307
42308@@ -430,6 +451,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42309 goto out_close;
42310 }
42311
42312+#ifdef CONFIG_PAX_SEGMEXEC
42313+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
42314+ pax_task_size = SEGMEXEC_TASK_SIZE;
42315+#endif
42316+
42317 eppnt = elf_phdata;
42318 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
42319 if (eppnt->p_type == PT_LOAD) {
42320@@ -473,8 +499,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42321 k = load_addr + eppnt->p_vaddr;
42322 if (BAD_ADDR(k) ||
42323 eppnt->p_filesz > eppnt->p_memsz ||
42324- eppnt->p_memsz > TASK_SIZE ||
42325- TASK_SIZE - eppnt->p_memsz < k) {
42326+ eppnt->p_memsz > pax_task_size ||
42327+ pax_task_size - eppnt->p_memsz < k) {
42328 error = -ENOMEM;
42329 goto out_close;
42330 }
42331@@ -528,6 +554,348 @@ out:
42332 return error;
42333 }
42334
42335+static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
42336+{
42337+ unsigned long pax_flags = 0UL;
42338+
42339+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42340+
42341+#ifdef CONFIG_PAX_PAGEEXEC
42342+ if (elf_phdata->p_flags & PF_PAGEEXEC)
42343+ pax_flags |= MF_PAX_PAGEEXEC;
42344+#endif
42345+
42346+#ifdef CONFIG_PAX_SEGMEXEC
42347+ if (elf_phdata->p_flags & PF_SEGMEXEC)
42348+ pax_flags |= MF_PAX_SEGMEXEC;
42349+#endif
42350+
42351+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42352+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42353+ if ((__supported_pte_mask & _PAGE_NX))
42354+ pax_flags &= ~MF_PAX_SEGMEXEC;
42355+ else
42356+ pax_flags &= ~MF_PAX_PAGEEXEC;
42357+ }
42358+#endif
42359+
42360+#ifdef CONFIG_PAX_EMUTRAMP
42361+ if (elf_phdata->p_flags & PF_EMUTRAMP)
42362+ pax_flags |= MF_PAX_EMUTRAMP;
42363+#endif
42364+
42365+#ifdef CONFIG_PAX_MPROTECT
42366+ if (elf_phdata->p_flags & PF_MPROTECT)
42367+ pax_flags |= MF_PAX_MPROTECT;
42368+#endif
42369+
42370+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42371+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42372+ pax_flags |= MF_PAX_RANDMMAP;
42373+#endif
42374+
42375+#endif
42376+
42377+ return pax_flags;
42378+}
42379+
42380+static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
42381+{
42382+ unsigned long pax_flags = 0UL;
42383+
42384+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42385+
42386+#ifdef CONFIG_PAX_PAGEEXEC
42387+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42388+ pax_flags |= MF_PAX_PAGEEXEC;
42389+#endif
42390+
42391+#ifdef CONFIG_PAX_SEGMEXEC
42392+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42393+ pax_flags |= MF_PAX_SEGMEXEC;
42394+#endif
42395+
42396+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42397+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42398+ if ((__supported_pte_mask & _PAGE_NX))
42399+ pax_flags &= ~MF_PAX_SEGMEXEC;
42400+ else
42401+ pax_flags &= ~MF_PAX_PAGEEXEC;
42402+ }
42403+#endif
42404+
42405+#ifdef CONFIG_PAX_EMUTRAMP
42406+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42407+ pax_flags |= MF_PAX_EMUTRAMP;
42408+#endif
42409+
42410+#ifdef CONFIG_PAX_MPROTECT
42411+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42412+ pax_flags |= MF_PAX_MPROTECT;
42413+#endif
42414+
42415+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42416+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42417+ pax_flags |= MF_PAX_RANDMMAP;
42418+#endif
42419+
42420+#endif
42421+
42422+ return pax_flags;
42423+}
42424+
42425+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42426+{
42427+ unsigned long pax_flags = 0UL;
42428+
42429+#ifdef CONFIG_PAX_EI_PAX
42430+
42431+#ifdef CONFIG_PAX_PAGEEXEC
42432+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42433+ pax_flags |= MF_PAX_PAGEEXEC;
42434+#endif
42435+
42436+#ifdef CONFIG_PAX_SEGMEXEC
42437+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42438+ pax_flags |= MF_PAX_SEGMEXEC;
42439+#endif
42440+
42441+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42442+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42443+ if ((__supported_pte_mask & _PAGE_NX))
42444+ pax_flags &= ~MF_PAX_SEGMEXEC;
42445+ else
42446+ pax_flags &= ~MF_PAX_PAGEEXEC;
42447+ }
42448+#endif
42449+
42450+#ifdef CONFIG_PAX_EMUTRAMP
42451+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42452+ pax_flags |= MF_PAX_EMUTRAMP;
42453+#endif
42454+
42455+#ifdef CONFIG_PAX_MPROTECT
42456+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42457+ pax_flags |= MF_PAX_MPROTECT;
42458+#endif
42459+
42460+#ifdef CONFIG_PAX_ASLR
42461+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42462+ pax_flags |= MF_PAX_RANDMMAP;
42463+#endif
42464+
42465+#else
42466+
42467+#ifdef CONFIG_PAX_PAGEEXEC
42468+ pax_flags |= MF_PAX_PAGEEXEC;
42469+#endif
42470+
42471+#ifdef CONFIG_PAX_MPROTECT
42472+ pax_flags |= MF_PAX_MPROTECT;
42473+#endif
42474+
42475+#ifdef CONFIG_PAX_RANDMMAP
42476+ pax_flags |= MF_PAX_RANDMMAP;
42477+#endif
42478+
42479+#ifdef CONFIG_PAX_SEGMEXEC
42480+ if (!(__supported_pte_mask & _PAGE_NX)) {
42481+ pax_flags &= ~MF_PAX_PAGEEXEC;
42482+ pax_flags |= MF_PAX_SEGMEXEC;
42483+ }
42484+#endif
42485+
42486+#endif
42487+
42488+ return pax_flags;
42489+}
42490+
42491+static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42492+{
42493+
42494+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42495+ unsigned long i;
42496+
42497+ for (i = 0UL; i < elf_ex->e_phnum; i++)
42498+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42499+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42500+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42501+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42502+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42503+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42504+ return ~0UL;
42505+
42506+#ifdef CONFIG_PAX_SOFTMODE
42507+ if (pax_softmode)
42508+ return pax_parse_pt_pax_softmode(&elf_phdata[i]);
42509+ else
42510+#endif
42511+
42512+ return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
42513+ break;
42514+ }
42515+#endif
42516+
42517+ return ~0UL;
42518+}
42519+
42520+static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
42521+{
42522+ unsigned long pax_flags = 0UL;
42523+
42524+#ifdef CONFIG_PAX_PAGEEXEC
42525+ if (pax_flags_softmode & MF_PAX_PAGEEXEC)
42526+ pax_flags |= MF_PAX_PAGEEXEC;
42527+#endif
42528+
42529+#ifdef CONFIG_PAX_SEGMEXEC
42530+ if (pax_flags_softmode & MF_PAX_SEGMEXEC)
42531+ pax_flags |= MF_PAX_SEGMEXEC;
42532+#endif
42533+
42534+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42535+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42536+ if ((__supported_pte_mask & _PAGE_NX))
42537+ pax_flags &= ~MF_PAX_SEGMEXEC;
42538+ else
42539+ pax_flags &= ~MF_PAX_PAGEEXEC;
42540+ }
42541+#endif
42542+
42543+#ifdef CONFIG_PAX_EMUTRAMP
42544+ if (pax_flags_softmode & MF_PAX_EMUTRAMP)
42545+ pax_flags |= MF_PAX_EMUTRAMP;
42546+#endif
42547+
42548+#ifdef CONFIG_PAX_MPROTECT
42549+ if (pax_flags_softmode & MF_PAX_MPROTECT)
42550+ pax_flags |= MF_PAX_MPROTECT;
42551+#endif
42552+
42553+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42554+ if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
42555+ pax_flags |= MF_PAX_RANDMMAP;
42556+#endif
42557+
42558+ return pax_flags;
42559+}
42560+
42561+static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
42562+{
42563+ unsigned long pax_flags = 0UL;
42564+
42565+#ifdef CONFIG_PAX_PAGEEXEC
42566+ if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
42567+ pax_flags |= MF_PAX_PAGEEXEC;
42568+#endif
42569+
42570+#ifdef CONFIG_PAX_SEGMEXEC
42571+ if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
42572+ pax_flags |= MF_PAX_SEGMEXEC;
42573+#endif
42574+
42575+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42576+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42577+ if ((__supported_pte_mask & _PAGE_NX))
42578+ pax_flags &= ~MF_PAX_SEGMEXEC;
42579+ else
42580+ pax_flags &= ~MF_PAX_PAGEEXEC;
42581+ }
42582+#endif
42583+
42584+#ifdef CONFIG_PAX_EMUTRAMP
42585+ if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
42586+ pax_flags |= MF_PAX_EMUTRAMP;
42587+#endif
42588+
42589+#ifdef CONFIG_PAX_MPROTECT
42590+ if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
42591+ pax_flags |= MF_PAX_MPROTECT;
42592+#endif
42593+
42594+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42595+ if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
42596+ pax_flags |= MF_PAX_RANDMMAP;
42597+#endif
42598+
42599+ return pax_flags;
42600+}
42601+
42602+static unsigned long pax_parse_xattr_pax(struct file * const file)
42603+{
42604+
42605+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
42606+ ssize_t xattr_size, i;
42607+ unsigned char xattr_value[5];
42608+ unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
42609+
42610+ xattr_size = vfs_getxattr(file->f_path.dentry, XATTR_NAME_PAX_FLAGS, xattr_value, sizeof xattr_value);
42611+ if (xattr_size <= 0)
42612+ return ~0UL;
42613+
42614+ for (i = 0; i < xattr_size; i++)
42615+ switch (xattr_value[i]) {
42616+ default:
42617+ return ~0UL;
42618+
42619+#define parse_flag(option1, option2, flag) \
42620+ case option1: \
42621+ pax_flags_hardmode |= MF_PAX_##flag; \
42622+ break; \
42623+ case option2: \
42624+ pax_flags_softmode |= MF_PAX_##flag; \
42625+ break;
42626+
42627+ parse_flag('p', 'P', PAGEEXEC);
42628+ parse_flag('e', 'E', EMUTRAMP);
42629+ parse_flag('m', 'M', MPROTECT);
42630+ parse_flag('r', 'R', RANDMMAP);
42631+ parse_flag('s', 'S', SEGMEXEC);
42632+
42633+#undef parse_flag
42634+ }
42635+
42636+ if (pax_flags_hardmode & pax_flags_softmode)
42637+ return ~0UL;
42638+
42639+#ifdef CONFIG_PAX_SOFTMODE
42640+ if (pax_softmode)
42641+ return pax_parse_xattr_pax_softmode(pax_flags_softmode);
42642+ else
42643+#endif
42644+
42645+ return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
42646+#else
42647+ return ~0UL;
42648+#endif
42649+}
42650+
42651+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
42652+static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
42653+{
42654+ unsigned long pax_flags, pt_pax_flags, xattr_pax_flags;
42655+
42656+ pax_flags = pax_parse_ei_pax(elf_ex);
42657+ pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
42658+ xattr_pax_flags = pax_parse_xattr_pax(file);
42659+
42660+ if (pt_pax_flags == ~0UL)
42661+ pt_pax_flags = xattr_pax_flags;
42662+ else if (xattr_pax_flags == ~0UL)
42663+ xattr_pax_flags = pt_pax_flags;
42664+ if (pt_pax_flags != xattr_pax_flags)
42665+ return -EINVAL;
42666+ if (pt_pax_flags != ~0UL)
42667+ pax_flags = pt_pax_flags;
42668+
42669+ if (0 > pax_check_flags(&pax_flags))
42670+ return -EINVAL;
42671+
42672+ current->mm->pax_flags = pax_flags;
42673+ return 0;
42674+}
42675+#endif
42676+
42677 /*
42678 * These are the functions used to load ELF style executables and shared
42679 * libraries. There is no binary dependent code anywhere else.
42680@@ -544,6 +912,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
42681 {
42682 unsigned int random_variable = 0;
42683
42684+#ifdef CONFIG_PAX_RANDUSTACK
42685+ if (randomize_va_space)
42686+ return stack_top - current->mm->delta_stack;
42687+#endif
42688+
42689 if ((current->flags & PF_RANDOMIZE) &&
42690 !(current->personality & ADDR_NO_RANDOMIZE)) {
42691 random_variable = get_random_int() & STACK_RND_MASK;
42692@@ -562,7 +935,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42693 unsigned long load_addr = 0, load_bias = 0;
42694 int load_addr_set = 0;
42695 char * elf_interpreter = NULL;
42696- unsigned long error;
42697+ unsigned long error = 0;
42698 struct elf_phdr *elf_ppnt, *elf_phdata;
42699 unsigned long elf_bss, elf_brk;
42700 int retval, i;
42701@@ -572,11 +945,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42702 unsigned long start_code, end_code, start_data, end_data;
42703 unsigned long reloc_func_desc __maybe_unused = 0;
42704 int executable_stack = EXSTACK_DEFAULT;
42705- unsigned long def_flags = 0;
42706 struct {
42707 struct elfhdr elf_ex;
42708 struct elfhdr interp_elf_ex;
42709 } *loc;
42710+ unsigned long pax_task_size = TASK_SIZE;
42711
42712 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42713 if (!loc) {
42714@@ -713,11 +1086,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42715
42716 /* OK, This is the point of no return */
42717 current->flags &= ~PF_FORKNOEXEC;
42718- current->mm->def_flags = def_flags;
42719+
42720+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42721+ current->mm->pax_flags = 0UL;
42722+#endif
42723+
42724+#ifdef CONFIG_PAX_DLRESOLVE
42725+ current->mm->call_dl_resolve = 0UL;
42726+#endif
42727+
42728+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42729+ current->mm->call_syscall = 0UL;
42730+#endif
42731+
42732+#ifdef CONFIG_PAX_ASLR
42733+ current->mm->delta_mmap = 0UL;
42734+ current->mm->delta_stack = 0UL;
42735+#endif
42736+
42737+ current->mm->def_flags = 0;
42738+
42739+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
42740+ if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
42741+ send_sig(SIGKILL, current, 0);
42742+ goto out_free_dentry;
42743+ }
42744+#endif
42745+
42746+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
42747+ pax_set_initial_flags(bprm);
42748+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
42749+ if (pax_set_initial_flags_func)
42750+ (pax_set_initial_flags_func)(bprm);
42751+#endif
42752+
42753+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
42754+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
42755+ current->mm->context.user_cs_limit = PAGE_SIZE;
42756+ current->mm->def_flags |= VM_PAGEEXEC;
42757+ }
42758+#endif
42759+
42760+#ifdef CONFIG_PAX_SEGMEXEC
42761+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
42762+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
42763+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
42764+ pax_task_size = SEGMEXEC_TASK_SIZE;
42765+ current->mm->def_flags |= VM_NOHUGEPAGE;
42766+ }
42767+#endif
42768+
42769+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
42770+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42771+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
42772+ put_cpu();
42773+ }
42774+#endif
42775
42776 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
42777 may depend on the personality. */
42778 SET_PERSONALITY(loc->elf_ex);
42779+
42780+#ifdef CONFIG_PAX_ASLR
42781+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
42782+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
42783+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
42784+ }
42785+#endif
42786+
42787+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
42788+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42789+ executable_stack = EXSTACK_DISABLE_X;
42790+ current->personality &= ~READ_IMPLIES_EXEC;
42791+ } else
42792+#endif
42793+
42794 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
42795 current->personality |= READ_IMPLIES_EXEC;
42796
42797@@ -808,6 +1251,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42798 #else
42799 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
42800 #endif
42801+
42802+#ifdef CONFIG_PAX_RANDMMAP
42803+ /* PaX: randomize base address at the default exe base if requested */
42804+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
42805+#ifdef CONFIG_SPARC64
42806+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
42807+#else
42808+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
42809+#endif
42810+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
42811+ elf_flags |= MAP_FIXED;
42812+ }
42813+#endif
42814+
42815 }
42816
42817 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
42818@@ -840,9 +1297,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42819 * allowed task size. Note that p_filesz must always be
42820 * <= p_memsz so it is only necessary to check p_memsz.
42821 */
42822- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42823- elf_ppnt->p_memsz > TASK_SIZE ||
42824- TASK_SIZE - elf_ppnt->p_memsz < k) {
42825+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42826+ elf_ppnt->p_memsz > pax_task_size ||
42827+ pax_task_size - elf_ppnt->p_memsz < k) {
42828 /* set_brk can never work. Avoid overflows. */
42829 send_sig(SIGKILL, current, 0);
42830 retval = -EINVAL;
42831@@ -870,6 +1327,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42832 start_data += load_bias;
42833 end_data += load_bias;
42834
42835+#ifdef CONFIG_PAX_RANDMMAP
42836+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
42837+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
42838+#endif
42839+
42840 /* Calling set_brk effectively mmaps the pages that we need
42841 * for the bss and break sections. We must do this before
42842 * mapping in the interpreter, to make sure it doesn't wind
42843@@ -881,9 +1343,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42844 goto out_free_dentry;
42845 }
42846 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
42847- send_sig(SIGSEGV, current, 0);
42848- retval = -EFAULT; /* Nobody gets to see this, but.. */
42849- goto out_free_dentry;
42850+ /*
42851+ * This bss-zeroing can fail if the ELF
42852+ * file specifies odd protections. So
42853+ * we don't check the return value
42854+ */
42855 }
42856
42857 if (elf_interpreter) {
42858@@ -1098,7 +1562,7 @@ out:
42859 * Decide what to dump of a segment, part, all or none.
42860 */
42861 static unsigned long vma_dump_size(struct vm_area_struct *vma,
42862- unsigned long mm_flags)
42863+ unsigned long mm_flags, long signr)
42864 {
42865 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
42866
42867@@ -1132,7 +1596,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
42868 if (vma->vm_file == NULL)
42869 return 0;
42870
42871- if (FILTER(MAPPED_PRIVATE))
42872+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
42873 goto whole;
42874
42875 /*
42876@@ -1354,9 +1818,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
42877 {
42878 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
42879 int i = 0;
42880- do
42881+ do {
42882 i += 2;
42883- while (auxv[i - 2] != AT_NULL);
42884+ } while (auxv[i - 2] != AT_NULL);
42885 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
42886 }
42887
42888@@ -1862,14 +2326,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
42889 }
42890
42891 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
42892- unsigned long mm_flags)
42893+ struct coredump_params *cprm)
42894 {
42895 struct vm_area_struct *vma;
42896 size_t size = 0;
42897
42898 for (vma = first_vma(current, gate_vma); vma != NULL;
42899 vma = next_vma(vma, gate_vma))
42900- size += vma_dump_size(vma, mm_flags);
42901+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42902 return size;
42903 }
42904
42905@@ -1963,7 +2427,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42906
42907 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
42908
42909- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
42910+ offset += elf_core_vma_data_size(gate_vma, cprm);
42911 offset += elf_core_extra_data_size();
42912 e_shoff = offset;
42913
42914@@ -1977,10 +2441,12 @@ static int elf_core_dump(struct coredump_params *cprm)
42915 offset = dataoff;
42916
42917 size += sizeof(*elf);
42918+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42919 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
42920 goto end_coredump;
42921
42922 size += sizeof(*phdr4note);
42923+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42924 if (size > cprm->limit
42925 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
42926 goto end_coredump;
42927@@ -1994,7 +2460,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42928 phdr.p_offset = offset;
42929 phdr.p_vaddr = vma->vm_start;
42930 phdr.p_paddr = 0;
42931- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
42932+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42933 phdr.p_memsz = vma->vm_end - vma->vm_start;
42934 offset += phdr.p_filesz;
42935 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
42936@@ -2005,6 +2471,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42937 phdr.p_align = ELF_EXEC_PAGESIZE;
42938
42939 size += sizeof(phdr);
42940+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42941 if (size > cprm->limit
42942 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
42943 goto end_coredump;
42944@@ -2029,7 +2496,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42945 unsigned long addr;
42946 unsigned long end;
42947
42948- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
42949+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42950
42951 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
42952 struct page *page;
42953@@ -2038,6 +2505,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42954 page = get_dump_page(addr);
42955 if (page) {
42956 void *kaddr = kmap(page);
42957+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
42958 stop = ((size += PAGE_SIZE) > cprm->limit) ||
42959 !dump_write(cprm->file, kaddr,
42960 PAGE_SIZE);
42961@@ -2055,6 +2523,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42962
42963 if (e_phnum == PN_XNUM) {
42964 size += sizeof(*shdr4extnum);
42965+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42966 if (size > cprm->limit
42967 || !dump_write(cprm->file, shdr4extnum,
42968 sizeof(*shdr4extnum)))
42969@@ -2075,6 +2544,97 @@ out:
42970
42971 #endif /* CONFIG_ELF_CORE */
42972
42973+#ifdef CONFIG_PAX_MPROTECT
42974+/* PaX: non-PIC ELF libraries need relocations on their executable segments
42975+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
42976+ * we'll remove VM_MAYWRITE for good on RELRO segments.
42977+ *
42978+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
42979+ * basis because we want to allow the common case and not the special ones.
42980+ */
42981+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
42982+{
42983+ struct elfhdr elf_h;
42984+ struct elf_phdr elf_p;
42985+ unsigned long i;
42986+ unsigned long oldflags;
42987+ bool is_textrel_rw, is_textrel_rx, is_relro;
42988+
42989+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
42990+ return;
42991+
42992+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
42993+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
42994+
42995+#ifdef CONFIG_PAX_ELFRELOCS
42996+ /* possible TEXTREL */
42997+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
42998+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
42999+#else
43000+ is_textrel_rw = false;
43001+ is_textrel_rx = false;
43002+#endif
43003+
43004+ /* possible RELRO */
43005+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
43006+
43007+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
43008+ return;
43009+
43010+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
43011+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
43012+
43013+#ifdef CONFIG_PAX_ETEXECRELOCS
43014+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43015+#else
43016+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
43017+#endif
43018+
43019+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43020+ !elf_check_arch(&elf_h) ||
43021+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
43022+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
43023+ return;
43024+
43025+ for (i = 0UL; i < elf_h.e_phnum; i++) {
43026+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
43027+ return;
43028+ switch (elf_p.p_type) {
43029+ case PT_DYNAMIC:
43030+ if (!is_textrel_rw && !is_textrel_rx)
43031+ continue;
43032+ i = 0UL;
43033+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
43034+ elf_dyn dyn;
43035+
43036+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
43037+ return;
43038+ if (dyn.d_tag == DT_NULL)
43039+ return;
43040+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
43041+ gr_log_textrel(vma);
43042+ if (is_textrel_rw)
43043+ vma->vm_flags |= VM_MAYWRITE;
43044+ else
43045+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
43046+ vma->vm_flags &= ~VM_MAYWRITE;
43047+ return;
43048+ }
43049+ i++;
43050+ }
43051+ return;
43052+
43053+ case PT_GNU_RELRO:
43054+ if (!is_relro)
43055+ continue;
43056+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
43057+ vma->vm_flags &= ~VM_MAYWRITE;
43058+ return;
43059+ }
43060+ }
43061+}
43062+#endif
43063+
43064 static int __init init_elf_binfmt(void)
43065 {
43066 return register_binfmt(&elf_format);
43067diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
43068index 1bffbe0..c8c283e 100644
43069--- a/fs/binfmt_flat.c
43070+++ b/fs/binfmt_flat.c
43071@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_binprm * bprm,
43072 realdatastart = (unsigned long) -ENOMEM;
43073 printk("Unable to allocate RAM for process data, errno %d\n",
43074 (int)-realdatastart);
43075+ down_write(&current->mm->mmap_sem);
43076 do_munmap(current->mm, textpos, text_len);
43077+ up_write(&current->mm->mmap_sem);
43078 ret = realdatastart;
43079 goto err;
43080 }
43081@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_binprm * bprm,
43082 }
43083 if (IS_ERR_VALUE(result)) {
43084 printk("Unable to read data+bss, errno %d\n", (int)-result);
43085+ down_write(&current->mm->mmap_sem);
43086 do_munmap(current->mm, textpos, text_len);
43087 do_munmap(current->mm, realdatastart, len);
43088+ up_write(&current->mm->mmap_sem);
43089 ret = result;
43090 goto err;
43091 }
43092@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_binprm * bprm,
43093 }
43094 if (IS_ERR_VALUE(result)) {
43095 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
43096+ down_write(&current->mm->mmap_sem);
43097 do_munmap(current->mm, textpos, text_len + data_len + extra +
43098 MAX_SHARED_LIBS * sizeof(unsigned long));
43099+ up_write(&current->mm->mmap_sem);
43100 ret = result;
43101 goto err;
43102 }
43103diff --git a/fs/bio.c b/fs/bio.c
43104index 9bfade8..782f3b9 100644
43105--- a/fs/bio.c
43106+++ b/fs/bio.c
43107@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
43108 const int read = bio_data_dir(bio) == READ;
43109 struct bio_map_data *bmd = bio->bi_private;
43110 int i;
43111- char *p = bmd->sgvecs[0].iov_base;
43112+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
43113
43114 __bio_for_each_segment(bvec, bio, i, 0) {
43115 char *addr = page_address(bvec->bv_page);
43116diff --git a/fs/block_dev.c b/fs/block_dev.c
43117index 1c44b8d..e2507b4 100644
43118--- a/fs/block_dev.c
43119+++ b/fs/block_dev.c
43120@@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
43121 else if (bdev->bd_contains == bdev)
43122 return true; /* is a whole device which isn't held */
43123
43124- else if (whole->bd_holder == bd_may_claim)
43125+ else if (whole->bd_holder == (void *)bd_may_claim)
43126 return true; /* is a partition of a device that is being partitioned */
43127 else if (whole->bd_holder != NULL)
43128 return false; /* is a partition of a held device */
43129diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
43130index 011cab3..9ace713 100644
43131--- a/fs/btrfs/ctree.c
43132+++ b/fs/btrfs/ctree.c
43133@@ -488,9 +488,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
43134 free_extent_buffer(buf);
43135 add_root_to_dirty_list(root);
43136 } else {
43137- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
43138- parent_start = parent->start;
43139- else
43140+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
43141+ if (parent)
43142+ parent_start = parent->start;
43143+ else
43144+ parent_start = 0;
43145+ } else
43146 parent_start = 0;
43147
43148 WARN_ON(trans->transid != btrfs_header_generation(parent));
43149diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
43150index b2d004a..6bb543d 100644
43151--- a/fs/btrfs/inode.c
43152+++ b/fs/btrfs/inode.c
43153@@ -6922,7 +6922,7 @@ fail:
43154 return -ENOMEM;
43155 }
43156
43157-static int btrfs_getattr(struct vfsmount *mnt,
43158+int btrfs_getattr(struct vfsmount *mnt,
43159 struct dentry *dentry, struct kstat *stat)
43160 {
43161 struct inode *inode = dentry->d_inode;
43162@@ -6934,6 +6934,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
43163 return 0;
43164 }
43165
43166+EXPORT_SYMBOL(btrfs_getattr);
43167+
43168+dev_t get_btrfs_dev_from_inode(struct inode *inode)
43169+{
43170+ return BTRFS_I(inode)->root->anon_dev;
43171+}
43172+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
43173+
43174 /*
43175 * If a file is moved, it will inherit the cow and compression flags of the new
43176 * directory.
43177diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
43178index dae5dfe..6aa01b1 100644
43179--- a/fs/btrfs/ioctl.c
43180+++ b/fs/btrfs/ioctl.c
43181@@ -2704,9 +2704,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
43182 for (i = 0; i < num_types; i++) {
43183 struct btrfs_space_info *tmp;
43184
43185+ /* Don't copy in more than we allocated */
43186 if (!slot_count)
43187 break;
43188
43189+ slot_count--;
43190+
43191 info = NULL;
43192 rcu_read_lock();
43193 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
43194@@ -2728,15 +2731,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
43195 memcpy(dest, &space, sizeof(space));
43196 dest++;
43197 space_args.total_spaces++;
43198- slot_count--;
43199 }
43200- if (!slot_count)
43201- break;
43202 }
43203 up_read(&info->groups_sem);
43204 }
43205
43206- user_dest = (struct btrfs_ioctl_space_info *)
43207+ user_dest = (struct btrfs_ioctl_space_info __user *)
43208 (arg + sizeof(struct btrfs_ioctl_space_args));
43209
43210 if (copy_to_user(user_dest, dest_orig, alloc_size))
43211diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
43212index 59bb176..be9977d 100644
43213--- a/fs/btrfs/relocation.c
43214+++ b/fs/btrfs/relocation.c
43215@@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
43216 }
43217 spin_unlock(&rc->reloc_root_tree.lock);
43218
43219- BUG_ON((struct btrfs_root *)node->data != root);
43220+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
43221
43222 if (!del) {
43223 spin_lock(&rc->reloc_root_tree.lock);
43224diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
43225index 622f469..e8d2d55 100644
43226--- a/fs/cachefiles/bind.c
43227+++ b/fs/cachefiles/bind.c
43228@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
43229 args);
43230
43231 /* start by checking things over */
43232- ASSERT(cache->fstop_percent >= 0 &&
43233- cache->fstop_percent < cache->fcull_percent &&
43234+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
43235 cache->fcull_percent < cache->frun_percent &&
43236 cache->frun_percent < 100);
43237
43238- ASSERT(cache->bstop_percent >= 0 &&
43239- cache->bstop_percent < cache->bcull_percent &&
43240+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
43241 cache->bcull_percent < cache->brun_percent &&
43242 cache->brun_percent < 100);
43243
43244diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
43245index 0a1467b..6a53245 100644
43246--- a/fs/cachefiles/daemon.c
43247+++ b/fs/cachefiles/daemon.c
43248@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
43249 if (n > buflen)
43250 return -EMSGSIZE;
43251
43252- if (copy_to_user(_buffer, buffer, n) != 0)
43253+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
43254 return -EFAULT;
43255
43256 return n;
43257@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
43258 if (test_bit(CACHEFILES_DEAD, &cache->flags))
43259 return -EIO;
43260
43261- if (datalen < 0 || datalen > PAGE_SIZE - 1)
43262+ if (datalen > PAGE_SIZE - 1)
43263 return -EOPNOTSUPP;
43264
43265 /* drag the command string into the kernel so we can parse it */
43266@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
43267 if (args[0] != '%' || args[1] != '\0')
43268 return -EINVAL;
43269
43270- if (fstop < 0 || fstop >= cache->fcull_percent)
43271+ if (fstop >= cache->fcull_percent)
43272 return cachefiles_daemon_range_error(cache, args);
43273
43274 cache->fstop_percent = fstop;
43275@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
43276 if (args[0] != '%' || args[1] != '\0')
43277 return -EINVAL;
43278
43279- if (bstop < 0 || bstop >= cache->bcull_percent)
43280+ if (bstop >= cache->bcull_percent)
43281 return cachefiles_daemon_range_error(cache, args);
43282
43283 cache->bstop_percent = bstop;
43284diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
43285index bd6bc1b..b627b53 100644
43286--- a/fs/cachefiles/internal.h
43287+++ b/fs/cachefiles/internal.h
43288@@ -57,7 +57,7 @@ struct cachefiles_cache {
43289 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
43290 struct rb_root active_nodes; /* active nodes (can't be culled) */
43291 rwlock_t active_lock; /* lock for active_nodes */
43292- atomic_t gravecounter; /* graveyard uniquifier */
43293+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
43294 unsigned frun_percent; /* when to stop culling (% files) */
43295 unsigned fcull_percent; /* when to start culling (% files) */
43296 unsigned fstop_percent; /* when to stop allocating (% files) */
43297@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
43298 * proc.c
43299 */
43300 #ifdef CONFIG_CACHEFILES_HISTOGRAM
43301-extern atomic_t cachefiles_lookup_histogram[HZ];
43302-extern atomic_t cachefiles_mkdir_histogram[HZ];
43303-extern atomic_t cachefiles_create_histogram[HZ];
43304+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43305+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43306+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
43307
43308 extern int __init cachefiles_proc_init(void);
43309 extern void cachefiles_proc_cleanup(void);
43310 static inline
43311-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
43312+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
43313 {
43314 unsigned long jif = jiffies - start_jif;
43315 if (jif >= HZ)
43316 jif = HZ - 1;
43317- atomic_inc(&histogram[jif]);
43318+ atomic_inc_unchecked(&histogram[jif]);
43319 }
43320
43321 #else
43322diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
43323index a0358c2..d6137f2 100644
43324--- a/fs/cachefiles/namei.c
43325+++ b/fs/cachefiles/namei.c
43326@@ -318,7 +318,7 @@ try_again:
43327 /* first step is to make up a grave dentry in the graveyard */
43328 sprintf(nbuffer, "%08x%08x",
43329 (uint32_t) get_seconds(),
43330- (uint32_t) atomic_inc_return(&cache->gravecounter));
43331+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
43332
43333 /* do the multiway lock magic */
43334 trap = lock_rename(cache->graveyard, dir);
43335diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
43336index eccd339..4c1d995 100644
43337--- a/fs/cachefiles/proc.c
43338+++ b/fs/cachefiles/proc.c
43339@@ -14,9 +14,9 @@
43340 #include <linux/seq_file.h>
43341 #include "internal.h"
43342
43343-atomic_t cachefiles_lookup_histogram[HZ];
43344-atomic_t cachefiles_mkdir_histogram[HZ];
43345-atomic_t cachefiles_create_histogram[HZ];
43346+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43347+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43348+atomic_unchecked_t cachefiles_create_histogram[HZ];
43349
43350 /*
43351 * display the latency histogram
43352@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
43353 return 0;
43354 default:
43355 index = (unsigned long) v - 3;
43356- x = atomic_read(&cachefiles_lookup_histogram[index]);
43357- y = atomic_read(&cachefiles_mkdir_histogram[index]);
43358- z = atomic_read(&cachefiles_create_histogram[index]);
43359+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
43360+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
43361+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
43362 if (x == 0 && y == 0 && z == 0)
43363 return 0;
43364
43365diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
43366index 0e3c092..818480e 100644
43367--- a/fs/cachefiles/rdwr.c
43368+++ b/fs/cachefiles/rdwr.c
43369@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
43370 old_fs = get_fs();
43371 set_fs(KERNEL_DS);
43372 ret = file->f_op->write(
43373- file, (const void __user *) data, len, &pos);
43374+ file, (const void __force_user *) data, len, &pos);
43375 set_fs(old_fs);
43376 kunmap(page);
43377 if (ret != len)
43378diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
43379index 382abc9..bd89646 100644
43380--- a/fs/ceph/dir.c
43381+++ b/fs/ceph/dir.c
43382@@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
43383 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
43384 struct ceph_mds_client *mdsc = fsc->mdsc;
43385 unsigned frag = fpos_frag(filp->f_pos);
43386- int off = fpos_off(filp->f_pos);
43387+ unsigned int off = fpos_off(filp->f_pos);
43388 int err;
43389 u32 ftype;
43390 struct ceph_mds_reply_info_parsed *rinfo;
43391diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
43392index 6d40656..bc1f825 100644
43393--- a/fs/cifs/cifs_debug.c
43394+++ b/fs/cifs/cifs_debug.c
43395@@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
43396
43397 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
43398 #ifdef CONFIG_CIFS_STATS2
43399- atomic_set(&totBufAllocCount, 0);
43400- atomic_set(&totSmBufAllocCount, 0);
43401+ atomic_set_unchecked(&totBufAllocCount, 0);
43402+ atomic_set_unchecked(&totSmBufAllocCount, 0);
43403 #endif /* CONFIG_CIFS_STATS2 */
43404 spin_lock(&cifs_tcp_ses_lock);
43405 list_for_each(tmp1, &cifs_tcp_ses_list) {
43406@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
43407 tcon = list_entry(tmp3,
43408 struct cifs_tcon,
43409 tcon_list);
43410- atomic_set(&tcon->num_smbs_sent, 0);
43411- atomic_set(&tcon->num_writes, 0);
43412- atomic_set(&tcon->num_reads, 0);
43413- atomic_set(&tcon->num_oplock_brks, 0);
43414- atomic_set(&tcon->num_opens, 0);
43415- atomic_set(&tcon->num_posixopens, 0);
43416- atomic_set(&tcon->num_posixmkdirs, 0);
43417- atomic_set(&tcon->num_closes, 0);
43418- atomic_set(&tcon->num_deletes, 0);
43419- atomic_set(&tcon->num_mkdirs, 0);
43420- atomic_set(&tcon->num_rmdirs, 0);
43421- atomic_set(&tcon->num_renames, 0);
43422- atomic_set(&tcon->num_t2renames, 0);
43423- atomic_set(&tcon->num_ffirst, 0);
43424- atomic_set(&tcon->num_fnext, 0);
43425- atomic_set(&tcon->num_fclose, 0);
43426- atomic_set(&tcon->num_hardlinks, 0);
43427- atomic_set(&tcon->num_symlinks, 0);
43428- atomic_set(&tcon->num_locks, 0);
43429+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
43430+ atomic_set_unchecked(&tcon->num_writes, 0);
43431+ atomic_set_unchecked(&tcon->num_reads, 0);
43432+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
43433+ atomic_set_unchecked(&tcon->num_opens, 0);
43434+ atomic_set_unchecked(&tcon->num_posixopens, 0);
43435+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
43436+ atomic_set_unchecked(&tcon->num_closes, 0);
43437+ atomic_set_unchecked(&tcon->num_deletes, 0);
43438+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
43439+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
43440+ atomic_set_unchecked(&tcon->num_renames, 0);
43441+ atomic_set_unchecked(&tcon->num_t2renames, 0);
43442+ atomic_set_unchecked(&tcon->num_ffirst, 0);
43443+ atomic_set_unchecked(&tcon->num_fnext, 0);
43444+ atomic_set_unchecked(&tcon->num_fclose, 0);
43445+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
43446+ atomic_set_unchecked(&tcon->num_symlinks, 0);
43447+ atomic_set_unchecked(&tcon->num_locks, 0);
43448 }
43449 }
43450 }
43451@@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43452 smBufAllocCount.counter, cifs_min_small);
43453 #ifdef CONFIG_CIFS_STATS2
43454 seq_printf(m, "Total Large %d Small %d Allocations\n",
43455- atomic_read(&totBufAllocCount),
43456- atomic_read(&totSmBufAllocCount));
43457+ atomic_read_unchecked(&totBufAllocCount),
43458+ atomic_read_unchecked(&totSmBufAllocCount));
43459 #endif /* CONFIG_CIFS_STATS2 */
43460
43461 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
43462@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43463 if (tcon->need_reconnect)
43464 seq_puts(m, "\tDISCONNECTED ");
43465 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
43466- atomic_read(&tcon->num_smbs_sent),
43467- atomic_read(&tcon->num_oplock_brks));
43468+ atomic_read_unchecked(&tcon->num_smbs_sent),
43469+ atomic_read_unchecked(&tcon->num_oplock_brks));
43470 seq_printf(m, "\nReads: %d Bytes: %lld",
43471- atomic_read(&tcon->num_reads),
43472+ atomic_read_unchecked(&tcon->num_reads),
43473 (long long)(tcon->bytes_read));
43474 seq_printf(m, "\nWrites: %d Bytes: %lld",
43475- atomic_read(&tcon->num_writes),
43476+ atomic_read_unchecked(&tcon->num_writes),
43477 (long long)(tcon->bytes_written));
43478 seq_printf(m, "\nFlushes: %d",
43479- atomic_read(&tcon->num_flushes));
43480+ atomic_read_unchecked(&tcon->num_flushes));
43481 seq_printf(m, "\nLocks: %d HardLinks: %d "
43482 "Symlinks: %d",
43483- atomic_read(&tcon->num_locks),
43484- atomic_read(&tcon->num_hardlinks),
43485- atomic_read(&tcon->num_symlinks));
43486+ atomic_read_unchecked(&tcon->num_locks),
43487+ atomic_read_unchecked(&tcon->num_hardlinks),
43488+ atomic_read_unchecked(&tcon->num_symlinks));
43489 seq_printf(m, "\nOpens: %d Closes: %d "
43490 "Deletes: %d",
43491- atomic_read(&tcon->num_opens),
43492- atomic_read(&tcon->num_closes),
43493- atomic_read(&tcon->num_deletes));
43494+ atomic_read_unchecked(&tcon->num_opens),
43495+ atomic_read_unchecked(&tcon->num_closes),
43496+ atomic_read_unchecked(&tcon->num_deletes));
43497 seq_printf(m, "\nPosix Opens: %d "
43498 "Posix Mkdirs: %d",
43499- atomic_read(&tcon->num_posixopens),
43500- atomic_read(&tcon->num_posixmkdirs));
43501+ atomic_read_unchecked(&tcon->num_posixopens),
43502+ atomic_read_unchecked(&tcon->num_posixmkdirs));
43503 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
43504- atomic_read(&tcon->num_mkdirs),
43505- atomic_read(&tcon->num_rmdirs));
43506+ atomic_read_unchecked(&tcon->num_mkdirs),
43507+ atomic_read_unchecked(&tcon->num_rmdirs));
43508 seq_printf(m, "\nRenames: %d T2 Renames %d",
43509- atomic_read(&tcon->num_renames),
43510- atomic_read(&tcon->num_t2renames));
43511+ atomic_read_unchecked(&tcon->num_renames),
43512+ atomic_read_unchecked(&tcon->num_t2renames));
43513 seq_printf(m, "\nFindFirst: %d FNext %d "
43514 "FClose %d",
43515- atomic_read(&tcon->num_ffirst),
43516- atomic_read(&tcon->num_fnext),
43517- atomic_read(&tcon->num_fclose));
43518+ atomic_read_unchecked(&tcon->num_ffirst),
43519+ atomic_read_unchecked(&tcon->num_fnext),
43520+ atomic_read_unchecked(&tcon->num_fclose));
43521 }
43522 }
43523 }
43524diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
43525index 54b8f1e..f6a4c00 100644
43526--- a/fs/cifs/cifsfs.c
43527+++ b/fs/cifs/cifsfs.c
43528@@ -981,7 +981,7 @@ cifs_init_request_bufs(void)
43529 cifs_req_cachep = kmem_cache_create("cifs_request",
43530 CIFSMaxBufSize +
43531 MAX_CIFS_HDR_SIZE, 0,
43532- SLAB_HWCACHE_ALIGN, NULL);
43533+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43534 if (cifs_req_cachep == NULL)
43535 return -ENOMEM;
43536
43537@@ -1008,7 +1008,7 @@ cifs_init_request_bufs(void)
43538 efficient to alloc 1 per page off the slab compared to 17K (5page)
43539 alloc of large cifs buffers even when page debugging is on */
43540 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43541- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43542+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43543 NULL);
43544 if (cifs_sm_req_cachep == NULL) {
43545 mempool_destroy(cifs_req_poolp);
43546@@ -1093,8 +1093,8 @@ init_cifs(void)
43547 atomic_set(&bufAllocCount, 0);
43548 atomic_set(&smBufAllocCount, 0);
43549 #ifdef CONFIG_CIFS_STATS2
43550- atomic_set(&totBufAllocCount, 0);
43551- atomic_set(&totSmBufAllocCount, 0);
43552+ atomic_set_unchecked(&totBufAllocCount, 0);
43553+ atomic_set_unchecked(&totSmBufAllocCount, 0);
43554 #endif /* CONFIG_CIFS_STATS2 */
43555
43556 atomic_set(&midCount, 0);
43557diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
43558index 95dad9d..fe7af1a 100644
43559--- a/fs/cifs/cifsglob.h
43560+++ b/fs/cifs/cifsglob.h
43561@@ -381,28 +381,28 @@ struct cifs_tcon {
43562 __u16 Flags; /* optional support bits */
43563 enum statusEnum tidStatus;
43564 #ifdef CONFIG_CIFS_STATS
43565- atomic_t num_smbs_sent;
43566- atomic_t num_writes;
43567- atomic_t num_reads;
43568- atomic_t num_flushes;
43569- atomic_t num_oplock_brks;
43570- atomic_t num_opens;
43571- atomic_t num_closes;
43572- atomic_t num_deletes;
43573- atomic_t num_mkdirs;
43574- atomic_t num_posixopens;
43575- atomic_t num_posixmkdirs;
43576- atomic_t num_rmdirs;
43577- atomic_t num_renames;
43578- atomic_t num_t2renames;
43579- atomic_t num_ffirst;
43580- atomic_t num_fnext;
43581- atomic_t num_fclose;
43582- atomic_t num_hardlinks;
43583- atomic_t num_symlinks;
43584- atomic_t num_locks;
43585- atomic_t num_acl_get;
43586- atomic_t num_acl_set;
43587+ atomic_unchecked_t num_smbs_sent;
43588+ atomic_unchecked_t num_writes;
43589+ atomic_unchecked_t num_reads;
43590+ atomic_unchecked_t num_flushes;
43591+ atomic_unchecked_t num_oplock_brks;
43592+ atomic_unchecked_t num_opens;
43593+ atomic_unchecked_t num_closes;
43594+ atomic_unchecked_t num_deletes;
43595+ atomic_unchecked_t num_mkdirs;
43596+ atomic_unchecked_t num_posixopens;
43597+ atomic_unchecked_t num_posixmkdirs;
43598+ atomic_unchecked_t num_rmdirs;
43599+ atomic_unchecked_t num_renames;
43600+ atomic_unchecked_t num_t2renames;
43601+ atomic_unchecked_t num_ffirst;
43602+ atomic_unchecked_t num_fnext;
43603+ atomic_unchecked_t num_fclose;
43604+ atomic_unchecked_t num_hardlinks;
43605+ atomic_unchecked_t num_symlinks;
43606+ atomic_unchecked_t num_locks;
43607+ atomic_unchecked_t num_acl_get;
43608+ atomic_unchecked_t num_acl_set;
43609 #ifdef CONFIG_CIFS_STATS2
43610 unsigned long long time_writes;
43611 unsigned long long time_reads;
43612@@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim)
43613 }
43614
43615 #ifdef CONFIG_CIFS_STATS
43616-#define cifs_stats_inc atomic_inc
43617+#define cifs_stats_inc atomic_inc_unchecked
43618
43619 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
43620 unsigned int bytes)
43621@@ -953,8 +953,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
43622 /* Various Debug counters */
43623 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43624 #ifdef CONFIG_CIFS_STATS2
43625-GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43626-GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43627+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43628+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43629 #endif
43630 GLOBAL_EXTERN atomic_t smBufAllocCount;
43631 GLOBAL_EXTERN atomic_t midCount;
43632diff --git a/fs/cifs/link.c b/fs/cifs/link.c
43633index db3f18c..1f5955e 100644
43634--- a/fs/cifs/link.c
43635+++ b/fs/cifs/link.c
43636@@ -593,7 +593,7 @@ symlink_exit:
43637
43638 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43639 {
43640- char *p = nd_get_link(nd);
43641+ const char *p = nd_get_link(nd);
43642 if (!IS_ERR(p))
43643 kfree(p);
43644 }
43645diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
43646index 7c16933..c8212b5 100644
43647--- a/fs/cifs/misc.c
43648+++ b/fs/cifs/misc.c
43649@@ -156,7 +156,7 @@ cifs_buf_get(void)
43650 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43651 atomic_inc(&bufAllocCount);
43652 #ifdef CONFIG_CIFS_STATS2
43653- atomic_inc(&totBufAllocCount);
43654+ atomic_inc_unchecked(&totBufAllocCount);
43655 #endif /* CONFIG_CIFS_STATS2 */
43656 }
43657
43658@@ -191,7 +191,7 @@ cifs_small_buf_get(void)
43659 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43660 atomic_inc(&smBufAllocCount);
43661 #ifdef CONFIG_CIFS_STATS2
43662- atomic_inc(&totSmBufAllocCount);
43663+ atomic_inc_unchecked(&totSmBufAllocCount);
43664 #endif /* CONFIG_CIFS_STATS2 */
43665
43666 }
43667diff --git a/fs/coda/cache.c b/fs/coda/cache.c
43668index 6901578..d402eb5 100644
43669--- a/fs/coda/cache.c
43670+++ b/fs/coda/cache.c
43671@@ -24,7 +24,7 @@
43672 #include "coda_linux.h"
43673 #include "coda_cache.h"
43674
43675-static atomic_t permission_epoch = ATOMIC_INIT(0);
43676+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
43677
43678 /* replace or extend an acl cache hit */
43679 void coda_cache_enter(struct inode *inode, int mask)
43680@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
43681 struct coda_inode_info *cii = ITOC(inode);
43682
43683 spin_lock(&cii->c_lock);
43684- cii->c_cached_epoch = atomic_read(&permission_epoch);
43685+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
43686 if (cii->c_uid != current_fsuid()) {
43687 cii->c_uid = current_fsuid();
43688 cii->c_cached_perm = mask;
43689@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
43690 {
43691 struct coda_inode_info *cii = ITOC(inode);
43692 spin_lock(&cii->c_lock);
43693- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
43694+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
43695 spin_unlock(&cii->c_lock);
43696 }
43697
43698 /* remove all acl caches */
43699 void coda_cache_clear_all(struct super_block *sb)
43700 {
43701- atomic_inc(&permission_epoch);
43702+ atomic_inc_unchecked(&permission_epoch);
43703 }
43704
43705
43706@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
43707 spin_lock(&cii->c_lock);
43708 hit = (mask & cii->c_cached_perm) == mask &&
43709 cii->c_uid == current_fsuid() &&
43710- cii->c_cached_epoch == atomic_read(&permission_epoch);
43711+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
43712 spin_unlock(&cii->c_lock);
43713
43714 return hit;
43715diff --git a/fs/compat.c b/fs/compat.c
43716index 58b1da4..afcd9b8 100644
43717--- a/fs/compat.c
43718+++ b/fs/compat.c
43719@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
43720 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
43721 {
43722 compat_ino_t ino = stat->ino;
43723- typeof(ubuf->st_uid) uid = 0;
43724- typeof(ubuf->st_gid) gid = 0;
43725+ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
43726+ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
43727 int err;
43728
43729 SET_UID(uid, stat->uid);
43730@@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
43731
43732 set_fs(KERNEL_DS);
43733 /* The __user pointer cast is valid because of the set_fs() */
43734- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
43735+ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
43736 set_fs(oldfs);
43737 /* truncating is ok because it's a user address */
43738 if (!ret)
43739@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
43740 goto out;
43741
43742 ret = -EINVAL;
43743- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
43744+ if (nr_segs > UIO_MAXIOV)
43745 goto out;
43746 if (nr_segs > fast_segs) {
43747 ret = -ENOMEM;
43748@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
43749
43750 struct compat_readdir_callback {
43751 struct compat_old_linux_dirent __user *dirent;
43752+ struct file * file;
43753 int result;
43754 };
43755
43756@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
43757 buf->result = -EOVERFLOW;
43758 return -EOVERFLOW;
43759 }
43760+
43761+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43762+ return 0;
43763+
43764 buf->result++;
43765 dirent = buf->dirent;
43766 if (!access_ok(VERIFY_WRITE, dirent,
43767@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
43768
43769 buf.result = 0;
43770 buf.dirent = dirent;
43771+ buf.file = file;
43772
43773 error = vfs_readdir(file, compat_fillonedir, &buf);
43774 if (buf.result)
43775@@ -917,6 +923,7 @@ struct compat_linux_dirent {
43776 struct compat_getdents_callback {
43777 struct compat_linux_dirent __user *current_dir;
43778 struct compat_linux_dirent __user *previous;
43779+ struct file * file;
43780 int count;
43781 int error;
43782 };
43783@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
43784 buf->error = -EOVERFLOW;
43785 return -EOVERFLOW;
43786 }
43787+
43788+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43789+ return 0;
43790+
43791 dirent = buf->previous;
43792 if (dirent) {
43793 if (__put_user(offset, &dirent->d_off))
43794@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
43795 buf.previous = NULL;
43796 buf.count = count;
43797 buf.error = 0;
43798+ buf.file = file;
43799
43800 error = vfs_readdir(file, compat_filldir, &buf);
43801 if (error >= 0)
43802@@ -1006,6 +1018,7 @@ out:
43803 struct compat_getdents_callback64 {
43804 struct linux_dirent64 __user *current_dir;
43805 struct linux_dirent64 __user *previous;
43806+ struct file * file;
43807 int count;
43808 int error;
43809 };
43810@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
43811 buf->error = -EINVAL; /* only used if we fail.. */
43812 if (reclen > buf->count)
43813 return -EINVAL;
43814+
43815+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43816+ return 0;
43817+
43818 dirent = buf->previous;
43819
43820 if (dirent) {
43821@@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
43822 buf.previous = NULL;
43823 buf.count = count;
43824 buf.error = 0;
43825+ buf.file = file;
43826
43827 error = vfs_readdir(file, compat_filldir64, &buf);
43828 if (error >= 0)
43829 error = buf.error;
43830 lastdirent = buf.previous;
43831 if (lastdirent) {
43832- typeof(lastdirent->d_off) d_off = file->f_pos;
43833+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
43834 if (__put_user_unaligned(d_off, &lastdirent->d_off))
43835 error = -EFAULT;
43836 else
43837@@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
43838 struct fdtable *fdt;
43839 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
43840
43841+ pax_track_stack();
43842+
43843 if (n < 0)
43844 goto out_nofds;
43845
43846diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
43847index 112e45a..b59845b 100644
43848--- a/fs/compat_binfmt_elf.c
43849+++ b/fs/compat_binfmt_elf.c
43850@@ -30,11 +30,13 @@
43851 #undef elf_phdr
43852 #undef elf_shdr
43853 #undef elf_note
43854+#undef elf_dyn
43855 #undef elf_addr_t
43856 #define elfhdr elf32_hdr
43857 #define elf_phdr elf32_phdr
43858 #define elf_shdr elf32_shdr
43859 #define elf_note elf32_note
43860+#define elf_dyn Elf32_Dyn
43861 #define elf_addr_t Elf32_Addr
43862
43863 /*
43864diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
43865index 51352de..93292ff 100644
43866--- a/fs/compat_ioctl.c
43867+++ b/fs/compat_ioctl.c
43868@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
43869
43870 err = get_user(palp, &up->palette);
43871 err |= get_user(length, &up->length);
43872+ if (err)
43873+ return -EFAULT;
43874
43875 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
43876 err = put_user(compat_ptr(palp), &up_native->palette);
43877@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
43878 return -EFAULT;
43879 if (__get_user(udata, &ss32->iomem_base))
43880 return -EFAULT;
43881- ss.iomem_base = compat_ptr(udata);
43882+ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
43883 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
43884 __get_user(ss.port_high, &ss32->port_high))
43885 return -EFAULT;
43886@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
43887 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
43888 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
43889 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
43890- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43891+ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43892 return -EFAULT;
43893
43894 return ioctl_preallocate(file, p);
43895@@ -1644,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
43896 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
43897 {
43898 unsigned int a, b;
43899- a = *(unsigned int *)p;
43900- b = *(unsigned int *)q;
43901+ a = *(const unsigned int *)p;
43902+ b = *(const unsigned int *)q;
43903 if (a > b)
43904 return 1;
43905 if (a < b)
43906diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
43907index 9a37a9b..35792b6 100644
43908--- a/fs/configfs/dir.c
43909+++ b/fs/configfs/dir.c
43910@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43911 }
43912 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
43913 struct configfs_dirent *next;
43914- const char * name;
43915+ const unsigned char * name;
43916+ char d_name[sizeof(next->s_dentry->d_iname)];
43917 int len;
43918 struct inode *inode = NULL;
43919
43920@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43921 continue;
43922
43923 name = configfs_get_name(next);
43924- len = strlen(name);
43925+ if (next->s_dentry && name == next->s_dentry->d_iname) {
43926+ len = next->s_dentry->d_name.len;
43927+ memcpy(d_name, name, len);
43928+ name = d_name;
43929+ } else
43930+ len = strlen(name);
43931
43932 /*
43933 * We'll have a dentry and an inode for
43934diff --git a/fs/dcache.c b/fs/dcache.c
43935index 8b732a2..6db6c27 100644
43936--- a/fs/dcache.c
43937+++ b/fs/dcache.c
43938@@ -3015,7 +3015,7 @@ void __init vfs_caches_init(unsigned long mempages)
43939 mempages -= reserve;
43940
43941 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
43942- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
43943+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
43944
43945 dcache_init();
43946 inode_init();
43947diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
43948index 528da01..bd8c23d 100644
43949--- a/fs/ecryptfs/inode.c
43950+++ b/fs/ecryptfs/inode.c
43951@@ -691,7 +691,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
43952 old_fs = get_fs();
43953 set_fs(get_ds());
43954 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
43955- (char __user *)lower_buf,
43956+ (char __force_user *)lower_buf,
43957 lower_bufsiz);
43958 set_fs(old_fs);
43959 if (rc < 0)
43960@@ -737,7 +737,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
43961 }
43962 old_fs = get_fs();
43963 set_fs(get_ds());
43964- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
43965+ rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
43966 set_fs(old_fs);
43967 if (rc < 0) {
43968 kfree(buf);
43969@@ -752,7 +752,7 @@ out:
43970 static void
43971 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
43972 {
43973- char *buf = nd_get_link(nd);
43974+ const char *buf = nd_get_link(nd);
43975 if (!IS_ERR(buf)) {
43976 /* Free the char* */
43977 kfree(buf);
43978diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
43979index 940a82e..63af89e 100644
43980--- a/fs/ecryptfs/miscdev.c
43981+++ b/fs/ecryptfs/miscdev.c
43982@@ -328,7 +328,7 @@ check_list:
43983 goto out_unlock_msg_ctx;
43984 i = 5;
43985 if (msg_ctx->msg) {
43986- if (copy_to_user(&buf[i], packet_length, packet_length_size))
43987+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
43988 goto out_unlock_msg_ctx;
43989 i += packet_length_size;
43990 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
43991diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
43992index 3745f7c..89cc7a3 100644
43993--- a/fs/ecryptfs/read_write.c
43994+++ b/fs/ecryptfs/read_write.c
43995@@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
43996 return -EIO;
43997 fs_save = get_fs();
43998 set_fs(get_ds());
43999- rc = vfs_write(lower_file, data, size, &offset);
44000+ rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
44001 set_fs(fs_save);
44002 mark_inode_dirty_sync(ecryptfs_inode);
44003 return rc;
44004@@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
44005 return -EIO;
44006 fs_save = get_fs();
44007 set_fs(get_ds());
44008- rc = vfs_read(lower_file, data, size, &offset);
44009+ rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
44010 set_fs(fs_save);
44011 return rc;
44012 }
44013diff --git a/fs/exec.c b/fs/exec.c
44014index 25dcbe5..09c172c 100644
44015--- a/fs/exec.c
44016+++ b/fs/exec.c
44017@@ -55,12 +55,28 @@
44018 #include <linux/pipe_fs_i.h>
44019 #include <linux/oom.h>
44020 #include <linux/compat.h>
44021+#include <linux/random.h>
44022+#include <linux/seq_file.h>
44023+
44024+#ifdef CONFIG_PAX_REFCOUNT
44025+#include <linux/kallsyms.h>
44026+#include <linux/kdebug.h>
44027+#endif
44028
44029 #include <asm/uaccess.h>
44030 #include <asm/mmu_context.h>
44031 #include <asm/tlb.h>
44032 #include "internal.h"
44033
44034+#ifndef CONFIG_PAX_HAVE_ACL_FLAGS
44035+void __weak pax_set_initial_flags(struct linux_binprm *bprm) {}
44036+#endif
44037+
44038+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
44039+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
44040+EXPORT_SYMBOL(pax_set_initial_flags_func);
44041+#endif
44042+
44043 int core_uses_pid;
44044 char core_pattern[CORENAME_MAX_SIZE] = "core";
44045 unsigned int core_pipe_limit;
44046@@ -70,7 +86,7 @@ struct core_name {
44047 char *corename;
44048 int used, size;
44049 };
44050-static atomic_t call_count = ATOMIC_INIT(1);
44051+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
44052
44053 /* The maximal length of core_pattern is also specified in sysctl.c */
44054
44055@@ -188,18 +204,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
44056 int write)
44057 {
44058 struct page *page;
44059- int ret;
44060
44061-#ifdef CONFIG_STACK_GROWSUP
44062- if (write) {
44063- ret = expand_downwards(bprm->vma, pos);
44064- if (ret < 0)
44065- return NULL;
44066- }
44067-#endif
44068- ret = get_user_pages(current, bprm->mm, pos,
44069- 1, write, 1, &page, NULL);
44070- if (ret <= 0)
44071+ if (0 > expand_downwards(bprm->vma, pos))
44072+ return NULL;
44073+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
44074 return NULL;
44075
44076 if (write) {
44077@@ -274,6 +282,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
44078 vma->vm_end = STACK_TOP_MAX;
44079 vma->vm_start = vma->vm_end - PAGE_SIZE;
44080 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
44081+
44082+#ifdef CONFIG_PAX_SEGMEXEC
44083+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
44084+#endif
44085+
44086 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
44087 INIT_LIST_HEAD(&vma->anon_vma_chain);
44088
44089@@ -288,6 +301,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
44090 mm->stack_vm = mm->total_vm = 1;
44091 up_write(&mm->mmap_sem);
44092 bprm->p = vma->vm_end - sizeof(void *);
44093+
44094+#ifdef CONFIG_PAX_RANDUSTACK
44095+ if (randomize_va_space)
44096+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
44097+#endif
44098+
44099 return 0;
44100 err:
44101 up_write(&mm->mmap_sem);
44102@@ -396,19 +415,7 @@ err:
44103 return err;
44104 }
44105
44106-struct user_arg_ptr {
44107-#ifdef CONFIG_COMPAT
44108- bool is_compat;
44109-#endif
44110- union {
44111- const char __user *const __user *native;
44112-#ifdef CONFIG_COMPAT
44113- compat_uptr_t __user *compat;
44114-#endif
44115- } ptr;
44116-};
44117-
44118-static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44119+const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44120 {
44121 const char __user *native;
44122
44123@@ -417,14 +424,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44124 compat_uptr_t compat;
44125
44126 if (get_user(compat, argv.ptr.compat + nr))
44127- return ERR_PTR(-EFAULT);
44128+ return (const char __force_user *)ERR_PTR(-EFAULT);
44129
44130 return compat_ptr(compat);
44131 }
44132 #endif
44133
44134 if (get_user(native, argv.ptr.native + nr))
44135- return ERR_PTR(-EFAULT);
44136+ return (const char __force_user *)ERR_PTR(-EFAULT);
44137
44138 return native;
44139 }
44140@@ -443,7 +450,7 @@ static int count(struct user_arg_ptr argv, int max)
44141 if (!p)
44142 break;
44143
44144- if (IS_ERR(p))
44145+ if (IS_ERR((const char __force_kernel *)p))
44146 return -EFAULT;
44147
44148 if (i++ >= max)
44149@@ -477,7 +484,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
44150
44151 ret = -EFAULT;
44152 str = get_user_arg_ptr(argv, argc);
44153- if (IS_ERR(str))
44154+ if (IS_ERR((const char __force_kernel *)str))
44155 goto out;
44156
44157 len = strnlen_user(str, MAX_ARG_STRLEN);
44158@@ -559,7 +566,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
44159 int r;
44160 mm_segment_t oldfs = get_fs();
44161 struct user_arg_ptr argv = {
44162- .ptr.native = (const char __user *const __user *)__argv,
44163+ .ptr.native = (const char __force_user *const __force_user *)__argv,
44164 };
44165
44166 set_fs(KERNEL_DS);
44167@@ -594,7 +601,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
44168 unsigned long new_end = old_end - shift;
44169 struct mmu_gather tlb;
44170
44171- BUG_ON(new_start > new_end);
44172+ if (new_start >= new_end || new_start < mmap_min_addr)
44173+ return -ENOMEM;
44174
44175 /*
44176 * ensure there are no vmas between where we want to go
44177@@ -603,6 +611,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
44178 if (vma != find_vma(mm, new_start))
44179 return -EFAULT;
44180
44181+#ifdef CONFIG_PAX_SEGMEXEC
44182+ BUG_ON(pax_find_mirror_vma(vma));
44183+#endif
44184+
44185 /*
44186 * cover the whole range: [new_start, old_end)
44187 */
44188@@ -683,10 +695,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
44189 stack_top = arch_align_stack(stack_top);
44190 stack_top = PAGE_ALIGN(stack_top);
44191
44192- if (unlikely(stack_top < mmap_min_addr) ||
44193- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
44194- return -ENOMEM;
44195-
44196 stack_shift = vma->vm_end - stack_top;
44197
44198 bprm->p -= stack_shift;
44199@@ -698,8 +706,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
44200 bprm->exec -= stack_shift;
44201
44202 down_write(&mm->mmap_sem);
44203+
44204+ /* Move stack pages down in memory. */
44205+ if (stack_shift) {
44206+ ret = shift_arg_pages(vma, stack_shift);
44207+ if (ret)
44208+ goto out_unlock;
44209+ }
44210+
44211 vm_flags = VM_STACK_FLAGS;
44212
44213+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44214+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44215+ vm_flags &= ~VM_EXEC;
44216+
44217+#ifdef CONFIG_PAX_MPROTECT
44218+ if (mm->pax_flags & MF_PAX_MPROTECT)
44219+ vm_flags &= ~VM_MAYEXEC;
44220+#endif
44221+
44222+ }
44223+#endif
44224+
44225 /*
44226 * Adjust stack execute permissions; explicitly enable for
44227 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
44228@@ -718,13 +746,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
44229 goto out_unlock;
44230 BUG_ON(prev != vma);
44231
44232- /* Move stack pages down in memory. */
44233- if (stack_shift) {
44234- ret = shift_arg_pages(vma, stack_shift);
44235- if (ret)
44236- goto out_unlock;
44237- }
44238-
44239 /* mprotect_fixup is overkill to remove the temporary stack flags */
44240 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
44241
44242@@ -805,7 +826,7 @@ int kernel_read(struct file *file, loff_t offset,
44243 old_fs = get_fs();
44244 set_fs(get_ds());
44245 /* The cast to a user pointer is valid due to the set_fs() */
44246- result = vfs_read(file, (void __user *)addr, count, &pos);
44247+ result = vfs_read(file, (void __force_user *)addr, count, &pos);
44248 set_fs(old_fs);
44249 return result;
44250 }
44251@@ -1251,7 +1272,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
44252 }
44253 rcu_read_unlock();
44254
44255- if (p->fs->users > n_fs) {
44256+ if (atomic_read(&p->fs->users) > n_fs) {
44257 bprm->unsafe |= LSM_UNSAFE_SHARE;
44258 } else {
44259 res = -EAGAIN;
44260@@ -1454,6 +1475,11 @@ static int do_execve_common(const char *filename,
44261 struct user_arg_ptr envp,
44262 struct pt_regs *regs)
44263 {
44264+#ifdef CONFIG_GRKERNSEC
44265+ struct file *old_exec_file;
44266+ struct acl_subject_label *old_acl;
44267+ struct rlimit old_rlim[RLIM_NLIMITS];
44268+#endif
44269 struct linux_binprm *bprm;
44270 struct file *file;
44271 struct files_struct *displaced;
44272@@ -1461,6 +1487,8 @@ static int do_execve_common(const char *filename,
44273 int retval;
44274 const struct cred *cred = current_cred();
44275
44276+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44277+
44278 /*
44279 * We move the actual failure in case of RLIMIT_NPROC excess from
44280 * set*uid() to execve() because too many poorly written programs
44281@@ -1507,6 +1535,16 @@ static int do_execve_common(const char *filename,
44282 bprm->filename = filename;
44283 bprm->interp = filename;
44284
44285+ if (gr_process_user_ban()) {
44286+ retval = -EPERM;
44287+ goto out_file;
44288+ }
44289+
44290+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
44291+ retval = -EACCES;
44292+ goto out_file;
44293+ }
44294+
44295 retval = bprm_mm_init(bprm);
44296 if (retval)
44297 goto out_file;
44298@@ -1536,9 +1574,40 @@ static int do_execve_common(const char *filename,
44299 if (retval < 0)
44300 goto out;
44301
44302+ if (!gr_tpe_allow(file)) {
44303+ retval = -EACCES;
44304+ goto out;
44305+ }
44306+
44307+ if (gr_check_crash_exec(file)) {
44308+ retval = -EACCES;
44309+ goto out;
44310+ }
44311+
44312+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44313+
44314+ gr_handle_exec_args(bprm, argv);
44315+
44316+#ifdef CONFIG_GRKERNSEC
44317+ old_acl = current->acl;
44318+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44319+ old_exec_file = current->exec_file;
44320+ get_file(file);
44321+ current->exec_file = file;
44322+#endif
44323+
44324+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44325+ bprm->unsafe & LSM_UNSAFE_SHARE);
44326+ if (retval < 0)
44327+ goto out_fail;
44328+
44329 retval = search_binary_handler(bprm,regs);
44330 if (retval < 0)
44331- goto out;
44332+ goto out_fail;
44333+#ifdef CONFIG_GRKERNSEC
44334+ if (old_exec_file)
44335+ fput(old_exec_file);
44336+#endif
44337
44338 /* execve succeeded */
44339 current->fs->in_exec = 0;
44340@@ -1549,6 +1618,14 @@ static int do_execve_common(const char *filename,
44341 put_files_struct(displaced);
44342 return retval;
44343
44344+out_fail:
44345+#ifdef CONFIG_GRKERNSEC
44346+ current->acl = old_acl;
44347+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
44348+ fput(current->exec_file);
44349+ current->exec_file = old_exec_file;
44350+#endif
44351+
44352 out:
44353 if (bprm->mm) {
44354 acct_arg_size(bprm, 0);
44355@@ -1622,7 +1699,7 @@ static int expand_corename(struct core_name *cn)
44356 {
44357 char *old_corename = cn->corename;
44358
44359- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
44360+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
44361 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
44362
44363 if (!cn->corename) {
44364@@ -1719,7 +1796,7 @@ static int format_corename(struct core_name *cn, long signr)
44365 int pid_in_pattern = 0;
44366 int err = 0;
44367
44368- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
44369+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
44370 cn->corename = kmalloc(cn->size, GFP_KERNEL);
44371 cn->used = 0;
44372
44373@@ -1816,6 +1893,218 @@ out:
44374 return ispipe;
44375 }
44376
44377+int pax_check_flags(unsigned long *flags)
44378+{
44379+ int retval = 0;
44380+
44381+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
44382+ if (*flags & MF_PAX_SEGMEXEC)
44383+ {
44384+ *flags &= ~MF_PAX_SEGMEXEC;
44385+ retval = -EINVAL;
44386+ }
44387+#endif
44388+
44389+ if ((*flags & MF_PAX_PAGEEXEC)
44390+
44391+#ifdef CONFIG_PAX_PAGEEXEC
44392+ && (*flags & MF_PAX_SEGMEXEC)
44393+#endif
44394+
44395+ )
44396+ {
44397+ *flags &= ~MF_PAX_PAGEEXEC;
44398+ retval = -EINVAL;
44399+ }
44400+
44401+ if ((*flags & MF_PAX_MPROTECT)
44402+
44403+#ifdef CONFIG_PAX_MPROTECT
44404+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44405+#endif
44406+
44407+ )
44408+ {
44409+ *flags &= ~MF_PAX_MPROTECT;
44410+ retval = -EINVAL;
44411+ }
44412+
44413+ if ((*flags & MF_PAX_EMUTRAMP)
44414+
44415+#ifdef CONFIG_PAX_EMUTRAMP
44416+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44417+#endif
44418+
44419+ )
44420+ {
44421+ *flags &= ~MF_PAX_EMUTRAMP;
44422+ retval = -EINVAL;
44423+ }
44424+
44425+ return retval;
44426+}
44427+
44428+EXPORT_SYMBOL(pax_check_flags);
44429+
44430+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44431+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
44432+{
44433+ struct task_struct *tsk = current;
44434+ struct mm_struct *mm = current->mm;
44435+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
44436+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
44437+ char *path_exec = NULL;
44438+ char *path_fault = NULL;
44439+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
44440+
44441+ if (buffer_exec && buffer_fault) {
44442+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
44443+
44444+ down_read(&mm->mmap_sem);
44445+ vma = mm->mmap;
44446+ while (vma && (!vma_exec || !vma_fault)) {
44447+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
44448+ vma_exec = vma;
44449+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
44450+ vma_fault = vma;
44451+ vma = vma->vm_next;
44452+ }
44453+ if (vma_exec) {
44454+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
44455+ if (IS_ERR(path_exec))
44456+ path_exec = "<path too long>";
44457+ else {
44458+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
44459+ if (path_exec) {
44460+ *path_exec = 0;
44461+ path_exec = buffer_exec;
44462+ } else
44463+ path_exec = "<path too long>";
44464+ }
44465+ }
44466+ if (vma_fault) {
44467+ start = vma_fault->vm_start;
44468+ end = vma_fault->vm_end;
44469+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
44470+ if (vma_fault->vm_file) {
44471+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
44472+ if (IS_ERR(path_fault))
44473+ path_fault = "<path too long>";
44474+ else {
44475+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
44476+ if (path_fault) {
44477+ *path_fault = 0;
44478+ path_fault = buffer_fault;
44479+ } else
44480+ path_fault = "<path too long>";
44481+ }
44482+ } else
44483+ path_fault = "<anonymous mapping>";
44484+ }
44485+ up_read(&mm->mmap_sem);
44486+ }
44487+ if (tsk->signal->curr_ip)
44488+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
44489+ else
44490+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
44491+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
44492+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
44493+ task_uid(tsk), task_euid(tsk), pc, sp);
44494+ free_page((unsigned long)buffer_exec);
44495+ free_page((unsigned long)buffer_fault);
44496+ pax_report_insns(regs, pc, sp);
44497+ do_coredump(SIGKILL, SIGKILL, regs);
44498+}
44499+#endif
44500+
44501+#ifdef CONFIG_PAX_REFCOUNT
44502+void pax_report_refcount_overflow(struct pt_regs *regs)
44503+{
44504+ if (current->signal->curr_ip)
44505+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44506+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
44507+ else
44508+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44509+ current->comm, task_pid_nr(current), current_uid(), current_euid());
44510+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44511+ show_regs(regs);
44512+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
44513+}
44514+#endif
44515+
44516+#ifdef CONFIG_PAX_USERCOPY
44517+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44518+int object_is_on_stack(const void *obj, unsigned long len)
44519+{
44520+ const void * const stack = task_stack_page(current);
44521+ const void * const stackend = stack + THREAD_SIZE;
44522+
44523+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44524+ const void *frame = NULL;
44525+ const void *oldframe;
44526+#endif
44527+
44528+ if (obj + len < obj)
44529+ return -1;
44530+
44531+ if (obj + len <= stack || stackend <= obj)
44532+ return 0;
44533+
44534+ if (obj < stack || stackend < obj + len)
44535+ return -1;
44536+
44537+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44538+ oldframe = __builtin_frame_address(1);
44539+ if (oldframe)
44540+ frame = __builtin_frame_address(2);
44541+ /*
44542+ low ----------------------------------------------> high
44543+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
44544+ ^----------------^
44545+ allow copies only within here
44546+ */
44547+ while (stack <= frame && frame < stackend) {
44548+ /* if obj + len extends past the last frame, this
44549+ check won't pass and the next frame will be 0,
44550+ causing us to bail out and correctly report
44551+ the copy as invalid
44552+ */
44553+ if (obj + len <= frame)
44554+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44555+ oldframe = frame;
44556+ frame = *(const void * const *)frame;
44557+ }
44558+ return -1;
44559+#else
44560+ return 1;
44561+#endif
44562+}
44563+
44564+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44565+{
44566+ if (current->signal->curr_ip)
44567+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44568+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44569+ else
44570+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44571+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44572+ dump_stack();
44573+ gr_handle_kernel_exploit();
44574+ do_group_exit(SIGKILL);
44575+}
44576+#endif
44577+
44578+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
44579+void pax_track_stack(void)
44580+{
44581+ unsigned long sp = (unsigned long)&sp;
44582+ if (sp < current_thread_info()->lowest_stack &&
44583+ sp > (unsigned long)task_stack_page(current))
44584+ current_thread_info()->lowest_stack = sp;
44585+}
44586+EXPORT_SYMBOL(pax_track_stack);
44587+#endif
44588+
44589 static int zap_process(struct task_struct *start, int exit_code)
44590 {
44591 struct task_struct *t;
44592@@ -2027,17 +2316,17 @@ static void wait_for_dump_helpers(struct file *file)
44593 pipe = file->f_path.dentry->d_inode->i_pipe;
44594
44595 pipe_lock(pipe);
44596- pipe->readers++;
44597- pipe->writers--;
44598+ atomic_inc(&pipe->readers);
44599+ atomic_dec(&pipe->writers);
44600
44601- while ((pipe->readers > 1) && (!signal_pending(current))) {
44602+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
44603 wake_up_interruptible_sync(&pipe->wait);
44604 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
44605 pipe_wait(pipe);
44606 }
44607
44608- pipe->readers--;
44609- pipe->writers++;
44610+ atomic_dec(&pipe->readers);
44611+ atomic_inc(&pipe->writers);
44612 pipe_unlock(pipe);
44613
44614 }
44615@@ -2098,7 +2387,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44616 int retval = 0;
44617 int flag = 0;
44618 int ispipe;
44619- static atomic_t core_dump_count = ATOMIC_INIT(0);
44620+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
44621 struct coredump_params cprm = {
44622 .signr = signr,
44623 .regs = regs,
44624@@ -2113,6 +2402,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44625
44626 audit_core_dumps(signr);
44627
44628+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
44629+ gr_handle_brute_attach(current, cprm.mm_flags);
44630+
44631 binfmt = mm->binfmt;
44632 if (!binfmt || !binfmt->core_dump)
44633 goto fail;
44634@@ -2180,7 +2472,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44635 }
44636 cprm.limit = RLIM_INFINITY;
44637
44638- dump_count = atomic_inc_return(&core_dump_count);
44639+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
44640 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
44641 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
44642 task_tgid_vnr(current), current->comm);
44643@@ -2207,6 +2499,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44644 } else {
44645 struct inode *inode;
44646
44647+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
44648+
44649 if (cprm.limit < binfmt->min_coredump)
44650 goto fail_unlock;
44651
44652@@ -2250,7 +2544,7 @@ close_fail:
44653 filp_close(cprm.file, NULL);
44654 fail_dropcount:
44655 if (ispipe)
44656- atomic_dec(&core_dump_count);
44657+ atomic_dec_unchecked(&core_dump_count);
44658 fail_unlock:
44659 kfree(cn.corename);
44660 fail_corename:
44661@@ -2269,7 +2563,7 @@ fail:
44662 */
44663 int dump_write(struct file *file, const void *addr, int nr)
44664 {
44665- return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
44666+ return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
44667 }
44668 EXPORT_SYMBOL(dump_write);
44669
44670diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
44671index 8f44cef..cb07120 100644
44672--- a/fs/ext2/balloc.c
44673+++ b/fs/ext2/balloc.c
44674@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
44675
44676 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44677 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44678- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44679+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44680 sbi->s_resuid != current_fsuid() &&
44681 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44682 return 0;
44683diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
44684index 6386d76..0a266b1 100644
44685--- a/fs/ext3/balloc.c
44686+++ b/fs/ext3/balloc.c
44687@@ -1446,7 +1446,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
44688
44689 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44690 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44691- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44692+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44693 sbi->s_resuid != current_fsuid() &&
44694 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44695 return 0;
44696diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
44697index f8224ad..fbef97c 100644
44698--- a/fs/ext4/balloc.c
44699+++ b/fs/ext4/balloc.c
44700@@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct ext4_sb_info *sbi,
44701 /* Hm, nope. Are (enough) root reserved blocks available? */
44702 if (sbi->s_resuid == current_fsuid() ||
44703 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
44704- capable(CAP_SYS_RESOURCE) ||
44705- (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
44706+ (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
44707+ capable_nolog(CAP_SYS_RESOURCE)) {
44708
44709 if (free_blocks >= (nblocks + dirty_blocks))
44710 return 1;
44711diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
44712index 5c38120..2291d18 100644
44713--- a/fs/ext4/ext4.h
44714+++ b/fs/ext4/ext4.h
44715@@ -1180,19 +1180,19 @@ struct ext4_sb_info {
44716 unsigned long s_mb_last_start;
44717
44718 /* stats for buddy allocator */
44719- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
44720- atomic_t s_bal_success; /* we found long enough chunks */
44721- atomic_t s_bal_allocated; /* in blocks */
44722- atomic_t s_bal_ex_scanned; /* total extents scanned */
44723- atomic_t s_bal_goals; /* goal hits */
44724- atomic_t s_bal_breaks; /* too long searches */
44725- atomic_t s_bal_2orders; /* 2^order hits */
44726+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
44727+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
44728+ atomic_unchecked_t s_bal_allocated; /* in blocks */
44729+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
44730+ atomic_unchecked_t s_bal_goals; /* goal hits */
44731+ atomic_unchecked_t s_bal_breaks; /* too long searches */
44732+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
44733 spinlock_t s_bal_lock;
44734 unsigned long s_mb_buddies_generated;
44735 unsigned long long s_mb_generation_time;
44736- atomic_t s_mb_lost_chunks;
44737- atomic_t s_mb_preallocated;
44738- atomic_t s_mb_discarded;
44739+ atomic_unchecked_t s_mb_lost_chunks;
44740+ atomic_unchecked_t s_mb_preallocated;
44741+ atomic_unchecked_t s_mb_discarded;
44742 atomic_t s_lock_busy;
44743
44744 /* locality groups */
44745diff --git a/fs/ext4/file.c b/fs/ext4/file.c
44746index e4095e9..1c006c5 100644
44747--- a/fs/ext4/file.c
44748+++ b/fs/ext4/file.c
44749@@ -181,8 +181,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
44750 path.dentry = mnt->mnt_root;
44751 cp = d_path(&path, buf, sizeof(buf));
44752 if (!IS_ERR(cp)) {
44753- memcpy(sbi->s_es->s_last_mounted, cp,
44754- sizeof(sbi->s_es->s_last_mounted));
44755+ strlcpy(sbi->s_es->s_last_mounted, cp,
44756+ sizeof(sbi->s_es->s_last_mounted));
44757 ext4_mark_super_dirty(sb);
44758 }
44759 }
44760diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
44761index f18bfe3..43759b1 100644
44762--- a/fs/ext4/ioctl.c
44763+++ b/fs/ext4/ioctl.c
44764@@ -348,7 +348,7 @@ mext_out:
44765 if (!blk_queue_discard(q))
44766 return -EOPNOTSUPP;
44767
44768- if (copy_from_user(&range, (struct fstrim_range *)arg,
44769+ if (copy_from_user(&range, (struct fstrim_range __user *)arg,
44770 sizeof(range)))
44771 return -EFAULT;
44772
44773@@ -358,7 +358,7 @@ mext_out:
44774 if (ret < 0)
44775 return ret;
44776
44777- if (copy_to_user((struct fstrim_range *)arg, &range,
44778+ if (copy_to_user((struct fstrim_range __user *)arg, &range,
44779 sizeof(range)))
44780 return -EFAULT;
44781
44782diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
44783index 17a5a57..b6be3c5 100644
44784--- a/fs/ext4/mballoc.c
44785+++ b/fs/ext4/mballoc.c
44786@@ -1795,7 +1795,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
44787 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
44788
44789 if (EXT4_SB(sb)->s_mb_stats)
44790- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
44791+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
44792
44793 break;
44794 }
44795@@ -2089,7 +2089,7 @@ repeat:
44796 ac->ac_status = AC_STATUS_CONTINUE;
44797 ac->ac_flags |= EXT4_MB_HINT_FIRST;
44798 cr = 3;
44799- atomic_inc(&sbi->s_mb_lost_chunks);
44800+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
44801 goto repeat;
44802 }
44803 }
44804@@ -2132,6 +2132,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
44805 ext4_grpblk_t counters[16];
44806 } sg;
44807
44808+ pax_track_stack();
44809+
44810 group--;
44811 if (group == 0)
44812 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
44813@@ -2573,25 +2575,25 @@ int ext4_mb_release(struct super_block *sb)
44814 if (sbi->s_mb_stats) {
44815 ext4_msg(sb, KERN_INFO,
44816 "mballoc: %u blocks %u reqs (%u success)",
44817- atomic_read(&sbi->s_bal_allocated),
44818- atomic_read(&sbi->s_bal_reqs),
44819- atomic_read(&sbi->s_bal_success));
44820+ atomic_read_unchecked(&sbi->s_bal_allocated),
44821+ atomic_read_unchecked(&sbi->s_bal_reqs),
44822+ atomic_read_unchecked(&sbi->s_bal_success));
44823 ext4_msg(sb, KERN_INFO,
44824 "mballoc: %u extents scanned, %u goal hits, "
44825 "%u 2^N hits, %u breaks, %u lost",
44826- atomic_read(&sbi->s_bal_ex_scanned),
44827- atomic_read(&sbi->s_bal_goals),
44828- atomic_read(&sbi->s_bal_2orders),
44829- atomic_read(&sbi->s_bal_breaks),
44830- atomic_read(&sbi->s_mb_lost_chunks));
44831+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
44832+ atomic_read_unchecked(&sbi->s_bal_goals),
44833+ atomic_read_unchecked(&sbi->s_bal_2orders),
44834+ atomic_read_unchecked(&sbi->s_bal_breaks),
44835+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
44836 ext4_msg(sb, KERN_INFO,
44837 "mballoc: %lu generated and it took %Lu",
44838 sbi->s_mb_buddies_generated,
44839 sbi->s_mb_generation_time);
44840 ext4_msg(sb, KERN_INFO,
44841 "mballoc: %u preallocated, %u discarded",
44842- atomic_read(&sbi->s_mb_preallocated),
44843- atomic_read(&sbi->s_mb_discarded));
44844+ atomic_read_unchecked(&sbi->s_mb_preallocated),
44845+ atomic_read_unchecked(&sbi->s_mb_discarded));
44846 }
44847
44848 free_percpu(sbi->s_locality_groups);
44849@@ -3070,16 +3072,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
44850 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
44851
44852 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
44853- atomic_inc(&sbi->s_bal_reqs);
44854- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44855+ atomic_inc_unchecked(&sbi->s_bal_reqs);
44856+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44857 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
44858- atomic_inc(&sbi->s_bal_success);
44859- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
44860+ atomic_inc_unchecked(&sbi->s_bal_success);
44861+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
44862 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
44863 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
44864- atomic_inc(&sbi->s_bal_goals);
44865+ atomic_inc_unchecked(&sbi->s_bal_goals);
44866 if (ac->ac_found > sbi->s_mb_max_to_scan)
44867- atomic_inc(&sbi->s_bal_breaks);
44868+ atomic_inc_unchecked(&sbi->s_bal_breaks);
44869 }
44870
44871 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
44872@@ -3477,7 +3479,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
44873 trace_ext4_mb_new_inode_pa(ac, pa);
44874
44875 ext4_mb_use_inode_pa(ac, pa);
44876- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44877+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44878
44879 ei = EXT4_I(ac->ac_inode);
44880 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44881@@ -3537,7 +3539,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
44882 trace_ext4_mb_new_group_pa(ac, pa);
44883
44884 ext4_mb_use_group_pa(ac, pa);
44885- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44886+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44887
44888 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44889 lg = ac->ac_lg;
44890@@ -3625,7 +3627,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
44891 * from the bitmap and continue.
44892 */
44893 }
44894- atomic_add(free, &sbi->s_mb_discarded);
44895+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
44896
44897 return err;
44898 }
44899@@ -3643,7 +3645,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
44900 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
44901 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
44902 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
44903- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44904+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44905 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
44906
44907 return 0;
44908diff --git a/fs/fcntl.c b/fs/fcntl.c
44909index 22764c7..86372c9 100644
44910--- a/fs/fcntl.c
44911+++ b/fs/fcntl.c
44912@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
44913 if (err)
44914 return err;
44915
44916+ if (gr_handle_chroot_fowner(pid, type))
44917+ return -ENOENT;
44918+ if (gr_check_protected_task_fowner(pid, type))
44919+ return -EACCES;
44920+
44921 f_modown(filp, pid, type, force);
44922 return 0;
44923 }
44924@@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
44925
44926 static int f_setown_ex(struct file *filp, unsigned long arg)
44927 {
44928- struct f_owner_ex * __user owner_p = (void * __user)arg;
44929+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44930 struct f_owner_ex owner;
44931 struct pid *pid;
44932 int type;
44933@@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
44934
44935 static int f_getown_ex(struct file *filp, unsigned long arg)
44936 {
44937- struct f_owner_ex * __user owner_p = (void * __user)arg;
44938+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44939 struct f_owner_ex owner;
44940 int ret = 0;
44941
44942@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
44943 switch (cmd) {
44944 case F_DUPFD:
44945 case F_DUPFD_CLOEXEC:
44946+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
44947 if (arg >= rlimit(RLIMIT_NOFILE))
44948 break;
44949 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
44950diff --git a/fs/fifo.c b/fs/fifo.c
44951index b1a524d..4ee270e 100644
44952--- a/fs/fifo.c
44953+++ b/fs/fifo.c
44954@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
44955 */
44956 filp->f_op = &read_pipefifo_fops;
44957 pipe->r_counter++;
44958- if (pipe->readers++ == 0)
44959+ if (atomic_inc_return(&pipe->readers) == 1)
44960 wake_up_partner(inode);
44961
44962- if (!pipe->writers) {
44963+ if (!atomic_read(&pipe->writers)) {
44964 if ((filp->f_flags & O_NONBLOCK)) {
44965 /* suppress POLLHUP until we have
44966 * seen a writer */
44967@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
44968 * errno=ENXIO when there is no process reading the FIFO.
44969 */
44970 ret = -ENXIO;
44971- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
44972+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
44973 goto err;
44974
44975 filp->f_op = &write_pipefifo_fops;
44976 pipe->w_counter++;
44977- if (!pipe->writers++)
44978+ if (atomic_inc_return(&pipe->writers) == 1)
44979 wake_up_partner(inode);
44980
44981- if (!pipe->readers) {
44982+ if (!atomic_read(&pipe->readers)) {
44983 wait_for_partner(inode, &pipe->r_counter);
44984 if (signal_pending(current))
44985 goto err_wr;
44986@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
44987 */
44988 filp->f_op = &rdwr_pipefifo_fops;
44989
44990- pipe->readers++;
44991- pipe->writers++;
44992+ atomic_inc(&pipe->readers);
44993+ atomic_inc(&pipe->writers);
44994 pipe->r_counter++;
44995 pipe->w_counter++;
44996- if (pipe->readers == 1 || pipe->writers == 1)
44997+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
44998 wake_up_partner(inode);
44999 break;
45000
45001@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
45002 return 0;
45003
45004 err_rd:
45005- if (!--pipe->readers)
45006+ if (atomic_dec_and_test(&pipe->readers))
45007 wake_up_interruptible(&pipe->wait);
45008 ret = -ERESTARTSYS;
45009 goto err;
45010
45011 err_wr:
45012- if (!--pipe->writers)
45013+ if (atomic_dec_and_test(&pipe->writers))
45014 wake_up_interruptible(&pipe->wait);
45015 ret = -ERESTARTSYS;
45016 goto err;
45017
45018 err:
45019- if (!pipe->readers && !pipe->writers)
45020+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
45021 free_pipe_info(inode);
45022
45023 err_nocleanup:
45024diff --git a/fs/file.c b/fs/file.c
45025index 4c6992d..104cdea 100644
45026--- a/fs/file.c
45027+++ b/fs/file.c
45028@@ -15,6 +15,7 @@
45029 #include <linux/slab.h>
45030 #include <linux/vmalloc.h>
45031 #include <linux/file.h>
45032+#include <linux/security.h>
45033 #include <linux/fdtable.h>
45034 #include <linux/bitops.h>
45035 #include <linux/interrupt.h>
45036@@ -254,6 +255,7 @@ int expand_files(struct files_struct *files, int nr)
45037 * N.B. For clone tasks sharing a files structure, this test
45038 * will limit the total number of files that can be opened.
45039 */
45040+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
45041 if (nr >= rlimit(RLIMIT_NOFILE))
45042 return -EMFILE;
45043
45044diff --git a/fs/filesystems.c b/fs/filesystems.c
45045index 0845f84..7b4ebef 100644
45046--- a/fs/filesystems.c
45047+++ b/fs/filesystems.c
45048@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(const char *name)
45049 int len = dot ? dot - name : strlen(name);
45050
45051 fs = __get_fs_type(name, len);
45052+
45053+#ifdef CONFIG_GRKERNSEC_MODHARDEN
45054+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
45055+#else
45056 if (!fs && (request_module("%.*s", len, name) == 0))
45057+#endif
45058 fs = __get_fs_type(name, len);
45059
45060 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
45061diff --git a/fs/fs_struct.c b/fs/fs_struct.c
45062index 78b519c..212c0d0 100644
45063--- a/fs/fs_struct.c
45064+++ b/fs/fs_struct.c
45065@@ -4,6 +4,7 @@
45066 #include <linux/path.h>
45067 #include <linux/slab.h>
45068 #include <linux/fs_struct.h>
45069+#include <linux/grsecurity.h>
45070 #include "internal.h"
45071
45072 static inline void path_get_longterm(struct path *path)
45073@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
45074 old_root = fs->root;
45075 fs->root = *path;
45076 path_get_longterm(path);
45077+ gr_set_chroot_entries(current, path);
45078 write_seqcount_end(&fs->seq);
45079 spin_unlock(&fs->lock);
45080 if (old_root.dentry)
45081@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
45082 && fs->root.mnt == old_root->mnt) {
45083 path_get_longterm(new_root);
45084 fs->root = *new_root;
45085+ gr_set_chroot_entries(p, new_root);
45086 count++;
45087 }
45088 if (fs->pwd.dentry == old_root->dentry
45089@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
45090 spin_lock(&fs->lock);
45091 write_seqcount_begin(&fs->seq);
45092 tsk->fs = NULL;
45093- kill = !--fs->users;
45094+ gr_clear_chroot_entries(tsk);
45095+ kill = !atomic_dec_return(&fs->users);
45096 write_seqcount_end(&fs->seq);
45097 spin_unlock(&fs->lock);
45098 task_unlock(tsk);
45099@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
45100 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
45101 /* We don't need to lock fs - think why ;-) */
45102 if (fs) {
45103- fs->users = 1;
45104+ atomic_set(&fs->users, 1);
45105 fs->in_exec = 0;
45106 spin_lock_init(&fs->lock);
45107 seqcount_init(&fs->seq);
45108@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
45109 spin_lock(&old->lock);
45110 fs->root = old->root;
45111 path_get_longterm(&fs->root);
45112+ /* instead of calling gr_set_chroot_entries here,
45113+ we call it from every caller of this function
45114+ */
45115 fs->pwd = old->pwd;
45116 path_get_longterm(&fs->pwd);
45117 spin_unlock(&old->lock);
45118@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
45119
45120 task_lock(current);
45121 spin_lock(&fs->lock);
45122- kill = !--fs->users;
45123+ kill = !atomic_dec_return(&fs->users);
45124 current->fs = new_fs;
45125+ gr_set_chroot_entries(current, &new_fs->root);
45126 spin_unlock(&fs->lock);
45127 task_unlock(current);
45128
45129@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
45130
45131 /* to be mentioned only in INIT_TASK */
45132 struct fs_struct init_fs = {
45133- .users = 1,
45134+ .users = ATOMIC_INIT(1),
45135 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
45136 .seq = SEQCNT_ZERO,
45137 .umask = 0022,
45138@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
45139 task_lock(current);
45140
45141 spin_lock(&init_fs.lock);
45142- init_fs.users++;
45143+ atomic_inc(&init_fs.users);
45144 spin_unlock(&init_fs.lock);
45145
45146 spin_lock(&fs->lock);
45147 current->fs = &init_fs;
45148- kill = !--fs->users;
45149+ gr_set_chroot_entries(current, &current->fs->root);
45150+ kill = !atomic_dec_return(&fs->users);
45151 spin_unlock(&fs->lock);
45152
45153 task_unlock(current);
45154diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
45155index 9905350..02eaec4 100644
45156--- a/fs/fscache/cookie.c
45157+++ b/fs/fscache/cookie.c
45158@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
45159 parent ? (char *) parent->def->name : "<no-parent>",
45160 def->name, netfs_data);
45161
45162- fscache_stat(&fscache_n_acquires);
45163+ fscache_stat_unchecked(&fscache_n_acquires);
45164
45165 /* if there's no parent cookie, then we don't create one here either */
45166 if (!parent) {
45167- fscache_stat(&fscache_n_acquires_null);
45168+ fscache_stat_unchecked(&fscache_n_acquires_null);
45169 _leave(" [no parent]");
45170 return NULL;
45171 }
45172@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
45173 /* allocate and initialise a cookie */
45174 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
45175 if (!cookie) {
45176- fscache_stat(&fscache_n_acquires_oom);
45177+ fscache_stat_unchecked(&fscache_n_acquires_oom);
45178 _leave(" [ENOMEM]");
45179 return NULL;
45180 }
45181@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
45182
45183 switch (cookie->def->type) {
45184 case FSCACHE_COOKIE_TYPE_INDEX:
45185- fscache_stat(&fscache_n_cookie_index);
45186+ fscache_stat_unchecked(&fscache_n_cookie_index);
45187 break;
45188 case FSCACHE_COOKIE_TYPE_DATAFILE:
45189- fscache_stat(&fscache_n_cookie_data);
45190+ fscache_stat_unchecked(&fscache_n_cookie_data);
45191 break;
45192 default:
45193- fscache_stat(&fscache_n_cookie_special);
45194+ fscache_stat_unchecked(&fscache_n_cookie_special);
45195 break;
45196 }
45197
45198@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
45199 if (fscache_acquire_non_index_cookie(cookie) < 0) {
45200 atomic_dec(&parent->n_children);
45201 __fscache_cookie_put(cookie);
45202- fscache_stat(&fscache_n_acquires_nobufs);
45203+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
45204 _leave(" = NULL");
45205 return NULL;
45206 }
45207 }
45208
45209- fscache_stat(&fscache_n_acquires_ok);
45210+ fscache_stat_unchecked(&fscache_n_acquires_ok);
45211 _leave(" = %p", cookie);
45212 return cookie;
45213 }
45214@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
45215 cache = fscache_select_cache_for_object(cookie->parent);
45216 if (!cache) {
45217 up_read(&fscache_addremove_sem);
45218- fscache_stat(&fscache_n_acquires_no_cache);
45219+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
45220 _leave(" = -ENOMEDIUM [no cache]");
45221 return -ENOMEDIUM;
45222 }
45223@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
45224 object = cache->ops->alloc_object(cache, cookie);
45225 fscache_stat_d(&fscache_n_cop_alloc_object);
45226 if (IS_ERR(object)) {
45227- fscache_stat(&fscache_n_object_no_alloc);
45228+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
45229 ret = PTR_ERR(object);
45230 goto error;
45231 }
45232
45233- fscache_stat(&fscache_n_object_alloc);
45234+ fscache_stat_unchecked(&fscache_n_object_alloc);
45235
45236 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
45237
45238@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
45239 struct fscache_object *object;
45240 struct hlist_node *_p;
45241
45242- fscache_stat(&fscache_n_updates);
45243+ fscache_stat_unchecked(&fscache_n_updates);
45244
45245 if (!cookie) {
45246- fscache_stat(&fscache_n_updates_null);
45247+ fscache_stat_unchecked(&fscache_n_updates_null);
45248 _leave(" [no cookie]");
45249 return;
45250 }
45251@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
45252 struct fscache_object *object;
45253 unsigned long event;
45254
45255- fscache_stat(&fscache_n_relinquishes);
45256+ fscache_stat_unchecked(&fscache_n_relinquishes);
45257 if (retire)
45258- fscache_stat(&fscache_n_relinquishes_retire);
45259+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
45260
45261 if (!cookie) {
45262- fscache_stat(&fscache_n_relinquishes_null);
45263+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
45264 _leave(" [no cookie]");
45265 return;
45266 }
45267@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
45268
45269 /* wait for the cookie to finish being instantiated (or to fail) */
45270 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
45271- fscache_stat(&fscache_n_relinquishes_waitcrt);
45272+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
45273 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
45274 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
45275 }
45276diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
45277index f6aad48..88dcf26 100644
45278--- a/fs/fscache/internal.h
45279+++ b/fs/fscache/internal.h
45280@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
45281 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
45282 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
45283
45284-extern atomic_t fscache_n_op_pend;
45285-extern atomic_t fscache_n_op_run;
45286-extern atomic_t fscache_n_op_enqueue;
45287-extern atomic_t fscache_n_op_deferred_release;
45288-extern atomic_t fscache_n_op_release;
45289-extern atomic_t fscache_n_op_gc;
45290-extern atomic_t fscache_n_op_cancelled;
45291-extern atomic_t fscache_n_op_rejected;
45292+extern atomic_unchecked_t fscache_n_op_pend;
45293+extern atomic_unchecked_t fscache_n_op_run;
45294+extern atomic_unchecked_t fscache_n_op_enqueue;
45295+extern atomic_unchecked_t fscache_n_op_deferred_release;
45296+extern atomic_unchecked_t fscache_n_op_release;
45297+extern atomic_unchecked_t fscache_n_op_gc;
45298+extern atomic_unchecked_t fscache_n_op_cancelled;
45299+extern atomic_unchecked_t fscache_n_op_rejected;
45300
45301-extern atomic_t fscache_n_attr_changed;
45302-extern atomic_t fscache_n_attr_changed_ok;
45303-extern atomic_t fscache_n_attr_changed_nobufs;
45304-extern atomic_t fscache_n_attr_changed_nomem;
45305-extern atomic_t fscache_n_attr_changed_calls;
45306+extern atomic_unchecked_t fscache_n_attr_changed;
45307+extern atomic_unchecked_t fscache_n_attr_changed_ok;
45308+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
45309+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
45310+extern atomic_unchecked_t fscache_n_attr_changed_calls;
45311
45312-extern atomic_t fscache_n_allocs;
45313-extern atomic_t fscache_n_allocs_ok;
45314-extern atomic_t fscache_n_allocs_wait;
45315-extern atomic_t fscache_n_allocs_nobufs;
45316-extern atomic_t fscache_n_allocs_intr;
45317-extern atomic_t fscache_n_allocs_object_dead;
45318-extern atomic_t fscache_n_alloc_ops;
45319-extern atomic_t fscache_n_alloc_op_waits;
45320+extern atomic_unchecked_t fscache_n_allocs;
45321+extern atomic_unchecked_t fscache_n_allocs_ok;
45322+extern atomic_unchecked_t fscache_n_allocs_wait;
45323+extern atomic_unchecked_t fscache_n_allocs_nobufs;
45324+extern atomic_unchecked_t fscache_n_allocs_intr;
45325+extern atomic_unchecked_t fscache_n_allocs_object_dead;
45326+extern atomic_unchecked_t fscache_n_alloc_ops;
45327+extern atomic_unchecked_t fscache_n_alloc_op_waits;
45328
45329-extern atomic_t fscache_n_retrievals;
45330-extern atomic_t fscache_n_retrievals_ok;
45331-extern atomic_t fscache_n_retrievals_wait;
45332-extern atomic_t fscache_n_retrievals_nodata;
45333-extern atomic_t fscache_n_retrievals_nobufs;
45334-extern atomic_t fscache_n_retrievals_intr;
45335-extern atomic_t fscache_n_retrievals_nomem;
45336-extern atomic_t fscache_n_retrievals_object_dead;
45337-extern atomic_t fscache_n_retrieval_ops;
45338-extern atomic_t fscache_n_retrieval_op_waits;
45339+extern atomic_unchecked_t fscache_n_retrievals;
45340+extern atomic_unchecked_t fscache_n_retrievals_ok;
45341+extern atomic_unchecked_t fscache_n_retrievals_wait;
45342+extern atomic_unchecked_t fscache_n_retrievals_nodata;
45343+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
45344+extern atomic_unchecked_t fscache_n_retrievals_intr;
45345+extern atomic_unchecked_t fscache_n_retrievals_nomem;
45346+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
45347+extern atomic_unchecked_t fscache_n_retrieval_ops;
45348+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
45349
45350-extern atomic_t fscache_n_stores;
45351-extern atomic_t fscache_n_stores_ok;
45352-extern atomic_t fscache_n_stores_again;
45353-extern atomic_t fscache_n_stores_nobufs;
45354-extern atomic_t fscache_n_stores_oom;
45355-extern atomic_t fscache_n_store_ops;
45356-extern atomic_t fscache_n_store_calls;
45357-extern atomic_t fscache_n_store_pages;
45358-extern atomic_t fscache_n_store_radix_deletes;
45359-extern atomic_t fscache_n_store_pages_over_limit;
45360+extern atomic_unchecked_t fscache_n_stores;
45361+extern atomic_unchecked_t fscache_n_stores_ok;
45362+extern atomic_unchecked_t fscache_n_stores_again;
45363+extern atomic_unchecked_t fscache_n_stores_nobufs;
45364+extern atomic_unchecked_t fscache_n_stores_oom;
45365+extern atomic_unchecked_t fscache_n_store_ops;
45366+extern atomic_unchecked_t fscache_n_store_calls;
45367+extern atomic_unchecked_t fscache_n_store_pages;
45368+extern atomic_unchecked_t fscache_n_store_radix_deletes;
45369+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
45370
45371-extern atomic_t fscache_n_store_vmscan_not_storing;
45372-extern atomic_t fscache_n_store_vmscan_gone;
45373-extern atomic_t fscache_n_store_vmscan_busy;
45374-extern atomic_t fscache_n_store_vmscan_cancelled;
45375+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45376+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
45377+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
45378+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45379
45380-extern atomic_t fscache_n_marks;
45381-extern atomic_t fscache_n_uncaches;
45382+extern atomic_unchecked_t fscache_n_marks;
45383+extern atomic_unchecked_t fscache_n_uncaches;
45384
45385-extern atomic_t fscache_n_acquires;
45386-extern atomic_t fscache_n_acquires_null;
45387-extern atomic_t fscache_n_acquires_no_cache;
45388-extern atomic_t fscache_n_acquires_ok;
45389-extern atomic_t fscache_n_acquires_nobufs;
45390-extern atomic_t fscache_n_acquires_oom;
45391+extern atomic_unchecked_t fscache_n_acquires;
45392+extern atomic_unchecked_t fscache_n_acquires_null;
45393+extern atomic_unchecked_t fscache_n_acquires_no_cache;
45394+extern atomic_unchecked_t fscache_n_acquires_ok;
45395+extern atomic_unchecked_t fscache_n_acquires_nobufs;
45396+extern atomic_unchecked_t fscache_n_acquires_oom;
45397
45398-extern atomic_t fscache_n_updates;
45399-extern atomic_t fscache_n_updates_null;
45400-extern atomic_t fscache_n_updates_run;
45401+extern atomic_unchecked_t fscache_n_updates;
45402+extern atomic_unchecked_t fscache_n_updates_null;
45403+extern atomic_unchecked_t fscache_n_updates_run;
45404
45405-extern atomic_t fscache_n_relinquishes;
45406-extern atomic_t fscache_n_relinquishes_null;
45407-extern atomic_t fscache_n_relinquishes_waitcrt;
45408-extern atomic_t fscache_n_relinquishes_retire;
45409+extern atomic_unchecked_t fscache_n_relinquishes;
45410+extern atomic_unchecked_t fscache_n_relinquishes_null;
45411+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45412+extern atomic_unchecked_t fscache_n_relinquishes_retire;
45413
45414-extern atomic_t fscache_n_cookie_index;
45415-extern atomic_t fscache_n_cookie_data;
45416-extern atomic_t fscache_n_cookie_special;
45417+extern atomic_unchecked_t fscache_n_cookie_index;
45418+extern atomic_unchecked_t fscache_n_cookie_data;
45419+extern atomic_unchecked_t fscache_n_cookie_special;
45420
45421-extern atomic_t fscache_n_object_alloc;
45422-extern atomic_t fscache_n_object_no_alloc;
45423-extern atomic_t fscache_n_object_lookups;
45424-extern atomic_t fscache_n_object_lookups_negative;
45425-extern atomic_t fscache_n_object_lookups_positive;
45426-extern atomic_t fscache_n_object_lookups_timed_out;
45427-extern atomic_t fscache_n_object_created;
45428-extern atomic_t fscache_n_object_avail;
45429-extern atomic_t fscache_n_object_dead;
45430+extern atomic_unchecked_t fscache_n_object_alloc;
45431+extern atomic_unchecked_t fscache_n_object_no_alloc;
45432+extern atomic_unchecked_t fscache_n_object_lookups;
45433+extern atomic_unchecked_t fscache_n_object_lookups_negative;
45434+extern atomic_unchecked_t fscache_n_object_lookups_positive;
45435+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
45436+extern atomic_unchecked_t fscache_n_object_created;
45437+extern atomic_unchecked_t fscache_n_object_avail;
45438+extern atomic_unchecked_t fscache_n_object_dead;
45439
45440-extern atomic_t fscache_n_checkaux_none;
45441-extern atomic_t fscache_n_checkaux_okay;
45442-extern atomic_t fscache_n_checkaux_update;
45443-extern atomic_t fscache_n_checkaux_obsolete;
45444+extern atomic_unchecked_t fscache_n_checkaux_none;
45445+extern atomic_unchecked_t fscache_n_checkaux_okay;
45446+extern atomic_unchecked_t fscache_n_checkaux_update;
45447+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
45448
45449 extern atomic_t fscache_n_cop_alloc_object;
45450 extern atomic_t fscache_n_cop_lookup_object;
45451@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t *stat)
45452 atomic_inc(stat);
45453 }
45454
45455+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
45456+{
45457+ atomic_inc_unchecked(stat);
45458+}
45459+
45460 static inline void fscache_stat_d(atomic_t *stat)
45461 {
45462 atomic_dec(stat);
45463@@ -267,6 +272,7 @@ extern const struct file_operations fscache_stats_fops;
45464
45465 #define __fscache_stat(stat) (NULL)
45466 #define fscache_stat(stat) do {} while (0)
45467+#define fscache_stat_unchecked(stat) do {} while (0)
45468 #define fscache_stat_d(stat) do {} while (0)
45469 #endif
45470
45471diff --git a/fs/fscache/object.c b/fs/fscache/object.c
45472index b6b897c..0ffff9c 100644
45473--- a/fs/fscache/object.c
45474+++ b/fs/fscache/object.c
45475@@ -128,7 +128,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45476 /* update the object metadata on disk */
45477 case FSCACHE_OBJECT_UPDATING:
45478 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
45479- fscache_stat(&fscache_n_updates_run);
45480+ fscache_stat_unchecked(&fscache_n_updates_run);
45481 fscache_stat(&fscache_n_cop_update_object);
45482 object->cache->ops->update_object(object);
45483 fscache_stat_d(&fscache_n_cop_update_object);
45484@@ -217,7 +217,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45485 spin_lock(&object->lock);
45486 object->state = FSCACHE_OBJECT_DEAD;
45487 spin_unlock(&object->lock);
45488- fscache_stat(&fscache_n_object_dead);
45489+ fscache_stat_unchecked(&fscache_n_object_dead);
45490 goto terminal_transit;
45491
45492 /* handle the parent cache of this object being withdrawn from
45493@@ -232,7 +232,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45494 spin_lock(&object->lock);
45495 object->state = FSCACHE_OBJECT_DEAD;
45496 spin_unlock(&object->lock);
45497- fscache_stat(&fscache_n_object_dead);
45498+ fscache_stat_unchecked(&fscache_n_object_dead);
45499 goto terminal_transit;
45500
45501 /* complain about the object being woken up once it is
45502@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45503 parent->cookie->def->name, cookie->def->name,
45504 object->cache->tag->name);
45505
45506- fscache_stat(&fscache_n_object_lookups);
45507+ fscache_stat_unchecked(&fscache_n_object_lookups);
45508 fscache_stat(&fscache_n_cop_lookup_object);
45509 ret = object->cache->ops->lookup_object(object);
45510 fscache_stat_d(&fscache_n_cop_lookup_object);
45511@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45512 if (ret == -ETIMEDOUT) {
45513 /* probably stuck behind another object, so move this one to
45514 * the back of the queue */
45515- fscache_stat(&fscache_n_object_lookups_timed_out);
45516+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
45517 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45518 }
45519
45520@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
45521
45522 spin_lock(&object->lock);
45523 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45524- fscache_stat(&fscache_n_object_lookups_negative);
45525+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
45526
45527 /* transit here to allow write requests to begin stacking up
45528 * and read requests to begin returning ENODATA */
45529@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fscache_object *object)
45530 * result, in which case there may be data available */
45531 spin_lock(&object->lock);
45532 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45533- fscache_stat(&fscache_n_object_lookups_positive);
45534+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
45535
45536 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
45537
45538@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fscache_object *object)
45539 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45540 } else {
45541 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
45542- fscache_stat(&fscache_n_object_created);
45543+ fscache_stat_unchecked(&fscache_n_object_created);
45544
45545 object->state = FSCACHE_OBJECT_AVAILABLE;
45546 spin_unlock(&object->lock);
45547@@ -602,7 +602,7 @@ static void fscache_object_available(struct fscache_object *object)
45548 fscache_enqueue_dependents(object);
45549
45550 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
45551- fscache_stat(&fscache_n_object_avail);
45552+ fscache_stat_unchecked(&fscache_n_object_avail);
45553
45554 _leave("");
45555 }
45556@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45557 enum fscache_checkaux result;
45558
45559 if (!object->cookie->def->check_aux) {
45560- fscache_stat(&fscache_n_checkaux_none);
45561+ fscache_stat_unchecked(&fscache_n_checkaux_none);
45562 return FSCACHE_CHECKAUX_OKAY;
45563 }
45564
45565@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45566 switch (result) {
45567 /* entry okay as is */
45568 case FSCACHE_CHECKAUX_OKAY:
45569- fscache_stat(&fscache_n_checkaux_okay);
45570+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
45571 break;
45572
45573 /* entry requires update */
45574 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
45575- fscache_stat(&fscache_n_checkaux_update);
45576+ fscache_stat_unchecked(&fscache_n_checkaux_update);
45577 break;
45578
45579 /* entry requires deletion */
45580 case FSCACHE_CHECKAUX_OBSOLETE:
45581- fscache_stat(&fscache_n_checkaux_obsolete);
45582+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
45583 break;
45584
45585 default:
45586diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
45587index 30afdfa..2256596 100644
45588--- a/fs/fscache/operation.c
45589+++ b/fs/fscache/operation.c
45590@@ -17,7 +17,7 @@
45591 #include <linux/slab.h>
45592 #include "internal.h"
45593
45594-atomic_t fscache_op_debug_id;
45595+atomic_unchecked_t fscache_op_debug_id;
45596 EXPORT_SYMBOL(fscache_op_debug_id);
45597
45598 /**
45599@@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
45600 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
45601 ASSERTCMP(atomic_read(&op->usage), >, 0);
45602
45603- fscache_stat(&fscache_n_op_enqueue);
45604+ fscache_stat_unchecked(&fscache_n_op_enqueue);
45605 switch (op->flags & FSCACHE_OP_TYPE) {
45606 case FSCACHE_OP_ASYNC:
45607 _debug("queue async");
45608@@ -69,7 +69,7 @@ static void fscache_run_op(struct fscache_object *object,
45609 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
45610 if (op->processor)
45611 fscache_enqueue_operation(op);
45612- fscache_stat(&fscache_n_op_run);
45613+ fscache_stat_unchecked(&fscache_n_op_run);
45614 }
45615
45616 /*
45617@@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45618 if (object->n_ops > 1) {
45619 atomic_inc(&op->usage);
45620 list_add_tail(&op->pend_link, &object->pending_ops);
45621- fscache_stat(&fscache_n_op_pend);
45622+ fscache_stat_unchecked(&fscache_n_op_pend);
45623 } else if (!list_empty(&object->pending_ops)) {
45624 atomic_inc(&op->usage);
45625 list_add_tail(&op->pend_link, &object->pending_ops);
45626- fscache_stat(&fscache_n_op_pend);
45627+ fscache_stat_unchecked(&fscache_n_op_pend);
45628 fscache_start_operations(object);
45629 } else {
45630 ASSERTCMP(object->n_in_progress, ==, 0);
45631@@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45632 object->n_exclusive++; /* reads and writes must wait */
45633 atomic_inc(&op->usage);
45634 list_add_tail(&op->pend_link, &object->pending_ops);
45635- fscache_stat(&fscache_n_op_pend);
45636+ fscache_stat_unchecked(&fscache_n_op_pend);
45637 ret = 0;
45638 } else {
45639 /* not allowed to submit ops in any other state */
45640@@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_object *object,
45641 if (object->n_exclusive > 0) {
45642 atomic_inc(&op->usage);
45643 list_add_tail(&op->pend_link, &object->pending_ops);
45644- fscache_stat(&fscache_n_op_pend);
45645+ fscache_stat_unchecked(&fscache_n_op_pend);
45646 } else if (!list_empty(&object->pending_ops)) {
45647 atomic_inc(&op->usage);
45648 list_add_tail(&op->pend_link, &object->pending_ops);
45649- fscache_stat(&fscache_n_op_pend);
45650+ fscache_stat_unchecked(&fscache_n_op_pend);
45651 fscache_start_operations(object);
45652 } else {
45653 ASSERTCMP(object->n_exclusive, ==, 0);
45654@@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_object *object,
45655 object->n_ops++;
45656 atomic_inc(&op->usage);
45657 list_add_tail(&op->pend_link, &object->pending_ops);
45658- fscache_stat(&fscache_n_op_pend);
45659+ fscache_stat_unchecked(&fscache_n_op_pend);
45660 ret = 0;
45661 } else if (object->state == FSCACHE_OBJECT_DYING ||
45662 object->state == FSCACHE_OBJECT_LC_DYING ||
45663 object->state == FSCACHE_OBJECT_WITHDRAWING) {
45664- fscache_stat(&fscache_n_op_rejected);
45665+ fscache_stat_unchecked(&fscache_n_op_rejected);
45666 ret = -ENOBUFS;
45667 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
45668 fscache_report_unexpected_submission(object, op, ostate);
45669@@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_operation *op)
45670
45671 ret = -EBUSY;
45672 if (!list_empty(&op->pend_link)) {
45673- fscache_stat(&fscache_n_op_cancelled);
45674+ fscache_stat_unchecked(&fscache_n_op_cancelled);
45675 list_del_init(&op->pend_link);
45676 object->n_ops--;
45677 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
45678@@ -331,7 +331,7 @@ void fscache_put_operation(struct fscache_operation *op)
45679 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
45680 BUG();
45681
45682- fscache_stat(&fscache_n_op_release);
45683+ fscache_stat_unchecked(&fscache_n_op_release);
45684
45685 if (op->release) {
45686 op->release(op);
45687@@ -348,7 +348,7 @@ void fscache_put_operation(struct fscache_operation *op)
45688 * lock, and defer it otherwise */
45689 if (!spin_trylock(&object->lock)) {
45690 _debug("defer put");
45691- fscache_stat(&fscache_n_op_deferred_release);
45692+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
45693
45694 cache = object->cache;
45695 spin_lock(&cache->op_gc_list_lock);
45696@@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_struct *work)
45697
45698 _debug("GC DEFERRED REL OBJ%x OP%x",
45699 object->debug_id, op->debug_id);
45700- fscache_stat(&fscache_n_op_gc);
45701+ fscache_stat_unchecked(&fscache_n_op_gc);
45702
45703 ASSERTCMP(atomic_read(&op->usage), ==, 0);
45704
45705diff --git a/fs/fscache/page.c b/fs/fscache/page.c
45706index 3f7a59b..cf196cc 100644
45707--- a/fs/fscache/page.c
45708+++ b/fs/fscache/page.c
45709@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45710 val = radix_tree_lookup(&cookie->stores, page->index);
45711 if (!val) {
45712 rcu_read_unlock();
45713- fscache_stat(&fscache_n_store_vmscan_not_storing);
45714+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
45715 __fscache_uncache_page(cookie, page);
45716 return true;
45717 }
45718@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45719 spin_unlock(&cookie->stores_lock);
45720
45721 if (xpage) {
45722- fscache_stat(&fscache_n_store_vmscan_cancelled);
45723- fscache_stat(&fscache_n_store_radix_deletes);
45724+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
45725+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45726 ASSERTCMP(xpage, ==, page);
45727 } else {
45728- fscache_stat(&fscache_n_store_vmscan_gone);
45729+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
45730 }
45731
45732 wake_up_bit(&cookie->flags, 0);
45733@@ -107,7 +107,7 @@ page_busy:
45734 /* we might want to wait here, but that could deadlock the allocator as
45735 * the work threads writing to the cache may all end up sleeping
45736 * on memory allocation */
45737- fscache_stat(&fscache_n_store_vmscan_busy);
45738+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
45739 return false;
45740 }
45741 EXPORT_SYMBOL(__fscache_maybe_release_page);
45742@@ -131,7 +131,7 @@ static void fscache_end_page_write(struct fscache_object *object,
45743 FSCACHE_COOKIE_STORING_TAG);
45744 if (!radix_tree_tag_get(&cookie->stores, page->index,
45745 FSCACHE_COOKIE_PENDING_TAG)) {
45746- fscache_stat(&fscache_n_store_radix_deletes);
45747+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45748 xpage = radix_tree_delete(&cookie->stores, page->index);
45749 }
45750 spin_unlock(&cookie->stores_lock);
45751@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
45752
45753 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
45754
45755- fscache_stat(&fscache_n_attr_changed_calls);
45756+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
45757
45758 if (fscache_object_is_active(object)) {
45759 fscache_stat(&fscache_n_cop_attr_changed);
45760@@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45761
45762 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45763
45764- fscache_stat(&fscache_n_attr_changed);
45765+ fscache_stat_unchecked(&fscache_n_attr_changed);
45766
45767 op = kzalloc(sizeof(*op), GFP_KERNEL);
45768 if (!op) {
45769- fscache_stat(&fscache_n_attr_changed_nomem);
45770+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
45771 _leave(" = -ENOMEM");
45772 return -ENOMEM;
45773 }
45774@@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45775 if (fscache_submit_exclusive_op(object, op) < 0)
45776 goto nobufs;
45777 spin_unlock(&cookie->lock);
45778- fscache_stat(&fscache_n_attr_changed_ok);
45779+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
45780 fscache_put_operation(op);
45781 _leave(" = 0");
45782 return 0;
45783@@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45784 nobufs:
45785 spin_unlock(&cookie->lock);
45786 kfree(op);
45787- fscache_stat(&fscache_n_attr_changed_nobufs);
45788+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
45789 _leave(" = %d", -ENOBUFS);
45790 return -ENOBUFS;
45791 }
45792@@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
45793 /* allocate a retrieval operation and attempt to submit it */
45794 op = kzalloc(sizeof(*op), GFP_NOIO);
45795 if (!op) {
45796- fscache_stat(&fscache_n_retrievals_nomem);
45797+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45798 return NULL;
45799 }
45800
45801@@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45802 return 0;
45803 }
45804
45805- fscache_stat(&fscache_n_retrievals_wait);
45806+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
45807
45808 jif = jiffies;
45809 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
45810 fscache_wait_bit_interruptible,
45811 TASK_INTERRUPTIBLE) != 0) {
45812- fscache_stat(&fscache_n_retrievals_intr);
45813+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45814 _leave(" = -ERESTARTSYS");
45815 return -ERESTARTSYS;
45816 }
45817@@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45818 */
45819 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45820 struct fscache_retrieval *op,
45821- atomic_t *stat_op_waits,
45822- atomic_t *stat_object_dead)
45823+ atomic_unchecked_t *stat_op_waits,
45824+ atomic_unchecked_t *stat_object_dead)
45825 {
45826 int ret;
45827
45828@@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45829 goto check_if_dead;
45830
45831 _debug(">>> WT");
45832- fscache_stat(stat_op_waits);
45833+ fscache_stat_unchecked(stat_op_waits);
45834 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
45835 fscache_wait_bit_interruptible,
45836 TASK_INTERRUPTIBLE) < 0) {
45837@@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45838
45839 check_if_dead:
45840 if (unlikely(fscache_object_is_dead(object))) {
45841- fscache_stat(stat_object_dead);
45842+ fscache_stat_unchecked(stat_object_dead);
45843 return -ENOBUFS;
45844 }
45845 return 0;
45846@@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45847
45848 _enter("%p,%p,,,", cookie, page);
45849
45850- fscache_stat(&fscache_n_retrievals);
45851+ fscache_stat_unchecked(&fscache_n_retrievals);
45852
45853 if (hlist_empty(&cookie->backing_objects))
45854 goto nobufs;
45855@@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45856 goto nobufs_unlock;
45857 spin_unlock(&cookie->lock);
45858
45859- fscache_stat(&fscache_n_retrieval_ops);
45860+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45861
45862 /* pin the netfs read context in case we need to do the actual netfs
45863 * read because we've encountered a cache read failure */
45864@@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45865
45866 error:
45867 if (ret == -ENOMEM)
45868- fscache_stat(&fscache_n_retrievals_nomem);
45869+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45870 else if (ret == -ERESTARTSYS)
45871- fscache_stat(&fscache_n_retrievals_intr);
45872+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45873 else if (ret == -ENODATA)
45874- fscache_stat(&fscache_n_retrievals_nodata);
45875+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45876 else if (ret < 0)
45877- fscache_stat(&fscache_n_retrievals_nobufs);
45878+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45879 else
45880- fscache_stat(&fscache_n_retrievals_ok);
45881+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45882
45883 fscache_put_retrieval(op);
45884 _leave(" = %d", ret);
45885@@ -429,7 +429,7 @@ nobufs_unlock:
45886 spin_unlock(&cookie->lock);
45887 kfree(op);
45888 nobufs:
45889- fscache_stat(&fscache_n_retrievals_nobufs);
45890+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45891 _leave(" = -ENOBUFS");
45892 return -ENOBUFS;
45893 }
45894@@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45895
45896 _enter("%p,,%d,,,", cookie, *nr_pages);
45897
45898- fscache_stat(&fscache_n_retrievals);
45899+ fscache_stat_unchecked(&fscache_n_retrievals);
45900
45901 if (hlist_empty(&cookie->backing_objects))
45902 goto nobufs;
45903@@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45904 goto nobufs_unlock;
45905 spin_unlock(&cookie->lock);
45906
45907- fscache_stat(&fscache_n_retrieval_ops);
45908+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45909
45910 /* pin the netfs read context in case we need to do the actual netfs
45911 * read because we've encountered a cache read failure */
45912@@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45913
45914 error:
45915 if (ret == -ENOMEM)
45916- fscache_stat(&fscache_n_retrievals_nomem);
45917+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45918 else if (ret == -ERESTARTSYS)
45919- fscache_stat(&fscache_n_retrievals_intr);
45920+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45921 else if (ret == -ENODATA)
45922- fscache_stat(&fscache_n_retrievals_nodata);
45923+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45924 else if (ret < 0)
45925- fscache_stat(&fscache_n_retrievals_nobufs);
45926+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45927 else
45928- fscache_stat(&fscache_n_retrievals_ok);
45929+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45930
45931 fscache_put_retrieval(op);
45932 _leave(" = %d", ret);
45933@@ -545,7 +545,7 @@ nobufs_unlock:
45934 spin_unlock(&cookie->lock);
45935 kfree(op);
45936 nobufs:
45937- fscache_stat(&fscache_n_retrievals_nobufs);
45938+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45939 _leave(" = -ENOBUFS");
45940 return -ENOBUFS;
45941 }
45942@@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45943
45944 _enter("%p,%p,,,", cookie, page);
45945
45946- fscache_stat(&fscache_n_allocs);
45947+ fscache_stat_unchecked(&fscache_n_allocs);
45948
45949 if (hlist_empty(&cookie->backing_objects))
45950 goto nobufs;
45951@@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45952 goto nobufs_unlock;
45953 spin_unlock(&cookie->lock);
45954
45955- fscache_stat(&fscache_n_alloc_ops);
45956+ fscache_stat_unchecked(&fscache_n_alloc_ops);
45957
45958 ret = fscache_wait_for_retrieval_activation(
45959 object, op,
45960@@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45961
45962 error:
45963 if (ret == -ERESTARTSYS)
45964- fscache_stat(&fscache_n_allocs_intr);
45965+ fscache_stat_unchecked(&fscache_n_allocs_intr);
45966 else if (ret < 0)
45967- fscache_stat(&fscache_n_allocs_nobufs);
45968+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45969 else
45970- fscache_stat(&fscache_n_allocs_ok);
45971+ fscache_stat_unchecked(&fscache_n_allocs_ok);
45972
45973 fscache_put_retrieval(op);
45974 _leave(" = %d", ret);
45975@@ -625,7 +625,7 @@ nobufs_unlock:
45976 spin_unlock(&cookie->lock);
45977 kfree(op);
45978 nobufs:
45979- fscache_stat(&fscache_n_allocs_nobufs);
45980+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45981 _leave(" = -ENOBUFS");
45982 return -ENOBUFS;
45983 }
45984@@ -666,7 +666,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45985
45986 spin_lock(&cookie->stores_lock);
45987
45988- fscache_stat(&fscache_n_store_calls);
45989+ fscache_stat_unchecked(&fscache_n_store_calls);
45990
45991 /* find a page to store */
45992 page = NULL;
45993@@ -677,7 +677,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45994 page = results[0];
45995 _debug("gang %d [%lx]", n, page->index);
45996 if (page->index > op->store_limit) {
45997- fscache_stat(&fscache_n_store_pages_over_limit);
45998+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
45999 goto superseded;
46000 }
46001
46002@@ -689,7 +689,7 @@ static void fscache_write_op(struct fscache_operation *_op)
46003 spin_unlock(&cookie->stores_lock);
46004 spin_unlock(&object->lock);
46005
46006- fscache_stat(&fscache_n_store_pages);
46007+ fscache_stat_unchecked(&fscache_n_store_pages);
46008 fscache_stat(&fscache_n_cop_write_page);
46009 ret = object->cache->ops->write_page(op, page);
46010 fscache_stat_d(&fscache_n_cop_write_page);
46011@@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46012 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46013 ASSERT(PageFsCache(page));
46014
46015- fscache_stat(&fscache_n_stores);
46016+ fscache_stat_unchecked(&fscache_n_stores);
46017
46018 op = kzalloc(sizeof(*op), GFP_NOIO);
46019 if (!op)
46020@@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46021 spin_unlock(&cookie->stores_lock);
46022 spin_unlock(&object->lock);
46023
46024- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
46025+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
46026 op->store_limit = object->store_limit;
46027
46028 if (fscache_submit_op(object, &op->op) < 0)
46029@@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46030
46031 spin_unlock(&cookie->lock);
46032 radix_tree_preload_end();
46033- fscache_stat(&fscache_n_store_ops);
46034- fscache_stat(&fscache_n_stores_ok);
46035+ fscache_stat_unchecked(&fscache_n_store_ops);
46036+ fscache_stat_unchecked(&fscache_n_stores_ok);
46037
46038 /* the work queue now carries its own ref on the object */
46039 fscache_put_operation(&op->op);
46040@@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46041 return 0;
46042
46043 already_queued:
46044- fscache_stat(&fscache_n_stores_again);
46045+ fscache_stat_unchecked(&fscache_n_stores_again);
46046 already_pending:
46047 spin_unlock(&cookie->stores_lock);
46048 spin_unlock(&object->lock);
46049 spin_unlock(&cookie->lock);
46050 radix_tree_preload_end();
46051 kfree(op);
46052- fscache_stat(&fscache_n_stores_ok);
46053+ fscache_stat_unchecked(&fscache_n_stores_ok);
46054 _leave(" = 0");
46055 return 0;
46056
46057@@ -851,14 +851,14 @@ nobufs:
46058 spin_unlock(&cookie->lock);
46059 radix_tree_preload_end();
46060 kfree(op);
46061- fscache_stat(&fscache_n_stores_nobufs);
46062+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
46063 _leave(" = -ENOBUFS");
46064 return -ENOBUFS;
46065
46066 nomem_free:
46067 kfree(op);
46068 nomem:
46069- fscache_stat(&fscache_n_stores_oom);
46070+ fscache_stat_unchecked(&fscache_n_stores_oom);
46071 _leave(" = -ENOMEM");
46072 return -ENOMEM;
46073 }
46074@@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
46075 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46076 ASSERTCMP(page, !=, NULL);
46077
46078- fscache_stat(&fscache_n_uncaches);
46079+ fscache_stat_unchecked(&fscache_n_uncaches);
46080
46081 /* cache withdrawal may beat us to it */
46082 if (!PageFsCache(page))
46083@@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
46084 unsigned long loop;
46085
46086 #ifdef CONFIG_FSCACHE_STATS
46087- atomic_add(pagevec->nr, &fscache_n_marks);
46088+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
46089 #endif
46090
46091 for (loop = 0; loop < pagevec->nr; loop++) {
46092diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
46093index 4765190..2a067f2 100644
46094--- a/fs/fscache/stats.c
46095+++ b/fs/fscache/stats.c
46096@@ -18,95 +18,95 @@
46097 /*
46098 * operation counters
46099 */
46100-atomic_t fscache_n_op_pend;
46101-atomic_t fscache_n_op_run;
46102-atomic_t fscache_n_op_enqueue;
46103-atomic_t fscache_n_op_requeue;
46104-atomic_t fscache_n_op_deferred_release;
46105-atomic_t fscache_n_op_release;
46106-atomic_t fscache_n_op_gc;
46107-atomic_t fscache_n_op_cancelled;
46108-atomic_t fscache_n_op_rejected;
46109+atomic_unchecked_t fscache_n_op_pend;
46110+atomic_unchecked_t fscache_n_op_run;
46111+atomic_unchecked_t fscache_n_op_enqueue;
46112+atomic_unchecked_t fscache_n_op_requeue;
46113+atomic_unchecked_t fscache_n_op_deferred_release;
46114+atomic_unchecked_t fscache_n_op_release;
46115+atomic_unchecked_t fscache_n_op_gc;
46116+atomic_unchecked_t fscache_n_op_cancelled;
46117+atomic_unchecked_t fscache_n_op_rejected;
46118
46119-atomic_t fscache_n_attr_changed;
46120-atomic_t fscache_n_attr_changed_ok;
46121-atomic_t fscache_n_attr_changed_nobufs;
46122-atomic_t fscache_n_attr_changed_nomem;
46123-atomic_t fscache_n_attr_changed_calls;
46124+atomic_unchecked_t fscache_n_attr_changed;
46125+atomic_unchecked_t fscache_n_attr_changed_ok;
46126+atomic_unchecked_t fscache_n_attr_changed_nobufs;
46127+atomic_unchecked_t fscache_n_attr_changed_nomem;
46128+atomic_unchecked_t fscache_n_attr_changed_calls;
46129
46130-atomic_t fscache_n_allocs;
46131-atomic_t fscache_n_allocs_ok;
46132-atomic_t fscache_n_allocs_wait;
46133-atomic_t fscache_n_allocs_nobufs;
46134-atomic_t fscache_n_allocs_intr;
46135-atomic_t fscache_n_allocs_object_dead;
46136-atomic_t fscache_n_alloc_ops;
46137-atomic_t fscache_n_alloc_op_waits;
46138+atomic_unchecked_t fscache_n_allocs;
46139+atomic_unchecked_t fscache_n_allocs_ok;
46140+atomic_unchecked_t fscache_n_allocs_wait;
46141+atomic_unchecked_t fscache_n_allocs_nobufs;
46142+atomic_unchecked_t fscache_n_allocs_intr;
46143+atomic_unchecked_t fscache_n_allocs_object_dead;
46144+atomic_unchecked_t fscache_n_alloc_ops;
46145+atomic_unchecked_t fscache_n_alloc_op_waits;
46146
46147-atomic_t fscache_n_retrievals;
46148-atomic_t fscache_n_retrievals_ok;
46149-atomic_t fscache_n_retrievals_wait;
46150-atomic_t fscache_n_retrievals_nodata;
46151-atomic_t fscache_n_retrievals_nobufs;
46152-atomic_t fscache_n_retrievals_intr;
46153-atomic_t fscache_n_retrievals_nomem;
46154-atomic_t fscache_n_retrievals_object_dead;
46155-atomic_t fscache_n_retrieval_ops;
46156-atomic_t fscache_n_retrieval_op_waits;
46157+atomic_unchecked_t fscache_n_retrievals;
46158+atomic_unchecked_t fscache_n_retrievals_ok;
46159+atomic_unchecked_t fscache_n_retrievals_wait;
46160+atomic_unchecked_t fscache_n_retrievals_nodata;
46161+atomic_unchecked_t fscache_n_retrievals_nobufs;
46162+atomic_unchecked_t fscache_n_retrievals_intr;
46163+atomic_unchecked_t fscache_n_retrievals_nomem;
46164+atomic_unchecked_t fscache_n_retrievals_object_dead;
46165+atomic_unchecked_t fscache_n_retrieval_ops;
46166+atomic_unchecked_t fscache_n_retrieval_op_waits;
46167
46168-atomic_t fscache_n_stores;
46169-atomic_t fscache_n_stores_ok;
46170-atomic_t fscache_n_stores_again;
46171-atomic_t fscache_n_stores_nobufs;
46172-atomic_t fscache_n_stores_oom;
46173-atomic_t fscache_n_store_ops;
46174-atomic_t fscache_n_store_calls;
46175-atomic_t fscache_n_store_pages;
46176-atomic_t fscache_n_store_radix_deletes;
46177-atomic_t fscache_n_store_pages_over_limit;
46178+atomic_unchecked_t fscache_n_stores;
46179+atomic_unchecked_t fscache_n_stores_ok;
46180+atomic_unchecked_t fscache_n_stores_again;
46181+atomic_unchecked_t fscache_n_stores_nobufs;
46182+atomic_unchecked_t fscache_n_stores_oom;
46183+atomic_unchecked_t fscache_n_store_ops;
46184+atomic_unchecked_t fscache_n_store_calls;
46185+atomic_unchecked_t fscache_n_store_pages;
46186+atomic_unchecked_t fscache_n_store_radix_deletes;
46187+atomic_unchecked_t fscache_n_store_pages_over_limit;
46188
46189-atomic_t fscache_n_store_vmscan_not_storing;
46190-atomic_t fscache_n_store_vmscan_gone;
46191-atomic_t fscache_n_store_vmscan_busy;
46192-atomic_t fscache_n_store_vmscan_cancelled;
46193+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46194+atomic_unchecked_t fscache_n_store_vmscan_gone;
46195+atomic_unchecked_t fscache_n_store_vmscan_busy;
46196+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46197
46198-atomic_t fscache_n_marks;
46199-atomic_t fscache_n_uncaches;
46200+atomic_unchecked_t fscache_n_marks;
46201+atomic_unchecked_t fscache_n_uncaches;
46202
46203-atomic_t fscache_n_acquires;
46204-atomic_t fscache_n_acquires_null;
46205-atomic_t fscache_n_acquires_no_cache;
46206-atomic_t fscache_n_acquires_ok;
46207-atomic_t fscache_n_acquires_nobufs;
46208-atomic_t fscache_n_acquires_oom;
46209+atomic_unchecked_t fscache_n_acquires;
46210+atomic_unchecked_t fscache_n_acquires_null;
46211+atomic_unchecked_t fscache_n_acquires_no_cache;
46212+atomic_unchecked_t fscache_n_acquires_ok;
46213+atomic_unchecked_t fscache_n_acquires_nobufs;
46214+atomic_unchecked_t fscache_n_acquires_oom;
46215
46216-atomic_t fscache_n_updates;
46217-atomic_t fscache_n_updates_null;
46218-atomic_t fscache_n_updates_run;
46219+atomic_unchecked_t fscache_n_updates;
46220+atomic_unchecked_t fscache_n_updates_null;
46221+atomic_unchecked_t fscache_n_updates_run;
46222
46223-atomic_t fscache_n_relinquishes;
46224-atomic_t fscache_n_relinquishes_null;
46225-atomic_t fscache_n_relinquishes_waitcrt;
46226-atomic_t fscache_n_relinquishes_retire;
46227+atomic_unchecked_t fscache_n_relinquishes;
46228+atomic_unchecked_t fscache_n_relinquishes_null;
46229+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46230+atomic_unchecked_t fscache_n_relinquishes_retire;
46231
46232-atomic_t fscache_n_cookie_index;
46233-atomic_t fscache_n_cookie_data;
46234-atomic_t fscache_n_cookie_special;
46235+atomic_unchecked_t fscache_n_cookie_index;
46236+atomic_unchecked_t fscache_n_cookie_data;
46237+atomic_unchecked_t fscache_n_cookie_special;
46238
46239-atomic_t fscache_n_object_alloc;
46240-atomic_t fscache_n_object_no_alloc;
46241-atomic_t fscache_n_object_lookups;
46242-atomic_t fscache_n_object_lookups_negative;
46243-atomic_t fscache_n_object_lookups_positive;
46244-atomic_t fscache_n_object_lookups_timed_out;
46245-atomic_t fscache_n_object_created;
46246-atomic_t fscache_n_object_avail;
46247-atomic_t fscache_n_object_dead;
46248+atomic_unchecked_t fscache_n_object_alloc;
46249+atomic_unchecked_t fscache_n_object_no_alloc;
46250+atomic_unchecked_t fscache_n_object_lookups;
46251+atomic_unchecked_t fscache_n_object_lookups_negative;
46252+atomic_unchecked_t fscache_n_object_lookups_positive;
46253+atomic_unchecked_t fscache_n_object_lookups_timed_out;
46254+atomic_unchecked_t fscache_n_object_created;
46255+atomic_unchecked_t fscache_n_object_avail;
46256+atomic_unchecked_t fscache_n_object_dead;
46257
46258-atomic_t fscache_n_checkaux_none;
46259-atomic_t fscache_n_checkaux_okay;
46260-atomic_t fscache_n_checkaux_update;
46261-atomic_t fscache_n_checkaux_obsolete;
46262+atomic_unchecked_t fscache_n_checkaux_none;
46263+atomic_unchecked_t fscache_n_checkaux_okay;
46264+atomic_unchecked_t fscache_n_checkaux_update;
46265+atomic_unchecked_t fscache_n_checkaux_obsolete;
46266
46267 atomic_t fscache_n_cop_alloc_object;
46268 atomic_t fscache_n_cop_lookup_object;
46269@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
46270 seq_puts(m, "FS-Cache statistics\n");
46271
46272 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
46273- atomic_read(&fscache_n_cookie_index),
46274- atomic_read(&fscache_n_cookie_data),
46275- atomic_read(&fscache_n_cookie_special));
46276+ atomic_read_unchecked(&fscache_n_cookie_index),
46277+ atomic_read_unchecked(&fscache_n_cookie_data),
46278+ atomic_read_unchecked(&fscache_n_cookie_special));
46279
46280 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
46281- atomic_read(&fscache_n_object_alloc),
46282- atomic_read(&fscache_n_object_no_alloc),
46283- atomic_read(&fscache_n_object_avail),
46284- atomic_read(&fscache_n_object_dead));
46285+ atomic_read_unchecked(&fscache_n_object_alloc),
46286+ atomic_read_unchecked(&fscache_n_object_no_alloc),
46287+ atomic_read_unchecked(&fscache_n_object_avail),
46288+ atomic_read_unchecked(&fscache_n_object_dead));
46289 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
46290- atomic_read(&fscache_n_checkaux_none),
46291- atomic_read(&fscache_n_checkaux_okay),
46292- atomic_read(&fscache_n_checkaux_update),
46293- atomic_read(&fscache_n_checkaux_obsolete));
46294+ atomic_read_unchecked(&fscache_n_checkaux_none),
46295+ atomic_read_unchecked(&fscache_n_checkaux_okay),
46296+ atomic_read_unchecked(&fscache_n_checkaux_update),
46297+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
46298
46299 seq_printf(m, "Pages : mrk=%u unc=%u\n",
46300- atomic_read(&fscache_n_marks),
46301- atomic_read(&fscache_n_uncaches));
46302+ atomic_read_unchecked(&fscache_n_marks),
46303+ atomic_read_unchecked(&fscache_n_uncaches));
46304
46305 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
46306 " oom=%u\n",
46307- atomic_read(&fscache_n_acquires),
46308- atomic_read(&fscache_n_acquires_null),
46309- atomic_read(&fscache_n_acquires_no_cache),
46310- atomic_read(&fscache_n_acquires_ok),
46311- atomic_read(&fscache_n_acquires_nobufs),
46312- atomic_read(&fscache_n_acquires_oom));
46313+ atomic_read_unchecked(&fscache_n_acquires),
46314+ atomic_read_unchecked(&fscache_n_acquires_null),
46315+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
46316+ atomic_read_unchecked(&fscache_n_acquires_ok),
46317+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
46318+ atomic_read_unchecked(&fscache_n_acquires_oom));
46319
46320 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
46321- atomic_read(&fscache_n_object_lookups),
46322- atomic_read(&fscache_n_object_lookups_negative),
46323- atomic_read(&fscache_n_object_lookups_positive),
46324- atomic_read(&fscache_n_object_created),
46325- atomic_read(&fscache_n_object_lookups_timed_out));
46326+ atomic_read_unchecked(&fscache_n_object_lookups),
46327+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
46328+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
46329+ atomic_read_unchecked(&fscache_n_object_created),
46330+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
46331
46332 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
46333- atomic_read(&fscache_n_updates),
46334- atomic_read(&fscache_n_updates_null),
46335- atomic_read(&fscache_n_updates_run));
46336+ atomic_read_unchecked(&fscache_n_updates),
46337+ atomic_read_unchecked(&fscache_n_updates_null),
46338+ atomic_read_unchecked(&fscache_n_updates_run));
46339
46340 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
46341- atomic_read(&fscache_n_relinquishes),
46342- atomic_read(&fscache_n_relinquishes_null),
46343- atomic_read(&fscache_n_relinquishes_waitcrt),
46344- atomic_read(&fscache_n_relinquishes_retire));
46345+ atomic_read_unchecked(&fscache_n_relinquishes),
46346+ atomic_read_unchecked(&fscache_n_relinquishes_null),
46347+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
46348+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
46349
46350 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
46351- atomic_read(&fscache_n_attr_changed),
46352- atomic_read(&fscache_n_attr_changed_ok),
46353- atomic_read(&fscache_n_attr_changed_nobufs),
46354- atomic_read(&fscache_n_attr_changed_nomem),
46355- atomic_read(&fscache_n_attr_changed_calls));
46356+ atomic_read_unchecked(&fscache_n_attr_changed),
46357+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
46358+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
46359+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
46360+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
46361
46362 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
46363- atomic_read(&fscache_n_allocs),
46364- atomic_read(&fscache_n_allocs_ok),
46365- atomic_read(&fscache_n_allocs_wait),
46366- atomic_read(&fscache_n_allocs_nobufs),
46367- atomic_read(&fscache_n_allocs_intr));
46368+ atomic_read_unchecked(&fscache_n_allocs),
46369+ atomic_read_unchecked(&fscache_n_allocs_ok),
46370+ atomic_read_unchecked(&fscache_n_allocs_wait),
46371+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
46372+ atomic_read_unchecked(&fscache_n_allocs_intr));
46373 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
46374- atomic_read(&fscache_n_alloc_ops),
46375- atomic_read(&fscache_n_alloc_op_waits),
46376- atomic_read(&fscache_n_allocs_object_dead));
46377+ atomic_read_unchecked(&fscache_n_alloc_ops),
46378+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
46379+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
46380
46381 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
46382 " int=%u oom=%u\n",
46383- atomic_read(&fscache_n_retrievals),
46384- atomic_read(&fscache_n_retrievals_ok),
46385- atomic_read(&fscache_n_retrievals_wait),
46386- atomic_read(&fscache_n_retrievals_nodata),
46387- atomic_read(&fscache_n_retrievals_nobufs),
46388- atomic_read(&fscache_n_retrievals_intr),
46389- atomic_read(&fscache_n_retrievals_nomem));
46390+ atomic_read_unchecked(&fscache_n_retrievals),
46391+ atomic_read_unchecked(&fscache_n_retrievals_ok),
46392+ atomic_read_unchecked(&fscache_n_retrievals_wait),
46393+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
46394+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
46395+ atomic_read_unchecked(&fscache_n_retrievals_intr),
46396+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
46397 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
46398- atomic_read(&fscache_n_retrieval_ops),
46399- atomic_read(&fscache_n_retrieval_op_waits),
46400- atomic_read(&fscache_n_retrievals_object_dead));
46401+ atomic_read_unchecked(&fscache_n_retrieval_ops),
46402+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
46403+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
46404
46405 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
46406- atomic_read(&fscache_n_stores),
46407- atomic_read(&fscache_n_stores_ok),
46408- atomic_read(&fscache_n_stores_again),
46409- atomic_read(&fscache_n_stores_nobufs),
46410- atomic_read(&fscache_n_stores_oom));
46411+ atomic_read_unchecked(&fscache_n_stores),
46412+ atomic_read_unchecked(&fscache_n_stores_ok),
46413+ atomic_read_unchecked(&fscache_n_stores_again),
46414+ atomic_read_unchecked(&fscache_n_stores_nobufs),
46415+ atomic_read_unchecked(&fscache_n_stores_oom));
46416 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
46417- atomic_read(&fscache_n_store_ops),
46418- atomic_read(&fscache_n_store_calls),
46419- atomic_read(&fscache_n_store_pages),
46420- atomic_read(&fscache_n_store_radix_deletes),
46421- atomic_read(&fscache_n_store_pages_over_limit));
46422+ atomic_read_unchecked(&fscache_n_store_ops),
46423+ atomic_read_unchecked(&fscache_n_store_calls),
46424+ atomic_read_unchecked(&fscache_n_store_pages),
46425+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
46426+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
46427
46428 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
46429- atomic_read(&fscache_n_store_vmscan_not_storing),
46430- atomic_read(&fscache_n_store_vmscan_gone),
46431- atomic_read(&fscache_n_store_vmscan_busy),
46432- atomic_read(&fscache_n_store_vmscan_cancelled));
46433+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
46434+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
46435+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
46436+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
46437
46438 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
46439- atomic_read(&fscache_n_op_pend),
46440- atomic_read(&fscache_n_op_run),
46441- atomic_read(&fscache_n_op_enqueue),
46442- atomic_read(&fscache_n_op_cancelled),
46443- atomic_read(&fscache_n_op_rejected));
46444+ atomic_read_unchecked(&fscache_n_op_pend),
46445+ atomic_read_unchecked(&fscache_n_op_run),
46446+ atomic_read_unchecked(&fscache_n_op_enqueue),
46447+ atomic_read_unchecked(&fscache_n_op_cancelled),
46448+ atomic_read_unchecked(&fscache_n_op_rejected));
46449 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
46450- atomic_read(&fscache_n_op_deferred_release),
46451- atomic_read(&fscache_n_op_release),
46452- atomic_read(&fscache_n_op_gc));
46453+ atomic_read_unchecked(&fscache_n_op_deferred_release),
46454+ atomic_read_unchecked(&fscache_n_op_release),
46455+ atomic_read_unchecked(&fscache_n_op_gc));
46456
46457 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
46458 atomic_read(&fscache_n_cop_alloc_object),
46459diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
46460index b6cca47..ec782c3 100644
46461--- a/fs/fuse/cuse.c
46462+++ b/fs/fuse/cuse.c
46463@@ -586,10 +586,12 @@ static int __init cuse_init(void)
46464 INIT_LIST_HEAD(&cuse_conntbl[i]);
46465
46466 /* inherit and extend fuse_dev_operations */
46467- cuse_channel_fops = fuse_dev_operations;
46468- cuse_channel_fops.owner = THIS_MODULE;
46469- cuse_channel_fops.open = cuse_channel_open;
46470- cuse_channel_fops.release = cuse_channel_release;
46471+ pax_open_kernel();
46472+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
46473+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
46474+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
46475+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
46476+ pax_close_kernel();
46477
46478 cuse_class = class_create(THIS_MODULE, "cuse");
46479 if (IS_ERR(cuse_class))
46480diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
46481index 2aaf3ea..8e50863 100644
46482--- a/fs/fuse/dev.c
46483+++ b/fs/fuse/dev.c
46484@@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
46485 ret = 0;
46486 pipe_lock(pipe);
46487
46488- if (!pipe->readers) {
46489+ if (!atomic_read(&pipe->readers)) {
46490 send_sig(SIGPIPE, current, 0);
46491 if (!ret)
46492 ret = -EPIPE;
46493diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
46494index 9f63e49..d8a64c0 100644
46495--- a/fs/fuse/dir.c
46496+++ b/fs/fuse/dir.c
46497@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *dentry)
46498 return link;
46499 }
46500
46501-static void free_link(char *link)
46502+static void free_link(const char *link)
46503 {
46504 if (!IS_ERR(link))
46505 free_page((unsigned long) link);
46506diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
46507index 900cf98..3896726 100644
46508--- a/fs/gfs2/inode.c
46509+++ b/fs/gfs2/inode.c
46510@@ -1517,7 +1517,7 @@ out:
46511
46512 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
46513 {
46514- char *s = nd_get_link(nd);
46515+ const char *s = nd_get_link(nd);
46516 if (!IS_ERR(s))
46517 kfree(s);
46518 }
46519diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
46520index 4dfbfec..947c9c2 100644
46521--- a/fs/hfsplus/catalog.c
46522+++ b/fs/hfsplus/catalog.c
46523@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
46524 int err;
46525 u16 type;
46526
46527+ pax_track_stack();
46528+
46529 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
46530 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
46531 if (err)
46532@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
46533 int entry_size;
46534 int err;
46535
46536+ pax_track_stack();
46537+
46538 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
46539 str->name, cnid, inode->i_nlink);
46540 err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
46541@@ -353,6 +357,8 @@ int hfsplus_rename_cat(u32 cnid,
46542 int entry_size, type;
46543 int err;
46544
46545+ pax_track_stack();
46546+
46547 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
46548 cnid, src_dir->i_ino, src_name->name,
46549 dst_dir->i_ino, dst_name->name);
46550diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
46551index 25b2443..09a3341 100644
46552--- a/fs/hfsplus/dir.c
46553+++ b/fs/hfsplus/dir.c
46554@@ -131,6 +131,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
46555 struct hfsplus_readdir_data *rd;
46556 u16 type;
46557
46558+ pax_track_stack();
46559+
46560 if (filp->f_pos >= inode->i_size)
46561 return 0;
46562
46563diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
46564index 4cc1e3a..ad0f70b 100644
46565--- a/fs/hfsplus/inode.c
46566+++ b/fs/hfsplus/inode.c
46567@@ -501,6 +501,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
46568 int res = 0;
46569 u16 type;
46570
46571+ pax_track_stack();
46572+
46573 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
46574
46575 HFSPLUS_I(inode)->linkid = 0;
46576@@ -564,6 +566,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
46577 struct hfs_find_data fd;
46578 hfsplus_cat_entry entry;
46579
46580+ pax_track_stack();
46581+
46582 if (HFSPLUS_IS_RSRC(inode))
46583 main_inode = HFSPLUS_I(inode)->rsrc_inode;
46584
46585diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
46586index fbaa669..c548cd0 100644
46587--- a/fs/hfsplus/ioctl.c
46588+++ b/fs/hfsplus/ioctl.c
46589@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
46590 struct hfsplus_cat_file *file;
46591 int res;
46592
46593+ pax_track_stack();
46594+
46595 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46596 return -EOPNOTSUPP;
46597
46598@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
46599 struct hfsplus_cat_file *file;
46600 ssize_t res = 0;
46601
46602+ pax_track_stack();
46603+
46604 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46605 return -EOPNOTSUPP;
46606
46607diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
46608index d24a9b6..dd9b3dd 100644
46609--- a/fs/hfsplus/super.c
46610+++ b/fs/hfsplus/super.c
46611@@ -347,6 +347,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
46612 u64 last_fs_block, last_fs_page;
46613 int err;
46614
46615+ pax_track_stack();
46616+
46617 err = -EINVAL;
46618 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
46619 if (!sbi)
46620diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
46621index ec88953..cb5e98e 100644
46622--- a/fs/hugetlbfs/inode.c
46623+++ b/fs/hugetlbfs/inode.c
46624@@ -915,7 +915,7 @@ static struct file_system_type hugetlbfs_fs_type = {
46625 .kill_sb = kill_litter_super,
46626 };
46627
46628-static struct vfsmount *hugetlbfs_vfsmount;
46629+struct vfsmount *hugetlbfs_vfsmount;
46630
46631 static int can_do_hugetlb_shm(void)
46632 {
46633diff --git a/fs/inode.c b/fs/inode.c
46634index ec79246..054c36a 100644
46635--- a/fs/inode.c
46636+++ b/fs/inode.c
46637@@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
46638
46639 #ifdef CONFIG_SMP
46640 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
46641- static atomic_t shared_last_ino;
46642- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
46643+ static atomic_unchecked_t shared_last_ino;
46644+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
46645
46646 res = next - LAST_INO_BATCH;
46647 }
46648diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
46649index f94fc48..3bb8d30 100644
46650--- a/fs/jbd/checkpoint.c
46651+++ b/fs/jbd/checkpoint.c
46652@@ -358,6 +358,8 @@ int log_do_checkpoint(journal_t *journal)
46653 tid_t this_tid;
46654 int result;
46655
46656+ pax_track_stack();
46657+
46658 jbd_debug(1, "Start checkpoint\n");
46659
46660 /*
46661diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
46662index 16a5047..88ff6ca 100644
46663--- a/fs/jffs2/compr_rtime.c
46664+++ b/fs/jffs2/compr_rtime.c
46665@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
46666 int outpos = 0;
46667 int pos=0;
46668
46669+ pax_track_stack();
46670+
46671 memset(positions,0,sizeof(positions));
46672
46673 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
46674@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
46675 int outpos = 0;
46676 int pos=0;
46677
46678+ pax_track_stack();
46679+
46680 memset(positions,0,sizeof(positions));
46681
46682 while (outpos<destlen) {
46683diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
46684index 9e7cec8..4713089 100644
46685--- a/fs/jffs2/compr_rubin.c
46686+++ b/fs/jffs2/compr_rubin.c
46687@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
46688 int ret;
46689 uint32_t mysrclen, mydstlen;
46690
46691+ pax_track_stack();
46692+
46693 mysrclen = *sourcelen;
46694 mydstlen = *dstlen - 8;
46695
46696diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
46697index e513f19..2ab1351 100644
46698--- a/fs/jffs2/erase.c
46699+++ b/fs/jffs2/erase.c
46700@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
46701 struct jffs2_unknown_node marker = {
46702 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
46703 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46704- .totlen = cpu_to_je32(c->cleanmarker_size)
46705+ .totlen = cpu_to_je32(c->cleanmarker_size),
46706+ .hdr_crc = cpu_to_je32(0)
46707 };
46708
46709 jffs2_prealloc_raw_node_refs(c, jeb, 1);
46710diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
46711index 4515bea..178f2d6 100644
46712--- a/fs/jffs2/wbuf.c
46713+++ b/fs/jffs2/wbuf.c
46714@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
46715 {
46716 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
46717 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46718- .totlen = constant_cpu_to_je32(8)
46719+ .totlen = constant_cpu_to_je32(8),
46720+ .hdr_crc = constant_cpu_to_je32(0)
46721 };
46722
46723 /*
46724diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
46725index 3e93cdd..c8a80e1 100644
46726--- a/fs/jffs2/xattr.c
46727+++ b/fs/jffs2/xattr.c
46728@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
46729
46730 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
46731
46732+ pax_track_stack();
46733+
46734 /* Phase.1 : Merge same xref */
46735 for (i=0; i < XREF_TMPHASH_SIZE; i++)
46736 xref_tmphash[i] = NULL;
46737diff --git a/fs/jfs/super.c b/fs/jfs/super.c
46738index 06c8a67..589dbbd 100644
46739--- a/fs/jfs/super.c
46740+++ b/fs/jfs/super.c
46741@@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
46742
46743 jfs_inode_cachep =
46744 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
46745- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
46746+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
46747 init_once);
46748 if (jfs_inode_cachep == NULL)
46749 return -ENOMEM;
46750diff --git a/fs/libfs.c b/fs/libfs.c
46751index c18e9a1..0b04e2c 100644
46752--- a/fs/libfs.c
46753+++ b/fs/libfs.c
46754@@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46755
46756 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
46757 struct dentry *next;
46758+ char d_name[sizeof(next->d_iname)];
46759+ const unsigned char *name;
46760+
46761 next = list_entry(p, struct dentry, d_u.d_child);
46762 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
46763 if (!simple_positive(next)) {
46764@@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46765
46766 spin_unlock(&next->d_lock);
46767 spin_unlock(&dentry->d_lock);
46768- if (filldir(dirent, next->d_name.name,
46769+ name = next->d_name.name;
46770+ if (name == next->d_iname) {
46771+ memcpy(d_name, name, next->d_name.len);
46772+ name = d_name;
46773+ }
46774+ if (filldir(dirent, name,
46775 next->d_name.len, filp->f_pos,
46776 next->d_inode->i_ino,
46777 dt_type(next->d_inode)) < 0)
46778diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
46779index 8392cb8..ae8ed40 100644
46780--- a/fs/lockd/clntproc.c
46781+++ b/fs/lockd/clntproc.c
46782@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
46783 /*
46784 * Cookie counter for NLM requests
46785 */
46786-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
46787+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
46788
46789 void nlmclnt_next_cookie(struct nlm_cookie *c)
46790 {
46791- u32 cookie = atomic_inc_return(&nlm_cookie);
46792+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
46793
46794 memcpy(c->data, &cookie, 4);
46795 c->len=4;
46796@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
46797 struct nlm_rqst reqst, *req;
46798 int status;
46799
46800+ pax_track_stack();
46801+
46802 req = &reqst;
46803 memset(req, 0, sizeof(*req));
46804 locks_init_lock(&req->a_args.lock.fl);
46805diff --git a/fs/locks.c b/fs/locks.c
46806index 703f545..150a552 100644
46807--- a/fs/locks.c
46808+++ b/fs/locks.c
46809@@ -2022,16 +2022,16 @@ void locks_remove_flock(struct file *filp)
46810 return;
46811
46812 if (filp->f_op && filp->f_op->flock) {
46813- struct file_lock fl = {
46814+ struct file_lock flock = {
46815 .fl_pid = current->tgid,
46816 .fl_file = filp,
46817 .fl_flags = FL_FLOCK,
46818 .fl_type = F_UNLCK,
46819 .fl_end = OFFSET_MAX,
46820 };
46821- filp->f_op->flock(filp, F_SETLKW, &fl);
46822- if (fl.fl_ops && fl.fl_ops->fl_release_private)
46823- fl.fl_ops->fl_release_private(&fl);
46824+ filp->f_op->flock(filp, F_SETLKW, &flock);
46825+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
46826+ flock.fl_ops->fl_release_private(&flock);
46827 }
46828
46829 lock_flocks();
46830diff --git a/fs/logfs/super.c b/fs/logfs/super.c
46831index ce03a18..ac8c14f 100644
46832--- a/fs/logfs/super.c
46833+++ b/fs/logfs/super.c
46834@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super_block *sb)
46835 struct logfs_disk_super _ds1, *ds1 = &_ds1;
46836 int err, valid0, valid1;
46837
46838+ pax_track_stack();
46839+
46840 /* read first superblock */
46841 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
46842 if (err)
46843diff --git a/fs/minix/bitmap.c b/fs/minix/bitmap.c
46844index 3f32bcb..7c82c29 100644
46845--- a/fs/minix/bitmap.c
46846+++ b/fs/minix/bitmap.c
46847@@ -20,10 +20,11 @@ static const int nibblemap[] = { 4,3,3,2,3,2,2,1,3,2,2,1,2,1,1,0 };
46848
46849 static DEFINE_SPINLOCK(bitmap_lock);
46850
46851-static unsigned long count_free(struct buffer_head *map[], unsigned numblocks, __u32 numbits)
46852+static unsigned long count_free(struct buffer_head *map[], unsigned blocksize, __u32 numbits)
46853 {
46854 unsigned i, j, sum = 0;
46855 struct buffer_head *bh;
46856+ unsigned numblocks = minix_blocks_needed(numbits, blocksize);
46857
46858 for (i=0; i<numblocks-1; i++) {
46859 if (!(bh=map[i]))
46860@@ -105,10 +106,12 @@ int minix_new_block(struct inode * inode)
46861 return 0;
46862 }
46863
46864-unsigned long minix_count_free_blocks(struct minix_sb_info *sbi)
46865+unsigned long minix_count_free_blocks(struct super_block *sb)
46866 {
46867- return (count_free(sbi->s_zmap, sbi->s_zmap_blocks,
46868- sbi->s_nzones - sbi->s_firstdatazone + 1)
46869+ struct minix_sb_info *sbi = minix_sb(sb);
46870+ u32 bits = sbi->s_nzones - (sbi->s_firstdatazone + 1);
46871+
46872+ return (count_free(sbi->s_zmap, sb->s_blocksize, bits)
46873 << sbi->s_log_zone_size);
46874 }
46875
46876@@ -273,7 +276,10 @@ struct inode *minix_new_inode(const struct inode *dir, int mode, int *error)
46877 return inode;
46878 }
46879
46880-unsigned long minix_count_free_inodes(struct minix_sb_info *sbi)
46881+unsigned long minix_count_free_inodes(struct super_block *sb)
46882 {
46883- return count_free(sbi->s_imap, sbi->s_imap_blocks, sbi->s_ninodes + 1);
46884+ struct minix_sb_info *sbi = minix_sb(sb);
46885+ u32 bits = sbi->s_ninodes + 1;
46886+
46887+ return count_free(sbi->s_imap, sb->s_blocksize, bits);
46888 }
46889diff --git a/fs/minix/inode.c b/fs/minix/inode.c
46890index e7d23e2..1ed1351 100644
46891--- a/fs/minix/inode.c
46892+++ b/fs/minix/inode.c
46893@@ -279,6 +279,27 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
46894 else if (sbi->s_mount_state & MINIX_ERROR_FS)
46895 printk("MINIX-fs: mounting file system with errors, "
46896 "running fsck is recommended\n");
46897+
46898+ /* Apparently minix can create filesystems that allocate more blocks for
46899+ * the bitmaps than needed. We simply ignore that, but verify it didn't
46900+ * create one with not enough blocks and bail out if so.
46901+ */
46902+ block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
46903+ if (sbi->s_imap_blocks < block) {
46904+ printk("MINIX-fs: file system does not have enough "
46905+ "imap blocks allocated. Refusing to mount\n");
46906+ goto out_iput;
46907+ }
46908+
46909+ block = minix_blocks_needed(
46910+ (sbi->s_nzones - (sbi->s_firstdatazone + 1)),
46911+ s->s_blocksize);
46912+ if (sbi->s_zmap_blocks < block) {
46913+ printk("MINIX-fs: file system does not have enough "
46914+ "zmap blocks allocated. Refusing to mount.\n");
46915+ goto out_iput;
46916+ }
46917+
46918 return 0;
46919
46920 out_iput:
46921@@ -339,10 +360,10 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)
46922 buf->f_type = sb->s_magic;
46923 buf->f_bsize = sb->s_blocksize;
46924 buf->f_blocks = (sbi->s_nzones - sbi->s_firstdatazone) << sbi->s_log_zone_size;
46925- buf->f_bfree = minix_count_free_blocks(sbi);
46926+ buf->f_bfree = minix_count_free_blocks(sb);
46927 buf->f_bavail = buf->f_bfree;
46928 buf->f_files = sbi->s_ninodes;
46929- buf->f_ffree = minix_count_free_inodes(sbi);
46930+ buf->f_ffree = minix_count_free_inodes(sb);
46931 buf->f_namelen = sbi->s_namelen;
46932 buf->f_fsid.val[0] = (u32)id;
46933 buf->f_fsid.val[1] = (u32)(id >> 32);
46934diff --git a/fs/minix/minix.h b/fs/minix/minix.h
46935index 341e212..6415fe0 100644
46936--- a/fs/minix/minix.h
46937+++ b/fs/minix/minix.h
46938@@ -48,10 +48,10 @@ extern struct minix_inode * minix_V1_raw_inode(struct super_block *, ino_t, stru
46939 extern struct minix2_inode * minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
46940 extern struct inode * minix_new_inode(const struct inode *, int, int *);
46941 extern void minix_free_inode(struct inode * inode);
46942-extern unsigned long minix_count_free_inodes(struct minix_sb_info *sbi);
46943+extern unsigned long minix_count_free_inodes(struct super_block *sb);
46944 extern int minix_new_block(struct inode * inode);
46945 extern void minix_free_block(struct inode *inode, unsigned long block);
46946-extern unsigned long minix_count_free_blocks(struct minix_sb_info *sbi);
46947+extern unsigned long minix_count_free_blocks(struct super_block *sb);
46948 extern int minix_getattr(struct vfsmount *, struct dentry *, struct kstat *);
46949 extern int minix_prepare_chunk(struct page *page, loff_t pos, unsigned len);
46950
46951@@ -88,6 +88,11 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
46952 return list_entry(inode, struct minix_inode_info, vfs_inode);
46953 }
46954
46955+static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
46956+{
46957+ return DIV_ROUND_UP(bits, blocksize * 8);
46958+}
46959+
46960 #if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
46961 defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
46962
46963diff --git a/fs/namei.c b/fs/namei.c
46964index 3d15072..c1ddf9c 100644
46965--- a/fs/namei.c
46966+++ b/fs/namei.c
46967@@ -281,16 +281,32 @@ int generic_permission(struct inode *inode, int mask)
46968 if (ret != -EACCES)
46969 return ret;
46970
46971+#ifdef CONFIG_GRKERNSEC
46972+ /* we'll block if we have to log due to a denied capability use */
46973+ if (mask & MAY_NOT_BLOCK)
46974+ return -ECHILD;
46975+#endif
46976+
46977 if (S_ISDIR(inode->i_mode)) {
46978 /* DACs are overridable for directories */
46979- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46980- return 0;
46981 if (!(mask & MAY_WRITE))
46982- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46983+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46984+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46985 return 0;
46986+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46987+ return 0;
46988 return -EACCES;
46989 }
46990 /*
46991+ * Searching includes executable on directories, else just read.
46992+ */
46993+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46994+ if (mask == MAY_READ)
46995+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46996+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46997+ return 0;
46998+
46999+ /*
47000 * Read/write DACs are always overridable.
47001 * Executable DACs are overridable when there is
47002 * at least one exec bit set.
47003@@ -299,14 +315,6 @@ int generic_permission(struct inode *inode, int mask)
47004 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
47005 return 0;
47006
47007- /*
47008- * Searching includes executable on directories, else just read.
47009- */
47010- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
47011- if (mask == MAY_READ)
47012- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
47013- return 0;
47014-
47015 return -EACCES;
47016 }
47017
47018@@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
47019 return error;
47020 }
47021
47022+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
47023+ dentry->d_inode, dentry, nd->path.mnt)) {
47024+ error = -EACCES;
47025+ *p = ERR_PTR(error); /* no ->put_link(), please */
47026+ path_put(&nd->path);
47027+ return error;
47028+ }
47029+
47030 nd->last_type = LAST_BIND;
47031 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
47032 error = PTR_ERR(*p);
47033 if (!IS_ERR(*p)) {
47034- char *s = nd_get_link(nd);
47035+ const char *s = nd_get_link(nd);
47036 error = 0;
47037 if (s)
47038 error = __vfs_follow_link(nd, s);
47039@@ -1622,6 +1638,21 @@ static int path_lookupat(int dfd, const char *name,
47040 if (!err)
47041 err = complete_walk(nd);
47042
47043+ if (!(nd->flags & LOOKUP_PARENT)) {
47044+#ifdef CONFIG_GRKERNSEC
47045+ if (flags & LOOKUP_RCU) {
47046+ if (!err)
47047+ path_put(&nd->path);
47048+ err = -ECHILD;
47049+ } else
47050+#endif
47051+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47052+ if (!err)
47053+ path_put(&nd->path);
47054+ err = -ENOENT;
47055+ }
47056+ }
47057+
47058 if (!err && nd->flags & LOOKUP_DIRECTORY) {
47059 if (!nd->inode->i_op->lookup) {
47060 path_put(&nd->path);
47061@@ -1649,6 +1680,15 @@ static int do_path_lookup(int dfd, const char *name,
47062 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
47063
47064 if (likely(!retval)) {
47065+ if (*name != '/' && nd->path.dentry && nd->inode) {
47066+#ifdef CONFIG_GRKERNSEC
47067+ if (flags & LOOKUP_RCU)
47068+ return -ECHILD;
47069+#endif
47070+ if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
47071+ return -ENOENT;
47072+ }
47073+
47074 if (unlikely(!audit_dummy_context())) {
47075 if (nd->path.dentry && nd->inode)
47076 audit_inode(name, nd->path.dentry);
47077@@ -2049,7 +2089,27 @@ static int may_open(struct path *path, int acc_mode, int flag)
47078 /*
47079 * Ensure there are no outstanding leases on the file.
47080 */
47081- return break_lease(inode, flag);
47082+ error = break_lease(inode, flag);
47083+
47084+ if (error)
47085+ return error;
47086+
47087+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
47088+ error = -EPERM;
47089+ goto exit;
47090+ }
47091+
47092+ if (gr_handle_rawio(inode)) {
47093+ error = -EPERM;
47094+ goto exit;
47095+ }
47096+
47097+ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
47098+ error = -EACCES;
47099+ goto exit;
47100+ }
47101+exit:
47102+ return error;
47103 }
47104
47105 static int handle_truncate(struct file *filp)
47106@@ -2110,6 +2170,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47107 error = complete_walk(nd);
47108 if (error)
47109 return ERR_PTR(error);
47110+#ifdef CONFIG_GRKERNSEC
47111+ if (nd->flags & LOOKUP_RCU) {
47112+ error = -ECHILD;
47113+ goto exit;
47114+ }
47115+#endif
47116+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47117+ error = -ENOENT;
47118+ goto exit;
47119+ }
47120 audit_inode(pathname, nd->path.dentry);
47121 if (open_flag & O_CREAT) {
47122 error = -EISDIR;
47123@@ -2120,6 +2190,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47124 error = complete_walk(nd);
47125 if (error)
47126 return ERR_PTR(error);
47127+#ifdef CONFIG_GRKERNSEC
47128+ if (nd->flags & LOOKUP_RCU) {
47129+ error = -ECHILD;
47130+ goto exit;
47131+ }
47132+#endif
47133+ if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
47134+ error = -ENOENT;
47135+ goto exit;
47136+ }
47137 audit_inode(pathname, dir);
47138 goto ok;
47139 }
47140@@ -2141,6 +2221,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47141 error = complete_walk(nd);
47142 if (error)
47143 return ERR_PTR(-ECHILD);
47144+#ifdef CONFIG_GRKERNSEC
47145+ if (nd->flags & LOOKUP_RCU) {
47146+ error = -ECHILD;
47147+ goto exit;
47148+ }
47149+#endif
47150+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47151+ error = -ENOENT;
47152+ goto exit;
47153+ }
47154
47155 error = -ENOTDIR;
47156 if (nd->flags & LOOKUP_DIRECTORY) {
47157@@ -2181,6 +2271,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47158 /* Negative dentry, just create the file */
47159 if (!dentry->d_inode) {
47160 int mode = op->mode;
47161+
47162+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, open_flag, acc_mode, mode)) {
47163+ error = -EACCES;
47164+ goto exit_mutex_unlock;
47165+ }
47166+
47167 if (!IS_POSIXACL(dir->d_inode))
47168 mode &= ~current_umask();
47169 /*
47170@@ -2204,6 +2300,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47171 error = vfs_create(dir->d_inode, dentry, mode, nd);
47172 if (error)
47173 goto exit_mutex_unlock;
47174+ else
47175+ gr_handle_create(path->dentry, path->mnt);
47176 mutex_unlock(&dir->d_inode->i_mutex);
47177 dput(nd->path.dentry);
47178 nd->path.dentry = dentry;
47179@@ -2213,6 +2311,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47180 /*
47181 * It already exists.
47182 */
47183+
47184+ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
47185+ error = -ENOENT;
47186+ goto exit_mutex_unlock;
47187+ }
47188+
47189+ /* only check if O_CREAT is specified, all other checks need to go
47190+ into may_open */
47191+ if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
47192+ error = -EACCES;
47193+ goto exit_mutex_unlock;
47194+ }
47195+
47196 mutex_unlock(&dir->d_inode->i_mutex);
47197 audit_inode(pathname, path->dentry);
47198
47199@@ -2425,6 +2536,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
47200 *path = nd.path;
47201 return dentry;
47202 eexist:
47203+ if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt)) {
47204+ dput(dentry);
47205+ dentry = ERR_PTR(-ENOENT);
47206+ goto fail;
47207+ }
47208 dput(dentry);
47209 dentry = ERR_PTR(-EEXIST);
47210 fail:
47211@@ -2447,6 +2563,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
47212 }
47213 EXPORT_SYMBOL(user_path_create);
47214
47215+static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, char **to, int is_dir)
47216+{
47217+ char *tmp = getname(pathname);
47218+ struct dentry *res;
47219+ if (IS_ERR(tmp))
47220+ return ERR_CAST(tmp);
47221+ res = kern_path_create(dfd, tmp, path, is_dir);
47222+ if (IS_ERR(res))
47223+ putname(tmp);
47224+ else
47225+ *to = tmp;
47226+ return res;
47227+}
47228+
47229 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
47230 {
47231 int error = may_create(dir, dentry);
47232@@ -2514,6 +2644,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
47233 error = mnt_want_write(path.mnt);
47234 if (error)
47235 goto out_dput;
47236+
47237+ if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
47238+ error = -EPERM;
47239+ goto out_drop_write;
47240+ }
47241+
47242+ if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
47243+ error = -EACCES;
47244+ goto out_drop_write;
47245+ }
47246+
47247 error = security_path_mknod(&path, dentry, mode, dev);
47248 if (error)
47249 goto out_drop_write;
47250@@ -2531,6 +2672,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
47251 }
47252 out_drop_write:
47253 mnt_drop_write(path.mnt);
47254+
47255+ if (!error)
47256+ gr_handle_create(dentry, path.mnt);
47257 out_dput:
47258 dput(dentry);
47259 mutex_unlock(&path.dentry->d_inode->i_mutex);
47260@@ -2580,12 +2724,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
47261 error = mnt_want_write(path.mnt);
47262 if (error)
47263 goto out_dput;
47264+
47265+ if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
47266+ error = -EACCES;
47267+ goto out_drop_write;
47268+ }
47269+
47270 error = security_path_mkdir(&path, dentry, mode);
47271 if (error)
47272 goto out_drop_write;
47273 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
47274 out_drop_write:
47275 mnt_drop_write(path.mnt);
47276+
47277+ if (!error)
47278+ gr_handle_create(dentry, path.mnt);
47279 out_dput:
47280 dput(dentry);
47281 mutex_unlock(&path.dentry->d_inode->i_mutex);
47282@@ -2665,6 +2818,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
47283 char * name;
47284 struct dentry *dentry;
47285 struct nameidata nd;
47286+ ino_t saved_ino = 0;
47287+ dev_t saved_dev = 0;
47288
47289 error = user_path_parent(dfd, pathname, &nd, &name);
47290 if (error)
47291@@ -2693,6 +2848,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
47292 error = -ENOENT;
47293 goto exit3;
47294 }
47295+
47296+ saved_ino = dentry->d_inode->i_ino;
47297+ saved_dev = gr_get_dev_from_dentry(dentry);
47298+
47299+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
47300+ error = -EACCES;
47301+ goto exit3;
47302+ }
47303+
47304 error = mnt_want_write(nd.path.mnt);
47305 if (error)
47306 goto exit3;
47307@@ -2700,6 +2864,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
47308 if (error)
47309 goto exit4;
47310 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
47311+ if (!error && (saved_dev || saved_ino))
47312+ gr_handle_delete(saved_ino, saved_dev);
47313 exit4:
47314 mnt_drop_write(nd.path.mnt);
47315 exit3:
47316@@ -2762,6 +2928,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47317 struct dentry *dentry;
47318 struct nameidata nd;
47319 struct inode *inode = NULL;
47320+ ino_t saved_ino = 0;
47321+ dev_t saved_dev = 0;
47322
47323 error = user_path_parent(dfd, pathname, &nd, &name);
47324 if (error)
47325@@ -2784,6 +2952,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47326 if (!inode)
47327 goto slashes;
47328 ihold(inode);
47329+
47330+ if (inode->i_nlink <= 1) {
47331+ saved_ino = inode->i_ino;
47332+ saved_dev = gr_get_dev_from_dentry(dentry);
47333+ }
47334+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
47335+ error = -EACCES;
47336+ goto exit2;
47337+ }
47338+
47339 error = mnt_want_write(nd.path.mnt);
47340 if (error)
47341 goto exit2;
47342@@ -2791,6 +2969,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47343 if (error)
47344 goto exit3;
47345 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
47346+ if (!error && (saved_ino || saved_dev))
47347+ gr_handle_delete(saved_ino, saved_dev);
47348 exit3:
47349 mnt_drop_write(nd.path.mnt);
47350 exit2:
47351@@ -2866,10 +3046,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
47352 error = mnt_want_write(path.mnt);
47353 if (error)
47354 goto out_dput;
47355+
47356+ if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
47357+ error = -EACCES;
47358+ goto out_drop_write;
47359+ }
47360+
47361 error = security_path_symlink(&path, dentry, from);
47362 if (error)
47363 goto out_drop_write;
47364 error = vfs_symlink(path.dentry->d_inode, dentry, from);
47365+ if (!error)
47366+ gr_handle_create(dentry, path.mnt);
47367 out_drop_write:
47368 mnt_drop_write(path.mnt);
47369 out_dput:
47370@@ -2941,6 +3129,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47371 {
47372 struct dentry *new_dentry;
47373 struct path old_path, new_path;
47374+ char *to = NULL;
47375 int how = 0;
47376 int error;
47377
47378@@ -2964,7 +3153,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47379 if (error)
47380 return error;
47381
47382- new_dentry = user_path_create(newdfd, newname, &new_path, 0);
47383+ new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to, 0);
47384 error = PTR_ERR(new_dentry);
47385 if (IS_ERR(new_dentry))
47386 goto out;
47387@@ -2975,13 +3164,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47388 error = mnt_want_write(new_path.mnt);
47389 if (error)
47390 goto out_dput;
47391+
47392+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
47393+ old_path.dentry->d_inode,
47394+ old_path.dentry->d_inode->i_mode, to)) {
47395+ error = -EACCES;
47396+ goto out_drop_write;
47397+ }
47398+
47399+ if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
47400+ old_path.dentry, old_path.mnt, to)) {
47401+ error = -EACCES;
47402+ goto out_drop_write;
47403+ }
47404+
47405 error = security_path_link(old_path.dentry, &new_path, new_dentry);
47406 if (error)
47407 goto out_drop_write;
47408 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
47409+ if (!error)
47410+ gr_handle_create(new_dentry, new_path.mnt);
47411 out_drop_write:
47412 mnt_drop_write(new_path.mnt);
47413 out_dput:
47414+ putname(to);
47415 dput(new_dentry);
47416 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
47417 path_put(&new_path);
47418@@ -3153,6 +3359,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
47419 char *to;
47420 int error;
47421
47422+ pax_track_stack();
47423+
47424 error = user_path_parent(olddfd, oldname, &oldnd, &from);
47425 if (error)
47426 goto exit;
47427@@ -3209,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
47428 if (new_dentry == trap)
47429 goto exit5;
47430
47431+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
47432+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
47433+ to);
47434+ if (error)
47435+ goto exit5;
47436+
47437 error = mnt_want_write(oldnd.path.mnt);
47438 if (error)
47439 goto exit5;
47440@@ -3218,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
47441 goto exit6;
47442 error = vfs_rename(old_dir->d_inode, old_dentry,
47443 new_dir->d_inode, new_dentry);
47444+ if (!error)
47445+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
47446+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
47447 exit6:
47448 mnt_drop_write(oldnd.path.mnt);
47449 exit5:
47450@@ -3243,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
47451
47452 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
47453 {
47454+ char tmpbuf[64];
47455+ const char *newlink;
47456 int len;
47457
47458 len = PTR_ERR(link);
47459@@ -3252,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
47460 len = strlen(link);
47461 if (len > (unsigned) buflen)
47462 len = buflen;
47463- if (copy_to_user(buffer, link, len))
47464+
47465+ if (len < sizeof(tmpbuf)) {
47466+ memcpy(tmpbuf, link, len);
47467+ newlink = tmpbuf;
47468+ } else
47469+ newlink = link;
47470+
47471+ if (copy_to_user(buffer, newlink, len))
47472 len = -EFAULT;
47473 out:
47474 return len;
47475diff --git a/fs/namespace.c b/fs/namespace.c
47476index 5e7f2e9..cd13685 100644
47477--- a/fs/namespace.c
47478+++ b/fs/namespace.c
47479@@ -1326,6 +1326,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47480 if (!(sb->s_flags & MS_RDONLY))
47481 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
47482 up_write(&sb->s_umount);
47483+
47484+ gr_log_remount(mnt->mnt_devname, retval);
47485+
47486 return retval;
47487 }
47488
47489@@ -1345,6 +1348,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47490 br_write_unlock(vfsmount_lock);
47491 up_write(&namespace_sem);
47492 release_mounts(&umount_list);
47493+
47494+ gr_log_unmount(mnt->mnt_devname, retval);
47495+
47496 return retval;
47497 }
47498
47499@@ -2336,6 +2342,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47500 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
47501 MS_STRICTATIME);
47502
47503+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
47504+ retval = -EPERM;
47505+ goto dput_out;
47506+ }
47507+
47508+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47509+ retval = -EPERM;
47510+ goto dput_out;
47511+ }
47512+
47513 if (flags & MS_REMOUNT)
47514 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47515 data_page);
47516@@ -2350,6 +2366,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47517 dev_name, data_page);
47518 dput_out:
47519 path_put(&path);
47520+
47521+ gr_log_mount(dev_name, dir_name, retval);
47522+
47523 return retval;
47524 }
47525
47526@@ -2573,6 +2592,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
47527 if (error)
47528 goto out2;
47529
47530+ if (gr_handle_chroot_pivot()) {
47531+ error = -EPERM;
47532+ goto out2;
47533+ }
47534+
47535 get_fs_root(current->fs, &root);
47536 error = lock_mount(&old);
47537 if (error)
47538diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
47539index 9c51f62..503b252 100644
47540--- a/fs/ncpfs/dir.c
47541+++ b/fs/ncpfs/dir.c
47542@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentry, struct nameidata *nd)
47543 int res, val = 0, len;
47544 __u8 __name[NCP_MAXPATHLEN + 1];
47545
47546+ pax_track_stack();
47547+
47548 if (dentry == dentry->d_sb->s_root)
47549 return 1;
47550
47551@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
47552 int error, res, len;
47553 __u8 __name[NCP_MAXPATHLEN + 1];
47554
47555+ pax_track_stack();
47556+
47557 error = -EIO;
47558 if (!ncp_conn_valid(server))
47559 goto finished;
47560@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
47561 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
47562 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
47563
47564+ pax_track_stack();
47565+
47566 ncp_age_dentry(server, dentry);
47567 len = sizeof(__name);
47568 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
47569@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
47570 int error, len;
47571 __u8 __name[NCP_MAXPATHLEN + 1];
47572
47573+ pax_track_stack();
47574+
47575 DPRINTK("ncp_mkdir: making %s/%s\n",
47576 dentry->d_parent->d_name.name, dentry->d_name.name);
47577
47578@@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
47579 int old_len, new_len;
47580 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
47581
47582+ pax_track_stack();
47583+
47584 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
47585 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
47586 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
47587diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
47588index 202f370..9d4565e 100644
47589--- a/fs/ncpfs/inode.c
47590+++ b/fs/ncpfs/inode.c
47591@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
47592 #endif
47593 struct ncp_entry_info finfo;
47594
47595+ pax_track_stack();
47596+
47597 memset(&data, 0, sizeof(data));
47598 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
47599 if (!server)
47600diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
47601index 281ae95..dd895b9 100644
47602--- a/fs/nfs/blocklayout/blocklayout.c
47603+++ b/fs/nfs/blocklayout/blocklayout.c
47604@@ -90,7 +90,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
47605 */
47606 struct parallel_io {
47607 struct kref refcnt;
47608- struct rpc_call_ops call_ops;
47609+ rpc_call_ops_no_const call_ops;
47610 void (*pnfs_callback) (void *data);
47611 void *data;
47612 };
47613diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
47614index 679d2f5..ef1ffec 100644
47615--- a/fs/nfs/inode.c
47616+++ b/fs/nfs/inode.c
47617@@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
47618 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47619 nfsi->attrtimeo_timestamp = jiffies;
47620
47621- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47622+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47623 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47624 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47625 else
47626@@ -1002,16 +1002,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
47627 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47628 }
47629
47630-static atomic_long_t nfs_attr_generation_counter;
47631+static atomic_long_unchecked_t nfs_attr_generation_counter;
47632
47633 static unsigned long nfs_read_attr_generation_counter(void)
47634 {
47635- return atomic_long_read(&nfs_attr_generation_counter);
47636+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47637 }
47638
47639 unsigned long nfs_inc_attr_generation_counter(void)
47640 {
47641- return atomic_long_inc_return(&nfs_attr_generation_counter);
47642+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47643 }
47644
47645 void nfs_fattr_init(struct nfs_fattr *fattr)
47646diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
47647index 6f8bcc7..8f823c5 100644
47648--- a/fs/nfsd/nfs4state.c
47649+++ b/fs/nfsd/nfs4state.c
47650@@ -3999,6 +3999,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
47651 unsigned int strhashval;
47652 int err;
47653
47654+ pax_track_stack();
47655+
47656 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
47657 (long long) lock->lk_offset,
47658 (long long) lock->lk_length);
47659diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
47660index f810996..cec8977 100644
47661--- a/fs/nfsd/nfs4xdr.c
47662+++ b/fs/nfsd/nfs4xdr.c
47663@@ -1875,6 +1875,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
47664 .dentry = dentry,
47665 };
47666
47667+ pax_track_stack();
47668+
47669 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
47670 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
47671 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
47672diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
47673index acf88ae..4fd6245 100644
47674--- a/fs/nfsd/vfs.c
47675+++ b/fs/nfsd/vfs.c
47676@@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47677 } else {
47678 oldfs = get_fs();
47679 set_fs(KERNEL_DS);
47680- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47681+ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47682 set_fs(oldfs);
47683 }
47684
47685@@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47686
47687 /* Write the data. */
47688 oldfs = get_fs(); set_fs(KERNEL_DS);
47689- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47690+ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47691 set_fs(oldfs);
47692 if (host_err < 0)
47693 goto out_nfserr;
47694@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
47695 */
47696
47697 oldfs = get_fs(); set_fs(KERNEL_DS);
47698- host_err = inode->i_op->readlink(dentry, buf, *lenp);
47699+ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
47700 set_fs(oldfs);
47701
47702 if (host_err < 0)
47703diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
47704index 3e65427..ac258be 100644
47705--- a/fs/nilfs2/ioctl.c
47706+++ b/fs/nilfs2/ioctl.c
47707@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
47708 if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
47709 goto out_free;
47710
47711+ if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
47712+ goto out_free;
47713+
47714 len = argv[n].v_size * argv[n].v_nmembs;
47715 base = (void __user *)(unsigned long)argv[n].v_base;
47716 if (len == 0) {
47717diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
47718index 9fde1c0..14e8827 100644
47719--- a/fs/notify/fanotify/fanotify_user.c
47720+++ b/fs/notify/fanotify/fanotify_user.c
47721@@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
47722 goto out_close_fd;
47723
47724 ret = -EFAULT;
47725- if (copy_to_user(buf, &fanotify_event_metadata,
47726+ if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
47727+ copy_to_user(buf, &fanotify_event_metadata,
47728 fanotify_event_metadata.event_len))
47729 goto out_kill_access_response;
47730
47731diff --git a/fs/notify/mark.c b/fs/notify/mark.c
47732index e14587d..f104d56 100644
47733--- a/fs/notify/mark.c
47734+++ b/fs/notify/mark.c
47735@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
47736
47737 mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
47738
47739- /* 1 from caller and 1 for being on i_list/g_list */
47740- BUG_ON(atomic_read(&mark->refcnt) < 2);
47741-
47742 spin_lock(&group->mark_lock);
47743
47744 if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
47745@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
47746 iput(inode);
47747
47748 /*
47749+ * We don't necessarily have a ref on mark from caller so the above iput
47750+ * may have already destroyed it. Don't touch from now on.
47751+ */
47752+
47753+ /*
47754 * it's possible that this group tried to destroy itself, but this
47755 * this mark was simultaneously being freed by inode. If that's the
47756 * case, we finish freeing the group here.
47757diff --git a/fs/notify/notification.c b/fs/notify/notification.c
47758index ee18815..7aa5d01 100644
47759--- a/fs/notify/notification.c
47760+++ b/fs/notify/notification.c
47761@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
47762 * get set to 0 so it will never get 'freed'
47763 */
47764 static struct fsnotify_event *q_overflow_event;
47765-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47766+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47767
47768 /**
47769 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
47770@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47771 */
47772 u32 fsnotify_get_cookie(void)
47773 {
47774- return atomic_inc_return(&fsnotify_sync_cookie);
47775+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
47776 }
47777 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
47778
47779diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
47780index 99e3610..02c1068 100644
47781--- a/fs/ntfs/dir.c
47782+++ b/fs/ntfs/dir.c
47783@@ -1329,7 +1329,7 @@ find_next_index_buffer:
47784 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
47785 ~(s64)(ndir->itype.index.block_size - 1)));
47786 /* Bounds checks. */
47787- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47788+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47789 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
47790 "inode 0x%lx or driver bug.", vdir->i_ino);
47791 goto err_out;
47792diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
47793index c587e2d..3641eaa 100644
47794--- a/fs/ntfs/file.c
47795+++ b/fs/ntfs/file.c
47796@@ -2229,6 +2229,6 @@ const struct inode_operations ntfs_file_inode_ops = {
47797 #endif /* NTFS_RW */
47798 };
47799
47800-const struct file_operations ntfs_empty_file_ops = {};
47801+const struct file_operations ntfs_empty_file_ops __read_only;
47802
47803-const struct inode_operations ntfs_empty_inode_ops = {};
47804+const struct inode_operations ntfs_empty_inode_ops __read_only;
47805diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
47806index 210c352..a174f83 100644
47807--- a/fs/ocfs2/localalloc.c
47808+++ b/fs/ocfs2/localalloc.c
47809@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
47810 goto bail;
47811 }
47812
47813- atomic_inc(&osb->alloc_stats.moves);
47814+ atomic_inc_unchecked(&osb->alloc_stats.moves);
47815
47816 bail:
47817 if (handle)
47818diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
47819index 53aa41e..d7df9f1 100644
47820--- a/fs/ocfs2/namei.c
47821+++ b/fs/ocfs2/namei.c
47822@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *old_dir,
47823 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
47824 struct ocfs2_dir_lookup_result target_insert = { NULL, };
47825
47826+ pax_track_stack();
47827+
47828 /* At some point it might be nice to break this function up a
47829 * bit. */
47830
47831diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
47832index 4092858..51c70ff 100644
47833--- a/fs/ocfs2/ocfs2.h
47834+++ b/fs/ocfs2/ocfs2.h
47835@@ -235,11 +235,11 @@ enum ocfs2_vol_state
47836
47837 struct ocfs2_alloc_stats
47838 {
47839- atomic_t moves;
47840- atomic_t local_data;
47841- atomic_t bitmap_data;
47842- atomic_t bg_allocs;
47843- atomic_t bg_extends;
47844+ atomic_unchecked_t moves;
47845+ atomic_unchecked_t local_data;
47846+ atomic_unchecked_t bitmap_data;
47847+ atomic_unchecked_t bg_allocs;
47848+ atomic_unchecked_t bg_extends;
47849 };
47850
47851 enum ocfs2_local_alloc_state
47852diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
47853index ba5d97e..c77db25 100644
47854--- a/fs/ocfs2/suballoc.c
47855+++ b/fs/ocfs2/suballoc.c
47856@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
47857 mlog_errno(status);
47858 goto bail;
47859 }
47860- atomic_inc(&osb->alloc_stats.bg_extends);
47861+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
47862
47863 /* You should never ask for this much metadata */
47864 BUG_ON(bits_wanted >
47865@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handle,
47866 mlog_errno(status);
47867 goto bail;
47868 }
47869- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47870+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47871
47872 *suballoc_loc = res.sr_bg_blkno;
47873 *suballoc_bit_start = res.sr_bit_offset;
47874@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
47875 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
47876 res->sr_bits);
47877
47878- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47879+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47880
47881 BUG_ON(res->sr_bits != 1);
47882
47883@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
47884 mlog_errno(status);
47885 goto bail;
47886 }
47887- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47888+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47889
47890 BUG_ON(res.sr_bits != 1);
47891
47892@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47893 cluster_start,
47894 num_clusters);
47895 if (!status)
47896- atomic_inc(&osb->alloc_stats.local_data);
47897+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
47898 } else {
47899 if (min_clusters > (osb->bitmap_cpg - 1)) {
47900 /* The only paths asking for contiguousness
47901@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47902 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
47903 res.sr_bg_blkno,
47904 res.sr_bit_offset);
47905- atomic_inc(&osb->alloc_stats.bitmap_data);
47906+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
47907 *num_clusters = res.sr_bits;
47908 }
47909 }
47910diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
47911index 56f6102..1433c29 100644
47912--- a/fs/ocfs2/super.c
47913+++ b/fs/ocfs2/super.c
47914@@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
47915 "%10s => GlobalAllocs: %d LocalAllocs: %d "
47916 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
47917 "Stats",
47918- atomic_read(&osb->alloc_stats.bitmap_data),
47919- atomic_read(&osb->alloc_stats.local_data),
47920- atomic_read(&osb->alloc_stats.bg_allocs),
47921- atomic_read(&osb->alloc_stats.moves),
47922- atomic_read(&osb->alloc_stats.bg_extends));
47923+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
47924+ atomic_read_unchecked(&osb->alloc_stats.local_data),
47925+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
47926+ atomic_read_unchecked(&osb->alloc_stats.moves),
47927+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
47928
47929 out += snprintf(buf + out, len - out,
47930 "%10s => State: %u Descriptor: %llu Size: %u bits "
47931@@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
47932 spin_lock_init(&osb->osb_xattr_lock);
47933 ocfs2_init_steal_slots(osb);
47934
47935- atomic_set(&osb->alloc_stats.moves, 0);
47936- atomic_set(&osb->alloc_stats.local_data, 0);
47937- atomic_set(&osb->alloc_stats.bitmap_data, 0);
47938- atomic_set(&osb->alloc_stats.bg_allocs, 0);
47939- atomic_set(&osb->alloc_stats.bg_extends, 0);
47940+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
47941+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
47942+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
47943+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
47944+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
47945
47946 /* Copy the blockcheck stats from the superblock probe */
47947 osb->osb_ecc_stats = *stats;
47948diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
47949index 5d22872..523db20 100644
47950--- a/fs/ocfs2/symlink.c
47951+++ b/fs/ocfs2/symlink.c
47952@@ -142,7 +142,7 @@ bail:
47953
47954 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47955 {
47956- char *link = nd_get_link(nd);
47957+ const char *link = nd_get_link(nd);
47958 if (!IS_ERR(link))
47959 kfree(link);
47960 }
47961diff --git a/fs/open.c b/fs/open.c
47962index f711921..28d5958 100644
47963--- a/fs/open.c
47964+++ b/fs/open.c
47965@@ -112,6 +112,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
47966 error = locks_verify_truncate(inode, NULL, length);
47967 if (!error)
47968 error = security_path_truncate(&path);
47969+
47970+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
47971+ error = -EACCES;
47972+
47973 if (!error)
47974 error = do_truncate(path.dentry, length, 0, NULL);
47975
47976@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
47977 if (__mnt_is_readonly(path.mnt))
47978 res = -EROFS;
47979
47980+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
47981+ res = -EACCES;
47982+
47983 out_path_release:
47984 path_put(&path);
47985 out:
47986@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
47987 if (error)
47988 goto dput_and_out;
47989
47990+ gr_log_chdir(path.dentry, path.mnt);
47991+
47992 set_fs_pwd(current->fs, &path);
47993
47994 dput_and_out:
47995@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
47996 goto out_putf;
47997
47998 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
47999+
48000+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
48001+ error = -EPERM;
48002+
48003+ if (!error)
48004+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
48005+
48006 if (!error)
48007 set_fs_pwd(current->fs, &file->f_path);
48008 out_putf:
48009@@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
48010 if (error)
48011 goto dput_and_out;
48012
48013+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
48014+ goto dput_and_out;
48015+
48016 set_fs_root(current->fs, &path);
48017+
48018+ gr_handle_chroot_chdir(&path);
48019+
48020 error = 0;
48021 dput_and_out:
48022 path_put(&path);
48023@@ -456,6 +478,16 @@ static int chmod_common(struct path *path, umode_t mode)
48024 if (error)
48025 return error;
48026 mutex_lock(&inode->i_mutex);
48027+
48028+ if (!gr_acl_handle_fchmod(path->dentry, path->mnt, mode)) {
48029+ error = -EACCES;
48030+ goto out_unlock;
48031+ }
48032+ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
48033+ error = -EACCES;
48034+ goto out_unlock;
48035+ }
48036+
48037 error = security_path_chmod(path->dentry, path->mnt, mode);
48038 if (error)
48039 goto out_unlock;
48040@@ -506,6 +538,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
48041 int error;
48042 struct iattr newattrs;
48043
48044+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
48045+ return -EACCES;
48046+
48047 newattrs.ia_valid = ATTR_CTIME;
48048 if (user != (uid_t) -1) {
48049 newattrs.ia_valid |= ATTR_UID;
48050diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
48051index 6296b40..417c00f 100644
48052--- a/fs/partitions/efi.c
48053+++ b/fs/partitions/efi.c
48054@@ -234,14 +234,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
48055 if (!gpt)
48056 return NULL;
48057
48058+ if (!le32_to_cpu(gpt->num_partition_entries))
48059+ return NULL;
48060+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
48061+ if (!pte)
48062+ return NULL;
48063+
48064 count = le32_to_cpu(gpt->num_partition_entries) *
48065 le32_to_cpu(gpt->sizeof_partition_entry);
48066- if (!count)
48067- return NULL;
48068- pte = kzalloc(count, GFP_KERNEL);
48069- if (!pte)
48070- return NULL;
48071-
48072 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
48073 (u8 *) pte,
48074 count) < count) {
48075diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
48076index af9fdf0..75b15c3 100644
48077--- a/fs/partitions/ldm.c
48078+++ b/fs/partitions/ldm.c
48079@@ -1322,7 +1322,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
48080 goto found;
48081 }
48082
48083- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
48084+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
48085 if (!f) {
48086 ldm_crit ("Out of memory.");
48087 return false;
48088diff --git a/fs/pipe.c b/fs/pipe.c
48089index 0e0be1d..f62a72d 100644
48090--- a/fs/pipe.c
48091+++ b/fs/pipe.c
48092@@ -420,9 +420,9 @@ redo:
48093 }
48094 if (bufs) /* More to do? */
48095 continue;
48096- if (!pipe->writers)
48097+ if (!atomic_read(&pipe->writers))
48098 break;
48099- if (!pipe->waiting_writers) {
48100+ if (!atomic_read(&pipe->waiting_writers)) {
48101 /* syscall merging: Usually we must not sleep
48102 * if O_NONBLOCK is set, or if we got some data.
48103 * But if a writer sleeps in kernel space, then
48104@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
48105 mutex_lock(&inode->i_mutex);
48106 pipe = inode->i_pipe;
48107
48108- if (!pipe->readers) {
48109+ if (!atomic_read(&pipe->readers)) {
48110 send_sig(SIGPIPE, current, 0);
48111 ret = -EPIPE;
48112 goto out;
48113@@ -530,7 +530,7 @@ redo1:
48114 for (;;) {
48115 int bufs;
48116
48117- if (!pipe->readers) {
48118+ if (!atomic_read(&pipe->readers)) {
48119 send_sig(SIGPIPE, current, 0);
48120 if (!ret)
48121 ret = -EPIPE;
48122@@ -616,9 +616,9 @@ redo2:
48123 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
48124 do_wakeup = 0;
48125 }
48126- pipe->waiting_writers++;
48127+ atomic_inc(&pipe->waiting_writers);
48128 pipe_wait(pipe);
48129- pipe->waiting_writers--;
48130+ atomic_dec(&pipe->waiting_writers);
48131 }
48132 out:
48133 mutex_unlock(&inode->i_mutex);
48134@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table *wait)
48135 mask = 0;
48136 if (filp->f_mode & FMODE_READ) {
48137 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
48138- if (!pipe->writers && filp->f_version != pipe->w_counter)
48139+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
48140 mask |= POLLHUP;
48141 }
48142
48143@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table *wait)
48144 * Most Unices do not set POLLERR for FIFOs but on Linux they
48145 * behave exactly like pipes for poll().
48146 */
48147- if (!pipe->readers)
48148+ if (!atomic_read(&pipe->readers))
48149 mask |= POLLERR;
48150 }
48151
48152@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int decr, int decw)
48153
48154 mutex_lock(&inode->i_mutex);
48155 pipe = inode->i_pipe;
48156- pipe->readers -= decr;
48157- pipe->writers -= decw;
48158+ atomic_sub(decr, &pipe->readers);
48159+ atomic_sub(decw, &pipe->writers);
48160
48161- if (!pipe->readers && !pipe->writers) {
48162+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
48163 free_pipe_info(inode);
48164 } else {
48165 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
48166@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
48167
48168 if (inode->i_pipe) {
48169 ret = 0;
48170- inode->i_pipe->readers++;
48171+ atomic_inc(&inode->i_pipe->readers);
48172 }
48173
48174 mutex_unlock(&inode->i_mutex);
48175@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
48176
48177 if (inode->i_pipe) {
48178 ret = 0;
48179- inode->i_pipe->writers++;
48180+ atomic_inc(&inode->i_pipe->writers);
48181 }
48182
48183 mutex_unlock(&inode->i_mutex);
48184@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
48185 if (inode->i_pipe) {
48186 ret = 0;
48187 if (filp->f_mode & FMODE_READ)
48188- inode->i_pipe->readers++;
48189+ atomic_inc(&inode->i_pipe->readers);
48190 if (filp->f_mode & FMODE_WRITE)
48191- inode->i_pipe->writers++;
48192+ atomic_inc(&inode->i_pipe->writers);
48193 }
48194
48195 mutex_unlock(&inode->i_mutex);
48196@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
48197 inode->i_pipe = NULL;
48198 }
48199
48200-static struct vfsmount *pipe_mnt __read_mostly;
48201+struct vfsmount *pipe_mnt __read_mostly;
48202
48203 /*
48204 * pipefs_dname() is called from d_path().
48205@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(void)
48206 goto fail_iput;
48207 inode->i_pipe = pipe;
48208
48209- pipe->readers = pipe->writers = 1;
48210+ atomic_set(&pipe->readers, 1);
48211+ atomic_set(&pipe->writers, 1);
48212 inode->i_fop = &rdwr_pipefifo_fops;
48213
48214 /*
48215diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
48216index 15af622..0e9f4467 100644
48217--- a/fs/proc/Kconfig
48218+++ b/fs/proc/Kconfig
48219@@ -30,12 +30,12 @@ config PROC_FS
48220
48221 config PROC_KCORE
48222 bool "/proc/kcore support" if !ARM
48223- depends on PROC_FS && MMU
48224+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
48225
48226 config PROC_VMCORE
48227 bool "/proc/vmcore support"
48228- depends on PROC_FS && CRASH_DUMP
48229- default y
48230+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
48231+ default n
48232 help
48233 Exports the dump image of crashed kernel in ELF format.
48234
48235@@ -59,8 +59,8 @@ config PROC_SYSCTL
48236 limited in memory.
48237
48238 config PROC_PAGE_MONITOR
48239- default y
48240- depends on PROC_FS && MMU
48241+ default n
48242+ depends on PROC_FS && MMU && !GRKERNSEC
48243 bool "Enable /proc page monitoring" if EXPERT
48244 help
48245 Various /proc files exist to monitor process memory utilization:
48246diff --git a/fs/proc/array.c b/fs/proc/array.c
48247index 3a1dafd..c7fed72 100644
48248--- a/fs/proc/array.c
48249+++ b/fs/proc/array.c
48250@@ -60,6 +60,7 @@
48251 #include <linux/tty.h>
48252 #include <linux/string.h>
48253 #include <linux/mman.h>
48254+#include <linux/grsecurity.h>
48255 #include <linux/proc_fs.h>
48256 #include <linux/ioport.h>
48257 #include <linux/uaccess.h>
48258@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
48259 seq_putc(m, '\n');
48260 }
48261
48262+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48263+static inline void task_pax(struct seq_file *m, struct task_struct *p)
48264+{
48265+ if (p->mm)
48266+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
48267+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
48268+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
48269+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
48270+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
48271+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
48272+ else
48273+ seq_printf(m, "PaX:\t-----\n");
48274+}
48275+#endif
48276+
48277 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48278 struct pid *pid, struct task_struct *task)
48279 {
48280@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48281 task_cpus_allowed(m, task);
48282 cpuset_task_status_allowed(m, task);
48283 task_context_switch_counts(m, task);
48284+
48285+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48286+ task_pax(m, task);
48287+#endif
48288+
48289+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
48290+ task_grsec_rbac(m, task);
48291+#endif
48292+
48293 return 0;
48294 }
48295
48296+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48297+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48298+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
48299+ _mm->pax_flags & MF_PAX_SEGMEXEC))
48300+#endif
48301+
48302 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48303 struct pid *pid, struct task_struct *task, int whole)
48304 {
48305@@ -378,6 +409,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48306 char tcomm[sizeof(task->comm)];
48307 unsigned long flags;
48308
48309+ pax_track_stack();
48310+
48311 state = *get_task_state(task);
48312 vsize = eip = esp = 0;
48313 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
48314@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48315 gtime = task->gtime;
48316 }
48317
48318+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48319+ if (PAX_RAND_FLAGS(mm)) {
48320+ eip = 0;
48321+ esp = 0;
48322+ wchan = 0;
48323+ }
48324+#endif
48325+#ifdef CONFIG_GRKERNSEC_HIDESYM
48326+ wchan = 0;
48327+ eip =0;
48328+ esp =0;
48329+#endif
48330+
48331 /* scale priority and nice values from timeslices to -20..20 */
48332 /* to make it look like a "normal" Unix priority/nice value */
48333 priority = task_prio(task);
48334@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48335 vsize,
48336 mm ? get_mm_rss(mm) : 0,
48337 rsslim,
48338+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48339+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
48340+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
48341+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
48342+#else
48343 mm ? (permitted ? mm->start_code : 1) : 0,
48344 mm ? (permitted ? mm->end_code : 1) : 0,
48345 (permitted && mm) ? mm->start_stack : 0,
48346+#endif
48347 esp,
48348 eip,
48349 /* The signal information here is obsolete.
48350@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48351
48352 return 0;
48353 }
48354+
48355+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48356+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
48357+{
48358+ u32 curr_ip = 0;
48359+ unsigned long flags;
48360+
48361+ if (lock_task_sighand(task, &flags)) {
48362+ curr_ip = task->signal->curr_ip;
48363+ unlock_task_sighand(task, &flags);
48364+ }
48365+
48366+ return sprintf(buffer, "%pI4\n", &curr_ip);
48367+}
48368+#endif
48369diff --git a/fs/proc/base.c b/fs/proc/base.c
48370index 5eb0206..f8f1974 100644
48371--- a/fs/proc/base.c
48372+++ b/fs/proc/base.c
48373@@ -107,6 +107,22 @@ struct pid_entry {
48374 union proc_op op;
48375 };
48376
48377+struct getdents_callback {
48378+ struct linux_dirent __user * current_dir;
48379+ struct linux_dirent __user * previous;
48380+ struct file * file;
48381+ int count;
48382+ int error;
48383+};
48384+
48385+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
48386+ loff_t offset, u64 ino, unsigned int d_type)
48387+{
48388+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
48389+ buf->error = -EINVAL;
48390+ return 0;
48391+}
48392+
48393 #define NOD(NAME, MODE, IOP, FOP, OP) { \
48394 .name = (NAME), \
48395 .len = sizeof(NAME) - 1, \
48396@@ -194,65 +210,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
48397 return result;
48398 }
48399
48400-static struct mm_struct *__check_mem_permission(struct task_struct *task)
48401-{
48402- struct mm_struct *mm;
48403-
48404- mm = get_task_mm(task);
48405- if (!mm)
48406- return ERR_PTR(-EINVAL);
48407-
48408- /*
48409- * A task can always look at itself, in case it chooses
48410- * to use system calls instead of load instructions.
48411- */
48412- if (task == current)
48413- return mm;
48414-
48415- /*
48416- * If current is actively ptrace'ing, and would also be
48417- * permitted to freshly attach with ptrace now, permit it.
48418- */
48419- if (task_is_stopped_or_traced(task)) {
48420- int match;
48421- rcu_read_lock();
48422- match = (ptrace_parent(task) == current);
48423- rcu_read_unlock();
48424- if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
48425- return mm;
48426- }
48427-
48428- /*
48429- * No one else is allowed.
48430- */
48431- mmput(mm);
48432- return ERR_PTR(-EPERM);
48433-}
48434-
48435-/*
48436- * If current may access user memory in @task return a reference to the
48437- * corresponding mm, otherwise ERR_PTR.
48438- */
48439-static struct mm_struct *check_mem_permission(struct task_struct *task)
48440-{
48441- struct mm_struct *mm;
48442- int err;
48443-
48444- /*
48445- * Avoid racing if task exec's as we might get a new mm but validate
48446- * against old credentials.
48447- */
48448- err = mutex_lock_killable(&task->signal->cred_guard_mutex);
48449- if (err)
48450- return ERR_PTR(err);
48451-
48452- mm = __check_mem_permission(task);
48453- mutex_unlock(&task->signal->cred_guard_mutex);
48454-
48455- return mm;
48456-}
48457-
48458-struct mm_struct *mm_for_maps(struct task_struct *task)
48459+static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
48460 {
48461 struct mm_struct *mm;
48462 int err;
48463@@ -262,16 +220,23 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
48464 return ERR_PTR(err);
48465
48466 mm = get_task_mm(task);
48467- if (mm && mm != current->mm &&
48468- !ptrace_may_access(task, PTRACE_MODE_READ)) {
48469- mmput(mm);
48470- mm = ERR_PTR(-EACCES);
48471+ if (mm) {
48472+ if ((mm != current->mm && !ptrace_may_access(task, mode)) ||
48473+ (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))) {
48474+ mmput(mm);
48475+ mm = ERR_PTR(-EACCES);
48476+ }
48477 }
48478 mutex_unlock(&task->signal->cred_guard_mutex);
48479
48480 return mm;
48481 }
48482
48483+struct mm_struct *mm_for_maps(struct task_struct *task)
48484+{
48485+ return mm_access(task, PTRACE_MODE_READ);
48486+}
48487+
48488 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
48489 {
48490 int res = 0;
48491@@ -282,6 +247,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
48492 if (!mm->arg_end)
48493 goto out_mm; /* Shh! No looking before we're done */
48494
48495+ if (gr_acl_handle_procpidmem(task))
48496+ goto out_mm;
48497+
48498 len = mm->arg_end - mm->arg_start;
48499
48500 if (len > PAGE_SIZE)
48501@@ -309,12 +277,28 @@ out:
48502 return res;
48503 }
48504
48505+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48506+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48507+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
48508+ _mm->pax_flags & MF_PAX_SEGMEXEC))
48509+#endif
48510+
48511 static int proc_pid_auxv(struct task_struct *task, char *buffer)
48512 {
48513 struct mm_struct *mm = mm_for_maps(task);
48514 int res = PTR_ERR(mm);
48515 if (mm && !IS_ERR(mm)) {
48516 unsigned int nwords = 0;
48517+
48518+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48519+ /* allow if we're currently ptracing this task */
48520+ if (PAX_RAND_FLAGS(mm) &&
48521+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
48522+ mmput(mm);
48523+ return 0;
48524+ }
48525+#endif
48526+
48527 do {
48528 nwords += 2;
48529 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
48530@@ -328,7 +312,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
48531 }
48532
48533
48534-#ifdef CONFIG_KALLSYMS
48535+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48536 /*
48537 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
48538 * Returns the resolved symbol. If that fails, simply return the address.
48539@@ -367,7 +351,7 @@ static void unlock_trace(struct task_struct *task)
48540 mutex_unlock(&task->signal->cred_guard_mutex);
48541 }
48542
48543-#ifdef CONFIG_STACKTRACE
48544+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48545
48546 #define MAX_STACK_TRACE_DEPTH 64
48547
48548@@ -558,7 +542,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
48549 return count;
48550 }
48551
48552-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48553+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48554 static int proc_pid_syscall(struct task_struct *task, char *buffer)
48555 {
48556 long nr;
48557@@ -587,7 +571,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
48558 /************************************************************************/
48559
48560 /* permission checks */
48561-static int proc_fd_access_allowed(struct inode *inode)
48562+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
48563 {
48564 struct task_struct *task;
48565 int allowed = 0;
48566@@ -597,7 +581,10 @@ static int proc_fd_access_allowed(struct inode *inode)
48567 */
48568 task = get_proc_task(inode);
48569 if (task) {
48570- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48571+ if (log)
48572+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
48573+ else
48574+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48575 put_task_struct(task);
48576 }
48577 return allowed;
48578@@ -816,38 +803,39 @@ static const struct file_operations proc_single_file_operations = {
48579
48580 static int mem_open(struct inode* inode, struct file* file)
48581 {
48582- file->private_data = (void*)((long)current->self_exec_id);
48583+ struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
48584+ struct mm_struct *mm;
48585+
48586+ if (!task)
48587+ return -ESRCH;
48588+
48589+ mm = mm_access(task, PTRACE_MODE_ATTACH);
48590+ put_task_struct(task);
48591+
48592+ if (IS_ERR(mm))
48593+ return PTR_ERR(mm);
48594+
48595 /* OK to pass negative loff_t, we can catch out-of-range */
48596 file->f_mode |= FMODE_UNSIGNED_OFFSET;
48597+ file->private_data = mm;
48598+
48599 return 0;
48600 }
48601
48602 static ssize_t mem_read(struct file * file, char __user * buf,
48603 size_t count, loff_t *ppos)
48604 {
48605- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
48606+ int ret;
48607 char *page;
48608 unsigned long src = *ppos;
48609- int ret = -ESRCH;
48610- struct mm_struct *mm;
48611+ struct mm_struct *mm = file->private_data;
48612
48613- if (!task)
48614- goto out_no_task;
48615+ if (!mm)
48616+ return 0;
48617
48618- ret = -ENOMEM;
48619 page = (char *)__get_free_page(GFP_TEMPORARY);
48620 if (!page)
48621- goto out;
48622-
48623- mm = check_mem_permission(task);
48624- ret = PTR_ERR(mm);
48625- if (IS_ERR(mm))
48626- goto out_free;
48627-
48628- ret = -EIO;
48629-
48630- if (file->private_data != (void*)((long)current->self_exec_id))
48631- goto out_put;
48632+ return -ENOMEM;
48633
48634 ret = 0;
48635
48636@@ -874,42 +862,28 @@ static ssize_t mem_read(struct file * file, char __user * buf,
48637 }
48638 *ppos = src;
48639
48640-out_put:
48641- mmput(mm);
48642-out_free:
48643 free_page((unsigned long) page);
48644-out:
48645- put_task_struct(task);
48646-out_no_task:
48647 return ret;
48648 }
48649
48650+#define mem_write NULL
48651+
48652+#ifndef mem_write
48653+/* They were right the first time */
48654 static ssize_t mem_write(struct file * file, const char __user *buf,
48655 size_t count, loff_t *ppos)
48656 {
48657 int copied;
48658 char *page;
48659- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
48660 unsigned long dst = *ppos;
48661- struct mm_struct *mm;
48662+ struct mm_struct *mm = file->private_data;
48663
48664- copied = -ESRCH;
48665- if (!task)
48666- goto out_no_task;
48667+ if (!mm)
48668+ return 0;
48669
48670- copied = -ENOMEM;
48671 page = (char *)__get_free_page(GFP_TEMPORARY);
48672 if (!page)
48673- goto out_task;
48674-
48675- mm = check_mem_permission(task);
48676- copied = PTR_ERR(mm);
48677- if (IS_ERR(mm))
48678- goto out_free;
48679-
48680- copied = -EIO;
48681- if (file->private_data != (void *)((long)current->self_exec_id))
48682- goto out_mm;
48683+ return -ENOMEM;
48684
48685 copied = 0;
48686 while (count > 0) {
48687@@ -933,15 +907,10 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
48688 }
48689 *ppos = dst;
48690
48691-out_mm:
48692- mmput(mm);
48693-out_free:
48694 free_page((unsigned long) page);
48695-out_task:
48696- put_task_struct(task);
48697-out_no_task:
48698 return copied;
48699 }
48700+#endif
48701
48702 loff_t mem_lseek(struct file *file, loff_t offset, int orig)
48703 {
48704@@ -959,11 +928,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
48705 return file->f_pos;
48706 }
48707
48708+static int mem_release(struct inode *inode, struct file *file)
48709+{
48710+ struct mm_struct *mm = file->private_data;
48711+
48712+ mmput(mm);
48713+ return 0;
48714+}
48715+
48716 static const struct file_operations proc_mem_operations = {
48717 .llseek = mem_lseek,
48718 .read = mem_read,
48719 .write = mem_write,
48720 .open = mem_open,
48721+ .release = mem_release,
48722 };
48723
48724 static ssize_t environ_read(struct file *file, char __user *buf,
48725@@ -978,6 +956,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
48726 if (!task)
48727 goto out_no_task;
48728
48729+ if (gr_acl_handle_procpidmem(task))
48730+ goto out;
48731+
48732 ret = -ENOMEM;
48733 page = (char *)__get_free_page(GFP_TEMPORARY);
48734 if (!page)
48735@@ -1613,7 +1594,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
48736 path_put(&nd->path);
48737
48738 /* Are we allowed to snoop on the tasks file descriptors? */
48739- if (!proc_fd_access_allowed(inode))
48740+ if (!proc_fd_access_allowed(inode,0))
48741 goto out;
48742
48743 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
48744@@ -1652,8 +1633,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
48745 struct path path;
48746
48747 /* Are we allowed to snoop on the tasks file descriptors? */
48748- if (!proc_fd_access_allowed(inode))
48749- goto out;
48750+ /* logging this is needed for learning on chromium to work properly,
48751+ but we don't want to flood the logs from 'ps' which does a readlink
48752+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
48753+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
48754+ */
48755+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
48756+ if (!proc_fd_access_allowed(inode,0))
48757+ goto out;
48758+ } else {
48759+ if (!proc_fd_access_allowed(inode,1))
48760+ goto out;
48761+ }
48762
48763 error = PROC_I(inode)->op.proc_get_link(inode, &path);
48764 if (error)
48765@@ -1718,7 +1709,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
48766 rcu_read_lock();
48767 cred = __task_cred(task);
48768 inode->i_uid = cred->euid;
48769+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48770+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48771+#else
48772 inode->i_gid = cred->egid;
48773+#endif
48774 rcu_read_unlock();
48775 }
48776 security_task_to_inode(task, inode);
48777@@ -1736,6 +1731,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48778 struct inode *inode = dentry->d_inode;
48779 struct task_struct *task;
48780 const struct cred *cred;
48781+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48782+ const struct cred *tmpcred = current_cred();
48783+#endif
48784
48785 generic_fillattr(inode, stat);
48786
48787@@ -1743,13 +1741,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48788 stat->uid = 0;
48789 stat->gid = 0;
48790 task = pid_task(proc_pid(inode), PIDTYPE_PID);
48791+
48792+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
48793+ rcu_read_unlock();
48794+ return -ENOENT;
48795+ }
48796+
48797 if (task) {
48798+ cred = __task_cred(task);
48799+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48800+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48801+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48802+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48803+#endif
48804+ ) {
48805+#endif
48806 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48807+#ifdef CONFIG_GRKERNSEC_PROC_USER
48808+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48809+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48810+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48811+#endif
48812 task_dumpable(task)) {
48813- cred = __task_cred(task);
48814 stat->uid = cred->euid;
48815+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48816+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48817+#else
48818 stat->gid = cred->egid;
48819+#endif
48820 }
48821+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48822+ } else {
48823+ rcu_read_unlock();
48824+ return -ENOENT;
48825+ }
48826+#endif
48827 }
48828 rcu_read_unlock();
48829 return 0;
48830@@ -1786,11 +1812,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
48831
48832 if (task) {
48833 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48834+#ifdef CONFIG_GRKERNSEC_PROC_USER
48835+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48836+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48837+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48838+#endif
48839 task_dumpable(task)) {
48840 rcu_read_lock();
48841 cred = __task_cred(task);
48842 inode->i_uid = cred->euid;
48843+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48844+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48845+#else
48846 inode->i_gid = cred->egid;
48847+#endif
48848 rcu_read_unlock();
48849 } else {
48850 inode->i_uid = 0;
48851@@ -1908,7 +1943,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
48852 int fd = proc_fd(inode);
48853
48854 if (task) {
48855- files = get_files_struct(task);
48856+ if (!gr_acl_handle_procpidmem(task))
48857+ files = get_files_struct(task);
48858 put_task_struct(task);
48859 }
48860 if (files) {
48861@@ -2176,11 +2212,21 @@ static const struct file_operations proc_fd_operations = {
48862 */
48863 static int proc_fd_permission(struct inode *inode, int mask)
48864 {
48865+ struct task_struct *task;
48866 int rv = generic_permission(inode, mask);
48867- if (rv == 0)
48868- return 0;
48869+
48870 if (task_pid(current) == proc_pid(inode))
48871 rv = 0;
48872+
48873+ task = get_proc_task(inode);
48874+ if (task == NULL)
48875+ return rv;
48876+
48877+ if (gr_acl_handle_procpidmem(task))
48878+ rv = -EACCES;
48879+
48880+ put_task_struct(task);
48881+
48882 return rv;
48883 }
48884
48885@@ -2290,6 +2336,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
48886 if (!task)
48887 goto out_no_task;
48888
48889+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48890+ goto out;
48891+
48892 /*
48893 * Yes, it does not scale. And it should not. Don't add
48894 * new entries into /proc/<tgid>/ without very good reasons.
48895@@ -2334,6 +2383,9 @@ static int proc_pident_readdir(struct file *filp,
48896 if (!task)
48897 goto out_no_task;
48898
48899+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48900+ goto out;
48901+
48902 ret = 0;
48903 i = filp->f_pos;
48904 switch (i) {
48905@@ -2604,7 +2656,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
48906 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48907 void *cookie)
48908 {
48909- char *s = nd_get_link(nd);
48910+ const char *s = nd_get_link(nd);
48911 if (!IS_ERR(s))
48912 __putname(s);
48913 }
48914@@ -2802,7 +2854,7 @@ static const struct pid_entry tgid_base_stuff[] = {
48915 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
48916 #endif
48917 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48918-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48919+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48920 INF("syscall", S_IRUGO, proc_pid_syscall),
48921 #endif
48922 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48923@@ -2827,10 +2879,10 @@ static const struct pid_entry tgid_base_stuff[] = {
48924 #ifdef CONFIG_SECURITY
48925 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48926 #endif
48927-#ifdef CONFIG_KALLSYMS
48928+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48929 INF("wchan", S_IRUGO, proc_pid_wchan),
48930 #endif
48931-#ifdef CONFIG_STACKTRACE
48932+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48933 ONE("stack", S_IRUGO, proc_pid_stack),
48934 #endif
48935 #ifdef CONFIG_SCHEDSTATS
48936@@ -2864,6 +2916,9 @@ static const struct pid_entry tgid_base_stuff[] = {
48937 #ifdef CONFIG_HARDWALL
48938 INF("hardwall", S_IRUGO, proc_pid_hardwall),
48939 #endif
48940+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48941+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
48942+#endif
48943 };
48944
48945 static int proc_tgid_base_readdir(struct file * filp,
48946@@ -2989,7 +3044,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
48947 if (!inode)
48948 goto out;
48949
48950+#ifdef CONFIG_GRKERNSEC_PROC_USER
48951+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
48952+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48953+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48954+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
48955+#else
48956 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
48957+#endif
48958 inode->i_op = &proc_tgid_base_inode_operations;
48959 inode->i_fop = &proc_tgid_base_operations;
48960 inode->i_flags|=S_IMMUTABLE;
48961@@ -3031,7 +3093,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
48962 if (!task)
48963 goto out;
48964
48965+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48966+ goto out_put_task;
48967+
48968 result = proc_pid_instantiate(dir, dentry, task, NULL);
48969+out_put_task:
48970 put_task_struct(task);
48971 out:
48972 return result;
48973@@ -3096,6 +3162,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48974 {
48975 unsigned int nr;
48976 struct task_struct *reaper;
48977+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48978+ const struct cred *tmpcred = current_cred();
48979+ const struct cred *itercred;
48980+#endif
48981+ filldir_t __filldir = filldir;
48982 struct tgid_iter iter;
48983 struct pid_namespace *ns;
48984
48985@@ -3119,8 +3190,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48986 for (iter = next_tgid(ns, iter);
48987 iter.task;
48988 iter.tgid += 1, iter = next_tgid(ns, iter)) {
48989+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48990+ rcu_read_lock();
48991+ itercred = __task_cred(iter.task);
48992+#endif
48993+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
48994+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48995+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
48996+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48997+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48998+#endif
48999+ )
49000+#endif
49001+ )
49002+ __filldir = &gr_fake_filldir;
49003+ else
49004+ __filldir = filldir;
49005+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49006+ rcu_read_unlock();
49007+#endif
49008 filp->f_pos = iter.tgid + TGID_OFFSET;
49009- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
49010+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
49011 put_task_struct(iter.task);
49012 goto out;
49013 }
49014@@ -3148,7 +3238,7 @@ static const struct pid_entry tid_base_stuff[] = {
49015 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
49016 #endif
49017 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49018-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49019+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49020 INF("syscall", S_IRUGO, proc_pid_syscall),
49021 #endif
49022 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49023@@ -3172,10 +3262,10 @@ static const struct pid_entry tid_base_stuff[] = {
49024 #ifdef CONFIG_SECURITY
49025 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49026 #endif
49027-#ifdef CONFIG_KALLSYMS
49028+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49029 INF("wchan", S_IRUGO, proc_pid_wchan),
49030 #endif
49031-#ifdef CONFIG_STACKTRACE
49032+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49033 ONE("stack", S_IRUGO, proc_pid_stack),
49034 #endif
49035 #ifdef CONFIG_SCHEDSTATS
49036diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
49037index 82676e3..5f8518a 100644
49038--- a/fs/proc/cmdline.c
49039+++ b/fs/proc/cmdline.c
49040@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
49041
49042 static int __init proc_cmdline_init(void)
49043 {
49044+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49045+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
49046+#else
49047 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
49048+#endif
49049 return 0;
49050 }
49051 module_init(proc_cmdline_init);
49052diff --git a/fs/proc/devices.c b/fs/proc/devices.c
49053index b143471..bb105e5 100644
49054--- a/fs/proc/devices.c
49055+++ b/fs/proc/devices.c
49056@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
49057
49058 static int __init proc_devices_init(void)
49059 {
49060+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49061+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
49062+#else
49063 proc_create("devices", 0, NULL, &proc_devinfo_operations);
49064+#endif
49065 return 0;
49066 }
49067 module_init(proc_devices_init);
49068diff --git a/fs/proc/inode.c b/fs/proc/inode.c
49069index 7ed72d6..d5f061a 100644
49070--- a/fs/proc/inode.c
49071+++ b/fs/proc/inode.c
49072@@ -18,12 +18,18 @@
49073 #include <linux/module.h>
49074 #include <linux/sysctl.h>
49075 #include <linux/slab.h>
49076+#include <linux/grsecurity.h>
49077
49078 #include <asm/system.h>
49079 #include <asm/uaccess.h>
49080
49081 #include "internal.h"
49082
49083+#ifdef CONFIG_PROC_SYSCTL
49084+extern const struct inode_operations proc_sys_inode_operations;
49085+extern const struct inode_operations proc_sys_dir_operations;
49086+#endif
49087+
49088 static void proc_evict_inode(struct inode *inode)
49089 {
49090 struct proc_dir_entry *de;
49091@@ -49,6 +55,13 @@ static void proc_evict_inode(struct inode *inode)
49092 ns_ops = PROC_I(inode)->ns_ops;
49093 if (ns_ops && ns_ops->put)
49094 ns_ops->put(PROC_I(inode)->ns);
49095+
49096+#ifdef CONFIG_PROC_SYSCTL
49097+ if (inode->i_op == &proc_sys_inode_operations ||
49098+ inode->i_op == &proc_sys_dir_operations)
49099+ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
49100+#endif
49101+
49102 }
49103
49104 static struct kmem_cache * proc_inode_cachep;
49105@@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
49106 if (de->mode) {
49107 inode->i_mode = de->mode;
49108 inode->i_uid = de->uid;
49109+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49110+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49111+#else
49112 inode->i_gid = de->gid;
49113+#endif
49114 }
49115 if (de->size)
49116 inode->i_size = de->size;
49117diff --git a/fs/proc/internal.h b/fs/proc/internal.h
49118index 7838e5c..ff92cbc 100644
49119--- a/fs/proc/internal.h
49120+++ b/fs/proc/internal.h
49121@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49122 struct pid *pid, struct task_struct *task);
49123 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
49124 struct pid *pid, struct task_struct *task);
49125+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49126+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
49127+#endif
49128 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
49129
49130 extern const struct file_operations proc_maps_operations;
49131diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
49132index d245cb2..7e645bd 100644
49133--- a/fs/proc/kcore.c
49134+++ b/fs/proc/kcore.c
49135@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
49136 off_t offset = 0;
49137 struct kcore_list *m;
49138
49139+ pax_track_stack();
49140+
49141 /* setup ELF header */
49142 elf = (struct elfhdr *) bufp;
49143 bufp += sizeof(struct elfhdr);
49144@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49145 * the addresses in the elf_phdr on our list.
49146 */
49147 start = kc_offset_to_vaddr(*fpos - elf_buflen);
49148- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
49149+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
49150+ if (tsz > buflen)
49151 tsz = buflen;
49152-
49153+
49154 while (buflen) {
49155 struct kcore_list *m;
49156
49157@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49158 kfree(elf_buf);
49159 } else {
49160 if (kern_addr_valid(start)) {
49161- unsigned long n;
49162+ char *elf_buf;
49163+ mm_segment_t oldfs;
49164
49165- n = copy_to_user(buffer, (char *)start, tsz);
49166- /*
49167- * We cannot distingush between fault on source
49168- * and fault on destination. When this happens
49169- * we clear too and hope it will trigger the
49170- * EFAULT again.
49171- */
49172- if (n) {
49173- if (clear_user(buffer + tsz - n,
49174- n))
49175+ elf_buf = kmalloc(tsz, GFP_KERNEL);
49176+ if (!elf_buf)
49177+ return -ENOMEM;
49178+ oldfs = get_fs();
49179+ set_fs(KERNEL_DS);
49180+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
49181+ set_fs(oldfs);
49182+ if (copy_to_user(buffer, elf_buf, tsz)) {
49183+ kfree(elf_buf);
49184 return -EFAULT;
49185+ }
49186 }
49187+ set_fs(oldfs);
49188+ kfree(elf_buf);
49189 } else {
49190 if (clear_user(buffer, tsz))
49191 return -EFAULT;
49192@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49193
49194 static int open_kcore(struct inode *inode, struct file *filp)
49195 {
49196+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
49197+ return -EPERM;
49198+#endif
49199 if (!capable(CAP_SYS_RAWIO))
49200 return -EPERM;
49201 if (kcore_need_update)
49202diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
49203index 80e4645..d2689e9 100644
49204--- a/fs/proc/meminfo.c
49205+++ b/fs/proc/meminfo.c
49206@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
49207 unsigned long pages[NR_LRU_LISTS];
49208 int lru;
49209
49210+ pax_track_stack();
49211+
49212 /*
49213 * display in kilobytes.
49214 */
49215@@ -158,7 +160,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
49216 vmi.used >> 10,
49217 vmi.largest_chunk >> 10
49218 #ifdef CONFIG_MEMORY_FAILURE
49219- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
49220+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
49221 #endif
49222 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
49223 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
49224diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
49225index b1822dd..df622cb 100644
49226--- a/fs/proc/nommu.c
49227+++ b/fs/proc/nommu.c
49228@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
49229 if (len < 1)
49230 len = 1;
49231 seq_printf(m, "%*c", len, ' ');
49232- seq_path(m, &file->f_path, "");
49233+ seq_path(m, &file->f_path, "\n\\");
49234 }
49235
49236 seq_putc(m, '\n');
49237diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
49238index f738024..876984a 100644
49239--- a/fs/proc/proc_net.c
49240+++ b/fs/proc/proc_net.c
49241@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
49242 struct task_struct *task;
49243 struct nsproxy *ns;
49244 struct net *net = NULL;
49245+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49246+ const struct cred *cred = current_cred();
49247+#endif
49248+
49249+#ifdef CONFIG_GRKERNSEC_PROC_USER
49250+ if (cred->fsuid)
49251+ return net;
49252+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49253+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
49254+ return net;
49255+#endif
49256
49257 rcu_read_lock();
49258 task = pid_task(proc_pid(dir), PIDTYPE_PID);
49259diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
49260index 1a77dbe..56ec911 100644
49261--- a/fs/proc/proc_sysctl.c
49262+++ b/fs/proc/proc_sysctl.c
49263@@ -8,11 +8,13 @@
49264 #include <linux/namei.h>
49265 #include "internal.h"
49266
49267+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
49268+
49269 static const struct dentry_operations proc_sys_dentry_operations;
49270 static const struct file_operations proc_sys_file_operations;
49271-static const struct inode_operations proc_sys_inode_operations;
49272+const struct inode_operations proc_sys_inode_operations;
49273 static const struct file_operations proc_sys_dir_file_operations;
49274-static const struct inode_operations proc_sys_dir_operations;
49275+const struct inode_operations proc_sys_dir_operations;
49276
49277 static struct inode *proc_sys_make_inode(struct super_block *sb,
49278 struct ctl_table_header *head, struct ctl_table *table)
49279@@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
49280
49281 err = NULL;
49282 d_set_d_op(dentry, &proc_sys_dentry_operations);
49283+
49284+ gr_handle_proc_create(dentry, inode);
49285+
49286 d_add(dentry, inode);
49287
49288+ if (gr_handle_sysctl(p, MAY_EXEC))
49289+ err = ERR_PTR(-ENOENT);
49290+
49291 out:
49292 sysctl_head_finish(head);
49293 return err;
49294@@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
49295 return -ENOMEM;
49296 } else {
49297 d_set_d_op(child, &proc_sys_dentry_operations);
49298+
49299+ gr_handle_proc_create(child, inode);
49300+
49301 d_add(child, inode);
49302 }
49303 } else {
49304@@ -230,6 +241,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
49305 if (*pos < file->f_pos)
49306 continue;
49307
49308+ if (gr_handle_sysctl(table, 0))
49309+ continue;
49310+
49311 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
49312 if (res)
49313 return res;
49314@@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
49315 if (IS_ERR(head))
49316 return PTR_ERR(head);
49317
49318+ if (table && gr_handle_sysctl(table, MAY_EXEC))
49319+ return -ENOENT;
49320+
49321 generic_fillattr(inode, stat);
49322 if (table)
49323 stat->mode = (stat->mode & S_IFMT) | table->mode;
49324@@ -370,17 +387,18 @@ static const struct file_operations proc_sys_file_operations = {
49325 };
49326
49327 static const struct file_operations proc_sys_dir_file_operations = {
49328+ .read = generic_read_dir,
49329 .readdir = proc_sys_readdir,
49330 .llseek = generic_file_llseek,
49331 };
49332
49333-static const struct inode_operations proc_sys_inode_operations = {
49334+const struct inode_operations proc_sys_inode_operations = {
49335 .permission = proc_sys_permission,
49336 .setattr = proc_sys_setattr,
49337 .getattr = proc_sys_getattr,
49338 };
49339
49340-static const struct inode_operations proc_sys_dir_operations = {
49341+const struct inode_operations proc_sys_dir_operations = {
49342 .lookup = proc_sys_lookup,
49343 .permission = proc_sys_permission,
49344 .setattr = proc_sys_setattr,
49345diff --git a/fs/proc/root.c b/fs/proc/root.c
49346index 9a8a2b7..3018df6 100644
49347--- a/fs/proc/root.c
49348+++ b/fs/proc/root.c
49349@@ -123,7 +123,15 @@ void __init proc_root_init(void)
49350 #ifdef CONFIG_PROC_DEVICETREE
49351 proc_device_tree_init();
49352 #endif
49353+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49354+#ifdef CONFIG_GRKERNSEC_PROC_USER
49355+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
49356+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49357+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
49358+#endif
49359+#else
49360 proc_mkdir("bus", NULL);
49361+#endif
49362 proc_sys_init();
49363 }
49364
49365diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
49366index c7d4ee6..41c5564 100644
49367--- a/fs/proc/task_mmu.c
49368+++ b/fs/proc/task_mmu.c
49369@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49370 "VmExe:\t%8lu kB\n"
49371 "VmLib:\t%8lu kB\n"
49372 "VmPTE:\t%8lu kB\n"
49373- "VmSwap:\t%8lu kB\n",
49374- hiwater_vm << (PAGE_SHIFT-10),
49375+ "VmSwap:\t%8lu kB\n"
49376+
49377+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49378+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
49379+#endif
49380+
49381+ ,hiwater_vm << (PAGE_SHIFT-10),
49382 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
49383 mm->locked_vm << (PAGE_SHIFT-10),
49384 hiwater_rss << (PAGE_SHIFT-10),
49385@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49386 data << (PAGE_SHIFT-10),
49387 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
49388 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
49389- swap << (PAGE_SHIFT-10));
49390+ swap << (PAGE_SHIFT-10)
49391+
49392+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49393+ , mm->context.user_cs_base, mm->context.user_cs_limit
49394+#endif
49395+
49396+ );
49397 }
49398
49399 unsigned long task_vsize(struct mm_struct *mm)
49400@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *inode, struct file *file,
49401 return ret;
49402 }
49403
49404+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49405+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49406+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49407+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49408+#endif
49409+
49410 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49411 {
49412 struct mm_struct *mm = vma->vm_mm;
49413@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49414 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
49415 }
49416
49417- /* We don't show the stack guard page in /proc/maps */
49418+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49419+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
49420+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
49421+#else
49422 start = vma->vm_start;
49423- if (stack_guard_page_start(vma, start))
49424- start += PAGE_SIZE;
49425 end = vma->vm_end;
49426- if (stack_guard_page_end(vma, end))
49427- end -= PAGE_SIZE;
49428+#endif
49429
49430 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
49431 start,
49432@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49433 flags & VM_WRITE ? 'w' : '-',
49434 flags & VM_EXEC ? 'x' : '-',
49435 flags & VM_MAYSHARE ? 's' : 'p',
49436+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49437+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
49438+#else
49439 pgoff,
49440+#endif
49441 MAJOR(dev), MINOR(dev), ino, &len);
49442
49443 /*
49444@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49445 */
49446 if (file) {
49447 pad_len_spaces(m, len);
49448- seq_path(m, &file->f_path, "\n");
49449+ seq_path(m, &file->f_path, "\n\\");
49450 } else {
49451 const char *name = arch_vma_name(vma);
49452 if (!name) {
49453@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49454 if (vma->vm_start <= mm->brk &&
49455 vma->vm_end >= mm->start_brk) {
49456 name = "[heap]";
49457- } else if (vma->vm_start <= mm->start_stack &&
49458- vma->vm_end >= mm->start_stack) {
49459+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
49460+ (vma->vm_start <= mm->start_stack &&
49461+ vma->vm_end >= mm->start_stack)) {
49462 name = "[stack]";
49463 }
49464 } else {
49465@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m, void *v)
49466 };
49467
49468 memset(&mss, 0, sizeof mss);
49469- mss.vma = vma;
49470- /* mmap_sem is held in m_start */
49471- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49472- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49473-
49474+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49475+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
49476+#endif
49477+ mss.vma = vma;
49478+ /* mmap_sem is held in m_start */
49479+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49480+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49481+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49482+ }
49483+#endif
49484 show_map_vma(m, vma);
49485
49486 seq_printf(m,
49487@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m, void *v)
49488 "KernelPageSize: %8lu kB\n"
49489 "MMUPageSize: %8lu kB\n"
49490 "Locked: %8lu kB\n",
49491+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49492+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
49493+#else
49494 (vma->vm_end - vma->vm_start) >> 10,
49495+#endif
49496 mss.resident >> 10,
49497 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
49498 mss.shared_clean >> 10,
49499@@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file *m, void *v)
49500
49501 if (file) {
49502 seq_printf(m, " file=");
49503- seq_path(m, &file->f_path, "\n\t= ");
49504+ seq_path(m, &file->f_path, "\n\t\\= ");
49505 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
49506 seq_printf(m, " heap");
49507 } else if (vma->vm_start <= mm->start_stack &&
49508diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
49509index 980de54..2a4db5f 100644
49510--- a/fs/proc/task_nommu.c
49511+++ b/fs/proc/task_nommu.c
49512@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49513 else
49514 bytes += kobjsize(mm);
49515
49516- if (current->fs && current->fs->users > 1)
49517+ if (current->fs && atomic_read(&current->fs->users) > 1)
49518 sbytes += kobjsize(current->fs);
49519 else
49520 bytes += kobjsize(current->fs);
49521@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
49522
49523 if (file) {
49524 pad_len_spaces(m, len);
49525- seq_path(m, &file->f_path, "");
49526+ seq_path(m, &file->f_path, "\n\\");
49527 } else if (mm) {
49528 if (vma->vm_start <= mm->start_stack &&
49529 vma->vm_end >= mm->start_stack) {
49530diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
49531index d67908b..d13f6a6 100644
49532--- a/fs/quota/netlink.c
49533+++ b/fs/quota/netlink.c
49534@@ -33,7 +33,7 @@ static struct genl_family quota_genl_family = {
49535 void quota_send_warning(short type, unsigned int id, dev_t dev,
49536 const char warntype)
49537 {
49538- static atomic_t seq;
49539+ static atomic_unchecked_t seq;
49540 struct sk_buff *skb;
49541 void *msg_head;
49542 int ret;
49543@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsigned int id, dev_t dev,
49544 "VFS: Not enough memory to send quota warning.\n");
49545 return;
49546 }
49547- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
49548+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
49549 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
49550 if (!msg_head) {
49551 printk(KERN_ERR
49552diff --git a/fs/readdir.c b/fs/readdir.c
49553index 356f715..c918d38 100644
49554--- a/fs/readdir.c
49555+++ b/fs/readdir.c
49556@@ -17,6 +17,7 @@
49557 #include <linux/security.h>
49558 #include <linux/syscalls.h>
49559 #include <linux/unistd.h>
49560+#include <linux/namei.h>
49561
49562 #include <asm/uaccess.h>
49563
49564@@ -67,6 +68,7 @@ struct old_linux_dirent {
49565
49566 struct readdir_callback {
49567 struct old_linux_dirent __user * dirent;
49568+ struct file * file;
49569 int result;
49570 };
49571
49572@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
49573 buf->result = -EOVERFLOW;
49574 return -EOVERFLOW;
49575 }
49576+
49577+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49578+ return 0;
49579+
49580 buf->result++;
49581 dirent = buf->dirent;
49582 if (!access_ok(VERIFY_WRITE, dirent,
49583@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
49584
49585 buf.result = 0;
49586 buf.dirent = dirent;
49587+ buf.file = file;
49588
49589 error = vfs_readdir(file, fillonedir, &buf);
49590 if (buf.result)
49591@@ -142,6 +149,7 @@ struct linux_dirent {
49592 struct getdents_callback {
49593 struct linux_dirent __user * current_dir;
49594 struct linux_dirent __user * previous;
49595+ struct file * file;
49596 int count;
49597 int error;
49598 };
49599@@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
49600 buf->error = -EOVERFLOW;
49601 return -EOVERFLOW;
49602 }
49603+
49604+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49605+ return 0;
49606+
49607 dirent = buf->previous;
49608 if (dirent) {
49609 if (__put_user(offset, &dirent->d_off))
49610@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
49611 buf.previous = NULL;
49612 buf.count = count;
49613 buf.error = 0;
49614+ buf.file = file;
49615
49616 error = vfs_readdir(file, filldir, &buf);
49617 if (error >= 0)
49618@@ -229,6 +242,7 @@ out:
49619 struct getdents_callback64 {
49620 struct linux_dirent64 __user * current_dir;
49621 struct linux_dirent64 __user * previous;
49622+ struct file *file;
49623 int count;
49624 int error;
49625 };
49626@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
49627 buf->error = -EINVAL; /* only used if we fail.. */
49628 if (reclen > buf->count)
49629 return -EINVAL;
49630+
49631+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49632+ return 0;
49633+
49634 dirent = buf->previous;
49635 if (dirent) {
49636 if (__put_user(offset, &dirent->d_off))
49637@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
49638
49639 buf.current_dir = dirent;
49640 buf.previous = NULL;
49641+ buf.file = file;
49642 buf.count = count;
49643 buf.error = 0;
49644
49645@@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
49646 error = buf.error;
49647 lastdirent = buf.previous;
49648 if (lastdirent) {
49649- typeof(lastdirent->d_off) d_off = file->f_pos;
49650+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
49651 if (__put_user(d_off, &lastdirent->d_off))
49652 error = -EFAULT;
49653 else
49654diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
49655index 133e935..349ef18 100644
49656--- a/fs/reiserfs/dir.c
49657+++ b/fs/reiserfs/dir.c
49658@@ -75,6 +75,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
49659 struct reiserfs_dir_entry de;
49660 int ret = 0;
49661
49662+ pax_track_stack();
49663+
49664 reiserfs_write_lock(inode->i_sb);
49665
49666 reiserfs_check_lock_depth(inode->i_sb, "readdir");
49667diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
49668index 60c0804..d814f98 100644
49669--- a/fs/reiserfs/do_balan.c
49670+++ b/fs/reiserfs/do_balan.c
49671@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
49672 return;
49673 }
49674
49675- atomic_inc(&(fs_generation(tb->tb_sb)));
49676+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
49677 do_balance_starts(tb);
49678
49679 /* balance leaf returns 0 except if combining L R and S into
49680diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
49681index a159ba5..0396a76 100644
49682--- a/fs/reiserfs/journal.c
49683+++ b/fs/reiserfs/journal.c
49684@@ -2289,6 +2289,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
49685 struct buffer_head *bh;
49686 int i, j;
49687
49688+ pax_track_stack();
49689+
49690 bh = __getblk(dev, block, bufsize);
49691 if (buffer_uptodate(bh))
49692 return (bh);
49693diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
49694index ef39232..0fa91ba 100644
49695--- a/fs/reiserfs/namei.c
49696+++ b/fs/reiserfs/namei.c
49697@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
49698 unsigned long savelink = 1;
49699 struct timespec ctime;
49700
49701+ pax_track_stack();
49702+
49703 /* three balancings: (1) old name removal, (2) new name insertion
49704 and (3) maybe "save" link insertion
49705 stat data updates: (1) old directory,
49706diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
49707index 7a99811..2c9286f 100644
49708--- a/fs/reiserfs/procfs.c
49709+++ b/fs/reiserfs/procfs.c
49710@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
49711 "SMALL_TAILS " : "NO_TAILS ",
49712 replay_only(sb) ? "REPLAY_ONLY " : "",
49713 convert_reiserfs(sb) ? "CONV " : "",
49714- atomic_read(&r->s_generation_counter),
49715+ atomic_read_unchecked(&r->s_generation_counter),
49716 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
49717 SF(s_do_balance), SF(s_unneeded_left_neighbor),
49718 SF(s_good_search_by_key_reada), SF(s_bmaps),
49719@@ -299,6 +299,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
49720 struct journal_params *jp = &rs->s_v1.s_journal;
49721 char b[BDEVNAME_SIZE];
49722
49723+ pax_track_stack();
49724+
49725 seq_printf(m, /* on-disk fields */
49726 "jp_journal_1st_block: \t%i\n"
49727 "jp_journal_dev: \t%s[%x]\n"
49728diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
49729index 313d39d..3a5811b 100644
49730--- a/fs/reiserfs/stree.c
49731+++ b/fs/reiserfs/stree.c
49732@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
49733 int iter = 0;
49734 #endif
49735
49736+ pax_track_stack();
49737+
49738 BUG_ON(!th->t_trans_id);
49739
49740 init_tb_struct(th, &s_del_balance, sb, path,
49741@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
49742 int retval;
49743 int quota_cut_bytes = 0;
49744
49745+ pax_track_stack();
49746+
49747 BUG_ON(!th->t_trans_id);
49748
49749 le_key2cpu_key(&cpu_key, key);
49750@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
49751 int quota_cut_bytes;
49752 loff_t tail_pos = 0;
49753
49754+ pax_track_stack();
49755+
49756 BUG_ON(!th->t_trans_id);
49757
49758 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
49759@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
49760 int retval;
49761 int fs_gen;
49762
49763+ pax_track_stack();
49764+
49765 BUG_ON(!th->t_trans_id);
49766
49767 fs_gen = get_generation(inode->i_sb);
49768@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
49769 int fs_gen = 0;
49770 int quota_bytes = 0;
49771
49772+ pax_track_stack();
49773+
49774 BUG_ON(!th->t_trans_id);
49775
49776 if (inode) { /* Do we count quotas for item? */
49777diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
49778index 5e3527b..e55e569 100644
49779--- a/fs/reiserfs/super.c
49780+++ b/fs/reiserfs/super.c
49781@@ -931,6 +931,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
49782 {.option_name = NULL}
49783 };
49784
49785+ pax_track_stack();
49786+
49787 *blocks = 0;
49788 if (!options || !*options)
49789 /* use default configuration: create tails, journaling on, no
49790diff --git a/fs/select.c b/fs/select.c
49791index d33418f..f8e06bc 100644
49792--- a/fs/select.c
49793+++ b/fs/select.c
49794@@ -20,6 +20,7 @@
49795 #include <linux/module.h>
49796 #include <linux/slab.h>
49797 #include <linux/poll.h>
49798+#include <linux/security.h>
49799 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49800 #include <linux/file.h>
49801 #include <linux/fdtable.h>
49802@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
49803 int retval, i, timed_out = 0;
49804 unsigned long slack = 0;
49805
49806+ pax_track_stack();
49807+
49808 rcu_read_lock();
49809 retval = max_select_fd(n, fds);
49810 rcu_read_unlock();
49811@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
49812 /* Allocate small arguments on the stack to save memory and be faster */
49813 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
49814
49815+ pax_track_stack();
49816+
49817 ret = -EINVAL;
49818 if (n < 0)
49819 goto out_nofds;
49820@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
49821 struct poll_list *walk = head;
49822 unsigned long todo = nfds;
49823
49824+ pax_track_stack();
49825+
49826+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49827 if (nfds > rlimit(RLIMIT_NOFILE))
49828 return -EINVAL;
49829
49830diff --git a/fs/seq_file.c b/fs/seq_file.c
49831index dba43c3..a99fb63 100644
49832--- a/fs/seq_file.c
49833+++ b/fs/seq_file.c
49834@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49835 return 0;
49836 }
49837 if (!m->buf) {
49838- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49839+ m->size = PAGE_SIZE;
49840+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49841 if (!m->buf)
49842 return -ENOMEM;
49843 }
49844@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49845 Eoverflow:
49846 m->op->stop(m, p);
49847 kfree(m->buf);
49848- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49849+ m->size <<= 1;
49850+ m->buf = kmalloc(m->size, GFP_KERNEL);
49851 return !m->buf ? -ENOMEM : -EAGAIN;
49852 }
49853
49854@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49855 m->version = file->f_version;
49856 /* grab buffer if we didn't have one */
49857 if (!m->buf) {
49858- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49859+ m->size = PAGE_SIZE;
49860+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49861 if (!m->buf)
49862 goto Enomem;
49863 }
49864@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49865 goto Fill;
49866 m->op->stop(m, p);
49867 kfree(m->buf);
49868- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49869+ m->size <<= 1;
49870+ m->buf = kmalloc(m->size, GFP_KERNEL);
49871 if (!m->buf)
49872 goto Enomem;
49873 m->count = 0;
49874@@ -549,7 +553,7 @@ static void single_stop(struct seq_file *p, void *v)
49875 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49876 void *data)
49877 {
49878- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49879+ seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49880 int res = -ENOMEM;
49881
49882 if (op) {
49883diff --git a/fs/splice.c b/fs/splice.c
49884index fa2defa..9a697a5 100644
49885--- a/fs/splice.c
49886+++ b/fs/splice.c
49887@@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49888 pipe_lock(pipe);
49889
49890 for (;;) {
49891- if (!pipe->readers) {
49892+ if (!atomic_read(&pipe->readers)) {
49893 send_sig(SIGPIPE, current, 0);
49894 if (!ret)
49895 ret = -EPIPE;
49896@@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49897 do_wakeup = 0;
49898 }
49899
49900- pipe->waiting_writers++;
49901+ atomic_inc(&pipe->waiting_writers);
49902 pipe_wait(pipe);
49903- pipe->waiting_writers--;
49904+ atomic_dec(&pipe->waiting_writers);
49905 }
49906
49907 pipe_unlock(pipe);
49908@@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
49909 .spd_release = spd_release_page,
49910 };
49911
49912+ pax_track_stack();
49913+
49914 if (splice_grow_spd(pipe, &spd))
49915 return -ENOMEM;
49916
49917@@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
49918 old_fs = get_fs();
49919 set_fs(get_ds());
49920 /* The cast to a user pointer is valid due to the set_fs() */
49921- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
49922+ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
49923 set_fs(old_fs);
49924
49925 return res;
49926@@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
49927 old_fs = get_fs();
49928 set_fs(get_ds());
49929 /* The cast to a user pointer is valid due to the set_fs() */
49930- res = vfs_write(file, (const char __user *)buf, count, &pos);
49931+ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
49932 set_fs(old_fs);
49933
49934 return res;
49935@@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49936 .spd_release = spd_release_page,
49937 };
49938
49939+ pax_track_stack();
49940+
49941 if (splice_grow_spd(pipe, &spd))
49942 return -ENOMEM;
49943
49944@@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49945 goto err;
49946
49947 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
49948- vec[i].iov_base = (void __user *) page_address(page);
49949+ vec[i].iov_base = (void __force_user *) page_address(page);
49950 vec[i].iov_len = this_len;
49951 spd.pages[i] = page;
49952 spd.nr_pages++;
49953@@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
49954 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
49955 {
49956 while (!pipe->nrbufs) {
49957- if (!pipe->writers)
49958+ if (!atomic_read(&pipe->writers))
49959 return 0;
49960
49961- if (!pipe->waiting_writers && sd->num_spliced)
49962+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
49963 return 0;
49964
49965 if (sd->flags & SPLICE_F_NONBLOCK)
49966@@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
49967 * out of the pipe right after the splice_to_pipe(). So set
49968 * PIPE_READERS appropriately.
49969 */
49970- pipe->readers = 1;
49971+ atomic_set(&pipe->readers, 1);
49972
49973 current->splice_pipe = pipe;
49974 }
49975@@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
49976 };
49977 long ret;
49978
49979+ pax_track_stack();
49980+
49981 pipe = get_pipe_info(file);
49982 if (!pipe)
49983 return -EBADF;
49984@@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49985 ret = -ERESTARTSYS;
49986 break;
49987 }
49988- if (!pipe->writers)
49989+ if (!atomic_read(&pipe->writers))
49990 break;
49991- if (!pipe->waiting_writers) {
49992+ if (!atomic_read(&pipe->waiting_writers)) {
49993 if (flags & SPLICE_F_NONBLOCK) {
49994 ret = -EAGAIN;
49995 break;
49996@@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49997 pipe_lock(pipe);
49998
49999 while (pipe->nrbufs >= pipe->buffers) {
50000- if (!pipe->readers) {
50001+ if (!atomic_read(&pipe->readers)) {
50002 send_sig(SIGPIPE, current, 0);
50003 ret = -EPIPE;
50004 break;
50005@@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
50006 ret = -ERESTARTSYS;
50007 break;
50008 }
50009- pipe->waiting_writers++;
50010+ atomic_inc(&pipe->waiting_writers);
50011 pipe_wait(pipe);
50012- pipe->waiting_writers--;
50013+ atomic_dec(&pipe->waiting_writers);
50014 }
50015
50016 pipe_unlock(pipe);
50017@@ -1819,14 +1825,14 @@ retry:
50018 pipe_double_lock(ipipe, opipe);
50019
50020 do {
50021- if (!opipe->readers) {
50022+ if (!atomic_read(&opipe->readers)) {
50023 send_sig(SIGPIPE, current, 0);
50024 if (!ret)
50025 ret = -EPIPE;
50026 break;
50027 }
50028
50029- if (!ipipe->nrbufs && !ipipe->writers)
50030+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
50031 break;
50032
50033 /*
50034@@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
50035 pipe_double_lock(ipipe, opipe);
50036
50037 do {
50038- if (!opipe->readers) {
50039+ if (!atomic_read(&opipe->readers)) {
50040 send_sig(SIGPIPE, current, 0);
50041 if (!ret)
50042 ret = -EPIPE;
50043@@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
50044 * return EAGAIN if we have the potential of some data in the
50045 * future, otherwise just return 0
50046 */
50047- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
50048+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
50049 ret = -EAGAIN;
50050
50051 pipe_unlock(ipipe);
50052diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
50053index 1ad8c93..6633545 100644
50054--- a/fs/sysfs/file.c
50055+++ b/fs/sysfs/file.c
50056@@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
50057
50058 struct sysfs_open_dirent {
50059 atomic_t refcnt;
50060- atomic_t event;
50061+ atomic_unchecked_t event;
50062 wait_queue_head_t poll;
50063 struct list_head buffers; /* goes through sysfs_buffer.list */
50064 };
50065@@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
50066 if (!sysfs_get_active(attr_sd))
50067 return -ENODEV;
50068
50069- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
50070+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
50071 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
50072
50073 sysfs_put_active(attr_sd);
50074@@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
50075 return -ENOMEM;
50076
50077 atomic_set(&new_od->refcnt, 0);
50078- atomic_set(&new_od->event, 1);
50079+ atomic_set_unchecked(&new_od->event, 1);
50080 init_waitqueue_head(&new_od->poll);
50081 INIT_LIST_HEAD(&new_od->buffers);
50082 goto retry;
50083@@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
50084
50085 sysfs_put_active(attr_sd);
50086
50087- if (buffer->event != atomic_read(&od->event))
50088+ if (buffer->event != atomic_read_unchecked(&od->event))
50089 goto trigger;
50090
50091 return DEFAULT_POLLMASK;
50092@@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
50093
50094 od = sd->s_attr.open;
50095 if (od) {
50096- atomic_inc(&od->event);
50097+ atomic_inc_unchecked(&od->event);
50098 wake_up_interruptible(&od->poll);
50099 }
50100
50101diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
50102index e34f0d9..740ea7b 100644
50103--- a/fs/sysfs/mount.c
50104+++ b/fs/sysfs/mount.c
50105@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
50106 .s_name = "",
50107 .s_count = ATOMIC_INIT(1),
50108 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
50109+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
50110+ .s_mode = S_IFDIR | S_IRWXU,
50111+#else
50112 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
50113+#endif
50114 .s_ino = 1,
50115 };
50116
50117diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
50118index a7ac78f..02158e1 100644
50119--- a/fs/sysfs/symlink.c
50120+++ b/fs/sysfs/symlink.c
50121@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
50122
50123 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
50124 {
50125- char *page = nd_get_link(nd);
50126+ const char *page = nd_get_link(nd);
50127 if (!IS_ERR(page))
50128 free_page((unsigned long)page);
50129 }
50130diff --git a/fs/udf/inode.c b/fs/udf/inode.c
50131index 262050f..d2df565 100644
50132--- a/fs/udf/inode.c
50133+++ b/fs/udf/inode.c
50134@@ -576,6 +576,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
50135 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
50136 int lastblock = 0;
50137
50138+ pax_track_stack();
50139+
50140 prev_epos.offset = udf_file_entry_alloc_offset(inode);
50141 prev_epos.block = iinfo->i_location;
50142 prev_epos.bh = NULL;
50143diff --git a/fs/udf/misc.c b/fs/udf/misc.c
50144index 9215700..bf1f68e 100644
50145--- a/fs/udf/misc.c
50146+++ b/fs/udf/misc.c
50147@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
50148
50149 u8 udf_tag_checksum(const struct tag *t)
50150 {
50151- u8 *data = (u8 *)t;
50152+ const u8 *data = (const u8 *)t;
50153 u8 checksum = 0;
50154 int i;
50155 for (i = 0; i < sizeof(struct tag); ++i)
50156diff --git a/fs/utimes.c b/fs/utimes.c
50157index ba653f3..06ea4b1 100644
50158--- a/fs/utimes.c
50159+++ b/fs/utimes.c
50160@@ -1,6 +1,7 @@
50161 #include <linux/compiler.h>
50162 #include <linux/file.h>
50163 #include <linux/fs.h>
50164+#include <linux/security.h>
50165 #include <linux/linkage.h>
50166 #include <linux/mount.h>
50167 #include <linux/namei.h>
50168@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
50169 goto mnt_drop_write_and_out;
50170 }
50171 }
50172+
50173+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
50174+ error = -EACCES;
50175+ goto mnt_drop_write_and_out;
50176+ }
50177+
50178 mutex_lock(&inode->i_mutex);
50179 error = notify_change(path->dentry, &newattrs);
50180 mutex_unlock(&inode->i_mutex);
50181diff --git a/fs/xattr.c b/fs/xattr.c
50182index f060663..def7007 100644
50183--- a/fs/xattr.c
50184+++ b/fs/xattr.c
50185@@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
50186 * Extended attribute SET operations
50187 */
50188 static long
50189-setxattr(struct dentry *d, const char __user *name, const void __user *value,
50190+setxattr(struct path *path, const char __user *name, const void __user *value,
50191 size_t size, int flags)
50192 {
50193 int error;
50194@@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
50195 return PTR_ERR(kvalue);
50196 }
50197
50198- error = vfs_setxattr(d, kname, kvalue, size, flags);
50199+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
50200+ error = -EACCES;
50201+ goto out;
50202+ }
50203+
50204+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
50205+out:
50206 kfree(kvalue);
50207 return error;
50208 }
50209@@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
50210 return error;
50211 error = mnt_want_write(path.mnt);
50212 if (!error) {
50213- error = setxattr(path.dentry, name, value, size, flags);
50214+ error = setxattr(&path, name, value, size, flags);
50215 mnt_drop_write(path.mnt);
50216 }
50217 path_put(&path);
50218@@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
50219 return error;
50220 error = mnt_want_write(path.mnt);
50221 if (!error) {
50222- error = setxattr(path.dentry, name, value, size, flags);
50223+ error = setxattr(&path, name, value, size, flags);
50224 mnt_drop_write(path.mnt);
50225 }
50226 path_put(&path);
50227@@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
50228 const void __user *,value, size_t, size, int, flags)
50229 {
50230 struct file *f;
50231- struct dentry *dentry;
50232 int error = -EBADF;
50233
50234 f = fget(fd);
50235 if (!f)
50236 return error;
50237- dentry = f->f_path.dentry;
50238- audit_inode(NULL, dentry);
50239+ audit_inode(NULL, f->f_path.dentry);
50240 error = mnt_want_write_file(f);
50241 if (!error) {
50242- error = setxattr(dentry, name, value, size, flags);
50243+ error = setxattr(&f->f_path, name, value, size, flags);
50244 mnt_drop_write(f->f_path.mnt);
50245 }
50246 fput(f);
50247diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
50248index 8d5a506..7f62712 100644
50249--- a/fs/xattr_acl.c
50250+++ b/fs/xattr_acl.c
50251@@ -17,8 +17,8 @@
50252 struct posix_acl *
50253 posix_acl_from_xattr(const void *value, size_t size)
50254 {
50255- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
50256- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
50257+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
50258+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
50259 int count;
50260 struct posix_acl *acl;
50261 struct posix_acl_entry *acl_e;
50262diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
50263index 452a291..91a95f3b 100644
50264--- a/fs/xfs/xfs_bmap.c
50265+++ b/fs/xfs/xfs_bmap.c
50266@@ -250,7 +250,7 @@ xfs_bmap_validate_ret(
50267 int nmap,
50268 int ret_nmap);
50269 #else
50270-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
50271+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
50272 #endif /* DEBUG */
50273
50274 STATIC int
50275diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
50276index 79d05e8..e3e5861 100644
50277--- a/fs/xfs/xfs_dir2_sf.c
50278+++ b/fs/xfs/xfs_dir2_sf.c
50279@@ -852,7 +852,15 @@ xfs_dir2_sf_getdents(
50280 }
50281
50282 ino = xfs_dir2_sfe_get_ino(sfp, sfep);
50283- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
50284+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
50285+ char name[sfep->namelen];
50286+ memcpy(name, sfep->name, sfep->namelen);
50287+ if (filldir(dirent, name, sfep->namelen,
50288+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
50289+ *offset = off & 0x7fffffff;
50290+ return 0;
50291+ }
50292+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
50293 off & 0x7fffffff, ino, DT_UNKNOWN)) {
50294 *offset = off & 0x7fffffff;
50295 return 0;
50296diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
50297index f7ce7de..e1a5db0 100644
50298--- a/fs/xfs/xfs_ioctl.c
50299+++ b/fs/xfs/xfs_ioctl.c
50300@@ -128,7 +128,7 @@ xfs_find_handle(
50301 }
50302
50303 error = -EFAULT;
50304- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
50305+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
50306 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
50307 goto out_put;
50308
50309diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
50310index 474920b..97169a9 100644
50311--- a/fs/xfs/xfs_iops.c
50312+++ b/fs/xfs/xfs_iops.c
50313@@ -446,7 +446,7 @@ xfs_vn_put_link(
50314 struct nameidata *nd,
50315 void *p)
50316 {
50317- char *s = nd_get_link(nd);
50318+ const char *s = nd_get_link(nd);
50319
50320 if (!IS_ERR(s))
50321 kfree(s);
50322diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
50323new file mode 100644
50324index 0000000..4639511
50325--- /dev/null
50326+++ b/grsecurity/Kconfig
50327@@ -0,0 +1,1051 @@
50328+#
50329+# grecurity configuration
50330+#
50331+
50332+menu "Grsecurity"
50333+
50334+config GRKERNSEC
50335+ bool "Grsecurity"
50336+ select CRYPTO
50337+ select CRYPTO_SHA256
50338+ help
50339+ If you say Y here, you will be able to configure many features
50340+ that will enhance the security of your system. It is highly
50341+ recommended that you say Y here and read through the help
50342+ for each option so that you fully understand the features and
50343+ can evaluate their usefulness for your machine.
50344+
50345+choice
50346+ prompt "Security Level"
50347+ depends on GRKERNSEC
50348+ default GRKERNSEC_CUSTOM
50349+
50350+config GRKERNSEC_LOW
50351+ bool "Low"
50352+ select GRKERNSEC_LINK
50353+ select GRKERNSEC_FIFO
50354+ select GRKERNSEC_RANDNET
50355+ select GRKERNSEC_DMESG
50356+ select GRKERNSEC_CHROOT
50357+ select GRKERNSEC_CHROOT_CHDIR
50358+
50359+ help
50360+ If you choose this option, several of the grsecurity options will
50361+ be enabled that will give you greater protection against a number
50362+ of attacks, while assuring that none of your software will have any
50363+ conflicts with the additional security measures. If you run a lot
50364+ of unusual software, or you are having problems with the higher
50365+ security levels, you should say Y here. With this option, the
50366+ following features are enabled:
50367+
50368+ - Linking restrictions
50369+ - FIFO restrictions
50370+ - Restricted dmesg
50371+ - Enforced chdir("/") on chroot
50372+ - Runtime module disabling
50373+
50374+config GRKERNSEC_MEDIUM
50375+ bool "Medium"
50376+ select PAX
50377+ select PAX_EI_PAX
50378+ select PAX_PT_PAX_FLAGS
50379+ select PAX_HAVE_ACL_FLAGS
50380+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
50381+ select GRKERNSEC_CHROOT
50382+ select GRKERNSEC_CHROOT_SYSCTL
50383+ select GRKERNSEC_LINK
50384+ select GRKERNSEC_FIFO
50385+ select GRKERNSEC_DMESG
50386+ select GRKERNSEC_RANDNET
50387+ select GRKERNSEC_FORKFAIL
50388+ select GRKERNSEC_TIME
50389+ select GRKERNSEC_SIGNAL
50390+ select GRKERNSEC_CHROOT
50391+ select GRKERNSEC_CHROOT_UNIX
50392+ select GRKERNSEC_CHROOT_MOUNT
50393+ select GRKERNSEC_CHROOT_PIVOT
50394+ select GRKERNSEC_CHROOT_DOUBLE
50395+ select GRKERNSEC_CHROOT_CHDIR
50396+ select GRKERNSEC_CHROOT_MKNOD
50397+ select GRKERNSEC_PROC
50398+ select GRKERNSEC_PROC_USERGROUP
50399+ select PAX_RANDUSTACK
50400+ select PAX_ASLR
50401+ select PAX_RANDMMAP
50402+ select PAX_REFCOUNT if (X86 || SPARC64)
50403+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
50404+
50405+ help
50406+ If you say Y here, several features in addition to those included
50407+ in the low additional security level will be enabled. These
50408+ features provide even more security to your system, though in rare
50409+ cases they may be incompatible with very old or poorly written
50410+ software. If you enable this option, make sure that your auth
50411+ service (identd) is running as gid 1001. With this option,
50412+ the following features (in addition to those provided in the
50413+ low additional security level) will be enabled:
50414+
50415+ - Failed fork logging
50416+ - Time change logging
50417+ - Signal logging
50418+ - Deny mounts in chroot
50419+ - Deny double chrooting
50420+ - Deny sysctl writes in chroot
50421+ - Deny mknod in chroot
50422+ - Deny access to abstract AF_UNIX sockets out of chroot
50423+ - Deny pivot_root in chroot
50424+ - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
50425+ - /proc restrictions with special GID set to 10 (usually wheel)
50426+ - Address Space Layout Randomization (ASLR)
50427+ - Prevent exploitation of most refcount overflows
50428+ - Bounds checking of copying between the kernel and userland
50429+
50430+config GRKERNSEC_HIGH
50431+ bool "High"
50432+ select GRKERNSEC_LINK
50433+ select GRKERNSEC_FIFO
50434+ select GRKERNSEC_DMESG
50435+ select GRKERNSEC_FORKFAIL
50436+ select GRKERNSEC_TIME
50437+ select GRKERNSEC_SIGNAL
50438+ select GRKERNSEC_CHROOT
50439+ select GRKERNSEC_CHROOT_SHMAT
50440+ select GRKERNSEC_CHROOT_UNIX
50441+ select GRKERNSEC_CHROOT_MOUNT
50442+ select GRKERNSEC_CHROOT_FCHDIR
50443+ select GRKERNSEC_CHROOT_PIVOT
50444+ select GRKERNSEC_CHROOT_DOUBLE
50445+ select GRKERNSEC_CHROOT_CHDIR
50446+ select GRKERNSEC_CHROOT_MKNOD
50447+ select GRKERNSEC_CHROOT_CAPS
50448+ select GRKERNSEC_CHROOT_SYSCTL
50449+ select GRKERNSEC_CHROOT_FINDTASK
50450+ select GRKERNSEC_SYSFS_RESTRICT
50451+ select GRKERNSEC_PROC
50452+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
50453+ select GRKERNSEC_HIDESYM
50454+ select GRKERNSEC_BRUTE
50455+ select GRKERNSEC_PROC_USERGROUP
50456+ select GRKERNSEC_KMEM
50457+ select GRKERNSEC_RESLOG
50458+ select GRKERNSEC_RANDNET
50459+ select GRKERNSEC_PROC_ADD
50460+ select GRKERNSEC_CHROOT_CHMOD
50461+ select GRKERNSEC_CHROOT_NICE
50462+ select GRKERNSEC_SETXID
50463+ select GRKERNSEC_AUDIT_MOUNT
50464+ select GRKERNSEC_MODHARDEN if (MODULES)
50465+ select GRKERNSEC_HARDEN_PTRACE
50466+ select GRKERNSEC_VM86 if (X86_32)
50467+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
50468+ select PAX
50469+ select PAX_RANDUSTACK
50470+ select PAX_ASLR
50471+ select PAX_RANDMMAP
50472+ select PAX_NOEXEC
50473+ select PAX_MPROTECT
50474+ select PAX_EI_PAX
50475+ select PAX_PT_PAX_FLAGS
50476+ select PAX_HAVE_ACL_FLAGS
50477+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
50478+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
50479+ select PAX_RANDKSTACK if (X86_TSC && X86)
50480+ select PAX_SEGMEXEC if (X86_32)
50481+ select PAX_PAGEEXEC
50482+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
50483+ select PAX_EMUTRAMP if (PARISC)
50484+ select PAX_EMUSIGRT if (PARISC)
50485+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
50486+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
50487+ select PAX_REFCOUNT if (X86 || SPARC64)
50488+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
50489+ help
50490+ If you say Y here, many of the features of grsecurity will be
50491+ enabled, which will protect you against many kinds of attacks
50492+ against your system. The heightened security comes at a cost
50493+ of an increased chance of incompatibilities with rare software
50494+ on your machine. Since this security level enables PaX, you should
50495+ view <http://pax.grsecurity.net> and read about the PaX
50496+ project. While you are there, download chpax and run it on
50497+ binaries that cause problems with PaX. Also remember that
50498+ since the /proc restrictions are enabled, you must run your
50499+ identd as gid 1001. This security level enables the following
50500+ features in addition to those listed in the low and medium
50501+ security levels:
50502+
50503+ - Additional /proc restrictions
50504+ - Chmod restrictions in chroot
50505+ - No signals, ptrace, or viewing of processes outside of chroot
50506+ - Capability restrictions in chroot
50507+ - Deny fchdir out of chroot
50508+ - Priority restrictions in chroot
50509+ - Segmentation-based implementation of PaX
50510+ - Mprotect restrictions
50511+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
50512+ - Kernel stack randomization
50513+ - Mount/unmount/remount logging
50514+ - Kernel symbol hiding
50515+ - Hardening of module auto-loading
50516+ - Ptrace restrictions
50517+ - Restricted vm86 mode
50518+ - Restricted sysfs/debugfs
50519+ - Active kernel exploit response
50520+
50521+config GRKERNSEC_CUSTOM
50522+ bool "Custom"
50523+ help
50524+ If you say Y here, you will be able to configure every grsecurity
50525+ option, which allows you to enable many more features that aren't
50526+ covered in the basic security levels. These additional features
50527+ include TPE, socket restrictions, and the sysctl system for
50528+ grsecurity. It is advised that you read through the help for
50529+ each option to determine its usefulness in your situation.
50530+
50531+endchoice
50532+
50533+menu "Address Space Protection"
50534+depends on GRKERNSEC
50535+
50536+config GRKERNSEC_KMEM
50537+ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
50538+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
50539+ help
50540+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
50541+ be written to or read from to modify or leak the contents of the running
50542+ kernel. /dev/port will also not be allowed to be opened. If you have module
50543+ support disabled, enabling this will close up four ways that are
50544+ currently used to insert malicious code into the running kernel.
50545+ Even with all these features enabled, we still highly recommend that
50546+ you use the RBAC system, as it is still possible for an attacker to
50547+ modify the running kernel through privileged I/O granted by ioperm/iopl.
50548+ If you are not using XFree86, you may be able to stop this additional
50549+ case by enabling the 'Disable privileged I/O' option. Though nothing
50550+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
50551+ but only to video memory, which is the only writing we allow in this
50552+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
50553+ not be allowed to mprotect it with PROT_WRITE later.
50554+ It is highly recommended that you say Y here if you meet all the
50555+ conditions above.
50556+
50557+config GRKERNSEC_VM86
50558+ bool "Restrict VM86 mode"
50559+ depends on X86_32
50560+
50561+ help
50562+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
50563+ make use of a special execution mode on 32bit x86 processors called
50564+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
50565+ video cards and will still work with this option enabled. The purpose
50566+ of the option is to prevent exploitation of emulation errors in
50567+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
50568+ Nearly all users should be able to enable this option.
50569+
50570+config GRKERNSEC_IO
50571+ bool "Disable privileged I/O"
50572+ depends on X86
50573+ select RTC_CLASS
50574+ select RTC_INTF_DEV
50575+ select RTC_DRV_CMOS
50576+
50577+ help
50578+ If you say Y here, all ioperm and iopl calls will return an error.
50579+ Ioperm and iopl can be used to modify the running kernel.
50580+ Unfortunately, some programs need this access to operate properly,
50581+ the most notable of which are XFree86 and hwclock. hwclock can be
50582+ remedied by having RTC support in the kernel, so real-time
50583+ clock support is enabled if this option is enabled, to ensure
50584+ that hwclock operates correctly. XFree86 still will not
50585+ operate correctly with this option enabled, so DO NOT CHOOSE Y
50586+ IF YOU USE XFree86. If you use XFree86 and you still want to
50587+ protect your kernel against modification, use the RBAC system.
50588+
50589+config GRKERNSEC_PROC_MEMMAP
50590+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
50591+ default y if (PAX_NOEXEC || PAX_ASLR)
50592+ depends on PAX_NOEXEC || PAX_ASLR
50593+ help
50594+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
50595+ give no information about the addresses of its mappings if
50596+ PaX features that rely on random addresses are enabled on the task.
50597+ If you use PaX it is greatly recommended that you say Y here as it
50598+ closes up a hole that makes the full ASLR useless for suid
50599+ binaries.
50600+
50601+config GRKERNSEC_BRUTE
50602+ bool "Deter exploit bruteforcing"
50603+ help
50604+ If you say Y here, attempts to bruteforce exploits against forking
50605+ daemons such as apache or sshd, as well as against suid/sgid binaries
50606+ will be deterred. When a child of a forking daemon is killed by PaX
50607+ or crashes due to an illegal instruction or other suspicious signal,
50608+ the parent process will be delayed 30 seconds upon every subsequent
50609+ fork until the administrator is able to assess the situation and
50610+ restart the daemon.
50611+ In the suid/sgid case, the attempt is logged, the user has all their
50612+ processes terminated, and they are prevented from executing any further
50613+ processes for 15 minutes.
50614+ It is recommended that you also enable signal logging in the auditing
50615+ section so that logs are generated when a process triggers a suspicious
50616+ signal.
50617+ If the sysctl option is enabled, a sysctl option with name
50618+ "deter_bruteforce" is created.
50619+
50620+
50621+config GRKERNSEC_MODHARDEN
50622+ bool "Harden module auto-loading"
50623+ depends on MODULES
50624+ help
50625+ If you say Y here, module auto-loading in response to use of some
50626+ feature implemented by an unloaded module will be restricted to
50627+ root users. Enabling this option helps defend against attacks
50628+ by unprivileged users who abuse the auto-loading behavior to
50629+ cause a vulnerable module to load that is then exploited.
50630+
50631+ If this option prevents a legitimate use of auto-loading for a
50632+ non-root user, the administrator can execute modprobe manually
50633+ with the exact name of the module mentioned in the alert log.
50634+ Alternatively, the administrator can add the module to the list
50635+ of modules loaded at boot by modifying init scripts.
50636+
50637+ Modification of init scripts will most likely be needed on
50638+ Ubuntu servers with encrypted home directory support enabled,
50639+ as the first non-root user logging in will cause the ecb(aes),
50640+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
50641+
50642+config GRKERNSEC_HIDESYM
50643+ bool "Hide kernel symbols"
50644+ help
50645+ If you say Y here, getting information on loaded modules, and
50646+ displaying all kernel symbols through a syscall will be restricted
50647+ to users with CAP_SYS_MODULE. For software compatibility reasons,
50648+ /proc/kallsyms will be restricted to the root user. The RBAC
50649+ system can hide that entry even from root.
50650+
50651+ This option also prevents leaking of kernel addresses through
50652+ several /proc entries.
50653+
50654+ Note that this option is only effective provided the following
50655+ conditions are met:
50656+ 1) The kernel using grsecurity is not precompiled by some distribution
50657+ 2) You have also enabled GRKERNSEC_DMESG
50658+ 3) You are using the RBAC system and hiding other files such as your
50659+ kernel image and System.map. Alternatively, enabling this option
50660+ causes the permissions on /boot, /lib/modules, and the kernel
50661+ source directory to change at compile time to prevent
50662+ reading by non-root users.
50663+ If the above conditions are met, this option will aid in providing a
50664+ useful protection against local kernel exploitation of overflows
50665+ and arbitrary read/write vulnerabilities.
50666+
50667+config GRKERNSEC_KERN_LOCKOUT
50668+ bool "Active kernel exploit response"
50669+ depends on X86 || ARM || PPC || SPARC
50670+ help
50671+ If you say Y here, when a PaX alert is triggered due to suspicious
50672+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
50673+ or an OOPs occurs due to bad memory accesses, instead of just
50674+ terminating the offending process (and potentially allowing
50675+ a subsequent exploit from the same user), we will take one of two
50676+ actions:
50677+ If the user was root, we will panic the system
50678+ If the user was non-root, we will log the attempt, terminate
50679+ all processes owned by the user, then prevent them from creating
50680+ any new processes until the system is restarted
50681+ This deters repeated kernel exploitation/bruteforcing attempts
50682+ and is useful for later forensics.
50683+
50684+endmenu
50685+menu "Role Based Access Control Options"
50686+depends on GRKERNSEC
50687+
50688+config GRKERNSEC_RBAC_DEBUG
50689+ bool
50690+
50691+config GRKERNSEC_NO_RBAC
50692+ bool "Disable RBAC system"
50693+ help
50694+ If you say Y here, the /dev/grsec device will be removed from the kernel,
50695+ preventing the RBAC system from being enabled. You should only say Y
50696+ here if you have no intention of using the RBAC system, so as to prevent
50697+ an attacker with root access from misusing the RBAC system to hide files
50698+ and processes when loadable module support and /dev/[k]mem have been
50699+ locked down.
50700+
50701+config GRKERNSEC_ACL_HIDEKERN
50702+ bool "Hide kernel processes"
50703+ help
50704+ If you say Y here, all kernel threads will be hidden to all
50705+ processes but those whose subject has the "view hidden processes"
50706+ flag.
50707+
50708+config GRKERNSEC_ACL_MAXTRIES
50709+ int "Maximum tries before password lockout"
50710+ default 3
50711+ help
50712+ This option enforces the maximum number of times a user can attempt
50713+ to authorize themselves with the grsecurity RBAC system before being
50714+ denied the ability to attempt authorization again for a specified time.
50715+ The lower the number, the harder it will be to brute-force a password.
50716+
50717+config GRKERNSEC_ACL_TIMEOUT
50718+ int "Time to wait after max password tries, in seconds"
50719+ default 30
50720+ help
50721+ This option specifies the time the user must wait after attempting to
50722+ authorize to the RBAC system with the maximum number of invalid
50723+ passwords. The higher the number, the harder it will be to brute-force
50724+ a password.
50725+
50726+endmenu
50727+menu "Filesystem Protections"
50728+depends on GRKERNSEC
50729+
50730+config GRKERNSEC_PROC
50731+ bool "Proc restrictions"
50732+ help
50733+ If you say Y here, the permissions of the /proc filesystem
50734+ will be altered to enhance system security and privacy. You MUST
50735+ choose either a user only restriction or a user and group restriction.
50736+ Depending upon the option you choose, you can either restrict users to
50737+ see only the processes they themselves run, or choose a group that can
50738+ view all processes and files normally restricted to root if you choose
50739+ the "restrict to user only" option. NOTE: If you're running identd as
50740+ a non-root user, you will have to run it as the group you specify here.
50741+
50742+config GRKERNSEC_PROC_USER
50743+ bool "Restrict /proc to user only"
50744+ depends on GRKERNSEC_PROC
50745+ help
50746+ If you say Y here, non-root users will only be able to view their own
50747+ processes, and restricts them from viewing network-related information,
50748+ and viewing kernel symbol and module information.
50749+
50750+config GRKERNSEC_PROC_USERGROUP
50751+ bool "Allow special group"
50752+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
50753+ help
50754+ If you say Y here, you will be able to select a group that will be
50755+ able to view all processes and network-related information. If you've
50756+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
50757+ remain hidden. This option is useful if you want to run identd as
50758+ a non-root user.
50759+
50760+config GRKERNSEC_PROC_GID
50761+ int "GID for special group"
50762+ depends on GRKERNSEC_PROC_USERGROUP
50763+ default 1001
50764+
50765+config GRKERNSEC_PROC_ADD
50766+ bool "Additional restrictions"
50767+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
50768+ help
50769+ If you say Y here, additional restrictions will be placed on
50770+ /proc that keep normal users from viewing device information and
50771+ slabinfo information that could be useful for exploits.
50772+
50773+config GRKERNSEC_LINK
50774+ bool "Linking restrictions"
50775+ help
50776+ If you say Y here, /tmp race exploits will be prevented, since users
50777+ will no longer be able to follow symlinks owned by other users in
50778+ world-writable +t directories (e.g. /tmp), unless the owner of the
50779+ symlink is the owner of the directory. users will also not be
50780+ able to hardlink to files they do not own. If the sysctl option is
50781+ enabled, a sysctl option with name "linking_restrictions" is created.
50782+
50783+config GRKERNSEC_FIFO
50784+ bool "FIFO restrictions"
50785+ help
50786+ If you say Y here, users will not be able to write to FIFOs they don't
50787+ own in world-writable +t directories (e.g. /tmp), unless the owner of
50788+ the FIFO is the same owner of the directory it's held in. If the sysctl
50789+ option is enabled, a sysctl option with name "fifo_restrictions" is
50790+ created.
50791+
50792+config GRKERNSEC_SYSFS_RESTRICT
50793+ bool "Sysfs/debugfs restriction"
50794+ depends on SYSFS
50795+ help
50796+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
50797+ any filesystem normally mounted under it (e.g. debugfs) will only
50798+ be accessible by root. These filesystems generally provide access
50799+ to hardware and debug information that isn't appropriate for unprivileged
50800+ users of the system. Sysfs and debugfs have also become a large source
50801+ of new vulnerabilities, ranging from infoleaks to local compromise.
50802+ There has been very little oversight with an eye toward security involved
50803+ in adding new exporters of information to these filesystems, so their
50804+ use is discouraged.
50805+ This option is equivalent to a chmod 0700 of the mount paths.
50806+
50807+config GRKERNSEC_ROFS
50808+ bool "Runtime read-only mount protection"
50809+ help
50810+ If you say Y here, a sysctl option with name "romount_protect" will
50811+ be created. By setting this option to 1 at runtime, filesystems
50812+ will be protected in the following ways:
50813+ * No new writable mounts will be allowed
50814+ * Existing read-only mounts won't be able to be remounted read/write
50815+ * Write operations will be denied on all block devices
50816+ This option acts independently of grsec_lock: once it is set to 1,
50817+ it cannot be turned off. Therefore, please be mindful of the resulting
50818+ behavior if this option is enabled in an init script on a read-only
50819+ filesystem. This feature is mainly intended for secure embedded systems.
50820+
50821+config GRKERNSEC_CHROOT
50822+ bool "Chroot jail restrictions"
50823+ help
50824+ If you say Y here, you will be able to choose several options that will
50825+ make breaking out of a chrooted jail much more difficult. If you
50826+ encounter no software incompatibilities with the following options, it
50827+ is recommended that you enable each one.
50828+
50829+config GRKERNSEC_CHROOT_MOUNT
50830+ bool "Deny mounts"
50831+ depends on GRKERNSEC_CHROOT
50832+ help
50833+ If you say Y here, processes inside a chroot will not be able to
50834+ mount or remount filesystems. If the sysctl option is enabled, a
50835+ sysctl option with name "chroot_deny_mount" is created.
50836+
50837+config GRKERNSEC_CHROOT_DOUBLE
50838+ bool "Deny double-chroots"
50839+ depends on GRKERNSEC_CHROOT
50840+ help
50841+ If you say Y here, processes inside a chroot will not be able to chroot
50842+ again outside the chroot. This is a widely used method of breaking
50843+ out of a chroot jail and should not be allowed. If the sysctl
50844+ option is enabled, a sysctl option with name
50845+ "chroot_deny_chroot" is created.
50846+
50847+config GRKERNSEC_CHROOT_PIVOT
50848+ bool "Deny pivot_root in chroot"
50849+ depends on GRKERNSEC_CHROOT
50850+ help
50851+ If you say Y here, processes inside a chroot will not be able to use
50852+ a function called pivot_root() that was introduced in Linux 2.3.41. It
50853+ works similar to chroot in that it changes the root filesystem. This
50854+ function could be misused in a chrooted process to attempt to break out
50855+ of the chroot, and therefore should not be allowed. If the sysctl
50856+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
50857+ created.
50858+
50859+config GRKERNSEC_CHROOT_CHDIR
50860+ bool "Enforce chdir(\"/\") on all chroots"
50861+ depends on GRKERNSEC_CHROOT
50862+ help
50863+ If you say Y here, the current working directory of all newly-chrooted
50864+ applications will be set to the the root directory of the chroot.
50865+ The man page on chroot(2) states:
50866+ Note that this call does not change the current working
50867+ directory, so that `.' can be outside the tree rooted at
50868+ `/'. In particular, the super-user can escape from a
50869+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
50870+
50871+ It is recommended that you say Y here, since it's not known to break
50872+ any software. If the sysctl option is enabled, a sysctl option with
50873+ name "chroot_enforce_chdir" is created.
50874+
50875+config GRKERNSEC_CHROOT_CHMOD
50876+ bool "Deny (f)chmod +s"
50877+ depends on GRKERNSEC_CHROOT
50878+ help
50879+ If you say Y here, processes inside a chroot will not be able to chmod
50880+ or fchmod files to make them have suid or sgid bits. This protects
50881+ against another published method of breaking a chroot. If the sysctl
50882+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
50883+ created.
50884+
50885+config GRKERNSEC_CHROOT_FCHDIR
50886+ bool "Deny fchdir out of chroot"
50887+ depends on GRKERNSEC_CHROOT
50888+ help
50889+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
50890+ to a file descriptor of the chrooting process that points to a directory
50891+ outside the filesystem will be stopped. If the sysctl option
50892+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
50893+
50894+config GRKERNSEC_CHROOT_MKNOD
50895+ bool "Deny mknod"
50896+ depends on GRKERNSEC_CHROOT
50897+ help
50898+ If you say Y here, processes inside a chroot will not be allowed to
50899+ mknod. The problem with using mknod inside a chroot is that it
50900+ would allow an attacker to create a device entry that is the same
50901+ as one on the physical root of your system, which could range from
50902+ anything from the console device to a device for your harddrive (which
50903+ they could then use to wipe the drive or steal data). It is recommended
50904+ that you say Y here, unless you run into software incompatibilities.
50905+ If the sysctl option is enabled, a sysctl option with name
50906+ "chroot_deny_mknod" is created.
50907+
50908+config GRKERNSEC_CHROOT_SHMAT
50909+ bool "Deny shmat() out of chroot"
50910+ depends on GRKERNSEC_CHROOT
50911+ help
50912+ If you say Y here, processes inside a chroot will not be able to attach
50913+ to shared memory segments that were created outside of the chroot jail.
50914+ It is recommended that you say Y here. If the sysctl option is enabled,
50915+ a sysctl option with name "chroot_deny_shmat" is created.
50916+
50917+config GRKERNSEC_CHROOT_UNIX
50918+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
50919+ depends on GRKERNSEC_CHROOT
50920+ help
50921+ If you say Y here, processes inside a chroot will not be able to
50922+ connect to abstract (meaning not belonging to a filesystem) Unix
50923+ domain sockets that were bound outside of a chroot. It is recommended
50924+ that you say Y here. If the sysctl option is enabled, a sysctl option
50925+ with name "chroot_deny_unix" is created.
50926+
50927+config GRKERNSEC_CHROOT_FINDTASK
50928+ bool "Protect outside processes"
50929+ depends on GRKERNSEC_CHROOT
50930+ help
50931+ If you say Y here, processes inside a chroot will not be able to
50932+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
50933+ getsid, or view any process outside of the chroot. If the sysctl
50934+ option is enabled, a sysctl option with name "chroot_findtask" is
50935+ created.
50936+
50937+config GRKERNSEC_CHROOT_NICE
50938+ bool "Restrict priority changes"
50939+ depends on GRKERNSEC_CHROOT
50940+ help
50941+ If you say Y here, processes inside a chroot will not be able to raise
50942+ the priority of processes in the chroot, or alter the priority of
50943+ processes outside the chroot. This provides more security than simply
50944+ removing CAP_SYS_NICE from the process' capability set. If the
50945+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
50946+ is created.
50947+
50948+config GRKERNSEC_CHROOT_SYSCTL
50949+ bool "Deny sysctl writes"
50950+ depends on GRKERNSEC_CHROOT
50951+ help
50952+ If you say Y here, an attacker in a chroot will not be able to
50953+ write to sysctl entries, either by sysctl(2) or through a /proc
50954+ interface. It is strongly recommended that you say Y here. If the
50955+ sysctl option is enabled, a sysctl option with name
50956+ "chroot_deny_sysctl" is created.
50957+
50958+config GRKERNSEC_CHROOT_CAPS
50959+ bool "Capability restrictions"
50960+ depends on GRKERNSEC_CHROOT
50961+ help
50962+ If you say Y here, the capabilities on all processes within a
50963+ chroot jail will be lowered to stop module insertion, raw i/o,
50964+ system and net admin tasks, rebooting the system, modifying immutable
50965+ files, modifying IPC owned by another, and changing the system time.
50966+ This is left an option because it can break some apps. Disable this
50967+ if your chrooted apps are having problems performing those kinds of
50968+ tasks. If the sysctl option is enabled, a sysctl option with
50969+ name "chroot_caps" is created.
50970+
50971+endmenu
50972+menu "Kernel Auditing"
50973+depends on GRKERNSEC
50974+
50975+config GRKERNSEC_AUDIT_GROUP
50976+ bool "Single group for auditing"
50977+ help
50978+ If you say Y here, the exec, chdir, and (un)mount logging features
50979+ will only operate on a group you specify. This option is recommended
50980+ if you only want to watch certain users instead of having a large
50981+ amount of logs from the entire system. If the sysctl option is enabled,
50982+ a sysctl option with name "audit_group" is created.
50983+
50984+config GRKERNSEC_AUDIT_GID
50985+ int "GID for auditing"
50986+ depends on GRKERNSEC_AUDIT_GROUP
50987+ default 1007
50988+
50989+config GRKERNSEC_EXECLOG
50990+ bool "Exec logging"
50991+ help
50992+ If you say Y here, all execve() calls will be logged (since the
50993+ other exec*() calls are frontends to execve(), all execution
50994+ will be logged). Useful for shell-servers that like to keep track
50995+ of their users. If the sysctl option is enabled, a sysctl option with
50996+ name "exec_logging" is created.
50997+ WARNING: This option when enabled will produce a LOT of logs, especially
50998+ on an active system.
50999+
51000+config GRKERNSEC_RESLOG
51001+ bool "Resource logging"
51002+ help
51003+ If you say Y here, all attempts to overstep resource limits will
51004+ be logged with the resource name, the requested size, and the current
51005+ limit. It is highly recommended that you say Y here. If the sysctl
51006+ option is enabled, a sysctl option with name "resource_logging" is
51007+ created. If the RBAC system is enabled, the sysctl value is ignored.
51008+
51009+config GRKERNSEC_CHROOT_EXECLOG
51010+ bool "Log execs within chroot"
51011+ help
51012+ If you say Y here, all executions inside a chroot jail will be logged
51013+ to syslog. This can cause a large amount of logs if certain
51014+ applications (eg. djb's daemontools) are installed on the system, and
51015+ is therefore left as an option. If the sysctl option is enabled, a
51016+ sysctl option with name "chroot_execlog" is created.
51017+
51018+config GRKERNSEC_AUDIT_PTRACE
51019+ bool "Ptrace logging"
51020+ help
51021+ If you say Y here, all attempts to attach to a process via ptrace
51022+ will be logged. If the sysctl option is enabled, a sysctl option
51023+ with name "audit_ptrace" is created.
51024+
51025+config GRKERNSEC_AUDIT_CHDIR
51026+ bool "Chdir logging"
51027+ help
51028+ If you say Y here, all chdir() calls will be logged. If the sysctl
51029+ option is enabled, a sysctl option with name "audit_chdir" is created.
51030+
51031+config GRKERNSEC_AUDIT_MOUNT
51032+ bool "(Un)Mount logging"
51033+ help
51034+ If you say Y here, all mounts and unmounts will be logged. If the
51035+ sysctl option is enabled, a sysctl option with name "audit_mount" is
51036+ created.
51037+
51038+config GRKERNSEC_SIGNAL
51039+ bool "Signal logging"
51040+ help
51041+ If you say Y here, certain important signals will be logged, such as
51042+ SIGSEGV, which will as a result inform you of when a error in a program
51043+ occurred, which in some cases could mean a possible exploit attempt.
51044+ If the sysctl option is enabled, a sysctl option with name
51045+ "signal_logging" is created.
51046+
51047+config GRKERNSEC_FORKFAIL
51048+ bool "Fork failure logging"
51049+ help
51050+ If you say Y here, all failed fork() attempts will be logged.
51051+ This could suggest a fork bomb, or someone attempting to overstep
51052+ their process limit. If the sysctl option is enabled, a sysctl option
51053+ with name "forkfail_logging" is created.
51054+
51055+config GRKERNSEC_TIME
51056+ bool "Time change logging"
51057+ help
51058+ If you say Y here, any changes of the system clock will be logged.
51059+ If the sysctl option is enabled, a sysctl option with name
51060+ "timechange_logging" is created.
51061+
51062+config GRKERNSEC_PROC_IPADDR
51063+ bool "/proc/<pid>/ipaddr support"
51064+ help
51065+ If you say Y here, a new entry will be added to each /proc/<pid>
51066+ directory that contains the IP address of the person using the task.
51067+ The IP is carried across local TCP and AF_UNIX stream sockets.
51068+ This information can be useful for IDS/IPSes to perform remote response
51069+ to a local attack. The entry is readable by only the owner of the
51070+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
51071+ the RBAC system), and thus does not create privacy concerns.
51072+
51073+config GRKERNSEC_RWXMAP_LOG
51074+ bool 'Denied RWX mmap/mprotect logging'
51075+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
51076+ help
51077+ If you say Y here, calls to mmap() and mprotect() with explicit
51078+ usage of PROT_WRITE and PROT_EXEC together will be logged when
51079+ denied by the PAX_MPROTECT feature. If the sysctl option is
51080+ enabled, a sysctl option with name "rwxmap_logging" is created.
51081+
51082+config GRKERNSEC_AUDIT_TEXTREL
51083+ bool 'ELF text relocations logging (READ HELP)'
51084+ depends on PAX_MPROTECT
51085+ help
51086+ If you say Y here, text relocations will be logged with the filename
51087+ of the offending library or binary. The purpose of the feature is
51088+ to help Linux distribution developers get rid of libraries and
51089+ binaries that need text relocations which hinder the future progress
51090+ of PaX. Only Linux distribution developers should say Y here, and
51091+ never on a production machine, as this option creates an information
51092+ leak that could aid an attacker in defeating the randomization of
51093+ a single memory region. If the sysctl option is enabled, a sysctl
51094+ option with name "audit_textrel" is created.
51095+
51096+endmenu
51097+
51098+menu "Executable Protections"
51099+depends on GRKERNSEC
51100+
51101+config GRKERNSEC_DMESG
51102+ bool "Dmesg(8) restriction"
51103+ help
51104+ If you say Y here, non-root users will not be able to use dmesg(8)
51105+ to view up to the last 4kb of messages in the kernel's log buffer.
51106+ The kernel's log buffer often contains kernel addresses and other
51107+ identifying information useful to an attacker in fingerprinting a
51108+ system for a targeted exploit.
51109+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
51110+ created.
51111+
51112+config GRKERNSEC_HARDEN_PTRACE
51113+ bool "Deter ptrace-based process snooping"
51114+ help
51115+ If you say Y here, TTY sniffers and other malicious monitoring
51116+ programs implemented through ptrace will be defeated. If you
51117+ have been using the RBAC system, this option has already been
51118+ enabled for several years for all users, with the ability to make
51119+ fine-grained exceptions.
51120+
51121+ This option only affects the ability of non-root users to ptrace
51122+ processes that are not a descendent of the ptracing process.
51123+ This means that strace ./binary and gdb ./binary will still work,
51124+ but attaching to arbitrary processes will not. If the sysctl
51125+ option is enabled, a sysctl option with name "harden_ptrace" is
51126+ created.
51127+
51128+config GRKERNSEC_SETXID
51129+ bool "Enforce consistent multithreaded privileges"
51130+ help
51131+ If you say Y here, a change from a root uid to a non-root uid
51132+ in a multithreaded application will cause the resulting uids,
51133+ gids, supplementary groups, and capabilities in that thread
51134+ to be propagated to the other threads of the process. In most
51135+ cases this is unnecessary, as glibc will emulate this behavior
51136+ on behalf of the application. Other libcs do not act in the
51137+ same way, allowing the other threads of the process to continue
51138+ running with root privileges. If the sysctl option is enabled,
51139+ a sysctl option with name "consistent_setxid" is created.
51140+
51141+config GRKERNSEC_TPE
51142+ bool "Trusted Path Execution (TPE)"
51143+ help
51144+ If you say Y here, you will be able to choose a gid to add to the
51145+ supplementary groups of users you want to mark as "untrusted."
51146+ These users will not be able to execute any files that are not in
51147+ root-owned directories writable only by root. If the sysctl option
51148+ is enabled, a sysctl option with name "tpe" is created.
51149+
51150+config GRKERNSEC_TPE_ALL
51151+ bool "Partially restrict all non-root users"
51152+ depends on GRKERNSEC_TPE
51153+ help
51154+ If you say Y here, all non-root users will be covered under
51155+ a weaker TPE restriction. This is separate from, and in addition to,
51156+ the main TPE options that you have selected elsewhere. Thus, if a
51157+ "trusted" GID is chosen, this restriction applies to even that GID.
51158+ Under this restriction, all non-root users will only be allowed to
51159+ execute files in directories they own that are not group or
51160+ world-writable, or in directories owned by root and writable only by
51161+ root. If the sysctl option is enabled, a sysctl option with name
51162+ "tpe_restrict_all" is created.
51163+
51164+config GRKERNSEC_TPE_INVERT
51165+ bool "Invert GID option"
51166+ depends on GRKERNSEC_TPE
51167+ help
51168+ If you say Y here, the group you specify in the TPE configuration will
51169+ decide what group TPE restrictions will be *disabled* for. This
51170+ option is useful if you want TPE restrictions to be applied to most
51171+ users on the system. If the sysctl option is enabled, a sysctl option
51172+ with name "tpe_invert" is created. Unlike other sysctl options, this
51173+ entry will default to on for backward-compatibility.
51174+
51175+config GRKERNSEC_TPE_GID
51176+ int "GID for untrusted users"
51177+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
51178+ default 1005
51179+ help
51180+ Setting this GID determines what group TPE restrictions will be
51181+ *enabled* for. If the sysctl option is enabled, a sysctl option
51182+ with name "tpe_gid" is created.
51183+
51184+config GRKERNSEC_TPE_GID
51185+ int "GID for trusted users"
51186+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
51187+ default 1005
51188+ help
51189+ Setting this GID determines what group TPE restrictions will be
51190+ *disabled* for. If the sysctl option is enabled, a sysctl option
51191+ with name "tpe_gid" is created.
51192+
51193+endmenu
51194+menu "Network Protections"
51195+depends on GRKERNSEC
51196+
51197+config GRKERNSEC_RANDNET
51198+ bool "Larger entropy pools"
51199+ help
51200+ If you say Y here, the entropy pools used for many features of Linux
51201+ and grsecurity will be doubled in size. Since several grsecurity
51202+ features use additional randomness, it is recommended that you say Y
51203+ here. Saying Y here has a similar effect as modifying
51204+ /proc/sys/kernel/random/poolsize.
51205+
51206+config GRKERNSEC_BLACKHOLE
51207+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
51208+ depends on NET
51209+ help
51210+ If you say Y here, neither TCP resets nor ICMP
51211+ destination-unreachable packets will be sent in response to packets
51212+ sent to ports for which no associated listening process exists.
51213+ This feature supports both IPV4 and IPV6 and exempts the
51214+ loopback interface from blackholing. Enabling this feature
51215+ makes a host more resilient to DoS attacks and reduces network
51216+ visibility against scanners.
51217+
51218+ The blackhole feature as-implemented is equivalent to the FreeBSD
51219+ blackhole feature, as it prevents RST responses to all packets, not
51220+ just SYNs. Under most application behavior this causes no
51221+ problems, but applications (like haproxy) may not close certain
51222+ connections in a way that cleanly terminates them on the remote
51223+ end, leaving the remote host in LAST_ACK state. Because of this
51224+ side-effect and to prevent intentional LAST_ACK DoSes, this
51225+ feature also adds automatic mitigation against such attacks.
51226+ The mitigation drastically reduces the amount of time a socket
51227+ can spend in LAST_ACK state. If you're using haproxy and not
51228+ all servers it connects to have this option enabled, consider
51229+ disabling this feature on the haproxy host.
51230+
51231+ If the sysctl option is enabled, two sysctl options with names
51232+ "ip_blackhole" and "lastack_retries" will be created.
51233+ While "ip_blackhole" takes the standard zero/non-zero on/off
51234+ toggle, "lastack_retries" uses the same kinds of values as
51235+ "tcp_retries1" and "tcp_retries2". The default value of 4
51236+ prevents a socket from lasting more than 45 seconds in LAST_ACK
51237+ state.
51238+
51239+config GRKERNSEC_SOCKET
51240+ bool "Socket restrictions"
51241+ depends on NET
51242+ help
51243+ If you say Y here, you will be able to choose from several options.
51244+ If you assign a GID on your system and add it to the supplementary
51245+ groups of users you want to restrict socket access to, this patch
51246+ will perform up to three things, based on the option(s) you choose.
51247+
51248+config GRKERNSEC_SOCKET_ALL
51249+ bool "Deny any sockets to group"
51250+ depends on GRKERNSEC_SOCKET
51251+ help
51252+ If you say Y here, you will be able to choose a GID of whose users will
51253+ be unable to connect to other hosts from your machine or run server
51254+ applications from your machine. If the sysctl option is enabled, a
51255+ sysctl option with name "socket_all" is created.
51256+
51257+config GRKERNSEC_SOCKET_ALL_GID
51258+ int "GID to deny all sockets for"
51259+ depends on GRKERNSEC_SOCKET_ALL
51260+ default 1004
51261+ help
51262+ Here you can choose the GID to disable socket access for. Remember to
51263+ add the users you want socket access disabled for to the GID
51264+ specified here. If the sysctl option is enabled, a sysctl option
51265+ with name "socket_all_gid" is created.
51266+
51267+config GRKERNSEC_SOCKET_CLIENT
51268+ bool "Deny client sockets to group"
51269+ depends on GRKERNSEC_SOCKET
51270+ help
51271+ If you say Y here, you will be able to choose a GID of whose users will
51272+ be unable to connect to other hosts from your machine, but will be
51273+ able to run servers. If this option is enabled, all users in the group
51274+ you specify will have to use passive mode when initiating ftp transfers
51275+ from the shell on your machine. If the sysctl option is enabled, a
51276+ sysctl option with name "socket_client" is created.
51277+
51278+config GRKERNSEC_SOCKET_CLIENT_GID
51279+ int "GID to deny client sockets for"
51280+ depends on GRKERNSEC_SOCKET_CLIENT
51281+ default 1003
51282+ help
51283+ Here you can choose the GID to disable client socket access for.
51284+ Remember to add the users you want client socket access disabled for to
51285+ the GID specified here. If the sysctl option is enabled, a sysctl
51286+ option with name "socket_client_gid" is created.
51287+
51288+config GRKERNSEC_SOCKET_SERVER
51289+ bool "Deny server sockets to group"
51290+ depends on GRKERNSEC_SOCKET
51291+ help
51292+ If you say Y here, you will be able to choose a GID of whose users will
51293+ be unable to run server applications from your machine. If the sysctl
51294+ option is enabled, a sysctl option with name "socket_server" is created.
51295+
51296+config GRKERNSEC_SOCKET_SERVER_GID
51297+ int "GID to deny server sockets for"
51298+ depends on GRKERNSEC_SOCKET_SERVER
51299+ default 1002
51300+ help
51301+ Here you can choose the GID to disable server socket access for.
51302+ Remember to add the users you want server socket access disabled for to
51303+ the GID specified here. If the sysctl option is enabled, a sysctl
51304+ option with name "socket_server_gid" is created.
51305+
51306+endmenu
51307+menu "Sysctl support"
51308+depends on GRKERNSEC && SYSCTL
51309+
51310+config GRKERNSEC_SYSCTL
51311+ bool "Sysctl support"
51312+ help
51313+ If you say Y here, you will be able to change the options that
51314+ grsecurity runs with at bootup, without having to recompile your
51315+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
51316+ to enable (1) or disable (0) various features. All the sysctl entries
51317+ are mutable until the "grsec_lock" entry is set to a non-zero value.
51318+ All features enabled in the kernel configuration are disabled at boot
51319+ if you do not say Y to the "Turn on features by default" option.
51320+ All options should be set at startup, and the grsec_lock entry should
51321+ be set to a non-zero value after all the options are set.
51322+ *THIS IS EXTREMELY IMPORTANT*
51323+
51324+config GRKERNSEC_SYSCTL_DISTRO
51325+ bool "Extra sysctl support for distro makers (READ HELP)"
51326+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
51327+ help
51328+ If you say Y here, additional sysctl options will be created
51329+ for features that affect processes running as root. Therefore,
51330+ it is critical when using this option that the grsec_lock entry be
51331+ enabled after boot. Only distros with prebuilt kernel packages
51332+ with this option enabled that can ensure grsec_lock is enabled
51333+ after boot should use this option.
51334+ *Failure to set grsec_lock after boot makes all grsec features
51335+ this option covers useless*
51336+
51337+ Currently this option creates the following sysctl entries:
51338+ "Disable Privileged I/O": "disable_priv_io"
51339+
51340+config GRKERNSEC_SYSCTL_ON
51341+ bool "Turn on features by default"
51342+ depends on GRKERNSEC_SYSCTL
51343+ help
51344+ If you say Y here, instead of having all features enabled in the
51345+ kernel configuration disabled at boot time, the features will be
51346+ enabled at boot time. It is recommended you say Y here unless
51347+ there is some reason you would want all sysctl-tunable features to
51348+ be disabled by default. As mentioned elsewhere, it is important
51349+ to enable the grsec_lock entry once you have finished modifying
51350+ the sysctl entries.
51351+
51352+endmenu
51353+menu "Logging Options"
51354+depends on GRKERNSEC
51355+
51356+config GRKERNSEC_FLOODTIME
51357+ int "Seconds in between log messages (minimum)"
51358+ default 10
51359+ help
51360+ This option allows you to enforce the number of seconds between
51361+ grsecurity log messages. The default should be suitable for most
51362+ people, however, if you choose to change it, choose a value small enough
51363+ to allow informative logs to be produced, but large enough to
51364+ prevent flooding.
51365+
51366+config GRKERNSEC_FLOODBURST
51367+ int "Number of messages in a burst (maximum)"
51368+ default 6
51369+ help
51370+ This option allows you to choose the maximum number of messages allowed
51371+ within the flood time interval you chose in a separate option. The
51372+ default should be suitable for most people, however if you find that
51373+ many of your logs are being interpreted as flooding, you may want to
51374+ raise this value.
51375+
51376+endmenu
51377+
51378+endmenu
51379diff --git a/grsecurity/Makefile b/grsecurity/Makefile
51380new file mode 100644
51381index 0000000..be9ae3a
51382--- /dev/null
51383+++ b/grsecurity/Makefile
51384@@ -0,0 +1,36 @@
51385+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
51386+# during 2001-2009 it has been completely redesigned by Brad Spengler
51387+# into an RBAC system
51388+#
51389+# All code in this directory and various hooks inserted throughout the kernel
51390+# are copyright Brad Spengler - Open Source Security, Inc., and released
51391+# under the GPL v2 or higher
51392+
51393+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
51394+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
51395+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
51396+
51397+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
51398+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
51399+ gracl_learn.o grsec_log.o
51400+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
51401+
51402+ifdef CONFIG_NET
51403+obj-y += grsec_sock.o
51404+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
51405+endif
51406+
51407+ifndef CONFIG_GRKERNSEC
51408+obj-y += grsec_disabled.o
51409+endif
51410+
51411+ifdef CONFIG_GRKERNSEC_HIDESYM
51412+extra-y := grsec_hidesym.o
51413+$(obj)/grsec_hidesym.o:
51414+ @-chmod -f 500 /boot
51415+ @-chmod -f 500 /lib/modules
51416+ @-chmod -f 500 /lib64/modules
51417+ @-chmod -f 500 /lib32/modules
51418+ @-chmod -f 700 .
51419+ @echo ' grsec: protected kernel image paths'
51420+endif
51421diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
51422new file mode 100644
51423index 0000000..09258e0
51424--- /dev/null
51425+++ b/grsecurity/gracl.c
51426@@ -0,0 +1,4156 @@
51427+#include <linux/kernel.h>
51428+#include <linux/module.h>
51429+#include <linux/sched.h>
51430+#include <linux/mm.h>
51431+#include <linux/file.h>
51432+#include <linux/fs.h>
51433+#include <linux/namei.h>
51434+#include <linux/mount.h>
51435+#include <linux/tty.h>
51436+#include <linux/proc_fs.h>
51437+#include <linux/lglock.h>
51438+#include <linux/slab.h>
51439+#include <linux/vmalloc.h>
51440+#include <linux/types.h>
51441+#include <linux/sysctl.h>
51442+#include <linux/netdevice.h>
51443+#include <linux/ptrace.h>
51444+#include <linux/gracl.h>
51445+#include <linux/gralloc.h>
51446+#include <linux/grsecurity.h>
51447+#include <linux/grinternal.h>
51448+#include <linux/pid_namespace.h>
51449+#include <linux/fdtable.h>
51450+#include <linux/percpu.h>
51451+
51452+#include <asm/uaccess.h>
51453+#include <asm/errno.h>
51454+#include <asm/mman.h>
51455+
51456+static struct acl_role_db acl_role_set;
51457+static struct name_db name_set;
51458+static struct inodev_db inodev_set;
51459+
51460+/* for keeping track of userspace pointers used for subjects, so we
51461+ can share references in the kernel as well
51462+*/
51463+
51464+static struct path real_root;
51465+
51466+static struct acl_subj_map_db subj_map_set;
51467+
51468+static struct acl_role_label *default_role;
51469+
51470+static struct acl_role_label *role_list;
51471+
51472+static u16 acl_sp_role_value;
51473+
51474+extern char *gr_shared_page[4];
51475+static DEFINE_MUTEX(gr_dev_mutex);
51476+DEFINE_RWLOCK(gr_inode_lock);
51477+
51478+struct gr_arg *gr_usermode;
51479+
51480+static unsigned int gr_status __read_only = GR_STATUS_INIT;
51481+
51482+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51483+extern void gr_clear_learn_entries(void);
51484+
51485+#ifdef CONFIG_GRKERNSEC_RESLOG
51486+extern void gr_log_resource(const struct task_struct *task,
51487+ const int res, const unsigned long wanted, const int gt);
51488+#endif
51489+
51490+unsigned char *gr_system_salt;
51491+unsigned char *gr_system_sum;
51492+
51493+static struct sprole_pw **acl_special_roles = NULL;
51494+static __u16 num_sprole_pws = 0;
51495+
51496+static struct acl_role_label *kernel_role = NULL;
51497+
51498+static unsigned int gr_auth_attempts = 0;
51499+static unsigned long gr_auth_expires = 0UL;
51500+
51501+#ifdef CONFIG_NET
51502+extern struct vfsmount *sock_mnt;
51503+#endif
51504+
51505+extern struct vfsmount *pipe_mnt;
51506+extern struct vfsmount *shm_mnt;
51507+#ifdef CONFIG_HUGETLBFS
51508+extern struct vfsmount *hugetlbfs_vfsmount;
51509+#endif
51510+
51511+static struct acl_object_label *fakefs_obj_rw;
51512+static struct acl_object_label *fakefs_obj_rwx;
51513+
51514+extern int gr_init_uidset(void);
51515+extern void gr_free_uidset(void);
51516+extern void gr_remove_uid(uid_t uid);
51517+extern int gr_find_uid(uid_t uid);
51518+
51519+DECLARE_BRLOCK(vfsmount_lock);
51520+
51521+__inline__ int
51522+gr_acl_is_enabled(void)
51523+{
51524+ return (gr_status & GR_READY);
51525+}
51526+
51527+#ifdef CONFIG_BTRFS_FS
51528+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51529+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51530+#endif
51531+
51532+static inline dev_t __get_dev(const struct dentry *dentry)
51533+{
51534+#ifdef CONFIG_BTRFS_FS
51535+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51536+ return get_btrfs_dev_from_inode(dentry->d_inode);
51537+ else
51538+#endif
51539+ return dentry->d_inode->i_sb->s_dev;
51540+}
51541+
51542+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51543+{
51544+ return __get_dev(dentry);
51545+}
51546+
51547+static char gr_task_roletype_to_char(struct task_struct *task)
51548+{
51549+ switch (task->role->roletype &
51550+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51551+ GR_ROLE_SPECIAL)) {
51552+ case GR_ROLE_DEFAULT:
51553+ return 'D';
51554+ case GR_ROLE_USER:
51555+ return 'U';
51556+ case GR_ROLE_GROUP:
51557+ return 'G';
51558+ case GR_ROLE_SPECIAL:
51559+ return 'S';
51560+ }
51561+
51562+ return 'X';
51563+}
51564+
51565+char gr_roletype_to_char(void)
51566+{
51567+ return gr_task_roletype_to_char(current);
51568+}
51569+
51570+__inline__ int
51571+gr_acl_tpe_check(void)
51572+{
51573+ if (unlikely(!(gr_status & GR_READY)))
51574+ return 0;
51575+ if (current->role->roletype & GR_ROLE_TPE)
51576+ return 1;
51577+ else
51578+ return 0;
51579+}
51580+
51581+int
51582+gr_handle_rawio(const struct inode *inode)
51583+{
51584+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51585+ if (inode && S_ISBLK(inode->i_mode) &&
51586+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51587+ !capable(CAP_SYS_RAWIO))
51588+ return 1;
51589+#endif
51590+ return 0;
51591+}
51592+
51593+static int
51594+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51595+{
51596+ if (likely(lena != lenb))
51597+ return 0;
51598+
51599+ return !memcmp(a, b, lena);
51600+}
51601+
51602+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51603+{
51604+ *buflen -= namelen;
51605+ if (*buflen < 0)
51606+ return -ENAMETOOLONG;
51607+ *buffer -= namelen;
51608+ memcpy(*buffer, str, namelen);
51609+ return 0;
51610+}
51611+
51612+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51613+{
51614+ return prepend(buffer, buflen, name->name, name->len);
51615+}
51616+
51617+static int prepend_path(const struct path *path, struct path *root,
51618+ char **buffer, int *buflen)
51619+{
51620+ struct dentry *dentry = path->dentry;
51621+ struct vfsmount *vfsmnt = path->mnt;
51622+ bool slash = false;
51623+ int error = 0;
51624+
51625+ while (dentry != root->dentry || vfsmnt != root->mnt) {
51626+ struct dentry * parent;
51627+
51628+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51629+ /* Global root? */
51630+ if (vfsmnt->mnt_parent == vfsmnt) {
51631+ goto out;
51632+ }
51633+ dentry = vfsmnt->mnt_mountpoint;
51634+ vfsmnt = vfsmnt->mnt_parent;
51635+ continue;
51636+ }
51637+ parent = dentry->d_parent;
51638+ prefetch(parent);
51639+ spin_lock(&dentry->d_lock);
51640+ error = prepend_name(buffer, buflen, &dentry->d_name);
51641+ spin_unlock(&dentry->d_lock);
51642+ if (!error)
51643+ error = prepend(buffer, buflen, "/", 1);
51644+ if (error)
51645+ break;
51646+
51647+ slash = true;
51648+ dentry = parent;
51649+ }
51650+
51651+out:
51652+ if (!error && !slash)
51653+ error = prepend(buffer, buflen, "/", 1);
51654+
51655+ return error;
51656+}
51657+
51658+/* this must be called with vfsmount_lock and rename_lock held */
51659+
51660+static char *__our_d_path(const struct path *path, struct path *root,
51661+ char *buf, int buflen)
51662+{
51663+ char *res = buf + buflen;
51664+ int error;
51665+
51666+ prepend(&res, &buflen, "\0", 1);
51667+ error = prepend_path(path, root, &res, &buflen);
51668+ if (error)
51669+ return ERR_PTR(error);
51670+
51671+ return res;
51672+}
51673+
51674+static char *
51675+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51676+{
51677+ char *retval;
51678+
51679+ retval = __our_d_path(path, root, buf, buflen);
51680+ if (unlikely(IS_ERR(retval)))
51681+ retval = strcpy(buf, "<path too long>");
51682+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51683+ retval[1] = '\0';
51684+
51685+ return retval;
51686+}
51687+
51688+static char *
51689+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51690+ char *buf, int buflen)
51691+{
51692+ struct path path;
51693+ char *res;
51694+
51695+ path.dentry = (struct dentry *)dentry;
51696+ path.mnt = (struct vfsmount *)vfsmnt;
51697+
51698+ /* we can use real_root.dentry, real_root.mnt, because this is only called
51699+ by the RBAC system */
51700+ res = gen_full_path(&path, &real_root, buf, buflen);
51701+
51702+ return res;
51703+}
51704+
51705+static char *
51706+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51707+ char *buf, int buflen)
51708+{
51709+ char *res;
51710+ struct path path;
51711+ struct path root;
51712+ struct task_struct *reaper = &init_task;
51713+
51714+ path.dentry = (struct dentry *)dentry;
51715+ path.mnt = (struct vfsmount *)vfsmnt;
51716+
51717+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51718+ get_fs_root(reaper->fs, &root);
51719+
51720+ write_seqlock(&rename_lock);
51721+ br_read_lock(vfsmount_lock);
51722+ res = gen_full_path(&path, &root, buf, buflen);
51723+ br_read_unlock(vfsmount_lock);
51724+ write_sequnlock(&rename_lock);
51725+
51726+ path_put(&root);
51727+ return res;
51728+}
51729+
51730+static char *
51731+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51732+{
51733+ char *ret;
51734+ write_seqlock(&rename_lock);
51735+ br_read_lock(vfsmount_lock);
51736+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51737+ PAGE_SIZE);
51738+ br_read_unlock(vfsmount_lock);
51739+ write_sequnlock(&rename_lock);
51740+ return ret;
51741+}
51742+
51743+static char *
51744+gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51745+{
51746+ char *ret;
51747+ char *buf;
51748+ int buflen;
51749+
51750+ write_seqlock(&rename_lock);
51751+ br_read_lock(vfsmount_lock);
51752+ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51753+ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
51754+ buflen = (int)(ret - buf);
51755+ if (buflen >= 5)
51756+ prepend(&ret, &buflen, "/proc", 5);
51757+ else
51758+ ret = strcpy(buf, "<path too long>");
51759+ br_read_unlock(vfsmount_lock);
51760+ write_sequnlock(&rename_lock);
51761+ return ret;
51762+}
51763+
51764+char *
51765+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51766+{
51767+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51768+ PAGE_SIZE);
51769+}
51770+
51771+char *
51772+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51773+{
51774+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51775+ PAGE_SIZE);
51776+}
51777+
51778+char *
51779+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51780+{
51781+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51782+ PAGE_SIZE);
51783+}
51784+
51785+char *
51786+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51787+{
51788+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51789+ PAGE_SIZE);
51790+}
51791+
51792+char *
51793+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51794+{
51795+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51796+ PAGE_SIZE);
51797+}
51798+
51799+__inline__ __u32
51800+to_gr_audit(const __u32 reqmode)
51801+{
51802+ /* masks off auditable permission flags, then shifts them to create
51803+ auditing flags, and adds the special case of append auditing if
51804+ we're requesting write */
51805+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51806+}
51807+
51808+struct acl_subject_label *
51809+lookup_subject_map(const struct acl_subject_label *userp)
51810+{
51811+ unsigned int index = shash(userp, subj_map_set.s_size);
51812+ struct subject_map *match;
51813+
51814+ match = subj_map_set.s_hash[index];
51815+
51816+ while (match && match->user != userp)
51817+ match = match->next;
51818+
51819+ if (match != NULL)
51820+ return match->kernel;
51821+ else
51822+ return NULL;
51823+}
51824+
51825+static void
51826+insert_subj_map_entry(struct subject_map *subjmap)
51827+{
51828+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51829+ struct subject_map **curr;
51830+
51831+ subjmap->prev = NULL;
51832+
51833+ curr = &subj_map_set.s_hash[index];
51834+ if (*curr != NULL)
51835+ (*curr)->prev = subjmap;
51836+
51837+ subjmap->next = *curr;
51838+ *curr = subjmap;
51839+
51840+ return;
51841+}
51842+
51843+static struct acl_role_label *
51844+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51845+ const gid_t gid)
51846+{
51847+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51848+ struct acl_role_label *match;
51849+ struct role_allowed_ip *ipp;
51850+ unsigned int x;
51851+ u32 curr_ip = task->signal->curr_ip;
51852+
51853+ task->signal->saved_ip = curr_ip;
51854+
51855+ match = acl_role_set.r_hash[index];
51856+
51857+ while (match) {
51858+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51859+ for (x = 0; x < match->domain_child_num; x++) {
51860+ if (match->domain_children[x] == uid)
51861+ goto found;
51862+ }
51863+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51864+ break;
51865+ match = match->next;
51866+ }
51867+found:
51868+ if (match == NULL) {
51869+ try_group:
51870+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51871+ match = acl_role_set.r_hash[index];
51872+
51873+ while (match) {
51874+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51875+ for (x = 0; x < match->domain_child_num; x++) {
51876+ if (match->domain_children[x] == gid)
51877+ goto found2;
51878+ }
51879+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51880+ break;
51881+ match = match->next;
51882+ }
51883+found2:
51884+ if (match == NULL)
51885+ match = default_role;
51886+ if (match->allowed_ips == NULL)
51887+ return match;
51888+ else {
51889+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51890+ if (likely
51891+ ((ntohl(curr_ip) & ipp->netmask) ==
51892+ (ntohl(ipp->addr) & ipp->netmask)))
51893+ return match;
51894+ }
51895+ match = default_role;
51896+ }
51897+ } else if (match->allowed_ips == NULL) {
51898+ return match;
51899+ } else {
51900+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51901+ if (likely
51902+ ((ntohl(curr_ip) & ipp->netmask) ==
51903+ (ntohl(ipp->addr) & ipp->netmask)))
51904+ return match;
51905+ }
51906+ goto try_group;
51907+ }
51908+
51909+ return match;
51910+}
51911+
51912+struct acl_subject_label *
51913+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51914+ const struct acl_role_label *role)
51915+{
51916+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51917+ struct acl_subject_label *match;
51918+
51919+ match = role->subj_hash[index];
51920+
51921+ while (match && (match->inode != ino || match->device != dev ||
51922+ (match->mode & GR_DELETED))) {
51923+ match = match->next;
51924+ }
51925+
51926+ if (match && !(match->mode & GR_DELETED))
51927+ return match;
51928+ else
51929+ return NULL;
51930+}
51931+
51932+struct acl_subject_label *
51933+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51934+ const struct acl_role_label *role)
51935+{
51936+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51937+ struct acl_subject_label *match;
51938+
51939+ match = role->subj_hash[index];
51940+
51941+ while (match && (match->inode != ino || match->device != dev ||
51942+ !(match->mode & GR_DELETED))) {
51943+ match = match->next;
51944+ }
51945+
51946+ if (match && (match->mode & GR_DELETED))
51947+ return match;
51948+ else
51949+ return NULL;
51950+}
51951+
51952+static struct acl_object_label *
51953+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51954+ const struct acl_subject_label *subj)
51955+{
51956+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51957+ struct acl_object_label *match;
51958+
51959+ match = subj->obj_hash[index];
51960+
51961+ while (match && (match->inode != ino || match->device != dev ||
51962+ (match->mode & GR_DELETED))) {
51963+ match = match->next;
51964+ }
51965+
51966+ if (match && !(match->mode & GR_DELETED))
51967+ return match;
51968+ else
51969+ return NULL;
51970+}
51971+
51972+static struct acl_object_label *
51973+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51974+ const struct acl_subject_label *subj)
51975+{
51976+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51977+ struct acl_object_label *match;
51978+
51979+ match = subj->obj_hash[index];
51980+
51981+ while (match && (match->inode != ino || match->device != dev ||
51982+ !(match->mode & GR_DELETED))) {
51983+ match = match->next;
51984+ }
51985+
51986+ if (match && (match->mode & GR_DELETED))
51987+ return match;
51988+
51989+ match = subj->obj_hash[index];
51990+
51991+ while (match && (match->inode != ino || match->device != dev ||
51992+ (match->mode & GR_DELETED))) {
51993+ match = match->next;
51994+ }
51995+
51996+ if (match && !(match->mode & GR_DELETED))
51997+ return match;
51998+ else
51999+ return NULL;
52000+}
52001+
52002+static struct name_entry *
52003+lookup_name_entry(const char *name)
52004+{
52005+ unsigned int len = strlen(name);
52006+ unsigned int key = full_name_hash(name, len);
52007+ unsigned int index = key % name_set.n_size;
52008+ struct name_entry *match;
52009+
52010+ match = name_set.n_hash[index];
52011+
52012+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
52013+ match = match->next;
52014+
52015+ return match;
52016+}
52017+
52018+static struct name_entry *
52019+lookup_name_entry_create(const char *name)
52020+{
52021+ unsigned int len = strlen(name);
52022+ unsigned int key = full_name_hash(name, len);
52023+ unsigned int index = key % name_set.n_size;
52024+ struct name_entry *match;
52025+
52026+ match = name_set.n_hash[index];
52027+
52028+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52029+ !match->deleted))
52030+ match = match->next;
52031+
52032+ if (match && match->deleted)
52033+ return match;
52034+
52035+ match = name_set.n_hash[index];
52036+
52037+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52038+ match->deleted))
52039+ match = match->next;
52040+
52041+ if (match && !match->deleted)
52042+ return match;
52043+ else
52044+ return NULL;
52045+}
52046+
52047+static struct inodev_entry *
52048+lookup_inodev_entry(const ino_t ino, const dev_t dev)
52049+{
52050+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
52051+ struct inodev_entry *match;
52052+
52053+ match = inodev_set.i_hash[index];
52054+
52055+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
52056+ match = match->next;
52057+
52058+ return match;
52059+}
52060+
52061+static void
52062+insert_inodev_entry(struct inodev_entry *entry)
52063+{
52064+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
52065+ inodev_set.i_size);
52066+ struct inodev_entry **curr;
52067+
52068+ entry->prev = NULL;
52069+
52070+ curr = &inodev_set.i_hash[index];
52071+ if (*curr != NULL)
52072+ (*curr)->prev = entry;
52073+
52074+ entry->next = *curr;
52075+ *curr = entry;
52076+
52077+ return;
52078+}
52079+
52080+static void
52081+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
52082+{
52083+ unsigned int index =
52084+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
52085+ struct acl_role_label **curr;
52086+ struct acl_role_label *tmp;
52087+
52088+ curr = &acl_role_set.r_hash[index];
52089+
52090+ /* if role was already inserted due to domains and already has
52091+ a role in the same bucket as it attached, then we need to
52092+ combine these two buckets
52093+ */
52094+ if (role->next) {
52095+ tmp = role->next;
52096+ while (tmp->next)
52097+ tmp = tmp->next;
52098+ tmp->next = *curr;
52099+ } else
52100+ role->next = *curr;
52101+ *curr = role;
52102+
52103+ return;
52104+}
52105+
52106+static void
52107+insert_acl_role_label(struct acl_role_label *role)
52108+{
52109+ int i;
52110+
52111+ if (role_list == NULL) {
52112+ role_list = role;
52113+ role->prev = NULL;
52114+ } else {
52115+ role->prev = role_list;
52116+ role_list = role;
52117+ }
52118+
52119+ /* used for hash chains */
52120+ role->next = NULL;
52121+
52122+ if (role->roletype & GR_ROLE_DOMAIN) {
52123+ for (i = 0; i < role->domain_child_num; i++)
52124+ __insert_acl_role_label(role, role->domain_children[i]);
52125+ } else
52126+ __insert_acl_role_label(role, role->uidgid);
52127+}
52128+
52129+static int
52130+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52131+{
52132+ struct name_entry **curr, *nentry;
52133+ struct inodev_entry *ientry;
52134+ unsigned int len = strlen(name);
52135+ unsigned int key = full_name_hash(name, len);
52136+ unsigned int index = key % name_set.n_size;
52137+
52138+ curr = &name_set.n_hash[index];
52139+
52140+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52141+ curr = &((*curr)->next);
52142+
52143+ if (*curr != NULL)
52144+ return 1;
52145+
52146+ nentry = acl_alloc(sizeof (struct name_entry));
52147+ if (nentry == NULL)
52148+ return 0;
52149+ ientry = acl_alloc(sizeof (struct inodev_entry));
52150+ if (ientry == NULL)
52151+ return 0;
52152+ ientry->nentry = nentry;
52153+
52154+ nentry->key = key;
52155+ nentry->name = name;
52156+ nentry->inode = inode;
52157+ nentry->device = device;
52158+ nentry->len = len;
52159+ nentry->deleted = deleted;
52160+
52161+ nentry->prev = NULL;
52162+ curr = &name_set.n_hash[index];
52163+ if (*curr != NULL)
52164+ (*curr)->prev = nentry;
52165+ nentry->next = *curr;
52166+ *curr = nentry;
52167+
52168+ /* insert us into the table searchable by inode/dev */
52169+ insert_inodev_entry(ientry);
52170+
52171+ return 1;
52172+}
52173+
52174+static void
52175+insert_acl_obj_label(struct acl_object_label *obj,
52176+ struct acl_subject_label *subj)
52177+{
52178+ unsigned int index =
52179+ fhash(obj->inode, obj->device, subj->obj_hash_size);
52180+ struct acl_object_label **curr;
52181+
52182+
52183+ obj->prev = NULL;
52184+
52185+ curr = &subj->obj_hash[index];
52186+ if (*curr != NULL)
52187+ (*curr)->prev = obj;
52188+
52189+ obj->next = *curr;
52190+ *curr = obj;
52191+
52192+ return;
52193+}
52194+
52195+static void
52196+insert_acl_subj_label(struct acl_subject_label *obj,
52197+ struct acl_role_label *role)
52198+{
52199+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52200+ struct acl_subject_label **curr;
52201+
52202+ obj->prev = NULL;
52203+
52204+ curr = &role->subj_hash[index];
52205+ if (*curr != NULL)
52206+ (*curr)->prev = obj;
52207+
52208+ obj->next = *curr;
52209+ *curr = obj;
52210+
52211+ return;
52212+}
52213+
52214+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52215+
52216+static void *
52217+create_table(__u32 * len, int elementsize)
52218+{
52219+ unsigned int table_sizes[] = {
52220+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52221+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52222+ 4194301, 8388593, 16777213, 33554393, 67108859
52223+ };
52224+ void *newtable = NULL;
52225+ unsigned int pwr = 0;
52226+
52227+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52228+ table_sizes[pwr] <= *len)
52229+ pwr++;
52230+
52231+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52232+ return newtable;
52233+
52234+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52235+ newtable =
52236+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52237+ else
52238+ newtable = vmalloc(table_sizes[pwr] * elementsize);
52239+
52240+ *len = table_sizes[pwr];
52241+
52242+ return newtable;
52243+}
52244+
52245+static int
52246+init_variables(const struct gr_arg *arg)
52247+{
52248+ struct task_struct *reaper = &init_task;
52249+ unsigned int stacksize;
52250+
52251+ subj_map_set.s_size = arg->role_db.num_subjects;
52252+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52253+ name_set.n_size = arg->role_db.num_objects;
52254+ inodev_set.i_size = arg->role_db.num_objects;
52255+
52256+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
52257+ !name_set.n_size || !inodev_set.i_size)
52258+ return 1;
52259+
52260+ if (!gr_init_uidset())
52261+ return 1;
52262+
52263+ /* set up the stack that holds allocation info */
52264+
52265+ stacksize = arg->role_db.num_pointers + 5;
52266+
52267+ if (!acl_alloc_stack_init(stacksize))
52268+ return 1;
52269+
52270+ /* grab reference for the real root dentry and vfsmount */
52271+ get_fs_root(reaper->fs, &real_root);
52272+
52273+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52274+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52275+#endif
52276+
52277+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
52278+ if (fakefs_obj_rw == NULL)
52279+ return 1;
52280+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
52281+
52282+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
52283+ if (fakefs_obj_rwx == NULL)
52284+ return 1;
52285+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52286+
52287+ subj_map_set.s_hash =
52288+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52289+ acl_role_set.r_hash =
52290+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52291+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52292+ inodev_set.i_hash =
52293+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52294+
52295+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52296+ !name_set.n_hash || !inodev_set.i_hash)
52297+ return 1;
52298+
52299+ memset(subj_map_set.s_hash, 0,
52300+ sizeof(struct subject_map *) * subj_map_set.s_size);
52301+ memset(acl_role_set.r_hash, 0,
52302+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
52303+ memset(name_set.n_hash, 0,
52304+ sizeof (struct name_entry *) * name_set.n_size);
52305+ memset(inodev_set.i_hash, 0,
52306+ sizeof (struct inodev_entry *) * inodev_set.i_size);
52307+
52308+ return 0;
52309+}
52310+
52311+/* free information not needed after startup
52312+ currently contains user->kernel pointer mappings for subjects
52313+*/
52314+
52315+static void
52316+free_init_variables(void)
52317+{
52318+ __u32 i;
52319+
52320+ if (subj_map_set.s_hash) {
52321+ for (i = 0; i < subj_map_set.s_size; i++) {
52322+ if (subj_map_set.s_hash[i]) {
52323+ kfree(subj_map_set.s_hash[i]);
52324+ subj_map_set.s_hash[i] = NULL;
52325+ }
52326+ }
52327+
52328+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52329+ PAGE_SIZE)
52330+ kfree(subj_map_set.s_hash);
52331+ else
52332+ vfree(subj_map_set.s_hash);
52333+ }
52334+
52335+ return;
52336+}
52337+
52338+static void
52339+free_variables(void)
52340+{
52341+ struct acl_subject_label *s;
52342+ struct acl_role_label *r;
52343+ struct task_struct *task, *task2;
52344+ unsigned int x;
52345+
52346+ gr_clear_learn_entries();
52347+
52348+ read_lock(&tasklist_lock);
52349+ do_each_thread(task2, task) {
52350+ task->acl_sp_role = 0;
52351+ task->acl_role_id = 0;
52352+ task->acl = NULL;
52353+ task->role = NULL;
52354+ } while_each_thread(task2, task);
52355+ read_unlock(&tasklist_lock);
52356+
52357+ /* release the reference to the real root dentry and vfsmount */
52358+ path_put(&real_root);
52359+
52360+ /* free all object hash tables */
52361+
52362+ FOR_EACH_ROLE_START(r)
52363+ if (r->subj_hash == NULL)
52364+ goto next_role;
52365+ FOR_EACH_SUBJECT_START(r, s, x)
52366+ if (s->obj_hash == NULL)
52367+ break;
52368+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52369+ kfree(s->obj_hash);
52370+ else
52371+ vfree(s->obj_hash);
52372+ FOR_EACH_SUBJECT_END(s, x)
52373+ FOR_EACH_NESTED_SUBJECT_START(r, s)
52374+ if (s->obj_hash == NULL)
52375+ break;
52376+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52377+ kfree(s->obj_hash);
52378+ else
52379+ vfree(s->obj_hash);
52380+ FOR_EACH_NESTED_SUBJECT_END(s)
52381+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52382+ kfree(r->subj_hash);
52383+ else
52384+ vfree(r->subj_hash);
52385+ r->subj_hash = NULL;
52386+next_role:
52387+ FOR_EACH_ROLE_END(r)
52388+
52389+ acl_free_all();
52390+
52391+ if (acl_role_set.r_hash) {
52392+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52393+ PAGE_SIZE)
52394+ kfree(acl_role_set.r_hash);
52395+ else
52396+ vfree(acl_role_set.r_hash);
52397+ }
52398+ if (name_set.n_hash) {
52399+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
52400+ PAGE_SIZE)
52401+ kfree(name_set.n_hash);
52402+ else
52403+ vfree(name_set.n_hash);
52404+ }
52405+
52406+ if (inodev_set.i_hash) {
52407+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52408+ PAGE_SIZE)
52409+ kfree(inodev_set.i_hash);
52410+ else
52411+ vfree(inodev_set.i_hash);
52412+ }
52413+
52414+ gr_free_uidset();
52415+
52416+ memset(&name_set, 0, sizeof (struct name_db));
52417+ memset(&inodev_set, 0, sizeof (struct inodev_db));
52418+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52419+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52420+
52421+ default_role = NULL;
52422+ role_list = NULL;
52423+
52424+ return;
52425+}
52426+
52427+static __u32
52428+count_user_objs(struct acl_object_label *userp)
52429+{
52430+ struct acl_object_label o_tmp;
52431+ __u32 num = 0;
52432+
52433+ while (userp) {
52434+ if (copy_from_user(&o_tmp, userp,
52435+ sizeof (struct acl_object_label)))
52436+ break;
52437+
52438+ userp = o_tmp.prev;
52439+ num++;
52440+ }
52441+
52442+ return num;
52443+}
52444+
52445+static struct acl_subject_label *
52446+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52447+
52448+static int
52449+copy_user_glob(struct acl_object_label *obj)
52450+{
52451+ struct acl_object_label *g_tmp, **guser;
52452+ unsigned int len;
52453+ char *tmp;
52454+
52455+ if (obj->globbed == NULL)
52456+ return 0;
52457+
52458+ guser = &obj->globbed;
52459+ while (*guser) {
52460+ g_tmp = (struct acl_object_label *)
52461+ acl_alloc(sizeof (struct acl_object_label));
52462+ if (g_tmp == NULL)
52463+ return -ENOMEM;
52464+
52465+ if (copy_from_user(g_tmp, *guser,
52466+ sizeof (struct acl_object_label)))
52467+ return -EFAULT;
52468+
52469+ len = strnlen_user(g_tmp->filename, PATH_MAX);
52470+
52471+ if (!len || len >= PATH_MAX)
52472+ return -EINVAL;
52473+
52474+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52475+ return -ENOMEM;
52476+
52477+ if (copy_from_user(tmp, g_tmp->filename, len))
52478+ return -EFAULT;
52479+ tmp[len-1] = '\0';
52480+ g_tmp->filename = tmp;
52481+
52482+ *guser = g_tmp;
52483+ guser = &(g_tmp->next);
52484+ }
52485+
52486+ return 0;
52487+}
52488+
52489+static int
52490+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52491+ struct acl_role_label *role)
52492+{
52493+ struct acl_object_label *o_tmp;
52494+ unsigned int len;
52495+ int ret;
52496+ char *tmp;
52497+
52498+ while (userp) {
52499+ if ((o_tmp = (struct acl_object_label *)
52500+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
52501+ return -ENOMEM;
52502+
52503+ if (copy_from_user(o_tmp, userp,
52504+ sizeof (struct acl_object_label)))
52505+ return -EFAULT;
52506+
52507+ userp = o_tmp->prev;
52508+
52509+ len = strnlen_user(o_tmp->filename, PATH_MAX);
52510+
52511+ if (!len || len >= PATH_MAX)
52512+ return -EINVAL;
52513+
52514+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52515+ return -ENOMEM;
52516+
52517+ if (copy_from_user(tmp, o_tmp->filename, len))
52518+ return -EFAULT;
52519+ tmp[len-1] = '\0';
52520+ o_tmp->filename = tmp;
52521+
52522+ insert_acl_obj_label(o_tmp, subj);
52523+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52524+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52525+ return -ENOMEM;
52526+
52527+ ret = copy_user_glob(o_tmp);
52528+ if (ret)
52529+ return ret;
52530+
52531+ if (o_tmp->nested) {
52532+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52533+ if (IS_ERR(o_tmp->nested))
52534+ return PTR_ERR(o_tmp->nested);
52535+
52536+ /* insert into nested subject list */
52537+ o_tmp->nested->next = role->hash->first;
52538+ role->hash->first = o_tmp->nested;
52539+ }
52540+ }
52541+
52542+ return 0;
52543+}
52544+
52545+static __u32
52546+count_user_subjs(struct acl_subject_label *userp)
52547+{
52548+ struct acl_subject_label s_tmp;
52549+ __u32 num = 0;
52550+
52551+ while (userp) {
52552+ if (copy_from_user(&s_tmp, userp,
52553+ sizeof (struct acl_subject_label)))
52554+ break;
52555+
52556+ userp = s_tmp.prev;
52557+ /* do not count nested subjects against this count, since
52558+ they are not included in the hash table, but are
52559+ attached to objects. We have already counted
52560+ the subjects in userspace for the allocation
52561+ stack
52562+ */
52563+ if (!(s_tmp.mode & GR_NESTED))
52564+ num++;
52565+ }
52566+
52567+ return num;
52568+}
52569+
52570+static int
52571+copy_user_allowedips(struct acl_role_label *rolep)
52572+{
52573+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52574+
52575+ ruserip = rolep->allowed_ips;
52576+
52577+ while (ruserip) {
52578+ rlast = rtmp;
52579+
52580+ if ((rtmp = (struct role_allowed_ip *)
52581+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52582+ return -ENOMEM;
52583+
52584+ if (copy_from_user(rtmp, ruserip,
52585+ sizeof (struct role_allowed_ip)))
52586+ return -EFAULT;
52587+
52588+ ruserip = rtmp->prev;
52589+
52590+ if (!rlast) {
52591+ rtmp->prev = NULL;
52592+ rolep->allowed_ips = rtmp;
52593+ } else {
52594+ rlast->next = rtmp;
52595+ rtmp->prev = rlast;
52596+ }
52597+
52598+ if (!ruserip)
52599+ rtmp->next = NULL;
52600+ }
52601+
52602+ return 0;
52603+}
52604+
52605+static int
52606+copy_user_transitions(struct acl_role_label *rolep)
52607+{
52608+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
52609+
52610+ unsigned int len;
52611+ char *tmp;
52612+
52613+ rusertp = rolep->transitions;
52614+
52615+ while (rusertp) {
52616+ rlast = rtmp;
52617+
52618+ if ((rtmp = (struct role_transition *)
52619+ acl_alloc(sizeof (struct role_transition))) == NULL)
52620+ return -ENOMEM;
52621+
52622+ if (copy_from_user(rtmp, rusertp,
52623+ sizeof (struct role_transition)))
52624+ return -EFAULT;
52625+
52626+ rusertp = rtmp->prev;
52627+
52628+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52629+
52630+ if (!len || len >= GR_SPROLE_LEN)
52631+ return -EINVAL;
52632+
52633+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52634+ return -ENOMEM;
52635+
52636+ if (copy_from_user(tmp, rtmp->rolename, len))
52637+ return -EFAULT;
52638+ tmp[len-1] = '\0';
52639+ rtmp->rolename = tmp;
52640+
52641+ if (!rlast) {
52642+ rtmp->prev = NULL;
52643+ rolep->transitions = rtmp;
52644+ } else {
52645+ rlast->next = rtmp;
52646+ rtmp->prev = rlast;
52647+ }
52648+
52649+ if (!rusertp)
52650+ rtmp->next = NULL;
52651+ }
52652+
52653+ return 0;
52654+}
52655+
52656+static struct acl_subject_label *
52657+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52658+{
52659+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52660+ unsigned int len;
52661+ char *tmp;
52662+ __u32 num_objs;
52663+ struct acl_ip_label **i_tmp, *i_utmp2;
52664+ struct gr_hash_struct ghash;
52665+ struct subject_map *subjmap;
52666+ unsigned int i_num;
52667+ int err;
52668+
52669+ s_tmp = lookup_subject_map(userp);
52670+
52671+ /* we've already copied this subject into the kernel, just return
52672+ the reference to it, and don't copy it over again
52673+ */
52674+ if (s_tmp)
52675+ return(s_tmp);
52676+
52677+ if ((s_tmp = (struct acl_subject_label *)
52678+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52679+ return ERR_PTR(-ENOMEM);
52680+
52681+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52682+ if (subjmap == NULL)
52683+ return ERR_PTR(-ENOMEM);
52684+
52685+ subjmap->user = userp;
52686+ subjmap->kernel = s_tmp;
52687+ insert_subj_map_entry(subjmap);
52688+
52689+ if (copy_from_user(s_tmp, userp,
52690+ sizeof (struct acl_subject_label)))
52691+ return ERR_PTR(-EFAULT);
52692+
52693+ len = strnlen_user(s_tmp->filename, PATH_MAX);
52694+
52695+ if (!len || len >= PATH_MAX)
52696+ return ERR_PTR(-EINVAL);
52697+
52698+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52699+ return ERR_PTR(-ENOMEM);
52700+
52701+ if (copy_from_user(tmp, s_tmp->filename, len))
52702+ return ERR_PTR(-EFAULT);
52703+ tmp[len-1] = '\0';
52704+ s_tmp->filename = tmp;
52705+
52706+ if (!strcmp(s_tmp->filename, "/"))
52707+ role->root_label = s_tmp;
52708+
52709+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52710+ return ERR_PTR(-EFAULT);
52711+
52712+ /* copy user and group transition tables */
52713+
52714+ if (s_tmp->user_trans_num) {
52715+ uid_t *uidlist;
52716+
52717+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52718+ if (uidlist == NULL)
52719+ return ERR_PTR(-ENOMEM);
52720+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52721+ return ERR_PTR(-EFAULT);
52722+
52723+ s_tmp->user_transitions = uidlist;
52724+ }
52725+
52726+ if (s_tmp->group_trans_num) {
52727+ gid_t *gidlist;
52728+
52729+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52730+ if (gidlist == NULL)
52731+ return ERR_PTR(-ENOMEM);
52732+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52733+ return ERR_PTR(-EFAULT);
52734+
52735+ s_tmp->group_transitions = gidlist;
52736+ }
52737+
52738+ /* set up object hash table */
52739+ num_objs = count_user_objs(ghash.first);
52740+
52741+ s_tmp->obj_hash_size = num_objs;
52742+ s_tmp->obj_hash =
52743+ (struct acl_object_label **)
52744+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52745+
52746+ if (!s_tmp->obj_hash)
52747+ return ERR_PTR(-ENOMEM);
52748+
52749+ memset(s_tmp->obj_hash, 0,
52750+ s_tmp->obj_hash_size *
52751+ sizeof (struct acl_object_label *));
52752+
52753+ /* add in objects */
52754+ err = copy_user_objs(ghash.first, s_tmp, role);
52755+
52756+ if (err)
52757+ return ERR_PTR(err);
52758+
52759+ /* set pointer for parent subject */
52760+ if (s_tmp->parent_subject) {
52761+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52762+
52763+ if (IS_ERR(s_tmp2))
52764+ return s_tmp2;
52765+
52766+ s_tmp->parent_subject = s_tmp2;
52767+ }
52768+
52769+ /* add in ip acls */
52770+
52771+ if (!s_tmp->ip_num) {
52772+ s_tmp->ips = NULL;
52773+ goto insert;
52774+ }
52775+
52776+ i_tmp =
52777+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52778+ sizeof (struct acl_ip_label *));
52779+
52780+ if (!i_tmp)
52781+ return ERR_PTR(-ENOMEM);
52782+
52783+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52784+ *(i_tmp + i_num) =
52785+ (struct acl_ip_label *)
52786+ acl_alloc(sizeof (struct acl_ip_label));
52787+ if (!*(i_tmp + i_num))
52788+ return ERR_PTR(-ENOMEM);
52789+
52790+ if (copy_from_user
52791+ (&i_utmp2, s_tmp->ips + i_num,
52792+ sizeof (struct acl_ip_label *)))
52793+ return ERR_PTR(-EFAULT);
52794+
52795+ if (copy_from_user
52796+ (*(i_tmp + i_num), i_utmp2,
52797+ sizeof (struct acl_ip_label)))
52798+ return ERR_PTR(-EFAULT);
52799+
52800+ if ((*(i_tmp + i_num))->iface == NULL)
52801+ continue;
52802+
52803+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52804+ if (!len || len >= IFNAMSIZ)
52805+ return ERR_PTR(-EINVAL);
52806+ tmp = acl_alloc(len);
52807+ if (tmp == NULL)
52808+ return ERR_PTR(-ENOMEM);
52809+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52810+ return ERR_PTR(-EFAULT);
52811+ (*(i_tmp + i_num))->iface = tmp;
52812+ }
52813+
52814+ s_tmp->ips = i_tmp;
52815+
52816+insert:
52817+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52818+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52819+ return ERR_PTR(-ENOMEM);
52820+
52821+ return s_tmp;
52822+}
52823+
52824+static int
52825+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52826+{
52827+ struct acl_subject_label s_pre;
52828+ struct acl_subject_label * ret;
52829+ int err;
52830+
52831+ while (userp) {
52832+ if (copy_from_user(&s_pre, userp,
52833+ sizeof (struct acl_subject_label)))
52834+ return -EFAULT;
52835+
52836+ /* do not add nested subjects here, add
52837+ while parsing objects
52838+ */
52839+
52840+ if (s_pre.mode & GR_NESTED) {
52841+ userp = s_pre.prev;
52842+ continue;
52843+ }
52844+
52845+ ret = do_copy_user_subj(userp, role);
52846+
52847+ err = PTR_ERR(ret);
52848+ if (IS_ERR(ret))
52849+ return err;
52850+
52851+ insert_acl_subj_label(ret, role);
52852+
52853+ userp = s_pre.prev;
52854+ }
52855+
52856+ return 0;
52857+}
52858+
52859+static int
52860+copy_user_acl(struct gr_arg *arg)
52861+{
52862+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52863+ struct sprole_pw *sptmp;
52864+ struct gr_hash_struct *ghash;
52865+ uid_t *domainlist;
52866+ unsigned int r_num;
52867+ unsigned int len;
52868+ char *tmp;
52869+ int err = 0;
52870+ __u16 i;
52871+ __u32 num_subjs;
52872+
52873+ /* we need a default and kernel role */
52874+ if (arg->role_db.num_roles < 2)
52875+ return -EINVAL;
52876+
52877+ /* copy special role authentication info from userspace */
52878+
52879+ num_sprole_pws = arg->num_sprole_pws;
52880+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52881+
52882+ if (!acl_special_roles) {
52883+ err = -ENOMEM;
52884+ goto cleanup;
52885+ }
52886+
52887+ for (i = 0; i < num_sprole_pws; i++) {
52888+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52889+ if (!sptmp) {
52890+ err = -ENOMEM;
52891+ goto cleanup;
52892+ }
52893+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52894+ sizeof (struct sprole_pw))) {
52895+ err = -EFAULT;
52896+ goto cleanup;
52897+ }
52898+
52899+ len =
52900+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52901+
52902+ if (!len || len >= GR_SPROLE_LEN) {
52903+ err = -EINVAL;
52904+ goto cleanup;
52905+ }
52906+
52907+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52908+ err = -ENOMEM;
52909+ goto cleanup;
52910+ }
52911+
52912+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52913+ err = -EFAULT;
52914+ goto cleanup;
52915+ }
52916+ tmp[len-1] = '\0';
52917+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52918+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52919+#endif
52920+ sptmp->rolename = tmp;
52921+ acl_special_roles[i] = sptmp;
52922+ }
52923+
52924+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52925+
52926+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52927+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52928+
52929+ if (!r_tmp) {
52930+ err = -ENOMEM;
52931+ goto cleanup;
52932+ }
52933+
52934+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52935+ sizeof (struct acl_role_label *))) {
52936+ err = -EFAULT;
52937+ goto cleanup;
52938+ }
52939+
52940+ if (copy_from_user(r_tmp, r_utmp2,
52941+ sizeof (struct acl_role_label))) {
52942+ err = -EFAULT;
52943+ goto cleanup;
52944+ }
52945+
52946+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52947+
52948+ if (!len || len >= PATH_MAX) {
52949+ err = -EINVAL;
52950+ goto cleanup;
52951+ }
52952+
52953+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52954+ err = -ENOMEM;
52955+ goto cleanup;
52956+ }
52957+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52958+ err = -EFAULT;
52959+ goto cleanup;
52960+ }
52961+ tmp[len-1] = '\0';
52962+ r_tmp->rolename = tmp;
52963+
52964+ if (!strcmp(r_tmp->rolename, "default")
52965+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52966+ default_role = r_tmp;
52967+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52968+ kernel_role = r_tmp;
52969+ }
52970+
52971+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52972+ err = -ENOMEM;
52973+ goto cleanup;
52974+ }
52975+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52976+ err = -EFAULT;
52977+ goto cleanup;
52978+ }
52979+
52980+ r_tmp->hash = ghash;
52981+
52982+ num_subjs = count_user_subjs(r_tmp->hash->first);
52983+
52984+ r_tmp->subj_hash_size = num_subjs;
52985+ r_tmp->subj_hash =
52986+ (struct acl_subject_label **)
52987+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52988+
52989+ if (!r_tmp->subj_hash) {
52990+ err = -ENOMEM;
52991+ goto cleanup;
52992+ }
52993+
52994+ err = copy_user_allowedips(r_tmp);
52995+ if (err)
52996+ goto cleanup;
52997+
52998+ /* copy domain info */
52999+ if (r_tmp->domain_children != NULL) {
53000+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
53001+ if (domainlist == NULL) {
53002+ err = -ENOMEM;
53003+ goto cleanup;
53004+ }
53005+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
53006+ err = -EFAULT;
53007+ goto cleanup;
53008+ }
53009+ r_tmp->domain_children = domainlist;
53010+ }
53011+
53012+ err = copy_user_transitions(r_tmp);
53013+ if (err)
53014+ goto cleanup;
53015+
53016+ memset(r_tmp->subj_hash, 0,
53017+ r_tmp->subj_hash_size *
53018+ sizeof (struct acl_subject_label *));
53019+
53020+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
53021+
53022+ if (err)
53023+ goto cleanup;
53024+
53025+ /* set nested subject list to null */
53026+ r_tmp->hash->first = NULL;
53027+
53028+ insert_acl_role_label(r_tmp);
53029+ }
53030+
53031+ goto return_err;
53032+ cleanup:
53033+ free_variables();
53034+ return_err:
53035+ return err;
53036+
53037+}
53038+
53039+static int
53040+gracl_init(struct gr_arg *args)
53041+{
53042+ int error = 0;
53043+
53044+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
53045+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
53046+
53047+ if (init_variables(args)) {
53048+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
53049+ error = -ENOMEM;
53050+ free_variables();
53051+ goto out;
53052+ }
53053+
53054+ error = copy_user_acl(args);
53055+ free_init_variables();
53056+ if (error) {
53057+ free_variables();
53058+ goto out;
53059+ }
53060+
53061+ if ((error = gr_set_acls(0))) {
53062+ free_variables();
53063+ goto out;
53064+ }
53065+
53066+ pax_open_kernel();
53067+ gr_status |= GR_READY;
53068+ pax_close_kernel();
53069+
53070+ out:
53071+ return error;
53072+}
53073+
53074+/* derived from glibc fnmatch() 0: match, 1: no match*/
53075+
53076+static int
53077+glob_match(const char *p, const char *n)
53078+{
53079+ char c;
53080+
53081+ while ((c = *p++) != '\0') {
53082+ switch (c) {
53083+ case '?':
53084+ if (*n == '\0')
53085+ return 1;
53086+ else if (*n == '/')
53087+ return 1;
53088+ break;
53089+ case '\\':
53090+ if (*n != c)
53091+ return 1;
53092+ break;
53093+ case '*':
53094+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
53095+ if (*n == '/')
53096+ return 1;
53097+ else if (c == '?') {
53098+ if (*n == '\0')
53099+ return 1;
53100+ else
53101+ ++n;
53102+ }
53103+ }
53104+ if (c == '\0') {
53105+ return 0;
53106+ } else {
53107+ const char *endp;
53108+
53109+ if ((endp = strchr(n, '/')) == NULL)
53110+ endp = n + strlen(n);
53111+
53112+ if (c == '[') {
53113+ for (--p; n < endp; ++n)
53114+ if (!glob_match(p, n))
53115+ return 0;
53116+ } else if (c == '/') {
53117+ while (*n != '\0' && *n != '/')
53118+ ++n;
53119+ if (*n == '/' && !glob_match(p, n + 1))
53120+ return 0;
53121+ } else {
53122+ for (--p; n < endp; ++n)
53123+ if (*n == c && !glob_match(p, n))
53124+ return 0;
53125+ }
53126+
53127+ return 1;
53128+ }
53129+ case '[':
53130+ {
53131+ int not;
53132+ char cold;
53133+
53134+ if (*n == '\0' || *n == '/')
53135+ return 1;
53136+
53137+ not = (*p == '!' || *p == '^');
53138+ if (not)
53139+ ++p;
53140+
53141+ c = *p++;
53142+ for (;;) {
53143+ unsigned char fn = (unsigned char)*n;
53144+
53145+ if (c == '\0')
53146+ return 1;
53147+ else {
53148+ if (c == fn)
53149+ goto matched;
53150+ cold = c;
53151+ c = *p++;
53152+
53153+ if (c == '-' && *p != ']') {
53154+ unsigned char cend = *p++;
53155+
53156+ if (cend == '\0')
53157+ return 1;
53158+
53159+ if (cold <= fn && fn <= cend)
53160+ goto matched;
53161+
53162+ c = *p++;
53163+ }
53164+ }
53165+
53166+ if (c == ']')
53167+ break;
53168+ }
53169+ if (!not)
53170+ return 1;
53171+ break;
53172+ matched:
53173+ while (c != ']') {
53174+ if (c == '\0')
53175+ return 1;
53176+
53177+ c = *p++;
53178+ }
53179+ if (not)
53180+ return 1;
53181+ }
53182+ break;
53183+ default:
53184+ if (c != *n)
53185+ return 1;
53186+ }
53187+
53188+ ++n;
53189+ }
53190+
53191+ if (*n == '\0')
53192+ return 0;
53193+
53194+ if (*n == '/')
53195+ return 0;
53196+
53197+ return 1;
53198+}
53199+
53200+static struct acl_object_label *
53201+chk_glob_label(struct acl_object_label *globbed,
53202+ struct dentry *dentry, struct vfsmount *mnt, char **path)
53203+{
53204+ struct acl_object_label *tmp;
53205+
53206+ if (*path == NULL)
53207+ *path = gr_to_filename_nolock(dentry, mnt);
53208+
53209+ tmp = globbed;
53210+
53211+ while (tmp) {
53212+ if (!glob_match(tmp->filename, *path))
53213+ return tmp;
53214+ tmp = tmp->next;
53215+ }
53216+
53217+ return NULL;
53218+}
53219+
53220+static struct acl_object_label *
53221+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53222+ const ino_t curr_ino, const dev_t curr_dev,
53223+ const struct acl_subject_label *subj, char **path, const int checkglob)
53224+{
53225+ struct acl_subject_label *tmpsubj;
53226+ struct acl_object_label *retval;
53227+ struct acl_object_label *retval2;
53228+
53229+ tmpsubj = (struct acl_subject_label *) subj;
53230+ read_lock(&gr_inode_lock);
53231+ do {
53232+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53233+ if (retval) {
53234+ if (checkglob && retval->globbed) {
53235+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53236+ (struct vfsmount *)orig_mnt, path);
53237+ if (retval2)
53238+ retval = retval2;
53239+ }
53240+ break;
53241+ }
53242+ } while ((tmpsubj = tmpsubj->parent_subject));
53243+ read_unlock(&gr_inode_lock);
53244+
53245+ return retval;
53246+}
53247+
53248+static __inline__ struct acl_object_label *
53249+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53250+ struct dentry *curr_dentry,
53251+ const struct acl_subject_label *subj, char **path, const int checkglob)
53252+{
53253+ int newglob = checkglob;
53254+ ino_t inode;
53255+ dev_t device;
53256+
53257+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53258+ as we don't want a / * rule to match instead of the / object
53259+ don't do this for create lookups that call this function though, since they're looking up
53260+ on the parent and thus need globbing checks on all paths
53261+ */
53262+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53263+ newglob = GR_NO_GLOB;
53264+
53265+ spin_lock(&curr_dentry->d_lock);
53266+ inode = curr_dentry->d_inode->i_ino;
53267+ device = __get_dev(curr_dentry);
53268+ spin_unlock(&curr_dentry->d_lock);
53269+
53270+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53271+}
53272+
53273+static struct acl_object_label *
53274+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53275+ const struct acl_subject_label *subj, char *path, const int checkglob)
53276+{
53277+ struct dentry *dentry = (struct dentry *) l_dentry;
53278+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53279+ struct acl_object_label *retval;
53280+ struct dentry *parent;
53281+
53282+ write_seqlock(&rename_lock);
53283+ br_read_lock(vfsmount_lock);
53284+
53285+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53286+#ifdef CONFIG_NET
53287+ mnt == sock_mnt ||
53288+#endif
53289+#ifdef CONFIG_HUGETLBFS
53290+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53291+#endif
53292+ /* ignore Eric Biederman */
53293+ IS_PRIVATE(l_dentry->d_inode))) {
53294+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
53295+ goto out;
53296+ }
53297+
53298+ for (;;) {
53299+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53300+ break;
53301+
53302+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53303+ if (mnt->mnt_parent == mnt)
53304+ break;
53305+
53306+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53307+ if (retval != NULL)
53308+ goto out;
53309+
53310+ dentry = mnt->mnt_mountpoint;
53311+ mnt = mnt->mnt_parent;
53312+ continue;
53313+ }
53314+
53315+ parent = dentry->d_parent;
53316+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53317+ if (retval != NULL)
53318+ goto out;
53319+
53320+ dentry = parent;
53321+ }
53322+
53323+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53324+
53325+ /* real_root is pinned so we don't have to hold a reference */
53326+ if (retval == NULL)
53327+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53328+out:
53329+ br_read_unlock(vfsmount_lock);
53330+ write_sequnlock(&rename_lock);
53331+
53332+ BUG_ON(retval == NULL);
53333+
53334+ return retval;
53335+}
53336+
53337+static __inline__ struct acl_object_label *
53338+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53339+ const struct acl_subject_label *subj)
53340+{
53341+ char *path = NULL;
53342+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53343+}
53344+
53345+static __inline__ struct acl_object_label *
53346+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53347+ const struct acl_subject_label *subj)
53348+{
53349+ char *path = NULL;
53350+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53351+}
53352+
53353+static __inline__ struct acl_object_label *
53354+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53355+ const struct acl_subject_label *subj, char *path)
53356+{
53357+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53358+}
53359+
53360+static struct acl_subject_label *
53361+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53362+ const struct acl_role_label *role)
53363+{
53364+ struct dentry *dentry = (struct dentry *) l_dentry;
53365+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53366+ struct acl_subject_label *retval;
53367+ struct dentry *parent;
53368+
53369+ write_seqlock(&rename_lock);
53370+ br_read_lock(vfsmount_lock);
53371+
53372+ for (;;) {
53373+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53374+ break;
53375+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53376+ if (mnt->mnt_parent == mnt)
53377+ break;
53378+
53379+ spin_lock(&dentry->d_lock);
53380+ read_lock(&gr_inode_lock);
53381+ retval =
53382+ lookup_acl_subj_label(dentry->d_inode->i_ino,
53383+ __get_dev(dentry), role);
53384+ read_unlock(&gr_inode_lock);
53385+ spin_unlock(&dentry->d_lock);
53386+ if (retval != NULL)
53387+ goto out;
53388+
53389+ dentry = mnt->mnt_mountpoint;
53390+ mnt = mnt->mnt_parent;
53391+ continue;
53392+ }
53393+
53394+ spin_lock(&dentry->d_lock);
53395+ read_lock(&gr_inode_lock);
53396+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53397+ __get_dev(dentry), role);
53398+ read_unlock(&gr_inode_lock);
53399+ parent = dentry->d_parent;
53400+ spin_unlock(&dentry->d_lock);
53401+
53402+ if (retval != NULL)
53403+ goto out;
53404+
53405+ dentry = parent;
53406+ }
53407+
53408+ spin_lock(&dentry->d_lock);
53409+ read_lock(&gr_inode_lock);
53410+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53411+ __get_dev(dentry), role);
53412+ read_unlock(&gr_inode_lock);
53413+ spin_unlock(&dentry->d_lock);
53414+
53415+ if (unlikely(retval == NULL)) {
53416+ /* real_root is pinned, we don't need to hold a reference */
53417+ read_lock(&gr_inode_lock);
53418+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53419+ __get_dev(real_root.dentry), role);
53420+ read_unlock(&gr_inode_lock);
53421+ }
53422+out:
53423+ br_read_unlock(vfsmount_lock);
53424+ write_sequnlock(&rename_lock);
53425+
53426+ BUG_ON(retval == NULL);
53427+
53428+ return retval;
53429+}
53430+
53431+static void
53432+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53433+{
53434+ struct task_struct *task = current;
53435+ const struct cred *cred = current_cred();
53436+
53437+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53438+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53439+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53440+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53441+
53442+ return;
53443+}
53444+
53445+static void
53446+gr_log_learn_sysctl(const char *path, const __u32 mode)
53447+{
53448+ struct task_struct *task = current;
53449+ const struct cred *cred = current_cred();
53450+
53451+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53452+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53453+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53454+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
53455+
53456+ return;
53457+}
53458+
53459+static void
53460+gr_log_learn_id_change(const char type, const unsigned int real,
53461+ const unsigned int effective, const unsigned int fs)
53462+{
53463+ struct task_struct *task = current;
53464+ const struct cred *cred = current_cred();
53465+
53466+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53467+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53468+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53469+ type, real, effective, fs, &task->signal->saved_ip);
53470+
53471+ return;
53472+}
53473+
53474+__u32
53475+gr_search_file(const struct dentry * dentry, const __u32 mode,
53476+ const struct vfsmount * mnt)
53477+{
53478+ __u32 retval = mode;
53479+ struct acl_subject_label *curracl;
53480+ struct acl_object_label *currobj;
53481+
53482+ if (unlikely(!(gr_status & GR_READY)))
53483+ return (mode & ~GR_AUDITS);
53484+
53485+ curracl = current->acl;
53486+
53487+ currobj = chk_obj_label(dentry, mnt, curracl);
53488+ retval = currobj->mode & mode;
53489+
53490+ /* if we're opening a specified transfer file for writing
53491+ (e.g. /dev/initctl), then transfer our role to init
53492+ */
53493+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53494+ current->role->roletype & GR_ROLE_PERSIST)) {
53495+ struct task_struct *task = init_pid_ns.child_reaper;
53496+
53497+ if (task->role != current->role) {
53498+ task->acl_sp_role = 0;
53499+ task->acl_role_id = current->acl_role_id;
53500+ task->role = current->role;
53501+ rcu_read_lock();
53502+ read_lock(&grsec_exec_file_lock);
53503+ gr_apply_subject_to_task(task);
53504+ read_unlock(&grsec_exec_file_lock);
53505+ rcu_read_unlock();
53506+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53507+ }
53508+ }
53509+
53510+ if (unlikely
53511+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53512+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53513+ __u32 new_mode = mode;
53514+
53515+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53516+
53517+ retval = new_mode;
53518+
53519+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53520+ new_mode |= GR_INHERIT;
53521+
53522+ if (!(mode & GR_NOLEARN))
53523+ gr_log_learn(dentry, mnt, new_mode);
53524+ }
53525+
53526+ return retval;
53527+}
53528+
53529+struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
53530+ const struct dentry *parent,
53531+ const struct vfsmount *mnt)
53532+{
53533+ struct name_entry *match;
53534+ struct acl_object_label *matchpo;
53535+ struct acl_subject_label *curracl;
53536+ char *path;
53537+
53538+ if (unlikely(!(gr_status & GR_READY)))
53539+ return NULL;
53540+
53541+ preempt_disable();
53542+ path = gr_to_filename_rbac(new_dentry, mnt);
53543+ match = lookup_name_entry_create(path);
53544+
53545+ curracl = current->acl;
53546+
53547+ if (match) {
53548+ read_lock(&gr_inode_lock);
53549+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53550+ read_unlock(&gr_inode_lock);
53551+
53552+ if (matchpo) {
53553+ preempt_enable();
53554+ return matchpo;
53555+ }
53556+ }
53557+
53558+ // lookup parent
53559+
53560+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53561+
53562+ preempt_enable();
53563+ return matchpo;
53564+}
53565+
53566+__u32
53567+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53568+ const struct vfsmount * mnt, const __u32 mode)
53569+{
53570+ struct acl_object_label *matchpo;
53571+ __u32 retval;
53572+
53573+ if (unlikely(!(gr_status & GR_READY)))
53574+ return (mode & ~GR_AUDITS);
53575+
53576+ matchpo = gr_get_create_object(new_dentry, parent, mnt);
53577+
53578+ retval = matchpo->mode & mode;
53579+
53580+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53581+ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53582+ __u32 new_mode = mode;
53583+
53584+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53585+
53586+ gr_log_learn(new_dentry, mnt, new_mode);
53587+ return new_mode;
53588+ }
53589+
53590+ return retval;
53591+}
53592+
53593+__u32
53594+gr_check_link(const struct dentry * new_dentry,
53595+ const struct dentry * parent_dentry,
53596+ const struct vfsmount * parent_mnt,
53597+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53598+{
53599+ struct acl_object_label *obj;
53600+ __u32 oldmode, newmode;
53601+ __u32 needmode;
53602+ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
53603+ GR_DELETE | GR_INHERIT;
53604+
53605+ if (unlikely(!(gr_status & GR_READY)))
53606+ return (GR_CREATE | GR_LINK);
53607+
53608+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53609+ oldmode = obj->mode;
53610+
53611+ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
53612+ newmode = obj->mode;
53613+
53614+ needmode = newmode & checkmodes;
53615+
53616+ // old name for hardlink must have at least the permissions of the new name
53617+ if ((oldmode & needmode) != needmode)
53618+ goto bad;
53619+
53620+ // if old name had restrictions/auditing, make sure the new name does as well
53621+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53622+
53623+ // don't allow hardlinking of suid/sgid files without permission
53624+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53625+ needmode |= GR_SETID;
53626+
53627+ if ((newmode & needmode) != needmode)
53628+ goto bad;
53629+
53630+ // enforce minimum permissions
53631+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53632+ return newmode;
53633+bad:
53634+ needmode = oldmode;
53635+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53636+ needmode |= GR_SETID;
53637+
53638+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53639+ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
53640+ return (GR_CREATE | GR_LINK);
53641+ } else if (newmode & GR_SUPPRESS)
53642+ return GR_SUPPRESS;
53643+ else
53644+ return 0;
53645+}
53646+
53647+int
53648+gr_check_hidden_task(const struct task_struct *task)
53649+{
53650+ if (unlikely(!(gr_status & GR_READY)))
53651+ return 0;
53652+
53653+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53654+ return 1;
53655+
53656+ return 0;
53657+}
53658+
53659+int
53660+gr_check_protected_task(const struct task_struct *task)
53661+{
53662+ if (unlikely(!(gr_status & GR_READY) || !task))
53663+ return 0;
53664+
53665+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53666+ task->acl != current->acl)
53667+ return 1;
53668+
53669+ return 0;
53670+}
53671+
53672+int
53673+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53674+{
53675+ struct task_struct *p;
53676+ int ret = 0;
53677+
53678+ if (unlikely(!(gr_status & GR_READY) || !pid))
53679+ return ret;
53680+
53681+ read_lock(&tasklist_lock);
53682+ do_each_pid_task(pid, type, p) {
53683+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53684+ p->acl != current->acl) {
53685+ ret = 1;
53686+ goto out;
53687+ }
53688+ } while_each_pid_task(pid, type, p);
53689+out:
53690+ read_unlock(&tasklist_lock);
53691+
53692+ return ret;
53693+}
53694+
53695+void
53696+gr_copy_label(struct task_struct *tsk)
53697+{
53698+ tsk->signal->used_accept = 0;
53699+ tsk->acl_sp_role = 0;
53700+ tsk->acl_role_id = current->acl_role_id;
53701+ tsk->acl = current->acl;
53702+ tsk->role = current->role;
53703+ tsk->signal->curr_ip = current->signal->curr_ip;
53704+ tsk->signal->saved_ip = current->signal->saved_ip;
53705+ if (current->exec_file)
53706+ get_file(current->exec_file);
53707+ tsk->exec_file = current->exec_file;
53708+ tsk->is_writable = current->is_writable;
53709+ if (unlikely(current->signal->used_accept)) {
53710+ current->signal->curr_ip = 0;
53711+ current->signal->saved_ip = 0;
53712+ }
53713+
53714+ return;
53715+}
53716+
53717+static void
53718+gr_set_proc_res(struct task_struct *task)
53719+{
53720+ struct acl_subject_label *proc;
53721+ unsigned short i;
53722+
53723+ proc = task->acl;
53724+
53725+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53726+ return;
53727+
53728+ for (i = 0; i < RLIM_NLIMITS; i++) {
53729+ if (!(proc->resmask & (1 << i)))
53730+ continue;
53731+
53732+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53733+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53734+ }
53735+
53736+ return;
53737+}
53738+
53739+extern int __gr_process_user_ban(struct user_struct *user);
53740+
53741+int
53742+gr_check_user_change(int real, int effective, int fs)
53743+{
53744+ unsigned int i;
53745+ __u16 num;
53746+ uid_t *uidlist;
53747+ int curuid;
53748+ int realok = 0;
53749+ int effectiveok = 0;
53750+ int fsok = 0;
53751+
53752+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53753+ struct user_struct *user;
53754+
53755+ if (real == -1)
53756+ goto skipit;
53757+
53758+ user = find_user(real);
53759+ if (user == NULL)
53760+ goto skipit;
53761+
53762+ if (__gr_process_user_ban(user)) {
53763+ /* for find_user */
53764+ free_uid(user);
53765+ return 1;
53766+ }
53767+
53768+ /* for find_user */
53769+ free_uid(user);
53770+
53771+skipit:
53772+#endif
53773+
53774+ if (unlikely(!(gr_status & GR_READY)))
53775+ return 0;
53776+
53777+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53778+ gr_log_learn_id_change('u', real, effective, fs);
53779+
53780+ num = current->acl->user_trans_num;
53781+ uidlist = current->acl->user_transitions;
53782+
53783+ if (uidlist == NULL)
53784+ return 0;
53785+
53786+ if (real == -1)
53787+ realok = 1;
53788+ if (effective == -1)
53789+ effectiveok = 1;
53790+ if (fs == -1)
53791+ fsok = 1;
53792+
53793+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53794+ for (i = 0; i < num; i++) {
53795+ curuid = (int)uidlist[i];
53796+ if (real == curuid)
53797+ realok = 1;
53798+ if (effective == curuid)
53799+ effectiveok = 1;
53800+ if (fs == curuid)
53801+ fsok = 1;
53802+ }
53803+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53804+ for (i = 0; i < num; i++) {
53805+ curuid = (int)uidlist[i];
53806+ if (real == curuid)
53807+ break;
53808+ if (effective == curuid)
53809+ break;
53810+ if (fs == curuid)
53811+ break;
53812+ }
53813+ /* not in deny list */
53814+ if (i == num) {
53815+ realok = 1;
53816+ effectiveok = 1;
53817+ fsok = 1;
53818+ }
53819+ }
53820+
53821+ if (realok && effectiveok && fsok)
53822+ return 0;
53823+ else {
53824+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53825+ return 1;
53826+ }
53827+}
53828+
53829+int
53830+gr_check_group_change(int real, int effective, int fs)
53831+{
53832+ unsigned int i;
53833+ __u16 num;
53834+ gid_t *gidlist;
53835+ int curgid;
53836+ int realok = 0;
53837+ int effectiveok = 0;
53838+ int fsok = 0;
53839+
53840+ if (unlikely(!(gr_status & GR_READY)))
53841+ return 0;
53842+
53843+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53844+ gr_log_learn_id_change('g', real, effective, fs);
53845+
53846+ num = current->acl->group_trans_num;
53847+ gidlist = current->acl->group_transitions;
53848+
53849+ if (gidlist == NULL)
53850+ return 0;
53851+
53852+ if (real == -1)
53853+ realok = 1;
53854+ if (effective == -1)
53855+ effectiveok = 1;
53856+ if (fs == -1)
53857+ fsok = 1;
53858+
53859+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53860+ for (i = 0; i < num; i++) {
53861+ curgid = (int)gidlist[i];
53862+ if (real == curgid)
53863+ realok = 1;
53864+ if (effective == curgid)
53865+ effectiveok = 1;
53866+ if (fs == curgid)
53867+ fsok = 1;
53868+ }
53869+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53870+ for (i = 0; i < num; i++) {
53871+ curgid = (int)gidlist[i];
53872+ if (real == curgid)
53873+ break;
53874+ if (effective == curgid)
53875+ break;
53876+ if (fs == curgid)
53877+ break;
53878+ }
53879+ /* not in deny list */
53880+ if (i == num) {
53881+ realok = 1;
53882+ effectiveok = 1;
53883+ fsok = 1;
53884+ }
53885+ }
53886+
53887+ if (realok && effectiveok && fsok)
53888+ return 0;
53889+ else {
53890+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53891+ return 1;
53892+ }
53893+}
53894+
53895+void
53896+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53897+{
53898+ struct acl_role_label *role = task->role;
53899+ struct acl_subject_label *subj = NULL;
53900+ struct acl_object_label *obj;
53901+ struct file *filp;
53902+
53903+ if (unlikely(!(gr_status & GR_READY)))
53904+ return;
53905+
53906+ filp = task->exec_file;
53907+
53908+ /* kernel process, we'll give them the kernel role */
53909+ if (unlikely(!filp)) {
53910+ task->role = kernel_role;
53911+ task->acl = kernel_role->root_label;
53912+ return;
53913+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53914+ role = lookup_acl_role_label(task, uid, gid);
53915+
53916+ /* perform subject lookup in possibly new role
53917+ we can use this result below in the case where role == task->role
53918+ */
53919+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53920+
53921+ /* if we changed uid/gid, but result in the same role
53922+ and are using inheritance, don't lose the inherited subject
53923+ if current subject is other than what normal lookup
53924+ would result in, we arrived via inheritance, don't
53925+ lose subject
53926+ */
53927+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53928+ (subj == task->acl)))
53929+ task->acl = subj;
53930+
53931+ task->role = role;
53932+
53933+ task->is_writable = 0;
53934+
53935+ /* ignore additional mmap checks for processes that are writable
53936+ by the default ACL */
53937+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53938+ if (unlikely(obj->mode & GR_WRITE))
53939+ task->is_writable = 1;
53940+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53941+ if (unlikely(obj->mode & GR_WRITE))
53942+ task->is_writable = 1;
53943+
53944+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53945+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53946+#endif
53947+
53948+ gr_set_proc_res(task);
53949+
53950+ return;
53951+}
53952+
53953+int
53954+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53955+ const int unsafe_share)
53956+{
53957+ struct task_struct *task = current;
53958+ struct acl_subject_label *newacl;
53959+ struct acl_object_label *obj;
53960+ __u32 retmode;
53961+
53962+ if (unlikely(!(gr_status & GR_READY)))
53963+ return 0;
53964+
53965+ newacl = chk_subj_label(dentry, mnt, task->role);
53966+
53967+ task_lock(task);
53968+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53969+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53970+ !(task->role->roletype & GR_ROLE_GOD) &&
53971+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53972+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53973+ task_unlock(task);
53974+ if (unsafe_share)
53975+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53976+ else
53977+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53978+ return -EACCES;
53979+ }
53980+ task_unlock(task);
53981+
53982+ obj = chk_obj_label(dentry, mnt, task->acl);
53983+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53984+
53985+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53986+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53987+ if (obj->nested)
53988+ task->acl = obj->nested;
53989+ else
53990+ task->acl = newacl;
53991+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53992+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53993+
53994+ task->is_writable = 0;
53995+
53996+ /* ignore additional mmap checks for processes that are writable
53997+ by the default ACL */
53998+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53999+ if (unlikely(obj->mode & GR_WRITE))
54000+ task->is_writable = 1;
54001+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
54002+ if (unlikely(obj->mode & GR_WRITE))
54003+ task->is_writable = 1;
54004+
54005+ gr_set_proc_res(task);
54006+
54007+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54008+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54009+#endif
54010+ return 0;
54011+}
54012+
54013+/* always called with valid inodev ptr */
54014+static void
54015+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
54016+{
54017+ struct acl_object_label *matchpo;
54018+ struct acl_subject_label *matchps;
54019+ struct acl_subject_label *subj;
54020+ struct acl_role_label *role;
54021+ unsigned int x;
54022+
54023+ FOR_EACH_ROLE_START(role)
54024+ FOR_EACH_SUBJECT_START(role, subj, x)
54025+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
54026+ matchpo->mode |= GR_DELETED;
54027+ FOR_EACH_SUBJECT_END(subj,x)
54028+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54029+ if (subj->inode == ino && subj->device == dev)
54030+ subj->mode |= GR_DELETED;
54031+ FOR_EACH_NESTED_SUBJECT_END(subj)
54032+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
54033+ matchps->mode |= GR_DELETED;
54034+ FOR_EACH_ROLE_END(role)
54035+
54036+ inodev->nentry->deleted = 1;
54037+
54038+ return;
54039+}
54040+
54041+void
54042+gr_handle_delete(const ino_t ino, const dev_t dev)
54043+{
54044+ struct inodev_entry *inodev;
54045+
54046+ if (unlikely(!(gr_status & GR_READY)))
54047+ return;
54048+
54049+ write_lock(&gr_inode_lock);
54050+ inodev = lookup_inodev_entry(ino, dev);
54051+ if (inodev != NULL)
54052+ do_handle_delete(inodev, ino, dev);
54053+ write_unlock(&gr_inode_lock);
54054+
54055+ return;
54056+}
54057+
54058+static void
54059+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
54060+ const ino_t newinode, const dev_t newdevice,
54061+ struct acl_subject_label *subj)
54062+{
54063+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
54064+ struct acl_object_label *match;
54065+
54066+ match = subj->obj_hash[index];
54067+
54068+ while (match && (match->inode != oldinode ||
54069+ match->device != olddevice ||
54070+ !(match->mode & GR_DELETED)))
54071+ match = match->next;
54072+
54073+ if (match && (match->inode == oldinode)
54074+ && (match->device == olddevice)
54075+ && (match->mode & GR_DELETED)) {
54076+ if (match->prev == NULL) {
54077+ subj->obj_hash[index] = match->next;
54078+ if (match->next != NULL)
54079+ match->next->prev = NULL;
54080+ } else {
54081+ match->prev->next = match->next;
54082+ if (match->next != NULL)
54083+ match->next->prev = match->prev;
54084+ }
54085+ match->prev = NULL;
54086+ match->next = NULL;
54087+ match->inode = newinode;
54088+ match->device = newdevice;
54089+ match->mode &= ~GR_DELETED;
54090+
54091+ insert_acl_obj_label(match, subj);
54092+ }
54093+
54094+ return;
54095+}
54096+
54097+static void
54098+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
54099+ const ino_t newinode, const dev_t newdevice,
54100+ struct acl_role_label *role)
54101+{
54102+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
54103+ struct acl_subject_label *match;
54104+
54105+ match = role->subj_hash[index];
54106+
54107+ while (match && (match->inode != oldinode ||
54108+ match->device != olddevice ||
54109+ !(match->mode & GR_DELETED)))
54110+ match = match->next;
54111+
54112+ if (match && (match->inode == oldinode)
54113+ && (match->device == olddevice)
54114+ && (match->mode & GR_DELETED)) {
54115+ if (match->prev == NULL) {
54116+ role->subj_hash[index] = match->next;
54117+ if (match->next != NULL)
54118+ match->next->prev = NULL;
54119+ } else {
54120+ match->prev->next = match->next;
54121+ if (match->next != NULL)
54122+ match->next->prev = match->prev;
54123+ }
54124+ match->prev = NULL;
54125+ match->next = NULL;
54126+ match->inode = newinode;
54127+ match->device = newdevice;
54128+ match->mode &= ~GR_DELETED;
54129+
54130+ insert_acl_subj_label(match, role);
54131+ }
54132+
54133+ return;
54134+}
54135+
54136+static void
54137+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
54138+ const ino_t newinode, const dev_t newdevice)
54139+{
54140+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
54141+ struct inodev_entry *match;
54142+
54143+ match = inodev_set.i_hash[index];
54144+
54145+ while (match && (match->nentry->inode != oldinode ||
54146+ match->nentry->device != olddevice || !match->nentry->deleted))
54147+ match = match->next;
54148+
54149+ if (match && (match->nentry->inode == oldinode)
54150+ && (match->nentry->device == olddevice) &&
54151+ match->nentry->deleted) {
54152+ if (match->prev == NULL) {
54153+ inodev_set.i_hash[index] = match->next;
54154+ if (match->next != NULL)
54155+ match->next->prev = NULL;
54156+ } else {
54157+ match->prev->next = match->next;
54158+ if (match->next != NULL)
54159+ match->next->prev = match->prev;
54160+ }
54161+ match->prev = NULL;
54162+ match->next = NULL;
54163+ match->nentry->inode = newinode;
54164+ match->nentry->device = newdevice;
54165+ match->nentry->deleted = 0;
54166+
54167+ insert_inodev_entry(match);
54168+ }
54169+
54170+ return;
54171+}
54172+
54173+static void
54174+__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
54175+{
54176+ struct acl_subject_label *subj;
54177+ struct acl_role_label *role;
54178+ unsigned int x;
54179+
54180+ FOR_EACH_ROLE_START(role)
54181+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54182+
54183+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54184+ if ((subj->inode == ino) && (subj->device == dev)) {
54185+ subj->inode = ino;
54186+ subj->device = dev;
54187+ }
54188+ FOR_EACH_NESTED_SUBJECT_END(subj)
54189+ FOR_EACH_SUBJECT_START(role, subj, x)
54190+ update_acl_obj_label(matchn->inode, matchn->device,
54191+ ino, dev, subj);
54192+ FOR_EACH_SUBJECT_END(subj,x)
54193+ FOR_EACH_ROLE_END(role)
54194+
54195+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54196+
54197+ return;
54198+}
54199+
54200+static void
54201+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54202+ const struct vfsmount *mnt)
54203+{
54204+ ino_t ino = dentry->d_inode->i_ino;
54205+ dev_t dev = __get_dev(dentry);
54206+
54207+ __do_handle_create(matchn, ino, dev);
54208+
54209+ return;
54210+}
54211+
54212+void
54213+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54214+{
54215+ struct name_entry *matchn;
54216+
54217+ if (unlikely(!(gr_status & GR_READY)))
54218+ return;
54219+
54220+ preempt_disable();
54221+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54222+
54223+ if (unlikely((unsigned long)matchn)) {
54224+ write_lock(&gr_inode_lock);
54225+ do_handle_create(matchn, dentry, mnt);
54226+ write_unlock(&gr_inode_lock);
54227+ }
54228+ preempt_enable();
54229+
54230+ return;
54231+}
54232+
54233+void
54234+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
54235+{
54236+ struct name_entry *matchn;
54237+
54238+ if (unlikely(!(gr_status & GR_READY)))
54239+ return;
54240+
54241+ preempt_disable();
54242+ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
54243+
54244+ if (unlikely((unsigned long)matchn)) {
54245+ write_lock(&gr_inode_lock);
54246+ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
54247+ write_unlock(&gr_inode_lock);
54248+ }
54249+ preempt_enable();
54250+
54251+ return;
54252+}
54253+
54254+void
54255+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54256+ struct dentry *old_dentry,
54257+ struct dentry *new_dentry,
54258+ struct vfsmount *mnt, const __u8 replace)
54259+{
54260+ struct name_entry *matchn;
54261+ struct inodev_entry *inodev;
54262+ struct inode *inode = new_dentry->d_inode;
54263+ ino_t old_ino = old_dentry->d_inode->i_ino;
54264+ dev_t old_dev = __get_dev(old_dentry);
54265+
54266+ /* vfs_rename swaps the name and parent link for old_dentry and
54267+ new_dentry
54268+ at this point, old_dentry has the new name, parent link, and inode
54269+ for the renamed file
54270+ if a file is being replaced by a rename, new_dentry has the inode
54271+ and name for the replaced file
54272+ */
54273+
54274+ if (unlikely(!(gr_status & GR_READY)))
54275+ return;
54276+
54277+ preempt_disable();
54278+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54279+
54280+ /* we wouldn't have to check d_inode if it weren't for
54281+ NFS silly-renaming
54282+ */
54283+
54284+ write_lock(&gr_inode_lock);
54285+ if (unlikely(replace && inode)) {
54286+ ino_t new_ino = inode->i_ino;
54287+ dev_t new_dev = __get_dev(new_dentry);
54288+
54289+ inodev = lookup_inodev_entry(new_ino, new_dev);
54290+ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
54291+ do_handle_delete(inodev, new_ino, new_dev);
54292+ }
54293+
54294+ inodev = lookup_inodev_entry(old_ino, old_dev);
54295+ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
54296+ do_handle_delete(inodev, old_ino, old_dev);
54297+
54298+ if (unlikely((unsigned long)matchn))
54299+ do_handle_create(matchn, old_dentry, mnt);
54300+
54301+ write_unlock(&gr_inode_lock);
54302+ preempt_enable();
54303+
54304+ return;
54305+}
54306+
54307+static int
54308+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54309+ unsigned char **sum)
54310+{
54311+ struct acl_role_label *r;
54312+ struct role_allowed_ip *ipp;
54313+ struct role_transition *trans;
54314+ unsigned int i;
54315+ int found = 0;
54316+ u32 curr_ip = current->signal->curr_ip;
54317+
54318+ current->signal->saved_ip = curr_ip;
54319+
54320+ /* check transition table */
54321+
54322+ for (trans = current->role->transitions; trans; trans = trans->next) {
54323+ if (!strcmp(rolename, trans->rolename)) {
54324+ found = 1;
54325+ break;
54326+ }
54327+ }
54328+
54329+ if (!found)
54330+ return 0;
54331+
54332+ /* handle special roles that do not require authentication
54333+ and check ip */
54334+
54335+ FOR_EACH_ROLE_START(r)
54336+ if (!strcmp(rolename, r->rolename) &&
54337+ (r->roletype & GR_ROLE_SPECIAL)) {
54338+ found = 0;
54339+ if (r->allowed_ips != NULL) {
54340+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54341+ if ((ntohl(curr_ip) & ipp->netmask) ==
54342+ (ntohl(ipp->addr) & ipp->netmask))
54343+ found = 1;
54344+ }
54345+ } else
54346+ found = 2;
54347+ if (!found)
54348+ return 0;
54349+
54350+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54351+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54352+ *salt = NULL;
54353+ *sum = NULL;
54354+ return 1;
54355+ }
54356+ }
54357+ FOR_EACH_ROLE_END(r)
54358+
54359+ for (i = 0; i < num_sprole_pws; i++) {
54360+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54361+ *salt = acl_special_roles[i]->salt;
54362+ *sum = acl_special_roles[i]->sum;
54363+ return 1;
54364+ }
54365+ }
54366+
54367+ return 0;
54368+}
54369+
54370+static void
54371+assign_special_role(char *rolename)
54372+{
54373+ struct acl_object_label *obj;
54374+ struct acl_role_label *r;
54375+ struct acl_role_label *assigned = NULL;
54376+ struct task_struct *tsk;
54377+ struct file *filp;
54378+
54379+ FOR_EACH_ROLE_START(r)
54380+ if (!strcmp(rolename, r->rolename) &&
54381+ (r->roletype & GR_ROLE_SPECIAL)) {
54382+ assigned = r;
54383+ break;
54384+ }
54385+ FOR_EACH_ROLE_END(r)
54386+
54387+ if (!assigned)
54388+ return;
54389+
54390+ read_lock(&tasklist_lock);
54391+ read_lock(&grsec_exec_file_lock);
54392+
54393+ tsk = current->real_parent;
54394+ if (tsk == NULL)
54395+ goto out_unlock;
54396+
54397+ filp = tsk->exec_file;
54398+ if (filp == NULL)
54399+ goto out_unlock;
54400+
54401+ tsk->is_writable = 0;
54402+
54403+ tsk->acl_sp_role = 1;
54404+ tsk->acl_role_id = ++acl_sp_role_value;
54405+ tsk->role = assigned;
54406+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54407+
54408+ /* ignore additional mmap checks for processes that are writable
54409+ by the default ACL */
54410+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54411+ if (unlikely(obj->mode & GR_WRITE))
54412+ tsk->is_writable = 1;
54413+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54414+ if (unlikely(obj->mode & GR_WRITE))
54415+ tsk->is_writable = 1;
54416+
54417+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54418+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54419+#endif
54420+
54421+out_unlock:
54422+ read_unlock(&grsec_exec_file_lock);
54423+ read_unlock(&tasklist_lock);
54424+ return;
54425+}
54426+
54427+int gr_check_secure_terminal(struct task_struct *task)
54428+{
54429+ struct task_struct *p, *p2, *p3;
54430+ struct files_struct *files;
54431+ struct fdtable *fdt;
54432+ struct file *our_file = NULL, *file;
54433+ int i;
54434+
54435+ if (task->signal->tty == NULL)
54436+ return 1;
54437+
54438+ files = get_files_struct(task);
54439+ if (files != NULL) {
54440+ rcu_read_lock();
54441+ fdt = files_fdtable(files);
54442+ for (i=0; i < fdt->max_fds; i++) {
54443+ file = fcheck_files(files, i);
54444+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54445+ get_file(file);
54446+ our_file = file;
54447+ }
54448+ }
54449+ rcu_read_unlock();
54450+ put_files_struct(files);
54451+ }
54452+
54453+ if (our_file == NULL)
54454+ return 1;
54455+
54456+ read_lock(&tasklist_lock);
54457+ do_each_thread(p2, p) {
54458+ files = get_files_struct(p);
54459+ if (files == NULL ||
54460+ (p->signal && p->signal->tty == task->signal->tty)) {
54461+ if (files != NULL)
54462+ put_files_struct(files);
54463+ continue;
54464+ }
54465+ rcu_read_lock();
54466+ fdt = files_fdtable(files);
54467+ for (i=0; i < fdt->max_fds; i++) {
54468+ file = fcheck_files(files, i);
54469+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54470+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54471+ p3 = task;
54472+ while (p3->pid > 0) {
54473+ if (p3 == p)
54474+ break;
54475+ p3 = p3->real_parent;
54476+ }
54477+ if (p3 == p)
54478+ break;
54479+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54480+ gr_handle_alertkill(p);
54481+ rcu_read_unlock();
54482+ put_files_struct(files);
54483+ read_unlock(&tasklist_lock);
54484+ fput(our_file);
54485+ return 0;
54486+ }
54487+ }
54488+ rcu_read_unlock();
54489+ put_files_struct(files);
54490+ } while_each_thread(p2, p);
54491+ read_unlock(&tasklist_lock);
54492+
54493+ fput(our_file);
54494+ return 1;
54495+}
54496+
54497+ssize_t
54498+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54499+{
54500+ struct gr_arg_wrapper uwrap;
54501+ unsigned char *sprole_salt = NULL;
54502+ unsigned char *sprole_sum = NULL;
54503+ int error = sizeof (struct gr_arg_wrapper);
54504+ int error2 = 0;
54505+
54506+ mutex_lock(&gr_dev_mutex);
54507+
54508+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54509+ error = -EPERM;
54510+ goto out;
54511+ }
54512+
54513+ if (count != sizeof (struct gr_arg_wrapper)) {
54514+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54515+ error = -EINVAL;
54516+ goto out;
54517+ }
54518+
54519+
54520+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54521+ gr_auth_expires = 0;
54522+ gr_auth_attempts = 0;
54523+ }
54524+
54525+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54526+ error = -EFAULT;
54527+ goto out;
54528+ }
54529+
54530+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54531+ error = -EINVAL;
54532+ goto out;
54533+ }
54534+
54535+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54536+ error = -EFAULT;
54537+ goto out;
54538+ }
54539+
54540+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54541+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54542+ time_after(gr_auth_expires, get_seconds())) {
54543+ error = -EBUSY;
54544+ goto out;
54545+ }
54546+
54547+ /* if non-root trying to do anything other than use a special role,
54548+ do not attempt authentication, do not count towards authentication
54549+ locking
54550+ */
54551+
54552+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54553+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54554+ current_uid()) {
54555+ error = -EPERM;
54556+ goto out;
54557+ }
54558+
54559+ /* ensure pw and special role name are null terminated */
54560+
54561+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54562+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54563+
54564+ /* Okay.
54565+ * We have our enough of the argument structure..(we have yet
54566+ * to copy_from_user the tables themselves) . Copy the tables
54567+ * only if we need them, i.e. for loading operations. */
54568+
54569+ switch (gr_usermode->mode) {
54570+ case GR_STATUS:
54571+ if (gr_status & GR_READY) {
54572+ error = 1;
54573+ if (!gr_check_secure_terminal(current))
54574+ error = 3;
54575+ } else
54576+ error = 2;
54577+ goto out;
54578+ case GR_SHUTDOWN:
54579+ if ((gr_status & GR_READY)
54580+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54581+ pax_open_kernel();
54582+ gr_status &= ~GR_READY;
54583+ pax_close_kernel();
54584+
54585+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54586+ free_variables();
54587+ memset(gr_usermode, 0, sizeof (struct gr_arg));
54588+ memset(gr_system_salt, 0, GR_SALT_LEN);
54589+ memset(gr_system_sum, 0, GR_SHA_LEN);
54590+ } else if (gr_status & GR_READY) {
54591+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54592+ error = -EPERM;
54593+ } else {
54594+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54595+ error = -EAGAIN;
54596+ }
54597+ break;
54598+ case GR_ENABLE:
54599+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54600+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54601+ else {
54602+ if (gr_status & GR_READY)
54603+ error = -EAGAIN;
54604+ else
54605+ error = error2;
54606+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54607+ }
54608+ break;
54609+ case GR_RELOAD:
54610+ if (!(gr_status & GR_READY)) {
54611+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54612+ error = -EAGAIN;
54613+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54614+ preempt_disable();
54615+
54616+ pax_open_kernel();
54617+ gr_status &= ~GR_READY;
54618+ pax_close_kernel();
54619+
54620+ free_variables();
54621+ if (!(error2 = gracl_init(gr_usermode))) {
54622+ preempt_enable();
54623+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54624+ } else {
54625+ preempt_enable();
54626+ error = error2;
54627+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54628+ }
54629+ } else {
54630+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54631+ error = -EPERM;
54632+ }
54633+ break;
54634+ case GR_SEGVMOD:
54635+ if (unlikely(!(gr_status & GR_READY))) {
54636+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54637+ error = -EAGAIN;
54638+ break;
54639+ }
54640+
54641+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54642+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54643+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54644+ struct acl_subject_label *segvacl;
54645+ segvacl =
54646+ lookup_acl_subj_label(gr_usermode->segv_inode,
54647+ gr_usermode->segv_device,
54648+ current->role);
54649+ if (segvacl) {
54650+ segvacl->crashes = 0;
54651+ segvacl->expires = 0;
54652+ }
54653+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54654+ gr_remove_uid(gr_usermode->segv_uid);
54655+ }
54656+ } else {
54657+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54658+ error = -EPERM;
54659+ }
54660+ break;
54661+ case GR_SPROLE:
54662+ case GR_SPROLEPAM:
54663+ if (unlikely(!(gr_status & GR_READY))) {
54664+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54665+ error = -EAGAIN;
54666+ break;
54667+ }
54668+
54669+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54670+ current->role->expires = 0;
54671+ current->role->auth_attempts = 0;
54672+ }
54673+
54674+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54675+ time_after(current->role->expires, get_seconds())) {
54676+ error = -EBUSY;
54677+ goto out;
54678+ }
54679+
54680+ if (lookup_special_role_auth
54681+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54682+ && ((!sprole_salt && !sprole_sum)
54683+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54684+ char *p = "";
54685+ assign_special_role(gr_usermode->sp_role);
54686+ read_lock(&tasklist_lock);
54687+ if (current->real_parent)
54688+ p = current->real_parent->role->rolename;
54689+ read_unlock(&tasklist_lock);
54690+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54691+ p, acl_sp_role_value);
54692+ } else {
54693+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54694+ error = -EPERM;
54695+ if(!(current->role->auth_attempts++))
54696+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54697+
54698+ goto out;
54699+ }
54700+ break;
54701+ case GR_UNSPROLE:
54702+ if (unlikely(!(gr_status & GR_READY))) {
54703+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54704+ error = -EAGAIN;
54705+ break;
54706+ }
54707+
54708+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54709+ char *p = "";
54710+ int i = 0;
54711+
54712+ read_lock(&tasklist_lock);
54713+ if (current->real_parent) {
54714+ p = current->real_parent->role->rolename;
54715+ i = current->real_parent->acl_role_id;
54716+ }
54717+ read_unlock(&tasklist_lock);
54718+
54719+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54720+ gr_set_acls(1);
54721+ } else {
54722+ error = -EPERM;
54723+ goto out;
54724+ }
54725+ break;
54726+ default:
54727+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54728+ error = -EINVAL;
54729+ break;
54730+ }
54731+
54732+ if (error != -EPERM)
54733+ goto out;
54734+
54735+ if(!(gr_auth_attempts++))
54736+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54737+
54738+ out:
54739+ mutex_unlock(&gr_dev_mutex);
54740+ return error;
54741+}
54742+
54743+/* must be called with
54744+ rcu_read_lock();
54745+ read_lock(&tasklist_lock);
54746+ read_lock(&grsec_exec_file_lock);
54747+*/
54748+int gr_apply_subject_to_task(struct task_struct *task)
54749+{
54750+ struct acl_object_label *obj;
54751+ char *tmpname;
54752+ struct acl_subject_label *tmpsubj;
54753+ struct file *filp;
54754+ struct name_entry *nmatch;
54755+
54756+ filp = task->exec_file;
54757+ if (filp == NULL)
54758+ return 0;
54759+
54760+ /* the following is to apply the correct subject
54761+ on binaries running when the RBAC system
54762+ is enabled, when the binaries have been
54763+ replaced or deleted since their execution
54764+ -----
54765+ when the RBAC system starts, the inode/dev
54766+ from exec_file will be one the RBAC system
54767+ is unaware of. It only knows the inode/dev
54768+ of the present file on disk, or the absence
54769+ of it.
54770+ */
54771+ preempt_disable();
54772+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54773+
54774+ nmatch = lookup_name_entry(tmpname);
54775+ preempt_enable();
54776+ tmpsubj = NULL;
54777+ if (nmatch) {
54778+ if (nmatch->deleted)
54779+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54780+ else
54781+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54782+ if (tmpsubj != NULL)
54783+ task->acl = tmpsubj;
54784+ }
54785+ if (tmpsubj == NULL)
54786+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54787+ task->role);
54788+ if (task->acl) {
54789+ task->is_writable = 0;
54790+ /* ignore additional mmap checks for processes that are writable
54791+ by the default ACL */
54792+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54793+ if (unlikely(obj->mode & GR_WRITE))
54794+ task->is_writable = 1;
54795+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54796+ if (unlikely(obj->mode & GR_WRITE))
54797+ task->is_writable = 1;
54798+
54799+ gr_set_proc_res(task);
54800+
54801+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54802+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54803+#endif
54804+ } else {
54805+ return 1;
54806+ }
54807+
54808+ return 0;
54809+}
54810+
54811+int
54812+gr_set_acls(const int type)
54813+{
54814+ struct task_struct *task, *task2;
54815+ struct acl_role_label *role = current->role;
54816+ __u16 acl_role_id = current->acl_role_id;
54817+ const struct cred *cred;
54818+ int ret;
54819+
54820+ rcu_read_lock();
54821+ read_lock(&tasklist_lock);
54822+ read_lock(&grsec_exec_file_lock);
54823+ do_each_thread(task2, task) {
54824+ /* check to see if we're called from the exit handler,
54825+ if so, only replace ACLs that have inherited the admin
54826+ ACL */
54827+
54828+ if (type && (task->role != role ||
54829+ task->acl_role_id != acl_role_id))
54830+ continue;
54831+
54832+ task->acl_role_id = 0;
54833+ task->acl_sp_role = 0;
54834+
54835+ if (task->exec_file) {
54836+ cred = __task_cred(task);
54837+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54838+ ret = gr_apply_subject_to_task(task);
54839+ if (ret) {
54840+ read_unlock(&grsec_exec_file_lock);
54841+ read_unlock(&tasklist_lock);
54842+ rcu_read_unlock();
54843+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54844+ return ret;
54845+ }
54846+ } else {
54847+ // it's a kernel process
54848+ task->role = kernel_role;
54849+ task->acl = kernel_role->root_label;
54850+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54851+ task->acl->mode &= ~GR_PROCFIND;
54852+#endif
54853+ }
54854+ } while_each_thread(task2, task);
54855+ read_unlock(&grsec_exec_file_lock);
54856+ read_unlock(&tasklist_lock);
54857+ rcu_read_unlock();
54858+
54859+ return 0;
54860+}
54861+
54862+void
54863+gr_learn_resource(const struct task_struct *task,
54864+ const int res, const unsigned long wanted, const int gt)
54865+{
54866+ struct acl_subject_label *acl;
54867+ const struct cred *cred;
54868+
54869+ if (unlikely((gr_status & GR_READY) &&
54870+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54871+ goto skip_reslog;
54872+
54873+#ifdef CONFIG_GRKERNSEC_RESLOG
54874+ gr_log_resource(task, res, wanted, gt);
54875+#endif
54876+ skip_reslog:
54877+
54878+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54879+ return;
54880+
54881+ acl = task->acl;
54882+
54883+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54884+ !(acl->resmask & (1 << (unsigned short) res))))
54885+ return;
54886+
54887+ if (wanted >= acl->res[res].rlim_cur) {
54888+ unsigned long res_add;
54889+
54890+ res_add = wanted;
54891+ switch (res) {
54892+ case RLIMIT_CPU:
54893+ res_add += GR_RLIM_CPU_BUMP;
54894+ break;
54895+ case RLIMIT_FSIZE:
54896+ res_add += GR_RLIM_FSIZE_BUMP;
54897+ break;
54898+ case RLIMIT_DATA:
54899+ res_add += GR_RLIM_DATA_BUMP;
54900+ break;
54901+ case RLIMIT_STACK:
54902+ res_add += GR_RLIM_STACK_BUMP;
54903+ break;
54904+ case RLIMIT_CORE:
54905+ res_add += GR_RLIM_CORE_BUMP;
54906+ break;
54907+ case RLIMIT_RSS:
54908+ res_add += GR_RLIM_RSS_BUMP;
54909+ break;
54910+ case RLIMIT_NPROC:
54911+ res_add += GR_RLIM_NPROC_BUMP;
54912+ break;
54913+ case RLIMIT_NOFILE:
54914+ res_add += GR_RLIM_NOFILE_BUMP;
54915+ break;
54916+ case RLIMIT_MEMLOCK:
54917+ res_add += GR_RLIM_MEMLOCK_BUMP;
54918+ break;
54919+ case RLIMIT_AS:
54920+ res_add += GR_RLIM_AS_BUMP;
54921+ break;
54922+ case RLIMIT_LOCKS:
54923+ res_add += GR_RLIM_LOCKS_BUMP;
54924+ break;
54925+ case RLIMIT_SIGPENDING:
54926+ res_add += GR_RLIM_SIGPENDING_BUMP;
54927+ break;
54928+ case RLIMIT_MSGQUEUE:
54929+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54930+ break;
54931+ case RLIMIT_NICE:
54932+ res_add += GR_RLIM_NICE_BUMP;
54933+ break;
54934+ case RLIMIT_RTPRIO:
54935+ res_add += GR_RLIM_RTPRIO_BUMP;
54936+ break;
54937+ case RLIMIT_RTTIME:
54938+ res_add += GR_RLIM_RTTIME_BUMP;
54939+ break;
54940+ }
54941+
54942+ acl->res[res].rlim_cur = res_add;
54943+
54944+ if (wanted > acl->res[res].rlim_max)
54945+ acl->res[res].rlim_max = res_add;
54946+
54947+ /* only log the subject filename, since resource logging is supported for
54948+ single-subject learning only */
54949+ rcu_read_lock();
54950+ cred = __task_cred(task);
54951+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54952+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54953+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54954+ "", (unsigned long) res, &task->signal->saved_ip);
54955+ rcu_read_unlock();
54956+ }
54957+
54958+ return;
54959+}
54960+
54961+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54962+void
54963+pax_set_initial_flags(struct linux_binprm *bprm)
54964+{
54965+ struct task_struct *task = current;
54966+ struct acl_subject_label *proc;
54967+ unsigned long flags;
54968+
54969+ if (unlikely(!(gr_status & GR_READY)))
54970+ return;
54971+
54972+ flags = pax_get_flags(task);
54973+
54974+ proc = task->acl;
54975+
54976+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54977+ flags &= ~MF_PAX_PAGEEXEC;
54978+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54979+ flags &= ~MF_PAX_SEGMEXEC;
54980+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54981+ flags &= ~MF_PAX_RANDMMAP;
54982+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54983+ flags &= ~MF_PAX_EMUTRAMP;
54984+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54985+ flags &= ~MF_PAX_MPROTECT;
54986+
54987+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54988+ flags |= MF_PAX_PAGEEXEC;
54989+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54990+ flags |= MF_PAX_SEGMEXEC;
54991+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54992+ flags |= MF_PAX_RANDMMAP;
54993+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54994+ flags |= MF_PAX_EMUTRAMP;
54995+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54996+ flags |= MF_PAX_MPROTECT;
54997+
54998+ pax_set_flags(task, flags);
54999+
55000+ return;
55001+}
55002+#endif
55003+
55004+#ifdef CONFIG_SYSCTL
55005+/* Eric Biederman likes breaking userland ABI and every inode-based security
55006+ system to save 35kb of memory */
55007+
55008+/* we modify the passed in filename, but adjust it back before returning */
55009+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
55010+{
55011+ struct name_entry *nmatch;
55012+ char *p, *lastp = NULL;
55013+ struct acl_object_label *obj = NULL, *tmp;
55014+ struct acl_subject_label *tmpsubj;
55015+ char c = '\0';
55016+
55017+ read_lock(&gr_inode_lock);
55018+
55019+ p = name + len - 1;
55020+ do {
55021+ nmatch = lookup_name_entry(name);
55022+ if (lastp != NULL)
55023+ *lastp = c;
55024+
55025+ if (nmatch == NULL)
55026+ goto next_component;
55027+ tmpsubj = current->acl;
55028+ do {
55029+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
55030+ if (obj != NULL) {
55031+ tmp = obj->globbed;
55032+ while (tmp) {
55033+ if (!glob_match(tmp->filename, name)) {
55034+ obj = tmp;
55035+ goto found_obj;
55036+ }
55037+ tmp = tmp->next;
55038+ }
55039+ goto found_obj;
55040+ }
55041+ } while ((tmpsubj = tmpsubj->parent_subject));
55042+next_component:
55043+ /* end case */
55044+ if (p == name)
55045+ break;
55046+
55047+ while (*p != '/')
55048+ p--;
55049+ if (p == name)
55050+ lastp = p + 1;
55051+ else {
55052+ lastp = p;
55053+ p--;
55054+ }
55055+ c = *lastp;
55056+ *lastp = '\0';
55057+ } while (1);
55058+found_obj:
55059+ read_unlock(&gr_inode_lock);
55060+ /* obj returned will always be non-null */
55061+ return obj;
55062+}
55063+
55064+/* returns 0 when allowing, non-zero on error
55065+ op of 0 is used for readdir, so we don't log the names of hidden files
55066+*/
55067+__u32
55068+gr_handle_sysctl(const struct ctl_table *table, const int op)
55069+{
55070+ struct ctl_table *tmp;
55071+ const char *proc_sys = "/proc/sys";
55072+ char *path;
55073+ struct acl_object_label *obj;
55074+ unsigned short len = 0, pos = 0, depth = 0, i;
55075+ __u32 err = 0;
55076+ __u32 mode = 0;
55077+
55078+ if (unlikely(!(gr_status & GR_READY)))
55079+ return 0;
55080+
55081+ /* for now, ignore operations on non-sysctl entries if it's not a
55082+ readdir*/
55083+ if (table->child != NULL && op != 0)
55084+ return 0;
55085+
55086+ mode |= GR_FIND;
55087+ /* it's only a read if it's an entry, read on dirs is for readdir */
55088+ if (op & MAY_READ)
55089+ mode |= GR_READ;
55090+ if (op & MAY_WRITE)
55091+ mode |= GR_WRITE;
55092+
55093+ preempt_disable();
55094+
55095+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
55096+
55097+ /* it's only a read/write if it's an actual entry, not a dir
55098+ (which are opened for readdir)
55099+ */
55100+
55101+ /* convert the requested sysctl entry into a pathname */
55102+
55103+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55104+ len += strlen(tmp->procname);
55105+ len++;
55106+ depth++;
55107+ }
55108+
55109+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
55110+ /* deny */
55111+ goto out;
55112+ }
55113+
55114+ memset(path, 0, PAGE_SIZE);
55115+
55116+ memcpy(path, proc_sys, strlen(proc_sys));
55117+
55118+ pos += strlen(proc_sys);
55119+
55120+ for (; depth > 0; depth--) {
55121+ path[pos] = '/';
55122+ pos++;
55123+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55124+ if (depth == i) {
55125+ memcpy(path + pos, tmp->procname,
55126+ strlen(tmp->procname));
55127+ pos += strlen(tmp->procname);
55128+ }
55129+ i++;
55130+ }
55131+ }
55132+
55133+ obj = gr_lookup_by_name(path, pos);
55134+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
55135+
55136+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
55137+ ((err & mode) != mode))) {
55138+ __u32 new_mode = mode;
55139+
55140+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
55141+
55142+ err = 0;
55143+ gr_log_learn_sysctl(path, new_mode);
55144+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
55145+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
55146+ err = -ENOENT;
55147+ } else if (!(err & GR_FIND)) {
55148+ err = -ENOENT;
55149+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
55150+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
55151+ path, (mode & GR_READ) ? " reading" : "",
55152+ (mode & GR_WRITE) ? " writing" : "");
55153+ err = -EACCES;
55154+ } else if ((err & mode) != mode) {
55155+ err = -EACCES;
55156+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
55157+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
55158+ path, (mode & GR_READ) ? " reading" : "",
55159+ (mode & GR_WRITE) ? " writing" : "");
55160+ err = 0;
55161+ } else
55162+ err = 0;
55163+
55164+ out:
55165+ preempt_enable();
55166+
55167+ return err;
55168+}
55169+#endif
55170+
55171+int
55172+gr_handle_proc_ptrace(struct task_struct *task)
55173+{
55174+ struct file *filp;
55175+ struct task_struct *tmp = task;
55176+ struct task_struct *curtemp = current;
55177+ __u32 retmode;
55178+
55179+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55180+ if (unlikely(!(gr_status & GR_READY)))
55181+ return 0;
55182+#endif
55183+
55184+ read_lock(&tasklist_lock);
55185+ read_lock(&grsec_exec_file_lock);
55186+ filp = task->exec_file;
55187+
55188+ while (tmp->pid > 0) {
55189+ if (tmp == curtemp)
55190+ break;
55191+ tmp = tmp->real_parent;
55192+ }
55193+
55194+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55195+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
55196+ read_unlock(&grsec_exec_file_lock);
55197+ read_unlock(&tasklist_lock);
55198+ return 1;
55199+ }
55200+
55201+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55202+ if (!(gr_status & GR_READY)) {
55203+ read_unlock(&grsec_exec_file_lock);
55204+ read_unlock(&tasklist_lock);
55205+ return 0;
55206+ }
55207+#endif
55208+
55209+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55210+ read_unlock(&grsec_exec_file_lock);
55211+ read_unlock(&tasklist_lock);
55212+
55213+ if (retmode & GR_NOPTRACE)
55214+ return 1;
55215+
55216+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55217+ && (current->acl != task->acl || (current->acl != current->role->root_label
55218+ && current->pid != task->pid)))
55219+ return 1;
55220+
55221+ return 0;
55222+}
55223+
55224+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55225+{
55226+ if (unlikely(!(gr_status & GR_READY)))
55227+ return;
55228+
55229+ if (!(current->role->roletype & GR_ROLE_GOD))
55230+ return;
55231+
55232+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55233+ p->role->rolename, gr_task_roletype_to_char(p),
55234+ p->acl->filename);
55235+}
55236+
55237+int
55238+gr_handle_ptrace(struct task_struct *task, const long request)
55239+{
55240+ struct task_struct *tmp = task;
55241+ struct task_struct *curtemp = current;
55242+ __u32 retmode;
55243+
55244+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55245+ if (unlikely(!(gr_status & GR_READY)))
55246+ return 0;
55247+#endif
55248+
55249+ read_lock(&tasklist_lock);
55250+ while (tmp->pid > 0) {
55251+ if (tmp == curtemp)
55252+ break;
55253+ tmp = tmp->real_parent;
55254+ }
55255+
55256+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55257+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55258+ read_unlock(&tasklist_lock);
55259+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55260+ return 1;
55261+ }
55262+ read_unlock(&tasklist_lock);
55263+
55264+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55265+ if (!(gr_status & GR_READY))
55266+ return 0;
55267+#endif
55268+
55269+ read_lock(&grsec_exec_file_lock);
55270+ if (unlikely(!task->exec_file)) {
55271+ read_unlock(&grsec_exec_file_lock);
55272+ return 0;
55273+ }
55274+
55275+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55276+ read_unlock(&grsec_exec_file_lock);
55277+
55278+ if (retmode & GR_NOPTRACE) {
55279+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55280+ return 1;
55281+ }
55282+
55283+ if (retmode & GR_PTRACERD) {
55284+ switch (request) {
55285+ case PTRACE_SEIZE:
55286+ case PTRACE_POKETEXT:
55287+ case PTRACE_POKEDATA:
55288+ case PTRACE_POKEUSR:
55289+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55290+ case PTRACE_SETREGS:
55291+ case PTRACE_SETFPREGS:
55292+#endif
55293+#ifdef CONFIG_X86
55294+ case PTRACE_SETFPXREGS:
55295+#endif
55296+#ifdef CONFIG_ALTIVEC
55297+ case PTRACE_SETVRREGS:
55298+#endif
55299+ return 1;
55300+ default:
55301+ return 0;
55302+ }
55303+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
55304+ !(current->role->roletype & GR_ROLE_GOD) &&
55305+ (current->acl != task->acl)) {
55306+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55307+ return 1;
55308+ }
55309+
55310+ return 0;
55311+}
55312+
55313+static int is_writable_mmap(const struct file *filp)
55314+{
55315+ struct task_struct *task = current;
55316+ struct acl_object_label *obj, *obj2;
55317+
55318+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55319+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55320+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55321+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55322+ task->role->root_label);
55323+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55324+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55325+ return 1;
55326+ }
55327+ }
55328+ return 0;
55329+}
55330+
55331+int
55332+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55333+{
55334+ __u32 mode;
55335+
55336+ if (unlikely(!file || !(prot & PROT_EXEC)))
55337+ return 1;
55338+
55339+ if (is_writable_mmap(file))
55340+ return 0;
55341+
55342+ mode =
55343+ gr_search_file(file->f_path.dentry,
55344+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55345+ file->f_path.mnt);
55346+
55347+ if (!gr_tpe_allow(file))
55348+ return 0;
55349+
55350+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55351+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55352+ return 0;
55353+ } else if (unlikely(!(mode & GR_EXEC))) {
55354+ return 0;
55355+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55356+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55357+ return 1;
55358+ }
55359+
55360+ return 1;
55361+}
55362+
55363+int
55364+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55365+{
55366+ __u32 mode;
55367+
55368+ if (unlikely(!file || !(prot & PROT_EXEC)))
55369+ return 1;
55370+
55371+ if (is_writable_mmap(file))
55372+ return 0;
55373+
55374+ mode =
55375+ gr_search_file(file->f_path.dentry,
55376+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55377+ file->f_path.mnt);
55378+
55379+ if (!gr_tpe_allow(file))
55380+ return 0;
55381+
55382+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55383+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55384+ return 0;
55385+ } else if (unlikely(!(mode & GR_EXEC))) {
55386+ return 0;
55387+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55388+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55389+ return 1;
55390+ }
55391+
55392+ return 1;
55393+}
55394+
55395+void
55396+gr_acl_handle_psacct(struct task_struct *task, const long code)
55397+{
55398+ unsigned long runtime;
55399+ unsigned long cputime;
55400+ unsigned int wday, cday;
55401+ __u8 whr, chr;
55402+ __u8 wmin, cmin;
55403+ __u8 wsec, csec;
55404+ struct timespec timeval;
55405+
55406+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55407+ !(task->acl->mode & GR_PROCACCT)))
55408+ return;
55409+
55410+ do_posix_clock_monotonic_gettime(&timeval);
55411+ runtime = timeval.tv_sec - task->start_time.tv_sec;
55412+ wday = runtime / (3600 * 24);
55413+ runtime -= wday * (3600 * 24);
55414+ whr = runtime / 3600;
55415+ runtime -= whr * 3600;
55416+ wmin = runtime / 60;
55417+ runtime -= wmin * 60;
55418+ wsec = runtime;
55419+
55420+ cputime = (task->utime + task->stime) / HZ;
55421+ cday = cputime / (3600 * 24);
55422+ cputime -= cday * (3600 * 24);
55423+ chr = cputime / 3600;
55424+ cputime -= chr * 3600;
55425+ cmin = cputime / 60;
55426+ cputime -= cmin * 60;
55427+ csec = cputime;
55428+
55429+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55430+
55431+ return;
55432+}
55433+
55434+void gr_set_kernel_label(struct task_struct *task)
55435+{
55436+ if (gr_status & GR_READY) {
55437+ task->role = kernel_role;
55438+ task->acl = kernel_role->root_label;
55439+ }
55440+ return;
55441+}
55442+
55443+#ifdef CONFIG_TASKSTATS
55444+int gr_is_taskstats_denied(int pid)
55445+{
55446+ struct task_struct *task;
55447+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55448+ const struct cred *cred;
55449+#endif
55450+ int ret = 0;
55451+
55452+ /* restrict taskstats viewing to un-chrooted root users
55453+ who have the 'view' subject flag if the RBAC system is enabled
55454+ */
55455+
55456+ rcu_read_lock();
55457+ read_lock(&tasklist_lock);
55458+ task = find_task_by_vpid(pid);
55459+ if (task) {
55460+#ifdef CONFIG_GRKERNSEC_CHROOT
55461+ if (proc_is_chrooted(task))
55462+ ret = -EACCES;
55463+#endif
55464+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55465+ cred = __task_cred(task);
55466+#ifdef CONFIG_GRKERNSEC_PROC_USER
55467+ if (cred->uid != 0)
55468+ ret = -EACCES;
55469+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55470+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55471+ ret = -EACCES;
55472+#endif
55473+#endif
55474+ if (gr_status & GR_READY) {
55475+ if (!(task->acl->mode & GR_VIEW))
55476+ ret = -EACCES;
55477+ }
55478+ } else
55479+ ret = -ENOENT;
55480+
55481+ read_unlock(&tasklist_lock);
55482+ rcu_read_unlock();
55483+
55484+ return ret;
55485+}
55486+#endif
55487+
55488+/* AUXV entries are filled via a descendant of search_binary_handler
55489+ after we've already applied the subject for the target
55490+*/
55491+int gr_acl_enable_at_secure(void)
55492+{
55493+ if (unlikely(!(gr_status & GR_READY)))
55494+ return 0;
55495+
55496+ if (current->acl->mode & GR_ATSECURE)
55497+ return 1;
55498+
55499+ return 0;
55500+}
55501+
55502+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55503+{
55504+ struct task_struct *task = current;
55505+ struct dentry *dentry = file->f_path.dentry;
55506+ struct vfsmount *mnt = file->f_path.mnt;
55507+ struct acl_object_label *obj, *tmp;
55508+ struct acl_subject_label *subj;
55509+ unsigned int bufsize;
55510+ int is_not_root;
55511+ char *path;
55512+ dev_t dev = __get_dev(dentry);
55513+
55514+ if (unlikely(!(gr_status & GR_READY)))
55515+ return 1;
55516+
55517+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55518+ return 1;
55519+
55520+ /* ignore Eric Biederman */
55521+ if (IS_PRIVATE(dentry->d_inode))
55522+ return 1;
55523+
55524+ subj = task->acl;
55525+ do {
55526+ obj = lookup_acl_obj_label(ino, dev, subj);
55527+ if (obj != NULL)
55528+ return (obj->mode & GR_FIND) ? 1 : 0;
55529+ } while ((subj = subj->parent_subject));
55530+
55531+ /* this is purely an optimization since we're looking for an object
55532+ for the directory we're doing a readdir on
55533+ if it's possible for any globbed object to match the entry we're
55534+ filling into the directory, then the object we find here will be
55535+ an anchor point with attached globbed objects
55536+ */
55537+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55538+ if (obj->globbed == NULL)
55539+ return (obj->mode & GR_FIND) ? 1 : 0;
55540+
55541+ is_not_root = ((obj->filename[0] == '/') &&
55542+ (obj->filename[1] == '\0')) ? 0 : 1;
55543+ bufsize = PAGE_SIZE - namelen - is_not_root;
55544+
55545+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
55546+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55547+ return 1;
55548+
55549+ preempt_disable();
55550+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55551+ bufsize);
55552+
55553+ bufsize = strlen(path);
55554+
55555+ /* if base is "/", don't append an additional slash */
55556+ if (is_not_root)
55557+ *(path + bufsize) = '/';
55558+ memcpy(path + bufsize + is_not_root, name, namelen);
55559+ *(path + bufsize + namelen + is_not_root) = '\0';
55560+
55561+ tmp = obj->globbed;
55562+ while (tmp) {
55563+ if (!glob_match(tmp->filename, path)) {
55564+ preempt_enable();
55565+ return (tmp->mode & GR_FIND) ? 1 : 0;
55566+ }
55567+ tmp = tmp->next;
55568+ }
55569+ preempt_enable();
55570+ return (obj->mode & GR_FIND) ? 1 : 0;
55571+}
55572+
55573+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55574+EXPORT_SYMBOL(gr_acl_is_enabled);
55575+#endif
55576+EXPORT_SYMBOL(gr_learn_resource);
55577+EXPORT_SYMBOL(gr_set_kernel_label);
55578+#ifdef CONFIG_SECURITY
55579+EXPORT_SYMBOL(gr_check_user_change);
55580+EXPORT_SYMBOL(gr_check_group_change);
55581+#endif
55582+
55583diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
55584new file mode 100644
55585index 0000000..34fefda
55586--- /dev/null
55587+++ b/grsecurity/gracl_alloc.c
55588@@ -0,0 +1,105 @@
55589+#include <linux/kernel.h>
55590+#include <linux/mm.h>
55591+#include <linux/slab.h>
55592+#include <linux/vmalloc.h>
55593+#include <linux/gracl.h>
55594+#include <linux/grsecurity.h>
55595+
55596+static unsigned long alloc_stack_next = 1;
55597+static unsigned long alloc_stack_size = 1;
55598+static void **alloc_stack;
55599+
55600+static __inline__ int
55601+alloc_pop(void)
55602+{
55603+ if (alloc_stack_next == 1)
55604+ return 0;
55605+
55606+ kfree(alloc_stack[alloc_stack_next - 2]);
55607+
55608+ alloc_stack_next--;
55609+
55610+ return 1;
55611+}
55612+
55613+static __inline__ int
55614+alloc_push(void *buf)
55615+{
55616+ if (alloc_stack_next >= alloc_stack_size)
55617+ return 1;
55618+
55619+ alloc_stack[alloc_stack_next - 1] = buf;
55620+
55621+ alloc_stack_next++;
55622+
55623+ return 0;
55624+}
55625+
55626+void *
55627+acl_alloc(unsigned long len)
55628+{
55629+ void *ret = NULL;
55630+
55631+ if (!len || len > PAGE_SIZE)
55632+ goto out;
55633+
55634+ ret = kmalloc(len, GFP_KERNEL);
55635+
55636+ if (ret) {
55637+ if (alloc_push(ret)) {
55638+ kfree(ret);
55639+ ret = NULL;
55640+ }
55641+ }
55642+
55643+out:
55644+ return ret;
55645+}
55646+
55647+void *
55648+acl_alloc_num(unsigned long num, unsigned long len)
55649+{
55650+ if (!len || (num > (PAGE_SIZE / len)))
55651+ return NULL;
55652+
55653+ return acl_alloc(num * len);
55654+}
55655+
55656+void
55657+acl_free_all(void)
55658+{
55659+ if (gr_acl_is_enabled() || !alloc_stack)
55660+ return;
55661+
55662+ while (alloc_pop()) ;
55663+
55664+ if (alloc_stack) {
55665+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
55666+ kfree(alloc_stack);
55667+ else
55668+ vfree(alloc_stack);
55669+ }
55670+
55671+ alloc_stack = NULL;
55672+ alloc_stack_size = 1;
55673+ alloc_stack_next = 1;
55674+
55675+ return;
55676+}
55677+
55678+int
55679+acl_alloc_stack_init(unsigned long size)
55680+{
55681+ if ((size * sizeof (void *)) <= PAGE_SIZE)
55682+ alloc_stack =
55683+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
55684+ else
55685+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
55686+
55687+ alloc_stack_size = size;
55688+
55689+ if (!alloc_stack)
55690+ return 0;
55691+ else
55692+ return 1;
55693+}
55694diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
55695new file mode 100644
55696index 0000000..955ddfb
55697--- /dev/null
55698+++ b/grsecurity/gracl_cap.c
55699@@ -0,0 +1,101 @@
55700+#include <linux/kernel.h>
55701+#include <linux/module.h>
55702+#include <linux/sched.h>
55703+#include <linux/gracl.h>
55704+#include <linux/grsecurity.h>
55705+#include <linux/grinternal.h>
55706+
55707+extern const char *captab_log[];
55708+extern int captab_log_entries;
55709+
55710+int
55711+gr_acl_is_capable(const int cap)
55712+{
55713+ struct task_struct *task = current;
55714+ const struct cred *cred = current_cred();
55715+ struct acl_subject_label *curracl;
55716+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55717+ kernel_cap_t cap_audit = __cap_empty_set;
55718+
55719+ if (!gr_acl_is_enabled())
55720+ return 1;
55721+
55722+ curracl = task->acl;
55723+
55724+ cap_drop = curracl->cap_lower;
55725+ cap_mask = curracl->cap_mask;
55726+ cap_audit = curracl->cap_invert_audit;
55727+
55728+ while ((curracl = curracl->parent_subject)) {
55729+ /* if the cap isn't specified in the current computed mask but is specified in the
55730+ current level subject, and is lowered in the current level subject, then add
55731+ it to the set of dropped capabilities
55732+ otherwise, add the current level subject's mask to the current computed mask
55733+ */
55734+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55735+ cap_raise(cap_mask, cap);
55736+ if (cap_raised(curracl->cap_lower, cap))
55737+ cap_raise(cap_drop, cap);
55738+ if (cap_raised(curracl->cap_invert_audit, cap))
55739+ cap_raise(cap_audit, cap);
55740+ }
55741+ }
55742+
55743+ if (!cap_raised(cap_drop, cap)) {
55744+ if (cap_raised(cap_audit, cap))
55745+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55746+ return 1;
55747+ }
55748+
55749+ curracl = task->acl;
55750+
55751+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55752+ && cap_raised(cred->cap_effective, cap)) {
55753+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55754+ task->role->roletype, cred->uid,
55755+ cred->gid, task->exec_file ?
55756+ gr_to_filename(task->exec_file->f_path.dentry,
55757+ task->exec_file->f_path.mnt) : curracl->filename,
55758+ curracl->filename, 0UL,
55759+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55760+ return 1;
55761+ }
55762+
55763+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55764+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55765+ return 0;
55766+}
55767+
55768+int
55769+gr_acl_is_capable_nolog(const int cap)
55770+{
55771+ struct acl_subject_label *curracl;
55772+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55773+
55774+ if (!gr_acl_is_enabled())
55775+ return 1;
55776+
55777+ curracl = current->acl;
55778+
55779+ cap_drop = curracl->cap_lower;
55780+ cap_mask = curracl->cap_mask;
55781+
55782+ while ((curracl = curracl->parent_subject)) {
55783+ /* if the cap isn't specified in the current computed mask but is specified in the
55784+ current level subject, and is lowered in the current level subject, then add
55785+ it to the set of dropped capabilities
55786+ otherwise, add the current level subject's mask to the current computed mask
55787+ */
55788+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55789+ cap_raise(cap_mask, cap);
55790+ if (cap_raised(curracl->cap_lower, cap))
55791+ cap_raise(cap_drop, cap);
55792+ }
55793+ }
55794+
55795+ if (!cap_raised(cap_drop, cap))
55796+ return 1;
55797+
55798+ return 0;
55799+}
55800+
55801diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
55802new file mode 100644
55803index 0000000..4eda5c3
55804--- /dev/null
55805+++ b/grsecurity/gracl_fs.c
55806@@ -0,0 +1,433 @@
55807+#include <linux/kernel.h>
55808+#include <linux/sched.h>
55809+#include <linux/types.h>
55810+#include <linux/fs.h>
55811+#include <linux/file.h>
55812+#include <linux/stat.h>
55813+#include <linux/grsecurity.h>
55814+#include <linux/grinternal.h>
55815+#include <linux/gracl.h>
55816+
55817+__u32
55818+gr_acl_handle_hidden_file(const struct dentry * dentry,
55819+ const struct vfsmount * mnt)
55820+{
55821+ __u32 mode;
55822+
55823+ if (unlikely(!dentry->d_inode))
55824+ return GR_FIND;
55825+
55826+ mode =
55827+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55828+
55829+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55830+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55831+ return mode;
55832+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55833+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55834+ return 0;
55835+ } else if (unlikely(!(mode & GR_FIND)))
55836+ return 0;
55837+
55838+ return GR_FIND;
55839+}
55840+
55841+__u32
55842+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55843+ int acc_mode)
55844+{
55845+ __u32 reqmode = GR_FIND;
55846+ __u32 mode;
55847+
55848+ if (unlikely(!dentry->d_inode))
55849+ return reqmode;
55850+
55851+ if (acc_mode & MAY_APPEND)
55852+ reqmode |= GR_APPEND;
55853+ else if (acc_mode & MAY_WRITE)
55854+ reqmode |= GR_WRITE;
55855+ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
55856+ reqmode |= GR_READ;
55857+
55858+ mode =
55859+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55860+ mnt);
55861+
55862+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55863+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55864+ reqmode & GR_READ ? " reading" : "",
55865+ reqmode & GR_WRITE ? " writing" : reqmode &
55866+ GR_APPEND ? " appending" : "");
55867+ return reqmode;
55868+ } else
55869+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55870+ {
55871+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55872+ reqmode & GR_READ ? " reading" : "",
55873+ reqmode & GR_WRITE ? " writing" : reqmode &
55874+ GR_APPEND ? " appending" : "");
55875+ return 0;
55876+ } else if (unlikely((mode & reqmode) != reqmode))
55877+ return 0;
55878+
55879+ return reqmode;
55880+}
55881+
55882+__u32
55883+gr_acl_handle_creat(const struct dentry * dentry,
55884+ const struct dentry * p_dentry,
55885+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
55886+ const int imode)
55887+{
55888+ __u32 reqmode = GR_WRITE | GR_CREATE;
55889+ __u32 mode;
55890+
55891+ if (acc_mode & MAY_APPEND)
55892+ reqmode |= GR_APPEND;
55893+ // if a directory was required or the directory already exists, then
55894+ // don't count this open as a read
55895+ if ((acc_mode & MAY_READ) &&
55896+ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
55897+ reqmode |= GR_READ;
55898+ if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
55899+ reqmode |= GR_SETID;
55900+
55901+ mode =
55902+ gr_check_create(dentry, p_dentry, p_mnt,
55903+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55904+
55905+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55906+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55907+ reqmode & GR_READ ? " reading" : "",
55908+ reqmode & GR_WRITE ? " writing" : reqmode &
55909+ GR_APPEND ? " appending" : "");
55910+ return reqmode;
55911+ } else
55912+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55913+ {
55914+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55915+ reqmode & GR_READ ? " reading" : "",
55916+ reqmode & GR_WRITE ? " writing" : reqmode &
55917+ GR_APPEND ? " appending" : "");
55918+ return 0;
55919+ } else if (unlikely((mode & reqmode) != reqmode))
55920+ return 0;
55921+
55922+ return reqmode;
55923+}
55924+
55925+__u32
55926+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55927+ const int fmode)
55928+{
55929+ __u32 mode, reqmode = GR_FIND;
55930+
55931+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55932+ reqmode |= GR_EXEC;
55933+ if (fmode & S_IWOTH)
55934+ reqmode |= GR_WRITE;
55935+ if (fmode & S_IROTH)
55936+ reqmode |= GR_READ;
55937+
55938+ mode =
55939+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55940+ mnt);
55941+
55942+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55943+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55944+ reqmode & GR_READ ? " reading" : "",
55945+ reqmode & GR_WRITE ? " writing" : "",
55946+ reqmode & GR_EXEC ? " executing" : "");
55947+ return reqmode;
55948+ } else
55949+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55950+ {
55951+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55952+ reqmode & GR_READ ? " reading" : "",
55953+ reqmode & GR_WRITE ? " writing" : "",
55954+ reqmode & GR_EXEC ? " executing" : "");
55955+ return 0;
55956+ } else if (unlikely((mode & reqmode) != reqmode))
55957+ return 0;
55958+
55959+ return reqmode;
55960+}
55961+
55962+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55963+{
55964+ __u32 mode;
55965+
55966+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55967+
55968+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55969+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55970+ return mode;
55971+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55972+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55973+ return 0;
55974+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55975+ return 0;
55976+
55977+ return (reqmode);
55978+}
55979+
55980+__u32
55981+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55982+{
55983+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55984+}
55985+
55986+__u32
55987+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55988+{
55989+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55990+}
55991+
55992+__u32
55993+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55994+{
55995+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55996+}
55997+
55998+__u32
55999+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
56000+{
56001+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
56002+}
56003+
56004+__u32
56005+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
56006+ mode_t mode)
56007+{
56008+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
56009+ return 1;
56010+
56011+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56012+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56013+ GR_FCHMOD_ACL_MSG);
56014+ } else {
56015+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
56016+ }
56017+}
56018+
56019+__u32
56020+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
56021+ mode_t mode)
56022+{
56023+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56024+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56025+ GR_CHMOD_ACL_MSG);
56026+ } else {
56027+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
56028+ }
56029+}
56030+
56031+__u32
56032+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
56033+{
56034+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
56035+}
56036+
56037+__u32
56038+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
56039+{
56040+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
56041+}
56042+
56043+__u32
56044+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
56045+{
56046+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
56047+}
56048+
56049+__u32
56050+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
56051+{
56052+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
56053+ GR_UNIXCONNECT_ACL_MSG);
56054+}
56055+
56056+/* hardlinks require at minimum create and link permission,
56057+ any additional privilege required is based on the
56058+ privilege of the file being linked to
56059+*/
56060+__u32
56061+gr_acl_handle_link(const struct dentry * new_dentry,
56062+ const struct dentry * parent_dentry,
56063+ const struct vfsmount * parent_mnt,
56064+ const struct dentry * old_dentry,
56065+ const struct vfsmount * old_mnt, const char *to)
56066+{
56067+ __u32 mode;
56068+ __u32 needmode = GR_CREATE | GR_LINK;
56069+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
56070+
56071+ mode =
56072+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
56073+ old_mnt);
56074+
56075+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
56076+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56077+ return mode;
56078+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56079+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56080+ return 0;
56081+ } else if (unlikely((mode & needmode) != needmode))
56082+ return 0;
56083+
56084+ return 1;
56085+}
56086+
56087+__u32
56088+gr_acl_handle_symlink(const struct dentry * new_dentry,
56089+ const struct dentry * parent_dentry,
56090+ const struct vfsmount * parent_mnt, const char *from)
56091+{
56092+ __u32 needmode = GR_WRITE | GR_CREATE;
56093+ __u32 mode;
56094+
56095+ mode =
56096+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
56097+ GR_CREATE | GR_AUDIT_CREATE |
56098+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
56099+
56100+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
56101+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56102+ return mode;
56103+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56104+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56105+ return 0;
56106+ } else if (unlikely((mode & needmode) != needmode))
56107+ return 0;
56108+
56109+ return (GR_WRITE | GR_CREATE);
56110+}
56111+
56112+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
56113+{
56114+ __u32 mode;
56115+
56116+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
56117+
56118+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56119+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
56120+ return mode;
56121+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56122+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
56123+ return 0;
56124+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
56125+ return 0;
56126+
56127+ return (reqmode);
56128+}
56129+
56130+__u32
56131+gr_acl_handle_mknod(const struct dentry * new_dentry,
56132+ const struct dentry * parent_dentry,
56133+ const struct vfsmount * parent_mnt,
56134+ const int mode)
56135+{
56136+ __u32 reqmode = GR_WRITE | GR_CREATE;
56137+ if (unlikely(mode & (S_ISUID | S_ISGID)))
56138+ reqmode |= GR_SETID;
56139+
56140+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56141+ reqmode, GR_MKNOD_ACL_MSG);
56142+}
56143+
56144+__u32
56145+gr_acl_handle_mkdir(const struct dentry *new_dentry,
56146+ const struct dentry *parent_dentry,
56147+ const struct vfsmount *parent_mnt)
56148+{
56149+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56150+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
56151+}
56152+
56153+#define RENAME_CHECK_SUCCESS(old, new) \
56154+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
56155+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
56156+
56157+int
56158+gr_acl_handle_rename(struct dentry *new_dentry,
56159+ struct dentry *parent_dentry,
56160+ const struct vfsmount *parent_mnt,
56161+ struct dentry *old_dentry,
56162+ struct inode *old_parent_inode,
56163+ struct vfsmount *old_mnt, const char *newname)
56164+{
56165+ __u32 comp1, comp2;
56166+ int error = 0;
56167+
56168+ if (unlikely(!gr_acl_is_enabled()))
56169+ return 0;
56170+
56171+ if (!new_dentry->d_inode) {
56172+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
56173+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
56174+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
56175+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
56176+ GR_DELETE | GR_AUDIT_DELETE |
56177+ GR_AUDIT_READ | GR_AUDIT_WRITE |
56178+ GR_SUPPRESS, old_mnt);
56179+ } else {
56180+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
56181+ GR_CREATE | GR_DELETE |
56182+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
56183+ GR_AUDIT_READ | GR_AUDIT_WRITE |
56184+ GR_SUPPRESS, parent_mnt);
56185+ comp2 =
56186+ gr_search_file(old_dentry,
56187+ GR_READ | GR_WRITE | GR_AUDIT_READ |
56188+ GR_DELETE | GR_AUDIT_DELETE |
56189+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
56190+ }
56191+
56192+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
56193+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
56194+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56195+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
56196+ && !(comp2 & GR_SUPPRESS)) {
56197+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56198+ error = -EACCES;
56199+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
56200+ error = -EACCES;
56201+
56202+ return error;
56203+}
56204+
56205+void
56206+gr_acl_handle_exit(void)
56207+{
56208+ u16 id;
56209+ char *rolename;
56210+ struct file *exec_file;
56211+
56212+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
56213+ !(current->role->roletype & GR_ROLE_PERSIST))) {
56214+ id = current->acl_role_id;
56215+ rolename = current->role->rolename;
56216+ gr_set_acls(1);
56217+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
56218+ }
56219+
56220+ write_lock(&grsec_exec_file_lock);
56221+ exec_file = current->exec_file;
56222+ current->exec_file = NULL;
56223+ write_unlock(&grsec_exec_file_lock);
56224+
56225+ if (exec_file)
56226+ fput(exec_file);
56227+}
56228+
56229+int
56230+gr_acl_handle_procpidmem(const struct task_struct *task)
56231+{
56232+ if (unlikely(!gr_acl_is_enabled()))
56233+ return 0;
56234+
56235+ if (task != current && task->acl->mode & GR_PROTPROCFD)
56236+ return -EACCES;
56237+
56238+ return 0;
56239+}
56240diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
56241new file mode 100644
56242index 0000000..17050ca
56243--- /dev/null
56244+++ b/grsecurity/gracl_ip.c
56245@@ -0,0 +1,381 @@
56246+#include <linux/kernel.h>
56247+#include <asm/uaccess.h>
56248+#include <asm/errno.h>
56249+#include <net/sock.h>
56250+#include <linux/file.h>
56251+#include <linux/fs.h>
56252+#include <linux/net.h>
56253+#include <linux/in.h>
56254+#include <linux/skbuff.h>
56255+#include <linux/ip.h>
56256+#include <linux/udp.h>
56257+#include <linux/types.h>
56258+#include <linux/sched.h>
56259+#include <linux/netdevice.h>
56260+#include <linux/inetdevice.h>
56261+#include <linux/gracl.h>
56262+#include <linux/grsecurity.h>
56263+#include <linux/grinternal.h>
56264+
56265+#define GR_BIND 0x01
56266+#define GR_CONNECT 0x02
56267+#define GR_INVERT 0x04
56268+#define GR_BINDOVERRIDE 0x08
56269+#define GR_CONNECTOVERRIDE 0x10
56270+#define GR_SOCK_FAMILY 0x20
56271+
56272+static const char * gr_protocols[IPPROTO_MAX] = {
56273+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
56274+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
56275+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
56276+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
56277+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
56278+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
56279+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
56280+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
56281+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
56282+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
56283+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
56284+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
56285+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
56286+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
56287+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
56288+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
56289+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56290+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56291+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56292+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56293+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56294+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56295+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56296+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56297+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56298+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56299+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56300+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56301+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56302+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56303+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56304+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56305+ };
56306+
56307+static const char * gr_socktypes[SOCK_MAX] = {
56308+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56309+ "unknown:7", "unknown:8", "unknown:9", "packet"
56310+ };
56311+
56312+static const char * gr_sockfamilies[AF_MAX+1] = {
56313+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56314+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56315+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56316+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56317+ };
56318+
56319+const char *
56320+gr_proto_to_name(unsigned char proto)
56321+{
56322+ return gr_protocols[proto];
56323+}
56324+
56325+const char *
56326+gr_socktype_to_name(unsigned char type)
56327+{
56328+ return gr_socktypes[type];
56329+}
56330+
56331+const char *
56332+gr_sockfamily_to_name(unsigned char family)
56333+{
56334+ return gr_sockfamilies[family];
56335+}
56336+
56337+int
56338+gr_search_socket(const int domain, const int type, const int protocol)
56339+{
56340+ struct acl_subject_label *curr;
56341+ const struct cred *cred = current_cred();
56342+
56343+ if (unlikely(!gr_acl_is_enabled()))
56344+ goto exit;
56345+
56346+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
56347+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56348+ goto exit; // let the kernel handle it
56349+
56350+ curr = current->acl;
56351+
56352+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56353+ /* the family is allowed, if this is PF_INET allow it only if
56354+ the extra sock type/protocol checks pass */
56355+ if (domain == PF_INET)
56356+ goto inet_check;
56357+ goto exit;
56358+ } else {
56359+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56360+ __u32 fakeip = 0;
56361+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56362+ current->role->roletype, cred->uid,
56363+ cred->gid, current->exec_file ?
56364+ gr_to_filename(current->exec_file->f_path.dentry,
56365+ current->exec_file->f_path.mnt) :
56366+ curr->filename, curr->filename,
56367+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56368+ &current->signal->saved_ip);
56369+ goto exit;
56370+ }
56371+ goto exit_fail;
56372+ }
56373+
56374+inet_check:
56375+ /* the rest of this checking is for IPv4 only */
56376+ if (!curr->ips)
56377+ goto exit;
56378+
56379+ if ((curr->ip_type & (1 << type)) &&
56380+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56381+ goto exit;
56382+
56383+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56384+ /* we don't place acls on raw sockets , and sometimes
56385+ dgram/ip sockets are opened for ioctl and not
56386+ bind/connect, so we'll fake a bind learn log */
56387+ if (type == SOCK_RAW || type == SOCK_PACKET) {
56388+ __u32 fakeip = 0;
56389+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56390+ current->role->roletype, cred->uid,
56391+ cred->gid, current->exec_file ?
56392+ gr_to_filename(current->exec_file->f_path.dentry,
56393+ current->exec_file->f_path.mnt) :
56394+ curr->filename, curr->filename,
56395+ &fakeip, 0, type,
56396+ protocol, GR_CONNECT, &current->signal->saved_ip);
56397+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56398+ __u32 fakeip = 0;
56399+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56400+ current->role->roletype, cred->uid,
56401+ cred->gid, current->exec_file ?
56402+ gr_to_filename(current->exec_file->f_path.dentry,
56403+ current->exec_file->f_path.mnt) :
56404+ curr->filename, curr->filename,
56405+ &fakeip, 0, type,
56406+ protocol, GR_BIND, &current->signal->saved_ip);
56407+ }
56408+ /* we'll log when they use connect or bind */
56409+ goto exit;
56410+ }
56411+
56412+exit_fail:
56413+ if (domain == PF_INET)
56414+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56415+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
56416+ else
56417+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56418+ gr_socktype_to_name(type), protocol);
56419+
56420+ return 0;
56421+exit:
56422+ return 1;
56423+}
56424+
56425+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56426+{
56427+ if ((ip->mode & mode) &&
56428+ (ip_port >= ip->low) &&
56429+ (ip_port <= ip->high) &&
56430+ ((ntohl(ip_addr) & our_netmask) ==
56431+ (ntohl(our_addr) & our_netmask))
56432+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56433+ && (ip->type & (1 << type))) {
56434+ if (ip->mode & GR_INVERT)
56435+ return 2; // specifically denied
56436+ else
56437+ return 1; // allowed
56438+ }
56439+
56440+ return 0; // not specifically allowed, may continue parsing
56441+}
56442+
56443+static int
56444+gr_search_connectbind(const int full_mode, struct sock *sk,
56445+ struct sockaddr_in *addr, const int type)
56446+{
56447+ char iface[IFNAMSIZ] = {0};
56448+ struct acl_subject_label *curr;
56449+ struct acl_ip_label *ip;
56450+ struct inet_sock *isk;
56451+ struct net_device *dev;
56452+ struct in_device *idev;
56453+ unsigned long i;
56454+ int ret;
56455+ int mode = full_mode & (GR_BIND | GR_CONNECT);
56456+ __u32 ip_addr = 0;
56457+ __u32 our_addr;
56458+ __u32 our_netmask;
56459+ char *p;
56460+ __u16 ip_port = 0;
56461+ const struct cred *cred = current_cred();
56462+
56463+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56464+ return 0;
56465+
56466+ curr = current->acl;
56467+ isk = inet_sk(sk);
56468+
56469+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56470+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56471+ addr->sin_addr.s_addr = curr->inaddr_any_override;
56472+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56473+ struct sockaddr_in saddr;
56474+ int err;
56475+
56476+ saddr.sin_family = AF_INET;
56477+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
56478+ saddr.sin_port = isk->inet_sport;
56479+
56480+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56481+ if (err)
56482+ return err;
56483+
56484+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56485+ if (err)
56486+ return err;
56487+ }
56488+
56489+ if (!curr->ips)
56490+ return 0;
56491+
56492+ ip_addr = addr->sin_addr.s_addr;
56493+ ip_port = ntohs(addr->sin_port);
56494+
56495+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56496+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56497+ current->role->roletype, cred->uid,
56498+ cred->gid, current->exec_file ?
56499+ gr_to_filename(current->exec_file->f_path.dentry,
56500+ current->exec_file->f_path.mnt) :
56501+ curr->filename, curr->filename,
56502+ &ip_addr, ip_port, type,
56503+ sk->sk_protocol, mode, &current->signal->saved_ip);
56504+ return 0;
56505+ }
56506+
56507+ for (i = 0; i < curr->ip_num; i++) {
56508+ ip = *(curr->ips + i);
56509+ if (ip->iface != NULL) {
56510+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
56511+ p = strchr(iface, ':');
56512+ if (p != NULL)
56513+ *p = '\0';
56514+ dev = dev_get_by_name(sock_net(sk), iface);
56515+ if (dev == NULL)
56516+ continue;
56517+ idev = in_dev_get(dev);
56518+ if (idev == NULL) {
56519+ dev_put(dev);
56520+ continue;
56521+ }
56522+ rcu_read_lock();
56523+ for_ifa(idev) {
56524+ if (!strcmp(ip->iface, ifa->ifa_label)) {
56525+ our_addr = ifa->ifa_address;
56526+ our_netmask = 0xffffffff;
56527+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56528+ if (ret == 1) {
56529+ rcu_read_unlock();
56530+ in_dev_put(idev);
56531+ dev_put(dev);
56532+ return 0;
56533+ } else if (ret == 2) {
56534+ rcu_read_unlock();
56535+ in_dev_put(idev);
56536+ dev_put(dev);
56537+ goto denied;
56538+ }
56539+ }
56540+ } endfor_ifa(idev);
56541+ rcu_read_unlock();
56542+ in_dev_put(idev);
56543+ dev_put(dev);
56544+ } else {
56545+ our_addr = ip->addr;
56546+ our_netmask = ip->netmask;
56547+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56548+ if (ret == 1)
56549+ return 0;
56550+ else if (ret == 2)
56551+ goto denied;
56552+ }
56553+ }
56554+
56555+denied:
56556+ if (mode == GR_BIND)
56557+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56558+ else if (mode == GR_CONNECT)
56559+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56560+
56561+ return -EACCES;
56562+}
56563+
56564+int
56565+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56566+{
56567+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56568+}
56569+
56570+int
56571+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56572+{
56573+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56574+}
56575+
56576+int gr_search_listen(struct socket *sock)
56577+{
56578+ struct sock *sk = sock->sk;
56579+ struct sockaddr_in addr;
56580+
56581+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56582+ addr.sin_port = inet_sk(sk)->inet_sport;
56583+
56584+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56585+}
56586+
56587+int gr_search_accept(struct socket *sock)
56588+{
56589+ struct sock *sk = sock->sk;
56590+ struct sockaddr_in addr;
56591+
56592+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56593+ addr.sin_port = inet_sk(sk)->inet_sport;
56594+
56595+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56596+}
56597+
56598+int
56599+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56600+{
56601+ if (addr)
56602+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56603+ else {
56604+ struct sockaddr_in sin;
56605+ const struct inet_sock *inet = inet_sk(sk);
56606+
56607+ sin.sin_addr.s_addr = inet->inet_daddr;
56608+ sin.sin_port = inet->inet_dport;
56609+
56610+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56611+ }
56612+}
56613+
56614+int
56615+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56616+{
56617+ struct sockaddr_in sin;
56618+
56619+ if (unlikely(skb->len < sizeof (struct udphdr)))
56620+ return 0; // skip this packet
56621+
56622+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56623+ sin.sin_port = udp_hdr(skb)->source;
56624+
56625+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56626+}
56627diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
56628new file mode 100644
56629index 0000000..25f54ef
56630--- /dev/null
56631+++ b/grsecurity/gracl_learn.c
56632@@ -0,0 +1,207 @@
56633+#include <linux/kernel.h>
56634+#include <linux/mm.h>
56635+#include <linux/sched.h>
56636+#include <linux/poll.h>
56637+#include <linux/string.h>
56638+#include <linux/file.h>
56639+#include <linux/types.h>
56640+#include <linux/vmalloc.h>
56641+#include <linux/grinternal.h>
56642+
56643+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56644+ size_t count, loff_t *ppos);
56645+extern int gr_acl_is_enabled(void);
56646+
56647+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56648+static int gr_learn_attached;
56649+
56650+/* use a 512k buffer */
56651+#define LEARN_BUFFER_SIZE (512 * 1024)
56652+
56653+static DEFINE_SPINLOCK(gr_learn_lock);
56654+static DEFINE_MUTEX(gr_learn_user_mutex);
56655+
56656+/* we need to maintain two buffers, so that the kernel context of grlearn
56657+ uses a semaphore around the userspace copying, and the other kernel contexts
56658+ use a spinlock when copying into the buffer, since they cannot sleep
56659+*/
56660+static char *learn_buffer;
56661+static char *learn_buffer_user;
56662+static int learn_buffer_len;
56663+static int learn_buffer_user_len;
56664+
56665+static ssize_t
56666+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56667+{
56668+ DECLARE_WAITQUEUE(wait, current);
56669+ ssize_t retval = 0;
56670+
56671+ add_wait_queue(&learn_wait, &wait);
56672+ set_current_state(TASK_INTERRUPTIBLE);
56673+ do {
56674+ mutex_lock(&gr_learn_user_mutex);
56675+ spin_lock(&gr_learn_lock);
56676+ if (learn_buffer_len)
56677+ break;
56678+ spin_unlock(&gr_learn_lock);
56679+ mutex_unlock(&gr_learn_user_mutex);
56680+ if (file->f_flags & O_NONBLOCK) {
56681+ retval = -EAGAIN;
56682+ goto out;
56683+ }
56684+ if (signal_pending(current)) {
56685+ retval = -ERESTARTSYS;
56686+ goto out;
56687+ }
56688+
56689+ schedule();
56690+ } while (1);
56691+
56692+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56693+ learn_buffer_user_len = learn_buffer_len;
56694+ retval = learn_buffer_len;
56695+ learn_buffer_len = 0;
56696+
56697+ spin_unlock(&gr_learn_lock);
56698+
56699+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56700+ retval = -EFAULT;
56701+
56702+ mutex_unlock(&gr_learn_user_mutex);
56703+out:
56704+ set_current_state(TASK_RUNNING);
56705+ remove_wait_queue(&learn_wait, &wait);
56706+ return retval;
56707+}
56708+
56709+static unsigned int
56710+poll_learn(struct file * file, poll_table * wait)
56711+{
56712+ poll_wait(file, &learn_wait, wait);
56713+
56714+ if (learn_buffer_len)
56715+ return (POLLIN | POLLRDNORM);
56716+
56717+ return 0;
56718+}
56719+
56720+void
56721+gr_clear_learn_entries(void)
56722+{
56723+ char *tmp;
56724+
56725+ mutex_lock(&gr_learn_user_mutex);
56726+ spin_lock(&gr_learn_lock);
56727+ tmp = learn_buffer;
56728+ learn_buffer = NULL;
56729+ spin_unlock(&gr_learn_lock);
56730+ if (tmp)
56731+ vfree(tmp);
56732+ if (learn_buffer_user != NULL) {
56733+ vfree(learn_buffer_user);
56734+ learn_buffer_user = NULL;
56735+ }
56736+ learn_buffer_len = 0;
56737+ mutex_unlock(&gr_learn_user_mutex);
56738+
56739+ return;
56740+}
56741+
56742+void
56743+gr_add_learn_entry(const char *fmt, ...)
56744+{
56745+ va_list args;
56746+ unsigned int len;
56747+
56748+ if (!gr_learn_attached)
56749+ return;
56750+
56751+ spin_lock(&gr_learn_lock);
56752+
56753+ /* leave a gap at the end so we know when it's "full" but don't have to
56754+ compute the exact length of the string we're trying to append
56755+ */
56756+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56757+ spin_unlock(&gr_learn_lock);
56758+ wake_up_interruptible(&learn_wait);
56759+ return;
56760+ }
56761+ if (learn_buffer == NULL) {
56762+ spin_unlock(&gr_learn_lock);
56763+ return;
56764+ }
56765+
56766+ va_start(args, fmt);
56767+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56768+ va_end(args);
56769+
56770+ learn_buffer_len += len + 1;
56771+
56772+ spin_unlock(&gr_learn_lock);
56773+ wake_up_interruptible(&learn_wait);
56774+
56775+ return;
56776+}
56777+
56778+static int
56779+open_learn(struct inode *inode, struct file *file)
56780+{
56781+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56782+ return -EBUSY;
56783+ if (file->f_mode & FMODE_READ) {
56784+ int retval = 0;
56785+ mutex_lock(&gr_learn_user_mutex);
56786+ if (learn_buffer == NULL)
56787+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56788+ if (learn_buffer_user == NULL)
56789+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56790+ if (learn_buffer == NULL) {
56791+ retval = -ENOMEM;
56792+ goto out_error;
56793+ }
56794+ if (learn_buffer_user == NULL) {
56795+ retval = -ENOMEM;
56796+ goto out_error;
56797+ }
56798+ learn_buffer_len = 0;
56799+ learn_buffer_user_len = 0;
56800+ gr_learn_attached = 1;
56801+out_error:
56802+ mutex_unlock(&gr_learn_user_mutex);
56803+ return retval;
56804+ }
56805+ return 0;
56806+}
56807+
56808+static int
56809+close_learn(struct inode *inode, struct file *file)
56810+{
56811+ if (file->f_mode & FMODE_READ) {
56812+ char *tmp = NULL;
56813+ mutex_lock(&gr_learn_user_mutex);
56814+ spin_lock(&gr_learn_lock);
56815+ tmp = learn_buffer;
56816+ learn_buffer = NULL;
56817+ spin_unlock(&gr_learn_lock);
56818+ if (tmp)
56819+ vfree(tmp);
56820+ if (learn_buffer_user != NULL) {
56821+ vfree(learn_buffer_user);
56822+ learn_buffer_user = NULL;
56823+ }
56824+ learn_buffer_len = 0;
56825+ learn_buffer_user_len = 0;
56826+ gr_learn_attached = 0;
56827+ mutex_unlock(&gr_learn_user_mutex);
56828+ }
56829+
56830+ return 0;
56831+}
56832+
56833+const struct file_operations grsec_fops = {
56834+ .read = read_learn,
56835+ .write = write_grsec_handler,
56836+ .open = open_learn,
56837+ .release = close_learn,
56838+ .poll = poll_learn,
56839+};
56840diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
56841new file mode 100644
56842index 0000000..39645c9
56843--- /dev/null
56844+++ b/grsecurity/gracl_res.c
56845@@ -0,0 +1,68 @@
56846+#include <linux/kernel.h>
56847+#include <linux/sched.h>
56848+#include <linux/gracl.h>
56849+#include <linux/grinternal.h>
56850+
56851+static const char *restab_log[] = {
56852+ [RLIMIT_CPU] = "RLIMIT_CPU",
56853+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56854+ [RLIMIT_DATA] = "RLIMIT_DATA",
56855+ [RLIMIT_STACK] = "RLIMIT_STACK",
56856+ [RLIMIT_CORE] = "RLIMIT_CORE",
56857+ [RLIMIT_RSS] = "RLIMIT_RSS",
56858+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56859+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56860+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56861+ [RLIMIT_AS] = "RLIMIT_AS",
56862+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56863+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56864+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56865+ [RLIMIT_NICE] = "RLIMIT_NICE",
56866+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56867+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56868+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56869+};
56870+
56871+void
56872+gr_log_resource(const struct task_struct *task,
56873+ const int res, const unsigned long wanted, const int gt)
56874+{
56875+ const struct cred *cred;
56876+ unsigned long rlim;
56877+
56878+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56879+ return;
56880+
56881+ // not yet supported resource
56882+ if (unlikely(!restab_log[res]))
56883+ return;
56884+
56885+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56886+ rlim = task_rlimit_max(task, res);
56887+ else
56888+ rlim = task_rlimit(task, res);
56889+
56890+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56891+ return;
56892+
56893+ rcu_read_lock();
56894+ cred = __task_cred(task);
56895+
56896+ if (res == RLIMIT_NPROC &&
56897+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56898+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56899+ goto out_rcu_unlock;
56900+ else if (res == RLIMIT_MEMLOCK &&
56901+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56902+ goto out_rcu_unlock;
56903+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56904+ goto out_rcu_unlock;
56905+ rcu_read_unlock();
56906+
56907+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56908+
56909+ return;
56910+out_rcu_unlock:
56911+ rcu_read_unlock();
56912+ return;
56913+}
56914diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
56915new file mode 100644
56916index 0000000..5556be3
56917--- /dev/null
56918+++ b/grsecurity/gracl_segv.c
56919@@ -0,0 +1,299 @@
56920+#include <linux/kernel.h>
56921+#include <linux/mm.h>
56922+#include <asm/uaccess.h>
56923+#include <asm/errno.h>
56924+#include <asm/mman.h>
56925+#include <net/sock.h>
56926+#include <linux/file.h>
56927+#include <linux/fs.h>
56928+#include <linux/net.h>
56929+#include <linux/in.h>
56930+#include <linux/slab.h>
56931+#include <linux/types.h>
56932+#include <linux/sched.h>
56933+#include <linux/timer.h>
56934+#include <linux/gracl.h>
56935+#include <linux/grsecurity.h>
56936+#include <linux/grinternal.h>
56937+
56938+static struct crash_uid *uid_set;
56939+static unsigned short uid_used;
56940+static DEFINE_SPINLOCK(gr_uid_lock);
56941+extern rwlock_t gr_inode_lock;
56942+extern struct acl_subject_label *
56943+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56944+ struct acl_role_label *role);
56945+
56946+#ifdef CONFIG_BTRFS_FS
56947+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56948+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56949+#endif
56950+
56951+static inline dev_t __get_dev(const struct dentry *dentry)
56952+{
56953+#ifdef CONFIG_BTRFS_FS
56954+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56955+ return get_btrfs_dev_from_inode(dentry->d_inode);
56956+ else
56957+#endif
56958+ return dentry->d_inode->i_sb->s_dev;
56959+}
56960+
56961+int
56962+gr_init_uidset(void)
56963+{
56964+ uid_set =
56965+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56966+ uid_used = 0;
56967+
56968+ return uid_set ? 1 : 0;
56969+}
56970+
56971+void
56972+gr_free_uidset(void)
56973+{
56974+ if (uid_set)
56975+ kfree(uid_set);
56976+
56977+ return;
56978+}
56979+
56980+int
56981+gr_find_uid(const uid_t uid)
56982+{
56983+ struct crash_uid *tmp = uid_set;
56984+ uid_t buid;
56985+ int low = 0, high = uid_used - 1, mid;
56986+
56987+ while (high >= low) {
56988+ mid = (low + high) >> 1;
56989+ buid = tmp[mid].uid;
56990+ if (buid == uid)
56991+ return mid;
56992+ if (buid > uid)
56993+ high = mid - 1;
56994+ if (buid < uid)
56995+ low = mid + 1;
56996+ }
56997+
56998+ return -1;
56999+}
57000+
57001+static __inline__ void
57002+gr_insertsort(void)
57003+{
57004+ unsigned short i, j;
57005+ struct crash_uid index;
57006+
57007+ for (i = 1; i < uid_used; i++) {
57008+ index = uid_set[i];
57009+ j = i;
57010+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
57011+ uid_set[j] = uid_set[j - 1];
57012+ j--;
57013+ }
57014+ uid_set[j] = index;
57015+ }
57016+
57017+ return;
57018+}
57019+
57020+static __inline__ void
57021+gr_insert_uid(const uid_t uid, const unsigned long expires)
57022+{
57023+ int loc;
57024+
57025+ if (uid_used == GR_UIDTABLE_MAX)
57026+ return;
57027+
57028+ loc = gr_find_uid(uid);
57029+
57030+ if (loc >= 0) {
57031+ uid_set[loc].expires = expires;
57032+ return;
57033+ }
57034+
57035+ uid_set[uid_used].uid = uid;
57036+ uid_set[uid_used].expires = expires;
57037+ uid_used++;
57038+
57039+ gr_insertsort();
57040+
57041+ return;
57042+}
57043+
57044+void
57045+gr_remove_uid(const unsigned short loc)
57046+{
57047+ unsigned short i;
57048+
57049+ for (i = loc + 1; i < uid_used; i++)
57050+ uid_set[i - 1] = uid_set[i];
57051+
57052+ uid_used--;
57053+
57054+ return;
57055+}
57056+
57057+int
57058+gr_check_crash_uid(const uid_t uid)
57059+{
57060+ int loc;
57061+ int ret = 0;
57062+
57063+ if (unlikely(!gr_acl_is_enabled()))
57064+ return 0;
57065+
57066+ spin_lock(&gr_uid_lock);
57067+ loc = gr_find_uid(uid);
57068+
57069+ if (loc < 0)
57070+ goto out_unlock;
57071+
57072+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
57073+ gr_remove_uid(loc);
57074+ else
57075+ ret = 1;
57076+
57077+out_unlock:
57078+ spin_unlock(&gr_uid_lock);
57079+ return ret;
57080+}
57081+
57082+static __inline__ int
57083+proc_is_setxid(const struct cred *cred)
57084+{
57085+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
57086+ cred->uid != cred->fsuid)
57087+ return 1;
57088+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
57089+ cred->gid != cred->fsgid)
57090+ return 1;
57091+
57092+ return 0;
57093+}
57094+
57095+extern int gr_fake_force_sig(int sig, struct task_struct *t);
57096+
57097+void
57098+gr_handle_crash(struct task_struct *task, const int sig)
57099+{
57100+ struct acl_subject_label *curr;
57101+ struct task_struct *tsk, *tsk2;
57102+ const struct cred *cred;
57103+ const struct cred *cred2;
57104+
57105+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
57106+ return;
57107+
57108+ if (unlikely(!gr_acl_is_enabled()))
57109+ return;
57110+
57111+ curr = task->acl;
57112+
57113+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
57114+ return;
57115+
57116+ if (time_before_eq(curr->expires, get_seconds())) {
57117+ curr->expires = 0;
57118+ curr->crashes = 0;
57119+ }
57120+
57121+ curr->crashes++;
57122+
57123+ if (!curr->expires)
57124+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
57125+
57126+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57127+ time_after(curr->expires, get_seconds())) {
57128+ rcu_read_lock();
57129+ cred = __task_cred(task);
57130+ if (cred->uid && proc_is_setxid(cred)) {
57131+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57132+ spin_lock(&gr_uid_lock);
57133+ gr_insert_uid(cred->uid, curr->expires);
57134+ spin_unlock(&gr_uid_lock);
57135+ curr->expires = 0;
57136+ curr->crashes = 0;
57137+ read_lock(&tasklist_lock);
57138+ do_each_thread(tsk2, tsk) {
57139+ cred2 = __task_cred(tsk);
57140+ if (tsk != task && cred2->uid == cred->uid)
57141+ gr_fake_force_sig(SIGKILL, tsk);
57142+ } while_each_thread(tsk2, tsk);
57143+ read_unlock(&tasklist_lock);
57144+ } else {
57145+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57146+ read_lock(&tasklist_lock);
57147+ read_lock(&grsec_exec_file_lock);
57148+ do_each_thread(tsk2, tsk) {
57149+ if (likely(tsk != task)) {
57150+ // if this thread has the same subject as the one that triggered
57151+ // RES_CRASH and it's the same binary, kill it
57152+ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
57153+ gr_fake_force_sig(SIGKILL, tsk);
57154+ }
57155+ } while_each_thread(tsk2, tsk);
57156+ read_unlock(&grsec_exec_file_lock);
57157+ read_unlock(&tasklist_lock);
57158+ }
57159+ rcu_read_unlock();
57160+ }
57161+
57162+ return;
57163+}
57164+
57165+int
57166+gr_check_crash_exec(const struct file *filp)
57167+{
57168+ struct acl_subject_label *curr;
57169+
57170+ if (unlikely(!gr_acl_is_enabled()))
57171+ return 0;
57172+
57173+ read_lock(&gr_inode_lock);
57174+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
57175+ __get_dev(filp->f_path.dentry),
57176+ current->role);
57177+ read_unlock(&gr_inode_lock);
57178+
57179+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
57180+ (!curr->crashes && !curr->expires))
57181+ return 0;
57182+
57183+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57184+ time_after(curr->expires, get_seconds()))
57185+ return 1;
57186+ else if (time_before_eq(curr->expires, get_seconds())) {
57187+ curr->crashes = 0;
57188+ curr->expires = 0;
57189+ }
57190+
57191+ return 0;
57192+}
57193+
57194+void
57195+gr_handle_alertkill(struct task_struct *task)
57196+{
57197+ struct acl_subject_label *curracl;
57198+ __u32 curr_ip;
57199+ struct task_struct *p, *p2;
57200+
57201+ if (unlikely(!gr_acl_is_enabled()))
57202+ return;
57203+
57204+ curracl = task->acl;
57205+ curr_ip = task->signal->curr_ip;
57206+
57207+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
57208+ read_lock(&tasklist_lock);
57209+ do_each_thread(p2, p) {
57210+ if (p->signal->curr_ip == curr_ip)
57211+ gr_fake_force_sig(SIGKILL, p);
57212+ } while_each_thread(p2, p);
57213+ read_unlock(&tasklist_lock);
57214+ } else if (curracl->mode & GR_KILLPROC)
57215+ gr_fake_force_sig(SIGKILL, task);
57216+
57217+ return;
57218+}
57219diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
57220new file mode 100644
57221index 0000000..9d83a69
57222--- /dev/null
57223+++ b/grsecurity/gracl_shm.c
57224@@ -0,0 +1,40 @@
57225+#include <linux/kernel.h>
57226+#include <linux/mm.h>
57227+#include <linux/sched.h>
57228+#include <linux/file.h>
57229+#include <linux/ipc.h>
57230+#include <linux/gracl.h>
57231+#include <linux/grsecurity.h>
57232+#include <linux/grinternal.h>
57233+
57234+int
57235+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57236+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57237+{
57238+ struct task_struct *task;
57239+
57240+ if (!gr_acl_is_enabled())
57241+ return 1;
57242+
57243+ rcu_read_lock();
57244+ read_lock(&tasklist_lock);
57245+
57246+ task = find_task_by_vpid(shm_cprid);
57247+
57248+ if (unlikely(!task))
57249+ task = find_task_by_vpid(shm_lapid);
57250+
57251+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
57252+ (task->pid == shm_lapid)) &&
57253+ (task->acl->mode & GR_PROTSHM) &&
57254+ (task->acl != current->acl))) {
57255+ read_unlock(&tasklist_lock);
57256+ rcu_read_unlock();
57257+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
57258+ return 0;
57259+ }
57260+ read_unlock(&tasklist_lock);
57261+ rcu_read_unlock();
57262+
57263+ return 1;
57264+}
57265diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
57266new file mode 100644
57267index 0000000..bc0be01
57268--- /dev/null
57269+++ b/grsecurity/grsec_chdir.c
57270@@ -0,0 +1,19 @@
57271+#include <linux/kernel.h>
57272+#include <linux/sched.h>
57273+#include <linux/fs.h>
57274+#include <linux/file.h>
57275+#include <linux/grsecurity.h>
57276+#include <linux/grinternal.h>
57277+
57278+void
57279+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
57280+{
57281+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57282+ if ((grsec_enable_chdir && grsec_enable_group &&
57283+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
57284+ !grsec_enable_group)) {
57285+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
57286+ }
57287+#endif
57288+ return;
57289+}
57290diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
57291new file mode 100644
57292index 0000000..a2dc675
57293--- /dev/null
57294+++ b/grsecurity/grsec_chroot.c
57295@@ -0,0 +1,351 @@
57296+#include <linux/kernel.h>
57297+#include <linux/module.h>
57298+#include <linux/sched.h>
57299+#include <linux/file.h>
57300+#include <linux/fs.h>
57301+#include <linux/mount.h>
57302+#include <linux/types.h>
57303+#include <linux/pid_namespace.h>
57304+#include <linux/grsecurity.h>
57305+#include <linux/grinternal.h>
57306+
57307+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57308+{
57309+#ifdef CONFIG_GRKERNSEC
57310+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57311+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57312+ task->gr_is_chrooted = 1;
57313+ else
57314+ task->gr_is_chrooted = 0;
57315+
57316+ task->gr_chroot_dentry = path->dentry;
57317+#endif
57318+ return;
57319+}
57320+
57321+void gr_clear_chroot_entries(struct task_struct *task)
57322+{
57323+#ifdef CONFIG_GRKERNSEC
57324+ task->gr_is_chrooted = 0;
57325+ task->gr_chroot_dentry = NULL;
57326+#endif
57327+ return;
57328+}
57329+
57330+int
57331+gr_handle_chroot_unix(const pid_t pid)
57332+{
57333+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57334+ struct task_struct *p;
57335+
57336+ if (unlikely(!grsec_enable_chroot_unix))
57337+ return 1;
57338+
57339+ if (likely(!proc_is_chrooted(current)))
57340+ return 1;
57341+
57342+ rcu_read_lock();
57343+ read_lock(&tasklist_lock);
57344+ p = find_task_by_vpid_unrestricted(pid);
57345+ if (unlikely(p && !have_same_root(current, p))) {
57346+ read_unlock(&tasklist_lock);
57347+ rcu_read_unlock();
57348+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57349+ return 0;
57350+ }
57351+ read_unlock(&tasklist_lock);
57352+ rcu_read_unlock();
57353+#endif
57354+ return 1;
57355+}
57356+
57357+int
57358+gr_handle_chroot_nice(void)
57359+{
57360+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57361+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57362+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57363+ return -EPERM;
57364+ }
57365+#endif
57366+ return 0;
57367+}
57368+
57369+int
57370+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57371+{
57372+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57373+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57374+ && proc_is_chrooted(current)) {
57375+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57376+ return -EACCES;
57377+ }
57378+#endif
57379+ return 0;
57380+}
57381+
57382+int
57383+gr_handle_chroot_rawio(const struct inode *inode)
57384+{
57385+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57386+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57387+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57388+ return 1;
57389+#endif
57390+ return 0;
57391+}
57392+
57393+int
57394+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57395+{
57396+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57397+ struct task_struct *p;
57398+ int ret = 0;
57399+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57400+ return ret;
57401+
57402+ read_lock(&tasklist_lock);
57403+ do_each_pid_task(pid, type, p) {
57404+ if (!have_same_root(current, p)) {
57405+ ret = 1;
57406+ goto out;
57407+ }
57408+ } while_each_pid_task(pid, type, p);
57409+out:
57410+ read_unlock(&tasklist_lock);
57411+ return ret;
57412+#endif
57413+ return 0;
57414+}
57415+
57416+int
57417+gr_pid_is_chrooted(struct task_struct *p)
57418+{
57419+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57420+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57421+ return 0;
57422+
57423+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57424+ !have_same_root(current, p)) {
57425+ return 1;
57426+ }
57427+#endif
57428+ return 0;
57429+}
57430+
57431+EXPORT_SYMBOL(gr_pid_is_chrooted);
57432+
57433+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57434+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57435+{
57436+ struct path path, currentroot;
57437+ int ret = 0;
57438+
57439+ path.dentry = (struct dentry *)u_dentry;
57440+ path.mnt = (struct vfsmount *)u_mnt;
57441+ get_fs_root(current->fs, &currentroot);
57442+ if (path_is_under(&path, &currentroot))
57443+ ret = 1;
57444+ path_put(&currentroot);
57445+
57446+ return ret;
57447+}
57448+#endif
57449+
57450+int
57451+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57452+{
57453+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57454+ if (!grsec_enable_chroot_fchdir)
57455+ return 1;
57456+
57457+ if (!proc_is_chrooted(current))
57458+ return 1;
57459+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57460+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57461+ return 0;
57462+ }
57463+#endif
57464+ return 1;
57465+}
57466+
57467+int
57468+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57469+ const time_t shm_createtime)
57470+{
57471+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57472+ struct task_struct *p;
57473+ time_t starttime;
57474+
57475+ if (unlikely(!grsec_enable_chroot_shmat))
57476+ return 1;
57477+
57478+ if (likely(!proc_is_chrooted(current)))
57479+ return 1;
57480+
57481+ rcu_read_lock();
57482+ read_lock(&tasklist_lock);
57483+
57484+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
57485+ starttime = p->start_time.tv_sec;
57486+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
57487+ if (have_same_root(current, p)) {
57488+ goto allow;
57489+ } else {
57490+ read_unlock(&tasklist_lock);
57491+ rcu_read_unlock();
57492+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57493+ return 0;
57494+ }
57495+ }
57496+ /* creator exited, pid reuse, fall through to next check */
57497+ }
57498+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
57499+ if (unlikely(!have_same_root(current, p))) {
57500+ read_unlock(&tasklist_lock);
57501+ rcu_read_unlock();
57502+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57503+ return 0;
57504+ }
57505+ }
57506+
57507+allow:
57508+ read_unlock(&tasklist_lock);
57509+ rcu_read_unlock();
57510+#endif
57511+ return 1;
57512+}
57513+
57514+void
57515+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57516+{
57517+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57518+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57519+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57520+#endif
57521+ return;
57522+}
57523+
57524+int
57525+gr_handle_chroot_mknod(const struct dentry *dentry,
57526+ const struct vfsmount *mnt, const int mode)
57527+{
57528+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57529+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57530+ proc_is_chrooted(current)) {
57531+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57532+ return -EPERM;
57533+ }
57534+#endif
57535+ return 0;
57536+}
57537+
57538+int
57539+gr_handle_chroot_mount(const struct dentry *dentry,
57540+ const struct vfsmount *mnt, const char *dev_name)
57541+{
57542+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57543+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57544+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
57545+ return -EPERM;
57546+ }
57547+#endif
57548+ return 0;
57549+}
57550+
57551+int
57552+gr_handle_chroot_pivot(void)
57553+{
57554+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57555+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57556+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57557+ return -EPERM;
57558+ }
57559+#endif
57560+ return 0;
57561+}
57562+
57563+int
57564+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57565+{
57566+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57567+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57568+ !gr_is_outside_chroot(dentry, mnt)) {
57569+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57570+ return -EPERM;
57571+ }
57572+#endif
57573+ return 0;
57574+}
57575+
57576+extern const char *captab_log[];
57577+extern int captab_log_entries;
57578+
57579+int
57580+gr_chroot_is_capable(const int cap)
57581+{
57582+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57583+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
57584+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57585+ if (cap_raised(chroot_caps, cap)) {
57586+ const struct cred *creds = current_cred();
57587+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
57588+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
57589+ }
57590+ return 0;
57591+ }
57592+ }
57593+#endif
57594+ return 1;
57595+}
57596+
57597+int
57598+gr_chroot_is_capable_nolog(const int cap)
57599+{
57600+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57601+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
57602+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57603+ if (cap_raised(chroot_caps, cap)) {
57604+ return 0;
57605+ }
57606+ }
57607+#endif
57608+ return 1;
57609+}
57610+
57611+int
57612+gr_handle_chroot_sysctl(const int op)
57613+{
57614+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57615+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57616+ proc_is_chrooted(current))
57617+ return -EACCES;
57618+#endif
57619+ return 0;
57620+}
57621+
57622+void
57623+gr_handle_chroot_chdir(struct path *path)
57624+{
57625+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57626+ if (grsec_enable_chroot_chdir)
57627+ set_fs_pwd(current->fs, path);
57628+#endif
57629+ return;
57630+}
57631+
57632+int
57633+gr_handle_chroot_chmod(const struct dentry *dentry,
57634+ const struct vfsmount *mnt, const int mode)
57635+{
57636+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57637+ /* allow chmod +s on directories, but not files */
57638+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57639+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57640+ proc_is_chrooted(current)) {
57641+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57642+ return -EPERM;
57643+ }
57644+#endif
57645+ return 0;
57646+}
57647diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
57648new file mode 100644
57649index 0000000..d81a586
57650--- /dev/null
57651+++ b/grsecurity/grsec_disabled.c
57652@@ -0,0 +1,439 @@
57653+#include <linux/kernel.h>
57654+#include <linux/module.h>
57655+#include <linux/sched.h>
57656+#include <linux/file.h>
57657+#include <linux/fs.h>
57658+#include <linux/kdev_t.h>
57659+#include <linux/net.h>
57660+#include <linux/in.h>
57661+#include <linux/ip.h>
57662+#include <linux/skbuff.h>
57663+#include <linux/sysctl.h>
57664+
57665+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57666+void
57667+pax_set_initial_flags(struct linux_binprm *bprm)
57668+{
57669+ return;
57670+}
57671+#endif
57672+
57673+#ifdef CONFIG_SYSCTL
57674+__u32
57675+gr_handle_sysctl(const struct ctl_table * table, const int op)
57676+{
57677+ return 0;
57678+}
57679+#endif
57680+
57681+#ifdef CONFIG_TASKSTATS
57682+int gr_is_taskstats_denied(int pid)
57683+{
57684+ return 0;
57685+}
57686+#endif
57687+
57688+int
57689+gr_acl_is_enabled(void)
57690+{
57691+ return 0;
57692+}
57693+
57694+void
57695+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
57696+{
57697+ return;
57698+}
57699+
57700+int
57701+gr_handle_rawio(const struct inode *inode)
57702+{
57703+ return 0;
57704+}
57705+
57706+void
57707+gr_acl_handle_psacct(struct task_struct *task, const long code)
57708+{
57709+ return;
57710+}
57711+
57712+int
57713+gr_handle_ptrace(struct task_struct *task, const long request)
57714+{
57715+ return 0;
57716+}
57717+
57718+int
57719+gr_handle_proc_ptrace(struct task_struct *task)
57720+{
57721+ return 0;
57722+}
57723+
57724+void
57725+gr_learn_resource(const struct task_struct *task,
57726+ const int res, const unsigned long wanted, const int gt)
57727+{
57728+ return;
57729+}
57730+
57731+int
57732+gr_set_acls(const int type)
57733+{
57734+ return 0;
57735+}
57736+
57737+int
57738+gr_check_hidden_task(const struct task_struct *tsk)
57739+{
57740+ return 0;
57741+}
57742+
57743+int
57744+gr_check_protected_task(const struct task_struct *task)
57745+{
57746+ return 0;
57747+}
57748+
57749+int
57750+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57751+{
57752+ return 0;
57753+}
57754+
57755+void
57756+gr_copy_label(struct task_struct *tsk)
57757+{
57758+ return;
57759+}
57760+
57761+void
57762+gr_set_pax_flags(struct task_struct *task)
57763+{
57764+ return;
57765+}
57766+
57767+int
57768+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57769+ const int unsafe_share)
57770+{
57771+ return 0;
57772+}
57773+
57774+void
57775+gr_handle_delete(const ino_t ino, const dev_t dev)
57776+{
57777+ return;
57778+}
57779+
57780+void
57781+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57782+{
57783+ return;
57784+}
57785+
57786+void
57787+gr_handle_crash(struct task_struct *task, const int sig)
57788+{
57789+ return;
57790+}
57791+
57792+int
57793+gr_check_crash_exec(const struct file *filp)
57794+{
57795+ return 0;
57796+}
57797+
57798+int
57799+gr_check_crash_uid(const uid_t uid)
57800+{
57801+ return 0;
57802+}
57803+
57804+void
57805+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57806+ struct dentry *old_dentry,
57807+ struct dentry *new_dentry,
57808+ struct vfsmount *mnt, const __u8 replace)
57809+{
57810+ return;
57811+}
57812+
57813+int
57814+gr_search_socket(const int family, const int type, const int protocol)
57815+{
57816+ return 1;
57817+}
57818+
57819+int
57820+gr_search_connectbind(const int mode, const struct socket *sock,
57821+ const struct sockaddr_in *addr)
57822+{
57823+ return 0;
57824+}
57825+
57826+void
57827+gr_handle_alertkill(struct task_struct *task)
57828+{
57829+ return;
57830+}
57831+
57832+__u32
57833+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57834+{
57835+ return 1;
57836+}
57837+
57838+__u32
57839+gr_acl_handle_hidden_file(const struct dentry * dentry,
57840+ const struct vfsmount * mnt)
57841+{
57842+ return 1;
57843+}
57844+
57845+__u32
57846+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57847+ int acc_mode)
57848+{
57849+ return 1;
57850+}
57851+
57852+__u32
57853+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57854+{
57855+ return 1;
57856+}
57857+
57858+__u32
57859+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57860+{
57861+ return 1;
57862+}
57863+
57864+int
57865+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57866+ unsigned int *vm_flags)
57867+{
57868+ return 1;
57869+}
57870+
57871+__u32
57872+gr_acl_handle_truncate(const struct dentry * dentry,
57873+ const struct vfsmount * mnt)
57874+{
57875+ return 1;
57876+}
57877+
57878+__u32
57879+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57880+{
57881+ return 1;
57882+}
57883+
57884+__u32
57885+gr_acl_handle_access(const struct dentry * dentry,
57886+ const struct vfsmount * mnt, const int fmode)
57887+{
57888+ return 1;
57889+}
57890+
57891+__u32
57892+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57893+ mode_t mode)
57894+{
57895+ return 1;
57896+}
57897+
57898+__u32
57899+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57900+ mode_t mode)
57901+{
57902+ return 1;
57903+}
57904+
57905+__u32
57906+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57907+{
57908+ return 1;
57909+}
57910+
57911+__u32
57912+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57913+{
57914+ return 1;
57915+}
57916+
57917+void
57918+grsecurity_init(void)
57919+{
57920+ return;
57921+}
57922+
57923+__u32
57924+gr_acl_handle_mknod(const struct dentry * new_dentry,
57925+ const struct dentry * parent_dentry,
57926+ const struct vfsmount * parent_mnt,
57927+ const int mode)
57928+{
57929+ return 1;
57930+}
57931+
57932+__u32
57933+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57934+ const struct dentry * parent_dentry,
57935+ const struct vfsmount * parent_mnt)
57936+{
57937+ return 1;
57938+}
57939+
57940+__u32
57941+gr_acl_handle_symlink(const struct dentry * new_dentry,
57942+ const struct dentry * parent_dentry,
57943+ const struct vfsmount * parent_mnt, const char *from)
57944+{
57945+ return 1;
57946+}
57947+
57948+__u32
57949+gr_acl_handle_link(const struct dentry * new_dentry,
57950+ const struct dentry * parent_dentry,
57951+ const struct vfsmount * parent_mnt,
57952+ const struct dentry * old_dentry,
57953+ const struct vfsmount * old_mnt, const char *to)
57954+{
57955+ return 1;
57956+}
57957+
57958+int
57959+gr_acl_handle_rename(const struct dentry *new_dentry,
57960+ const struct dentry *parent_dentry,
57961+ const struct vfsmount *parent_mnt,
57962+ const struct dentry *old_dentry,
57963+ const struct inode *old_parent_inode,
57964+ const struct vfsmount *old_mnt, const char *newname)
57965+{
57966+ return 0;
57967+}
57968+
57969+int
57970+gr_acl_handle_filldir(const struct file *file, const char *name,
57971+ const int namelen, const ino_t ino)
57972+{
57973+ return 1;
57974+}
57975+
57976+int
57977+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57978+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57979+{
57980+ return 1;
57981+}
57982+
57983+int
57984+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57985+{
57986+ return 0;
57987+}
57988+
57989+int
57990+gr_search_accept(const struct socket *sock)
57991+{
57992+ return 0;
57993+}
57994+
57995+int
57996+gr_search_listen(const struct socket *sock)
57997+{
57998+ return 0;
57999+}
58000+
58001+int
58002+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
58003+{
58004+ return 0;
58005+}
58006+
58007+__u32
58008+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
58009+{
58010+ return 1;
58011+}
58012+
58013+__u32
58014+gr_acl_handle_creat(const struct dentry * dentry,
58015+ const struct dentry * p_dentry,
58016+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
58017+ const int imode)
58018+{
58019+ return 1;
58020+}
58021+
58022+void
58023+gr_acl_handle_exit(void)
58024+{
58025+ return;
58026+}
58027+
58028+int
58029+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
58030+{
58031+ return 1;
58032+}
58033+
58034+void
58035+gr_set_role_label(const uid_t uid, const gid_t gid)
58036+{
58037+ return;
58038+}
58039+
58040+int
58041+gr_acl_handle_procpidmem(const struct task_struct *task)
58042+{
58043+ return 0;
58044+}
58045+
58046+int
58047+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
58048+{
58049+ return 0;
58050+}
58051+
58052+int
58053+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
58054+{
58055+ return 0;
58056+}
58057+
58058+void
58059+gr_set_kernel_label(struct task_struct *task)
58060+{
58061+ return;
58062+}
58063+
58064+int
58065+gr_check_user_change(int real, int effective, int fs)
58066+{
58067+ return 0;
58068+}
58069+
58070+int
58071+gr_check_group_change(int real, int effective, int fs)
58072+{
58073+ return 0;
58074+}
58075+
58076+int gr_acl_enable_at_secure(void)
58077+{
58078+ return 0;
58079+}
58080+
58081+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
58082+{
58083+ return dentry->d_inode->i_sb->s_dev;
58084+}
58085+
58086+EXPORT_SYMBOL(gr_learn_resource);
58087+EXPORT_SYMBOL(gr_set_kernel_label);
58088+#ifdef CONFIG_SECURITY
58089+EXPORT_SYMBOL(gr_check_user_change);
58090+EXPORT_SYMBOL(gr_check_group_change);
58091+#endif
58092diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
58093new file mode 100644
58094index 0000000..2b05ada
58095--- /dev/null
58096+++ b/grsecurity/grsec_exec.c
58097@@ -0,0 +1,146 @@
58098+#include <linux/kernel.h>
58099+#include <linux/sched.h>
58100+#include <linux/file.h>
58101+#include <linux/binfmts.h>
58102+#include <linux/fs.h>
58103+#include <linux/types.h>
58104+#include <linux/grdefs.h>
58105+#include <linux/grsecurity.h>
58106+#include <linux/grinternal.h>
58107+#include <linux/capability.h>
58108+#include <linux/module.h>
58109+
58110+#include <asm/uaccess.h>
58111+
58112+#ifdef CONFIG_GRKERNSEC_EXECLOG
58113+static char gr_exec_arg_buf[132];
58114+static DEFINE_MUTEX(gr_exec_arg_mutex);
58115+#endif
58116+
58117+extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
58118+
58119+void
58120+gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
58121+{
58122+#ifdef CONFIG_GRKERNSEC_EXECLOG
58123+ char *grarg = gr_exec_arg_buf;
58124+ unsigned int i, x, execlen = 0;
58125+ char c;
58126+
58127+ if (!((grsec_enable_execlog && grsec_enable_group &&
58128+ in_group_p(grsec_audit_gid))
58129+ || (grsec_enable_execlog && !grsec_enable_group)))
58130+ return;
58131+
58132+ mutex_lock(&gr_exec_arg_mutex);
58133+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
58134+
58135+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
58136+ const char __user *p;
58137+ unsigned int len;
58138+
58139+ p = get_user_arg_ptr(argv, i);
58140+ if (IS_ERR(p))
58141+ goto log;
58142+
58143+ len = strnlen_user(p, 128 - execlen);
58144+ if (len > 128 - execlen)
58145+ len = 128 - execlen;
58146+ else if (len > 0)
58147+ len--;
58148+ if (copy_from_user(grarg + execlen, p, len))
58149+ goto log;
58150+
58151+ /* rewrite unprintable characters */
58152+ for (x = 0; x < len; x++) {
58153+ c = *(grarg + execlen + x);
58154+ if (c < 32 || c > 126)
58155+ *(grarg + execlen + x) = ' ';
58156+ }
58157+
58158+ execlen += len;
58159+ *(grarg + execlen) = ' ';
58160+ *(grarg + execlen + 1) = '\0';
58161+ execlen++;
58162+ }
58163+
58164+ log:
58165+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58166+ bprm->file->f_path.mnt, grarg);
58167+ mutex_unlock(&gr_exec_arg_mutex);
58168+#endif
58169+ return;
58170+}
58171+
58172+#ifdef CONFIG_GRKERNSEC
58173+extern int gr_acl_is_capable(const int cap);
58174+extern int gr_acl_is_capable_nolog(const int cap);
58175+extern int gr_chroot_is_capable(const int cap);
58176+extern int gr_chroot_is_capable_nolog(const int cap);
58177+#endif
58178+
58179+const char *captab_log[] = {
58180+ "CAP_CHOWN",
58181+ "CAP_DAC_OVERRIDE",
58182+ "CAP_DAC_READ_SEARCH",
58183+ "CAP_FOWNER",
58184+ "CAP_FSETID",
58185+ "CAP_KILL",
58186+ "CAP_SETGID",
58187+ "CAP_SETUID",
58188+ "CAP_SETPCAP",
58189+ "CAP_LINUX_IMMUTABLE",
58190+ "CAP_NET_BIND_SERVICE",
58191+ "CAP_NET_BROADCAST",
58192+ "CAP_NET_ADMIN",
58193+ "CAP_NET_RAW",
58194+ "CAP_IPC_LOCK",
58195+ "CAP_IPC_OWNER",
58196+ "CAP_SYS_MODULE",
58197+ "CAP_SYS_RAWIO",
58198+ "CAP_SYS_CHROOT",
58199+ "CAP_SYS_PTRACE",
58200+ "CAP_SYS_PACCT",
58201+ "CAP_SYS_ADMIN",
58202+ "CAP_SYS_BOOT",
58203+ "CAP_SYS_NICE",
58204+ "CAP_SYS_RESOURCE",
58205+ "CAP_SYS_TIME",
58206+ "CAP_SYS_TTY_CONFIG",
58207+ "CAP_MKNOD",
58208+ "CAP_LEASE",
58209+ "CAP_AUDIT_WRITE",
58210+ "CAP_AUDIT_CONTROL",
58211+ "CAP_SETFCAP",
58212+ "CAP_MAC_OVERRIDE",
58213+ "CAP_MAC_ADMIN",
58214+ "CAP_SYSLOG",
58215+ "CAP_WAKE_ALARM"
58216+};
58217+
58218+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
58219+
58220+int gr_is_capable(const int cap)
58221+{
58222+#ifdef CONFIG_GRKERNSEC
58223+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
58224+ return 1;
58225+ return 0;
58226+#else
58227+ return 1;
58228+#endif
58229+}
58230+
58231+int gr_is_capable_nolog(const int cap)
58232+{
58233+#ifdef CONFIG_GRKERNSEC
58234+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
58235+ return 1;
58236+ return 0;
58237+#else
58238+ return 1;
58239+#endif
58240+}
58241+
58242+EXPORT_SYMBOL(gr_is_capable);
58243+EXPORT_SYMBOL(gr_is_capable_nolog);
58244diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
58245new file mode 100644
58246index 0000000..d3ee748
58247--- /dev/null
58248+++ b/grsecurity/grsec_fifo.c
58249@@ -0,0 +1,24 @@
58250+#include <linux/kernel.h>
58251+#include <linux/sched.h>
58252+#include <linux/fs.h>
58253+#include <linux/file.h>
58254+#include <linux/grinternal.h>
58255+
58256+int
58257+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
58258+ const struct dentry *dir, const int flag, const int acc_mode)
58259+{
58260+#ifdef CONFIG_GRKERNSEC_FIFO
58261+ const struct cred *cred = current_cred();
58262+
58263+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
58264+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
58265+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
58266+ (cred->fsuid != dentry->d_inode->i_uid)) {
58267+ if (!inode_permission(dentry->d_inode, acc_mode))
58268+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
58269+ return -EACCES;
58270+ }
58271+#endif
58272+ return 0;
58273+}
58274diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
58275new file mode 100644
58276index 0000000..8ca18bf
58277--- /dev/null
58278+++ b/grsecurity/grsec_fork.c
58279@@ -0,0 +1,23 @@
58280+#include <linux/kernel.h>
58281+#include <linux/sched.h>
58282+#include <linux/grsecurity.h>
58283+#include <linux/grinternal.h>
58284+#include <linux/errno.h>
58285+
58286+void
58287+gr_log_forkfail(const int retval)
58288+{
58289+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58290+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58291+ switch (retval) {
58292+ case -EAGAIN:
58293+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58294+ break;
58295+ case -ENOMEM:
58296+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58297+ break;
58298+ }
58299+ }
58300+#endif
58301+ return;
58302+}
58303diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
58304new file mode 100644
58305index 0000000..cb8e5a1
58306--- /dev/null
58307+++ b/grsecurity/grsec_init.c
58308@@ -0,0 +1,273 @@
58309+#include <linux/kernel.h>
58310+#include <linux/sched.h>
58311+#include <linux/mm.h>
58312+#include <linux/gracl.h>
58313+#include <linux/slab.h>
58314+#include <linux/vmalloc.h>
58315+#include <linux/percpu.h>
58316+#include <linux/module.h>
58317+
58318+int grsec_enable_setxid;
58319+int grsec_enable_brute;
58320+int grsec_enable_link;
58321+int grsec_enable_dmesg;
58322+int grsec_enable_harden_ptrace;
58323+int grsec_enable_fifo;
58324+int grsec_enable_execlog;
58325+int grsec_enable_signal;
58326+int grsec_enable_forkfail;
58327+int grsec_enable_audit_ptrace;
58328+int grsec_enable_time;
58329+int grsec_enable_audit_textrel;
58330+int grsec_enable_group;
58331+int grsec_audit_gid;
58332+int grsec_enable_chdir;
58333+int grsec_enable_mount;
58334+int grsec_enable_rofs;
58335+int grsec_enable_chroot_findtask;
58336+int grsec_enable_chroot_mount;
58337+int grsec_enable_chroot_shmat;
58338+int grsec_enable_chroot_fchdir;
58339+int grsec_enable_chroot_double;
58340+int grsec_enable_chroot_pivot;
58341+int grsec_enable_chroot_chdir;
58342+int grsec_enable_chroot_chmod;
58343+int grsec_enable_chroot_mknod;
58344+int grsec_enable_chroot_nice;
58345+int grsec_enable_chroot_execlog;
58346+int grsec_enable_chroot_caps;
58347+int grsec_enable_chroot_sysctl;
58348+int grsec_enable_chroot_unix;
58349+int grsec_enable_tpe;
58350+int grsec_tpe_gid;
58351+int grsec_enable_blackhole;
58352+#ifdef CONFIG_IPV6_MODULE
58353+EXPORT_SYMBOL(grsec_enable_blackhole);
58354+#endif
58355+int grsec_lastack_retries;
58356+int grsec_enable_tpe_all;
58357+int grsec_enable_tpe_invert;
58358+int grsec_enable_socket_all;
58359+int grsec_socket_all_gid;
58360+int grsec_enable_socket_client;
58361+int grsec_socket_client_gid;
58362+int grsec_enable_socket_server;
58363+int grsec_socket_server_gid;
58364+int grsec_resource_logging;
58365+int grsec_disable_privio;
58366+int grsec_enable_log_rwxmaps;
58367+int grsec_lock;
58368+
58369+DEFINE_SPINLOCK(grsec_alert_lock);
58370+unsigned long grsec_alert_wtime = 0;
58371+unsigned long grsec_alert_fyet = 0;
58372+
58373+DEFINE_SPINLOCK(grsec_audit_lock);
58374+
58375+DEFINE_RWLOCK(grsec_exec_file_lock);
58376+
58377+char *gr_shared_page[4];
58378+
58379+char *gr_alert_log_fmt;
58380+char *gr_audit_log_fmt;
58381+char *gr_alert_log_buf;
58382+char *gr_audit_log_buf;
58383+
58384+extern struct gr_arg *gr_usermode;
58385+extern unsigned char *gr_system_salt;
58386+extern unsigned char *gr_system_sum;
58387+
58388+void __init
58389+grsecurity_init(void)
58390+{
58391+ int j;
58392+ /* create the per-cpu shared pages */
58393+
58394+#ifdef CONFIG_X86
58395+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58396+#endif
58397+
58398+ for (j = 0; j < 4; j++) {
58399+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58400+ if (gr_shared_page[j] == NULL) {
58401+ panic("Unable to allocate grsecurity shared page");
58402+ return;
58403+ }
58404+ }
58405+
58406+ /* allocate log buffers */
58407+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58408+ if (!gr_alert_log_fmt) {
58409+ panic("Unable to allocate grsecurity alert log format buffer");
58410+ return;
58411+ }
58412+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58413+ if (!gr_audit_log_fmt) {
58414+ panic("Unable to allocate grsecurity audit log format buffer");
58415+ return;
58416+ }
58417+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58418+ if (!gr_alert_log_buf) {
58419+ panic("Unable to allocate grsecurity alert log buffer");
58420+ return;
58421+ }
58422+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58423+ if (!gr_audit_log_buf) {
58424+ panic("Unable to allocate grsecurity audit log buffer");
58425+ return;
58426+ }
58427+
58428+ /* allocate memory for authentication structure */
58429+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58430+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58431+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58432+
58433+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58434+ panic("Unable to allocate grsecurity authentication structure");
58435+ return;
58436+ }
58437+
58438+
58439+#ifdef CONFIG_GRKERNSEC_IO
58440+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58441+ grsec_disable_privio = 1;
58442+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58443+ grsec_disable_privio = 1;
58444+#else
58445+ grsec_disable_privio = 0;
58446+#endif
58447+#endif
58448+
58449+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58450+ /* for backward compatibility, tpe_invert always defaults to on if
58451+ enabled in the kernel
58452+ */
58453+ grsec_enable_tpe_invert = 1;
58454+#endif
58455+
58456+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58457+#ifndef CONFIG_GRKERNSEC_SYSCTL
58458+ grsec_lock = 1;
58459+#endif
58460+
58461+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58462+ grsec_enable_audit_textrel = 1;
58463+#endif
58464+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58465+ grsec_enable_log_rwxmaps = 1;
58466+#endif
58467+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58468+ grsec_enable_group = 1;
58469+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58470+#endif
58471+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58472+ grsec_enable_chdir = 1;
58473+#endif
58474+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58475+ grsec_enable_harden_ptrace = 1;
58476+#endif
58477+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58478+ grsec_enable_mount = 1;
58479+#endif
58480+#ifdef CONFIG_GRKERNSEC_LINK
58481+ grsec_enable_link = 1;
58482+#endif
58483+#ifdef CONFIG_GRKERNSEC_BRUTE
58484+ grsec_enable_brute = 1;
58485+#endif
58486+#ifdef CONFIG_GRKERNSEC_DMESG
58487+ grsec_enable_dmesg = 1;
58488+#endif
58489+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58490+ grsec_enable_blackhole = 1;
58491+ grsec_lastack_retries = 4;
58492+#endif
58493+#ifdef CONFIG_GRKERNSEC_FIFO
58494+ grsec_enable_fifo = 1;
58495+#endif
58496+#ifdef CONFIG_GRKERNSEC_EXECLOG
58497+ grsec_enable_execlog = 1;
58498+#endif
58499+#ifdef CONFIG_GRKERNSEC_SETXID
58500+ grsec_enable_setxid = 1;
58501+#endif
58502+#ifdef CONFIG_GRKERNSEC_SIGNAL
58503+ grsec_enable_signal = 1;
58504+#endif
58505+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58506+ grsec_enable_forkfail = 1;
58507+#endif
58508+#ifdef CONFIG_GRKERNSEC_TIME
58509+ grsec_enable_time = 1;
58510+#endif
58511+#ifdef CONFIG_GRKERNSEC_RESLOG
58512+ grsec_resource_logging = 1;
58513+#endif
58514+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58515+ grsec_enable_chroot_findtask = 1;
58516+#endif
58517+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58518+ grsec_enable_chroot_unix = 1;
58519+#endif
58520+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58521+ grsec_enable_chroot_mount = 1;
58522+#endif
58523+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58524+ grsec_enable_chroot_fchdir = 1;
58525+#endif
58526+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58527+ grsec_enable_chroot_shmat = 1;
58528+#endif
58529+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58530+ grsec_enable_audit_ptrace = 1;
58531+#endif
58532+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58533+ grsec_enable_chroot_double = 1;
58534+#endif
58535+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58536+ grsec_enable_chroot_pivot = 1;
58537+#endif
58538+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58539+ grsec_enable_chroot_chdir = 1;
58540+#endif
58541+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58542+ grsec_enable_chroot_chmod = 1;
58543+#endif
58544+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58545+ grsec_enable_chroot_mknod = 1;
58546+#endif
58547+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58548+ grsec_enable_chroot_nice = 1;
58549+#endif
58550+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58551+ grsec_enable_chroot_execlog = 1;
58552+#endif
58553+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58554+ grsec_enable_chroot_caps = 1;
58555+#endif
58556+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58557+ grsec_enable_chroot_sysctl = 1;
58558+#endif
58559+#ifdef CONFIG_GRKERNSEC_TPE
58560+ grsec_enable_tpe = 1;
58561+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58562+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58563+ grsec_enable_tpe_all = 1;
58564+#endif
58565+#endif
58566+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58567+ grsec_enable_socket_all = 1;
58568+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58569+#endif
58570+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58571+ grsec_enable_socket_client = 1;
58572+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58573+#endif
58574+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58575+ grsec_enable_socket_server = 1;
58576+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58577+#endif
58578+#endif
58579+
58580+ return;
58581+}
58582diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
58583new file mode 100644
58584index 0000000..3efe141
58585--- /dev/null
58586+++ b/grsecurity/grsec_link.c
58587@@ -0,0 +1,43 @@
58588+#include <linux/kernel.h>
58589+#include <linux/sched.h>
58590+#include <linux/fs.h>
58591+#include <linux/file.h>
58592+#include <linux/grinternal.h>
58593+
58594+int
58595+gr_handle_follow_link(const struct inode *parent,
58596+ const struct inode *inode,
58597+ const struct dentry *dentry, const struct vfsmount *mnt)
58598+{
58599+#ifdef CONFIG_GRKERNSEC_LINK
58600+ const struct cred *cred = current_cred();
58601+
58602+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58603+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58604+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58605+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58606+ return -EACCES;
58607+ }
58608+#endif
58609+ return 0;
58610+}
58611+
58612+int
58613+gr_handle_hardlink(const struct dentry *dentry,
58614+ const struct vfsmount *mnt,
58615+ struct inode *inode, const int mode, const char *to)
58616+{
58617+#ifdef CONFIG_GRKERNSEC_LINK
58618+ const struct cred *cred = current_cred();
58619+
58620+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58621+ (!S_ISREG(mode) || (mode & S_ISUID) ||
58622+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
58623+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58624+ !capable(CAP_FOWNER) && cred->uid) {
58625+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58626+ return -EPERM;
58627+ }
58628+#endif
58629+ return 0;
58630+}
58631diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
58632new file mode 100644
58633index 0000000..a45d2e9
58634--- /dev/null
58635+++ b/grsecurity/grsec_log.c
58636@@ -0,0 +1,322 @@
58637+#include <linux/kernel.h>
58638+#include <linux/sched.h>
58639+#include <linux/file.h>
58640+#include <linux/tty.h>
58641+#include <linux/fs.h>
58642+#include <linux/grinternal.h>
58643+
58644+#ifdef CONFIG_TREE_PREEMPT_RCU
58645+#define DISABLE_PREEMPT() preempt_disable()
58646+#define ENABLE_PREEMPT() preempt_enable()
58647+#else
58648+#define DISABLE_PREEMPT()
58649+#define ENABLE_PREEMPT()
58650+#endif
58651+
58652+#define BEGIN_LOCKS(x) \
58653+ DISABLE_PREEMPT(); \
58654+ rcu_read_lock(); \
58655+ read_lock(&tasklist_lock); \
58656+ read_lock(&grsec_exec_file_lock); \
58657+ if (x != GR_DO_AUDIT) \
58658+ spin_lock(&grsec_alert_lock); \
58659+ else \
58660+ spin_lock(&grsec_audit_lock)
58661+
58662+#define END_LOCKS(x) \
58663+ if (x != GR_DO_AUDIT) \
58664+ spin_unlock(&grsec_alert_lock); \
58665+ else \
58666+ spin_unlock(&grsec_audit_lock); \
58667+ read_unlock(&grsec_exec_file_lock); \
58668+ read_unlock(&tasklist_lock); \
58669+ rcu_read_unlock(); \
58670+ ENABLE_PREEMPT(); \
58671+ if (x == GR_DONT_AUDIT) \
58672+ gr_handle_alertkill(current)
58673+
58674+enum {
58675+ FLOODING,
58676+ NO_FLOODING
58677+};
58678+
58679+extern char *gr_alert_log_fmt;
58680+extern char *gr_audit_log_fmt;
58681+extern char *gr_alert_log_buf;
58682+extern char *gr_audit_log_buf;
58683+
58684+static int gr_log_start(int audit)
58685+{
58686+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58687+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58688+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58689+#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
58690+ unsigned long curr_secs = get_seconds();
58691+
58692+ if (audit == GR_DO_AUDIT)
58693+ goto set_fmt;
58694+
58695+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
58696+ grsec_alert_wtime = curr_secs;
58697+ grsec_alert_fyet = 0;
58698+ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
58699+ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58700+ grsec_alert_fyet++;
58701+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58702+ grsec_alert_wtime = curr_secs;
58703+ grsec_alert_fyet++;
58704+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58705+ return FLOODING;
58706+ }
58707+ else return FLOODING;
58708+
58709+set_fmt:
58710+#endif
58711+ memset(buf, 0, PAGE_SIZE);
58712+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
58713+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58714+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58715+ } else if (current->signal->curr_ip) {
58716+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58717+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58718+ } else if (gr_acl_is_enabled()) {
58719+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58720+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58721+ } else {
58722+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58723+ strcpy(buf, fmt);
58724+ }
58725+
58726+ return NO_FLOODING;
58727+}
58728+
58729+static void gr_log_middle(int audit, const char *msg, va_list ap)
58730+ __attribute__ ((format (printf, 2, 0)));
58731+
58732+static void gr_log_middle(int audit, const char *msg, va_list ap)
58733+{
58734+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58735+ unsigned int len = strlen(buf);
58736+
58737+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58738+
58739+ return;
58740+}
58741+
58742+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58743+ __attribute__ ((format (printf, 2, 3)));
58744+
58745+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58746+{
58747+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58748+ unsigned int len = strlen(buf);
58749+ va_list ap;
58750+
58751+ va_start(ap, msg);
58752+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58753+ va_end(ap);
58754+
58755+ return;
58756+}
58757+
58758+static void gr_log_end(int audit, int append_default)
58759+{
58760+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58761+
58762+ if (append_default) {
58763+ unsigned int len = strlen(buf);
58764+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58765+ }
58766+
58767+ printk("%s\n", buf);
58768+
58769+ return;
58770+}
58771+
58772+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58773+{
58774+ int logtype;
58775+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58776+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58777+ void *voidptr = NULL;
58778+ int num1 = 0, num2 = 0;
58779+ unsigned long ulong1 = 0, ulong2 = 0;
58780+ struct dentry *dentry = NULL;
58781+ struct vfsmount *mnt = NULL;
58782+ struct file *file = NULL;
58783+ struct task_struct *task = NULL;
58784+ const struct cred *cred, *pcred;
58785+ va_list ap;
58786+
58787+ BEGIN_LOCKS(audit);
58788+ logtype = gr_log_start(audit);
58789+ if (logtype == FLOODING) {
58790+ END_LOCKS(audit);
58791+ return;
58792+ }
58793+ va_start(ap, argtypes);
58794+ switch (argtypes) {
58795+ case GR_TTYSNIFF:
58796+ task = va_arg(ap, struct task_struct *);
58797+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58798+ break;
58799+ case GR_SYSCTL_HIDDEN:
58800+ str1 = va_arg(ap, char *);
58801+ gr_log_middle_varargs(audit, msg, result, str1);
58802+ break;
58803+ case GR_RBAC:
58804+ dentry = va_arg(ap, struct dentry *);
58805+ mnt = va_arg(ap, struct vfsmount *);
58806+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58807+ break;
58808+ case GR_RBAC_STR:
58809+ dentry = va_arg(ap, struct dentry *);
58810+ mnt = va_arg(ap, struct vfsmount *);
58811+ str1 = va_arg(ap, char *);
58812+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58813+ break;
58814+ case GR_STR_RBAC:
58815+ str1 = va_arg(ap, char *);
58816+ dentry = va_arg(ap, struct dentry *);
58817+ mnt = va_arg(ap, struct vfsmount *);
58818+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58819+ break;
58820+ case GR_RBAC_MODE2:
58821+ dentry = va_arg(ap, struct dentry *);
58822+ mnt = va_arg(ap, struct vfsmount *);
58823+ str1 = va_arg(ap, char *);
58824+ str2 = va_arg(ap, char *);
58825+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58826+ break;
58827+ case GR_RBAC_MODE3:
58828+ dentry = va_arg(ap, struct dentry *);
58829+ mnt = va_arg(ap, struct vfsmount *);
58830+ str1 = va_arg(ap, char *);
58831+ str2 = va_arg(ap, char *);
58832+ str3 = va_arg(ap, char *);
58833+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58834+ break;
58835+ case GR_FILENAME:
58836+ dentry = va_arg(ap, struct dentry *);
58837+ mnt = va_arg(ap, struct vfsmount *);
58838+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58839+ break;
58840+ case GR_STR_FILENAME:
58841+ str1 = va_arg(ap, char *);
58842+ dentry = va_arg(ap, struct dentry *);
58843+ mnt = va_arg(ap, struct vfsmount *);
58844+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58845+ break;
58846+ case GR_FILENAME_STR:
58847+ dentry = va_arg(ap, struct dentry *);
58848+ mnt = va_arg(ap, struct vfsmount *);
58849+ str1 = va_arg(ap, char *);
58850+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58851+ break;
58852+ case GR_FILENAME_TWO_INT:
58853+ dentry = va_arg(ap, struct dentry *);
58854+ mnt = va_arg(ap, struct vfsmount *);
58855+ num1 = va_arg(ap, int);
58856+ num2 = va_arg(ap, int);
58857+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58858+ break;
58859+ case GR_FILENAME_TWO_INT_STR:
58860+ dentry = va_arg(ap, struct dentry *);
58861+ mnt = va_arg(ap, struct vfsmount *);
58862+ num1 = va_arg(ap, int);
58863+ num2 = va_arg(ap, int);
58864+ str1 = va_arg(ap, char *);
58865+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58866+ break;
58867+ case GR_TEXTREL:
58868+ file = va_arg(ap, struct file *);
58869+ ulong1 = va_arg(ap, unsigned long);
58870+ ulong2 = va_arg(ap, unsigned long);
58871+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58872+ break;
58873+ case GR_PTRACE:
58874+ task = va_arg(ap, struct task_struct *);
58875+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58876+ break;
58877+ case GR_RESOURCE:
58878+ task = va_arg(ap, struct task_struct *);
58879+ cred = __task_cred(task);
58880+ pcred = __task_cred(task->real_parent);
58881+ ulong1 = va_arg(ap, unsigned long);
58882+ str1 = va_arg(ap, char *);
58883+ ulong2 = va_arg(ap, unsigned long);
58884+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58885+ break;
58886+ case GR_CAP:
58887+ task = va_arg(ap, struct task_struct *);
58888+ cred = __task_cred(task);
58889+ pcred = __task_cred(task->real_parent);
58890+ str1 = va_arg(ap, char *);
58891+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58892+ break;
58893+ case GR_SIG:
58894+ str1 = va_arg(ap, char *);
58895+ voidptr = va_arg(ap, void *);
58896+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58897+ break;
58898+ case GR_SIG2:
58899+ task = va_arg(ap, struct task_struct *);
58900+ cred = __task_cred(task);
58901+ pcred = __task_cred(task->real_parent);
58902+ num1 = va_arg(ap, int);
58903+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58904+ break;
58905+ case GR_CRASH1:
58906+ task = va_arg(ap, struct task_struct *);
58907+ cred = __task_cred(task);
58908+ pcred = __task_cred(task->real_parent);
58909+ ulong1 = va_arg(ap, unsigned long);
58910+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58911+ break;
58912+ case GR_CRASH2:
58913+ task = va_arg(ap, struct task_struct *);
58914+ cred = __task_cred(task);
58915+ pcred = __task_cred(task->real_parent);
58916+ ulong1 = va_arg(ap, unsigned long);
58917+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58918+ break;
58919+ case GR_RWXMAP:
58920+ file = va_arg(ap, struct file *);
58921+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58922+ break;
58923+ case GR_PSACCT:
58924+ {
58925+ unsigned int wday, cday;
58926+ __u8 whr, chr;
58927+ __u8 wmin, cmin;
58928+ __u8 wsec, csec;
58929+ char cur_tty[64] = { 0 };
58930+ char parent_tty[64] = { 0 };
58931+
58932+ task = va_arg(ap, struct task_struct *);
58933+ wday = va_arg(ap, unsigned int);
58934+ cday = va_arg(ap, unsigned int);
58935+ whr = va_arg(ap, int);
58936+ chr = va_arg(ap, int);
58937+ wmin = va_arg(ap, int);
58938+ cmin = va_arg(ap, int);
58939+ wsec = va_arg(ap, int);
58940+ csec = va_arg(ap, int);
58941+ ulong1 = va_arg(ap, unsigned long);
58942+ cred = __task_cred(task);
58943+ pcred = __task_cred(task->real_parent);
58944+
58945+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58946+ }
58947+ break;
58948+ default:
58949+ gr_log_middle(audit, msg, ap);
58950+ }
58951+ va_end(ap);
58952+ // these don't need DEFAULTSECARGS printed on the end
58953+ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
58954+ gr_log_end(audit, 0);
58955+ else
58956+ gr_log_end(audit, 1);
58957+ END_LOCKS(audit);
58958+}
58959diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
58960new file mode 100644
58961index 0000000..6c0416b
58962--- /dev/null
58963+++ b/grsecurity/grsec_mem.c
58964@@ -0,0 +1,33 @@
58965+#include <linux/kernel.h>
58966+#include <linux/sched.h>
58967+#include <linux/mm.h>
58968+#include <linux/mman.h>
58969+#include <linux/grinternal.h>
58970+
58971+void
58972+gr_handle_ioperm(void)
58973+{
58974+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58975+ return;
58976+}
58977+
58978+void
58979+gr_handle_iopl(void)
58980+{
58981+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58982+ return;
58983+}
58984+
58985+void
58986+gr_handle_mem_readwrite(u64 from, u64 to)
58987+{
58988+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58989+ return;
58990+}
58991+
58992+void
58993+gr_handle_vm86(void)
58994+{
58995+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58996+ return;
58997+}
58998diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
58999new file mode 100644
59000index 0000000..2131422
59001--- /dev/null
59002+++ b/grsecurity/grsec_mount.c
59003@@ -0,0 +1,62 @@
59004+#include <linux/kernel.h>
59005+#include <linux/sched.h>
59006+#include <linux/mount.h>
59007+#include <linux/grsecurity.h>
59008+#include <linux/grinternal.h>
59009+
59010+void
59011+gr_log_remount(const char *devname, const int retval)
59012+{
59013+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59014+ if (grsec_enable_mount && (retval >= 0))
59015+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
59016+#endif
59017+ return;
59018+}
59019+
59020+void
59021+gr_log_unmount(const char *devname, const int retval)
59022+{
59023+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59024+ if (grsec_enable_mount && (retval >= 0))
59025+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
59026+#endif
59027+ return;
59028+}
59029+
59030+void
59031+gr_log_mount(const char *from, const char *to, const int retval)
59032+{
59033+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59034+ if (grsec_enable_mount && (retval >= 0))
59035+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
59036+#endif
59037+ return;
59038+}
59039+
59040+int
59041+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
59042+{
59043+#ifdef CONFIG_GRKERNSEC_ROFS
59044+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
59045+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
59046+ return -EPERM;
59047+ } else
59048+ return 0;
59049+#endif
59050+ return 0;
59051+}
59052+
59053+int
59054+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
59055+{
59056+#ifdef CONFIG_GRKERNSEC_ROFS
59057+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
59058+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
59059+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
59060+ return -EPERM;
59061+ } else
59062+ return 0;
59063+#endif
59064+ return 0;
59065+}
59066diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
59067new file mode 100644
59068index 0000000..a3b12a0
59069--- /dev/null
59070+++ b/grsecurity/grsec_pax.c
59071@@ -0,0 +1,36 @@
59072+#include <linux/kernel.h>
59073+#include <linux/sched.h>
59074+#include <linux/mm.h>
59075+#include <linux/file.h>
59076+#include <linux/grinternal.h>
59077+#include <linux/grsecurity.h>
59078+
59079+void
59080+gr_log_textrel(struct vm_area_struct * vma)
59081+{
59082+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59083+ if (grsec_enable_audit_textrel)
59084+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
59085+#endif
59086+ return;
59087+}
59088+
59089+void
59090+gr_log_rwxmmap(struct file *file)
59091+{
59092+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59093+ if (grsec_enable_log_rwxmaps)
59094+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
59095+#endif
59096+ return;
59097+}
59098+
59099+void
59100+gr_log_rwxmprotect(struct file *file)
59101+{
59102+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59103+ if (grsec_enable_log_rwxmaps)
59104+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
59105+#endif
59106+ return;
59107+}
59108diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
59109new file mode 100644
59110index 0000000..472c1d6
59111--- /dev/null
59112+++ b/grsecurity/grsec_ptrace.c
59113@@ -0,0 +1,14 @@
59114+#include <linux/kernel.h>
59115+#include <linux/sched.h>
59116+#include <linux/grinternal.h>
59117+#include <linux/grsecurity.h>
59118+
59119+void
59120+gr_audit_ptrace(struct task_struct *task)
59121+{
59122+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59123+ if (grsec_enable_audit_ptrace)
59124+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
59125+#endif
59126+ return;
59127+}
59128diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
59129new file mode 100644
59130index 0000000..7a5b2de
59131--- /dev/null
59132+++ b/grsecurity/grsec_sig.c
59133@@ -0,0 +1,207 @@
59134+#include <linux/kernel.h>
59135+#include <linux/sched.h>
59136+#include <linux/delay.h>
59137+#include <linux/grsecurity.h>
59138+#include <linux/grinternal.h>
59139+#include <linux/hardirq.h>
59140+
59141+char *signames[] = {
59142+ [SIGSEGV] = "Segmentation fault",
59143+ [SIGILL] = "Illegal instruction",
59144+ [SIGABRT] = "Abort",
59145+ [SIGBUS] = "Invalid alignment/Bus error"
59146+};
59147+
59148+void
59149+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
59150+{
59151+#ifdef CONFIG_GRKERNSEC_SIGNAL
59152+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
59153+ (sig == SIGABRT) || (sig == SIGBUS))) {
59154+ if (t->pid == current->pid) {
59155+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
59156+ } else {
59157+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
59158+ }
59159+ }
59160+#endif
59161+ return;
59162+}
59163+
59164+int
59165+gr_handle_signal(const struct task_struct *p, const int sig)
59166+{
59167+#ifdef CONFIG_GRKERNSEC
59168+ /* ignore the 0 signal for protected task checks */
59169+ if (current->pid > 1 && sig && gr_check_protected_task(p)) {
59170+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
59171+ return -EPERM;
59172+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
59173+ return -EPERM;
59174+ }
59175+#endif
59176+ return 0;
59177+}
59178+
59179+#ifdef CONFIG_GRKERNSEC
59180+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
59181+
59182+int gr_fake_force_sig(int sig, struct task_struct *t)
59183+{
59184+ unsigned long int flags;
59185+ int ret, blocked, ignored;
59186+ struct k_sigaction *action;
59187+
59188+ spin_lock_irqsave(&t->sighand->siglock, flags);
59189+ action = &t->sighand->action[sig-1];
59190+ ignored = action->sa.sa_handler == SIG_IGN;
59191+ blocked = sigismember(&t->blocked, sig);
59192+ if (blocked || ignored) {
59193+ action->sa.sa_handler = SIG_DFL;
59194+ if (blocked) {
59195+ sigdelset(&t->blocked, sig);
59196+ recalc_sigpending_and_wake(t);
59197+ }
59198+ }
59199+ if (action->sa.sa_handler == SIG_DFL)
59200+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
59201+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
59202+
59203+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
59204+
59205+ return ret;
59206+}
59207+#endif
59208+
59209+#ifdef CONFIG_GRKERNSEC_BRUTE
59210+#define GR_USER_BAN_TIME (15 * 60)
59211+
59212+static int __get_dumpable(unsigned long mm_flags)
59213+{
59214+ int ret;
59215+
59216+ ret = mm_flags & MMF_DUMPABLE_MASK;
59217+ return (ret >= 2) ? 2 : ret;
59218+}
59219+#endif
59220+
59221+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
59222+{
59223+#ifdef CONFIG_GRKERNSEC_BRUTE
59224+ uid_t uid = 0;
59225+
59226+ if (!grsec_enable_brute)
59227+ return;
59228+
59229+ rcu_read_lock();
59230+ read_lock(&tasklist_lock);
59231+ read_lock(&grsec_exec_file_lock);
59232+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
59233+ p->real_parent->brute = 1;
59234+ else {
59235+ const struct cred *cred = __task_cred(p), *cred2;
59236+ struct task_struct *tsk, *tsk2;
59237+
59238+ if (!__get_dumpable(mm_flags) && cred->uid) {
59239+ struct user_struct *user;
59240+
59241+ uid = cred->uid;
59242+
59243+ /* this is put upon execution past expiration */
59244+ user = find_user(uid);
59245+ if (user == NULL)
59246+ goto unlock;
59247+ user->banned = 1;
59248+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
59249+ if (user->ban_expires == ~0UL)
59250+ user->ban_expires--;
59251+
59252+ do_each_thread(tsk2, tsk) {
59253+ cred2 = __task_cred(tsk);
59254+ if (tsk != p && cred2->uid == uid)
59255+ gr_fake_force_sig(SIGKILL, tsk);
59256+ } while_each_thread(tsk2, tsk);
59257+ }
59258+ }
59259+unlock:
59260+ read_unlock(&grsec_exec_file_lock);
59261+ read_unlock(&tasklist_lock);
59262+ rcu_read_unlock();
59263+
59264+ if (uid)
59265+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
59266+
59267+#endif
59268+ return;
59269+}
59270+
59271+void gr_handle_brute_check(void)
59272+{
59273+#ifdef CONFIG_GRKERNSEC_BRUTE
59274+ if (current->brute)
59275+ msleep(30 * 1000);
59276+#endif
59277+ return;
59278+}
59279+
59280+void gr_handle_kernel_exploit(void)
59281+{
59282+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
59283+ const struct cred *cred;
59284+ struct task_struct *tsk, *tsk2;
59285+ struct user_struct *user;
59286+ uid_t uid;
59287+
59288+ if (in_irq() || in_serving_softirq() || in_nmi())
59289+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
59290+
59291+ uid = current_uid();
59292+
59293+ if (uid == 0)
59294+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
59295+ else {
59296+ /* kill all the processes of this user, hold a reference
59297+ to their creds struct, and prevent them from creating
59298+ another process until system reset
59299+ */
59300+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
59301+ /* we intentionally leak this ref */
59302+ user = get_uid(current->cred->user);
59303+ if (user) {
59304+ user->banned = 1;
59305+ user->ban_expires = ~0UL;
59306+ }
59307+
59308+ read_lock(&tasklist_lock);
59309+ do_each_thread(tsk2, tsk) {
59310+ cred = __task_cred(tsk);
59311+ if (cred->uid == uid)
59312+ gr_fake_force_sig(SIGKILL, tsk);
59313+ } while_each_thread(tsk2, tsk);
59314+ read_unlock(&tasklist_lock);
59315+ }
59316+#endif
59317+}
59318+
59319+int __gr_process_user_ban(struct user_struct *user)
59320+{
59321+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59322+ if (unlikely(user->banned)) {
59323+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59324+ user->banned = 0;
59325+ user->ban_expires = 0;
59326+ free_uid(user);
59327+ } else
59328+ return -EPERM;
59329+ }
59330+#endif
59331+ return 0;
59332+}
59333+
59334+int gr_process_user_ban(void)
59335+{
59336+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59337+ return __gr_process_user_ban(current->cred->user);
59338+#endif
59339+ return 0;
59340+}
59341diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
59342new file mode 100644
59343index 0000000..4030d57
59344--- /dev/null
59345+++ b/grsecurity/grsec_sock.c
59346@@ -0,0 +1,244 @@
59347+#include <linux/kernel.h>
59348+#include <linux/module.h>
59349+#include <linux/sched.h>
59350+#include <linux/file.h>
59351+#include <linux/net.h>
59352+#include <linux/in.h>
59353+#include <linux/ip.h>
59354+#include <net/sock.h>
59355+#include <net/inet_sock.h>
59356+#include <linux/grsecurity.h>
59357+#include <linux/grinternal.h>
59358+#include <linux/gracl.h>
59359+
59360+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59361+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59362+
59363+EXPORT_SYMBOL(gr_search_udp_recvmsg);
59364+EXPORT_SYMBOL(gr_search_udp_sendmsg);
59365+
59366+#ifdef CONFIG_UNIX_MODULE
59367+EXPORT_SYMBOL(gr_acl_handle_unix);
59368+EXPORT_SYMBOL(gr_acl_handle_mknod);
59369+EXPORT_SYMBOL(gr_handle_chroot_unix);
59370+EXPORT_SYMBOL(gr_handle_create);
59371+#endif
59372+
59373+#ifdef CONFIG_GRKERNSEC
59374+#define gr_conn_table_size 32749
59375+struct conn_table_entry {
59376+ struct conn_table_entry *next;
59377+ struct signal_struct *sig;
59378+};
59379+
59380+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59381+DEFINE_SPINLOCK(gr_conn_table_lock);
59382+
59383+extern const char * gr_socktype_to_name(unsigned char type);
59384+extern const char * gr_proto_to_name(unsigned char proto);
59385+extern const char * gr_sockfamily_to_name(unsigned char family);
59386+
59387+static __inline__ int
59388+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59389+{
59390+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59391+}
59392+
59393+static __inline__ int
59394+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59395+ __u16 sport, __u16 dport)
59396+{
59397+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59398+ sig->gr_sport == sport && sig->gr_dport == dport))
59399+ return 1;
59400+ else
59401+ return 0;
59402+}
59403+
59404+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59405+{
59406+ struct conn_table_entry **match;
59407+ unsigned int index;
59408+
59409+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59410+ sig->gr_sport, sig->gr_dport,
59411+ gr_conn_table_size);
59412+
59413+ newent->sig = sig;
59414+
59415+ match = &gr_conn_table[index];
59416+ newent->next = *match;
59417+ *match = newent;
59418+
59419+ return;
59420+}
59421+
59422+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59423+{
59424+ struct conn_table_entry *match, *last = NULL;
59425+ unsigned int index;
59426+
59427+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59428+ sig->gr_sport, sig->gr_dport,
59429+ gr_conn_table_size);
59430+
59431+ match = gr_conn_table[index];
59432+ while (match && !conn_match(match->sig,
59433+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59434+ sig->gr_dport)) {
59435+ last = match;
59436+ match = match->next;
59437+ }
59438+
59439+ if (match) {
59440+ if (last)
59441+ last->next = match->next;
59442+ else
59443+ gr_conn_table[index] = NULL;
59444+ kfree(match);
59445+ }
59446+
59447+ return;
59448+}
59449+
59450+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59451+ __u16 sport, __u16 dport)
59452+{
59453+ struct conn_table_entry *match;
59454+ unsigned int index;
59455+
59456+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59457+
59458+ match = gr_conn_table[index];
59459+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59460+ match = match->next;
59461+
59462+ if (match)
59463+ return match->sig;
59464+ else
59465+ return NULL;
59466+}
59467+
59468+#endif
59469+
59470+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59471+{
59472+#ifdef CONFIG_GRKERNSEC
59473+ struct signal_struct *sig = task->signal;
59474+ struct conn_table_entry *newent;
59475+
59476+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59477+ if (newent == NULL)
59478+ return;
59479+ /* no bh lock needed since we are called with bh disabled */
59480+ spin_lock(&gr_conn_table_lock);
59481+ gr_del_task_from_ip_table_nolock(sig);
59482+ sig->gr_saddr = inet->inet_rcv_saddr;
59483+ sig->gr_daddr = inet->inet_daddr;
59484+ sig->gr_sport = inet->inet_sport;
59485+ sig->gr_dport = inet->inet_dport;
59486+ gr_add_to_task_ip_table_nolock(sig, newent);
59487+ spin_unlock(&gr_conn_table_lock);
59488+#endif
59489+ return;
59490+}
59491+
59492+void gr_del_task_from_ip_table(struct task_struct *task)
59493+{
59494+#ifdef CONFIG_GRKERNSEC
59495+ spin_lock_bh(&gr_conn_table_lock);
59496+ gr_del_task_from_ip_table_nolock(task->signal);
59497+ spin_unlock_bh(&gr_conn_table_lock);
59498+#endif
59499+ return;
59500+}
59501+
59502+void
59503+gr_attach_curr_ip(const struct sock *sk)
59504+{
59505+#ifdef CONFIG_GRKERNSEC
59506+ struct signal_struct *p, *set;
59507+ const struct inet_sock *inet = inet_sk(sk);
59508+
59509+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59510+ return;
59511+
59512+ set = current->signal;
59513+
59514+ spin_lock_bh(&gr_conn_table_lock);
59515+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59516+ inet->inet_dport, inet->inet_sport);
59517+ if (unlikely(p != NULL)) {
59518+ set->curr_ip = p->curr_ip;
59519+ set->used_accept = 1;
59520+ gr_del_task_from_ip_table_nolock(p);
59521+ spin_unlock_bh(&gr_conn_table_lock);
59522+ return;
59523+ }
59524+ spin_unlock_bh(&gr_conn_table_lock);
59525+
59526+ set->curr_ip = inet->inet_daddr;
59527+ set->used_accept = 1;
59528+#endif
59529+ return;
59530+}
59531+
59532+int
59533+gr_handle_sock_all(const int family, const int type, const int protocol)
59534+{
59535+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59536+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59537+ (family != AF_UNIX)) {
59538+ if (family == AF_INET)
59539+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59540+ else
59541+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59542+ return -EACCES;
59543+ }
59544+#endif
59545+ return 0;
59546+}
59547+
59548+int
59549+gr_handle_sock_server(const struct sockaddr *sck)
59550+{
59551+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59552+ if (grsec_enable_socket_server &&
59553+ in_group_p(grsec_socket_server_gid) &&
59554+ sck && (sck->sa_family != AF_UNIX) &&
59555+ (sck->sa_family != AF_LOCAL)) {
59556+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59557+ return -EACCES;
59558+ }
59559+#endif
59560+ return 0;
59561+}
59562+
59563+int
59564+gr_handle_sock_server_other(const struct sock *sck)
59565+{
59566+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59567+ if (grsec_enable_socket_server &&
59568+ in_group_p(grsec_socket_server_gid) &&
59569+ sck && (sck->sk_family != AF_UNIX) &&
59570+ (sck->sk_family != AF_LOCAL)) {
59571+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59572+ return -EACCES;
59573+ }
59574+#endif
59575+ return 0;
59576+}
59577+
59578+int
59579+gr_handle_sock_client(const struct sockaddr *sck)
59580+{
59581+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59582+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59583+ sck && (sck->sa_family != AF_UNIX) &&
59584+ (sck->sa_family != AF_LOCAL)) {
59585+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59586+ return -EACCES;
59587+ }
59588+#endif
59589+ return 0;
59590+}
59591diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
59592new file mode 100644
59593index 0000000..bceef2f
59594--- /dev/null
59595+++ b/grsecurity/grsec_sysctl.c
59596@@ -0,0 +1,442 @@
59597+#include <linux/kernel.h>
59598+#include <linux/sched.h>
59599+#include <linux/sysctl.h>
59600+#include <linux/grsecurity.h>
59601+#include <linux/grinternal.h>
59602+
59603+int
59604+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59605+{
59606+#ifdef CONFIG_GRKERNSEC_SYSCTL
59607+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59608+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59609+ return -EACCES;
59610+ }
59611+#endif
59612+ return 0;
59613+}
59614+
59615+#ifdef CONFIG_GRKERNSEC_ROFS
59616+static int __maybe_unused one = 1;
59617+#endif
59618+
59619+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59620+struct ctl_table grsecurity_table[] = {
59621+#ifdef CONFIG_GRKERNSEC_SYSCTL
59622+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59623+#ifdef CONFIG_GRKERNSEC_IO
59624+ {
59625+ .procname = "disable_priv_io",
59626+ .data = &grsec_disable_privio,
59627+ .maxlen = sizeof(int),
59628+ .mode = 0600,
59629+ .proc_handler = &proc_dointvec,
59630+ },
59631+#endif
59632+#endif
59633+#ifdef CONFIG_GRKERNSEC_LINK
59634+ {
59635+ .procname = "linking_restrictions",
59636+ .data = &grsec_enable_link,
59637+ .maxlen = sizeof(int),
59638+ .mode = 0600,
59639+ .proc_handler = &proc_dointvec,
59640+ },
59641+#endif
59642+#ifdef CONFIG_GRKERNSEC_BRUTE
59643+ {
59644+ .procname = "deter_bruteforce",
59645+ .data = &grsec_enable_brute,
59646+ .maxlen = sizeof(int),
59647+ .mode = 0600,
59648+ .proc_handler = &proc_dointvec,
59649+ },
59650+#endif
59651+#ifdef CONFIG_GRKERNSEC_FIFO
59652+ {
59653+ .procname = "fifo_restrictions",
59654+ .data = &grsec_enable_fifo,
59655+ .maxlen = sizeof(int),
59656+ .mode = 0600,
59657+ .proc_handler = &proc_dointvec,
59658+ },
59659+#endif
59660+#ifdef CONFIG_GRKERNSEC_SETXID
59661+ {
59662+ .procname = "consistent_setxid",
59663+ .data = &grsec_enable_setxid,
59664+ .maxlen = sizeof(int),
59665+ .mode = 0600,
59666+ .proc_handler = &proc_dointvec,
59667+ },
59668+#endif
59669+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59670+ {
59671+ .procname = "ip_blackhole",
59672+ .data = &grsec_enable_blackhole,
59673+ .maxlen = sizeof(int),
59674+ .mode = 0600,
59675+ .proc_handler = &proc_dointvec,
59676+ },
59677+ {
59678+ .procname = "lastack_retries",
59679+ .data = &grsec_lastack_retries,
59680+ .maxlen = sizeof(int),
59681+ .mode = 0600,
59682+ .proc_handler = &proc_dointvec,
59683+ },
59684+#endif
59685+#ifdef CONFIG_GRKERNSEC_EXECLOG
59686+ {
59687+ .procname = "exec_logging",
59688+ .data = &grsec_enable_execlog,
59689+ .maxlen = sizeof(int),
59690+ .mode = 0600,
59691+ .proc_handler = &proc_dointvec,
59692+ },
59693+#endif
59694+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59695+ {
59696+ .procname = "rwxmap_logging",
59697+ .data = &grsec_enable_log_rwxmaps,
59698+ .maxlen = sizeof(int),
59699+ .mode = 0600,
59700+ .proc_handler = &proc_dointvec,
59701+ },
59702+#endif
59703+#ifdef CONFIG_GRKERNSEC_SIGNAL
59704+ {
59705+ .procname = "signal_logging",
59706+ .data = &grsec_enable_signal,
59707+ .maxlen = sizeof(int),
59708+ .mode = 0600,
59709+ .proc_handler = &proc_dointvec,
59710+ },
59711+#endif
59712+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59713+ {
59714+ .procname = "forkfail_logging",
59715+ .data = &grsec_enable_forkfail,
59716+ .maxlen = sizeof(int),
59717+ .mode = 0600,
59718+ .proc_handler = &proc_dointvec,
59719+ },
59720+#endif
59721+#ifdef CONFIG_GRKERNSEC_TIME
59722+ {
59723+ .procname = "timechange_logging",
59724+ .data = &grsec_enable_time,
59725+ .maxlen = sizeof(int),
59726+ .mode = 0600,
59727+ .proc_handler = &proc_dointvec,
59728+ },
59729+#endif
59730+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59731+ {
59732+ .procname = "chroot_deny_shmat",
59733+ .data = &grsec_enable_chroot_shmat,
59734+ .maxlen = sizeof(int),
59735+ .mode = 0600,
59736+ .proc_handler = &proc_dointvec,
59737+ },
59738+#endif
59739+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59740+ {
59741+ .procname = "chroot_deny_unix",
59742+ .data = &grsec_enable_chroot_unix,
59743+ .maxlen = sizeof(int),
59744+ .mode = 0600,
59745+ .proc_handler = &proc_dointvec,
59746+ },
59747+#endif
59748+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59749+ {
59750+ .procname = "chroot_deny_mount",
59751+ .data = &grsec_enable_chroot_mount,
59752+ .maxlen = sizeof(int),
59753+ .mode = 0600,
59754+ .proc_handler = &proc_dointvec,
59755+ },
59756+#endif
59757+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59758+ {
59759+ .procname = "chroot_deny_fchdir",
59760+ .data = &grsec_enable_chroot_fchdir,
59761+ .maxlen = sizeof(int),
59762+ .mode = 0600,
59763+ .proc_handler = &proc_dointvec,
59764+ },
59765+#endif
59766+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59767+ {
59768+ .procname = "chroot_deny_chroot",
59769+ .data = &grsec_enable_chroot_double,
59770+ .maxlen = sizeof(int),
59771+ .mode = 0600,
59772+ .proc_handler = &proc_dointvec,
59773+ },
59774+#endif
59775+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59776+ {
59777+ .procname = "chroot_deny_pivot",
59778+ .data = &grsec_enable_chroot_pivot,
59779+ .maxlen = sizeof(int),
59780+ .mode = 0600,
59781+ .proc_handler = &proc_dointvec,
59782+ },
59783+#endif
59784+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59785+ {
59786+ .procname = "chroot_enforce_chdir",
59787+ .data = &grsec_enable_chroot_chdir,
59788+ .maxlen = sizeof(int),
59789+ .mode = 0600,
59790+ .proc_handler = &proc_dointvec,
59791+ },
59792+#endif
59793+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59794+ {
59795+ .procname = "chroot_deny_chmod",
59796+ .data = &grsec_enable_chroot_chmod,
59797+ .maxlen = sizeof(int),
59798+ .mode = 0600,
59799+ .proc_handler = &proc_dointvec,
59800+ },
59801+#endif
59802+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59803+ {
59804+ .procname = "chroot_deny_mknod",
59805+ .data = &grsec_enable_chroot_mknod,
59806+ .maxlen = sizeof(int),
59807+ .mode = 0600,
59808+ .proc_handler = &proc_dointvec,
59809+ },
59810+#endif
59811+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59812+ {
59813+ .procname = "chroot_restrict_nice",
59814+ .data = &grsec_enable_chroot_nice,
59815+ .maxlen = sizeof(int),
59816+ .mode = 0600,
59817+ .proc_handler = &proc_dointvec,
59818+ },
59819+#endif
59820+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59821+ {
59822+ .procname = "chroot_execlog",
59823+ .data = &grsec_enable_chroot_execlog,
59824+ .maxlen = sizeof(int),
59825+ .mode = 0600,
59826+ .proc_handler = &proc_dointvec,
59827+ },
59828+#endif
59829+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59830+ {
59831+ .procname = "chroot_caps",
59832+ .data = &grsec_enable_chroot_caps,
59833+ .maxlen = sizeof(int),
59834+ .mode = 0600,
59835+ .proc_handler = &proc_dointvec,
59836+ },
59837+#endif
59838+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59839+ {
59840+ .procname = "chroot_deny_sysctl",
59841+ .data = &grsec_enable_chroot_sysctl,
59842+ .maxlen = sizeof(int),
59843+ .mode = 0600,
59844+ .proc_handler = &proc_dointvec,
59845+ },
59846+#endif
59847+#ifdef CONFIG_GRKERNSEC_TPE
59848+ {
59849+ .procname = "tpe",
59850+ .data = &grsec_enable_tpe,
59851+ .maxlen = sizeof(int),
59852+ .mode = 0600,
59853+ .proc_handler = &proc_dointvec,
59854+ },
59855+ {
59856+ .procname = "tpe_gid",
59857+ .data = &grsec_tpe_gid,
59858+ .maxlen = sizeof(int),
59859+ .mode = 0600,
59860+ .proc_handler = &proc_dointvec,
59861+ },
59862+#endif
59863+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59864+ {
59865+ .procname = "tpe_invert",
59866+ .data = &grsec_enable_tpe_invert,
59867+ .maxlen = sizeof(int),
59868+ .mode = 0600,
59869+ .proc_handler = &proc_dointvec,
59870+ },
59871+#endif
59872+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59873+ {
59874+ .procname = "tpe_restrict_all",
59875+ .data = &grsec_enable_tpe_all,
59876+ .maxlen = sizeof(int),
59877+ .mode = 0600,
59878+ .proc_handler = &proc_dointvec,
59879+ },
59880+#endif
59881+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59882+ {
59883+ .procname = "socket_all",
59884+ .data = &grsec_enable_socket_all,
59885+ .maxlen = sizeof(int),
59886+ .mode = 0600,
59887+ .proc_handler = &proc_dointvec,
59888+ },
59889+ {
59890+ .procname = "socket_all_gid",
59891+ .data = &grsec_socket_all_gid,
59892+ .maxlen = sizeof(int),
59893+ .mode = 0600,
59894+ .proc_handler = &proc_dointvec,
59895+ },
59896+#endif
59897+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59898+ {
59899+ .procname = "socket_client",
59900+ .data = &grsec_enable_socket_client,
59901+ .maxlen = sizeof(int),
59902+ .mode = 0600,
59903+ .proc_handler = &proc_dointvec,
59904+ },
59905+ {
59906+ .procname = "socket_client_gid",
59907+ .data = &grsec_socket_client_gid,
59908+ .maxlen = sizeof(int),
59909+ .mode = 0600,
59910+ .proc_handler = &proc_dointvec,
59911+ },
59912+#endif
59913+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59914+ {
59915+ .procname = "socket_server",
59916+ .data = &grsec_enable_socket_server,
59917+ .maxlen = sizeof(int),
59918+ .mode = 0600,
59919+ .proc_handler = &proc_dointvec,
59920+ },
59921+ {
59922+ .procname = "socket_server_gid",
59923+ .data = &grsec_socket_server_gid,
59924+ .maxlen = sizeof(int),
59925+ .mode = 0600,
59926+ .proc_handler = &proc_dointvec,
59927+ },
59928+#endif
59929+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59930+ {
59931+ .procname = "audit_group",
59932+ .data = &grsec_enable_group,
59933+ .maxlen = sizeof(int),
59934+ .mode = 0600,
59935+ .proc_handler = &proc_dointvec,
59936+ },
59937+ {
59938+ .procname = "audit_gid",
59939+ .data = &grsec_audit_gid,
59940+ .maxlen = sizeof(int),
59941+ .mode = 0600,
59942+ .proc_handler = &proc_dointvec,
59943+ },
59944+#endif
59945+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59946+ {
59947+ .procname = "audit_chdir",
59948+ .data = &grsec_enable_chdir,
59949+ .maxlen = sizeof(int),
59950+ .mode = 0600,
59951+ .proc_handler = &proc_dointvec,
59952+ },
59953+#endif
59954+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59955+ {
59956+ .procname = "audit_mount",
59957+ .data = &grsec_enable_mount,
59958+ .maxlen = sizeof(int),
59959+ .mode = 0600,
59960+ .proc_handler = &proc_dointvec,
59961+ },
59962+#endif
59963+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59964+ {
59965+ .procname = "audit_textrel",
59966+ .data = &grsec_enable_audit_textrel,
59967+ .maxlen = sizeof(int),
59968+ .mode = 0600,
59969+ .proc_handler = &proc_dointvec,
59970+ },
59971+#endif
59972+#ifdef CONFIG_GRKERNSEC_DMESG
59973+ {
59974+ .procname = "dmesg",
59975+ .data = &grsec_enable_dmesg,
59976+ .maxlen = sizeof(int),
59977+ .mode = 0600,
59978+ .proc_handler = &proc_dointvec,
59979+ },
59980+#endif
59981+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59982+ {
59983+ .procname = "chroot_findtask",
59984+ .data = &grsec_enable_chroot_findtask,
59985+ .maxlen = sizeof(int),
59986+ .mode = 0600,
59987+ .proc_handler = &proc_dointvec,
59988+ },
59989+#endif
59990+#ifdef CONFIG_GRKERNSEC_RESLOG
59991+ {
59992+ .procname = "resource_logging",
59993+ .data = &grsec_resource_logging,
59994+ .maxlen = sizeof(int),
59995+ .mode = 0600,
59996+ .proc_handler = &proc_dointvec,
59997+ },
59998+#endif
59999+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
60000+ {
60001+ .procname = "audit_ptrace",
60002+ .data = &grsec_enable_audit_ptrace,
60003+ .maxlen = sizeof(int),
60004+ .mode = 0600,
60005+ .proc_handler = &proc_dointvec,
60006+ },
60007+#endif
60008+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
60009+ {
60010+ .procname = "harden_ptrace",
60011+ .data = &grsec_enable_harden_ptrace,
60012+ .maxlen = sizeof(int),
60013+ .mode = 0600,
60014+ .proc_handler = &proc_dointvec,
60015+ },
60016+#endif
60017+ {
60018+ .procname = "grsec_lock",
60019+ .data = &grsec_lock,
60020+ .maxlen = sizeof(int),
60021+ .mode = 0600,
60022+ .proc_handler = &proc_dointvec,
60023+ },
60024+#endif
60025+#ifdef CONFIG_GRKERNSEC_ROFS
60026+ {
60027+ .procname = "romount_protect",
60028+ .data = &grsec_enable_rofs,
60029+ .maxlen = sizeof(int),
60030+ .mode = 0600,
60031+ .proc_handler = &proc_dointvec_minmax,
60032+ .extra1 = &one,
60033+ .extra2 = &one,
60034+ },
60035+#endif
60036+ { }
60037+};
60038+#endif
60039diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
60040new file mode 100644
60041index 0000000..0dc13c3
60042--- /dev/null
60043+++ b/grsecurity/grsec_time.c
60044@@ -0,0 +1,16 @@
60045+#include <linux/kernel.h>
60046+#include <linux/sched.h>
60047+#include <linux/grinternal.h>
60048+#include <linux/module.h>
60049+
60050+void
60051+gr_log_timechange(void)
60052+{
60053+#ifdef CONFIG_GRKERNSEC_TIME
60054+ if (grsec_enable_time)
60055+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
60056+#endif
60057+ return;
60058+}
60059+
60060+EXPORT_SYMBOL(gr_log_timechange);
60061diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
60062new file mode 100644
60063index 0000000..4a78774
60064--- /dev/null
60065+++ b/grsecurity/grsec_tpe.c
60066@@ -0,0 +1,39 @@
60067+#include <linux/kernel.h>
60068+#include <linux/sched.h>
60069+#include <linux/file.h>
60070+#include <linux/fs.h>
60071+#include <linux/grinternal.h>
60072+
60073+extern int gr_acl_tpe_check(void);
60074+
60075+int
60076+gr_tpe_allow(const struct file *file)
60077+{
60078+#ifdef CONFIG_GRKERNSEC
60079+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
60080+ const struct cred *cred = current_cred();
60081+
60082+ if (cred->uid && ((grsec_enable_tpe &&
60083+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
60084+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
60085+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
60086+#else
60087+ in_group_p(grsec_tpe_gid)
60088+#endif
60089+ ) || gr_acl_tpe_check()) &&
60090+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
60091+ (inode->i_mode & S_IWOTH))))) {
60092+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60093+ return 0;
60094+ }
60095+#ifdef CONFIG_GRKERNSEC_TPE_ALL
60096+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
60097+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
60098+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
60099+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60100+ return 0;
60101+ }
60102+#endif
60103+#endif
60104+ return 1;
60105+}
60106diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
60107new file mode 100644
60108index 0000000..9f7b1ac
60109--- /dev/null
60110+++ b/grsecurity/grsum.c
60111@@ -0,0 +1,61 @@
60112+#include <linux/err.h>
60113+#include <linux/kernel.h>
60114+#include <linux/sched.h>
60115+#include <linux/mm.h>
60116+#include <linux/scatterlist.h>
60117+#include <linux/crypto.h>
60118+#include <linux/gracl.h>
60119+
60120+
60121+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
60122+#error "crypto and sha256 must be built into the kernel"
60123+#endif
60124+
60125+int
60126+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
60127+{
60128+ char *p;
60129+ struct crypto_hash *tfm;
60130+ struct hash_desc desc;
60131+ struct scatterlist sg;
60132+ unsigned char temp_sum[GR_SHA_LEN];
60133+ volatile int retval = 0;
60134+ volatile int dummy = 0;
60135+ unsigned int i;
60136+
60137+ sg_init_table(&sg, 1);
60138+
60139+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
60140+ if (IS_ERR(tfm)) {
60141+ /* should never happen, since sha256 should be built in */
60142+ return 1;
60143+ }
60144+
60145+ desc.tfm = tfm;
60146+ desc.flags = 0;
60147+
60148+ crypto_hash_init(&desc);
60149+
60150+ p = salt;
60151+ sg_set_buf(&sg, p, GR_SALT_LEN);
60152+ crypto_hash_update(&desc, &sg, sg.length);
60153+
60154+ p = entry->pw;
60155+ sg_set_buf(&sg, p, strlen(p));
60156+
60157+ crypto_hash_update(&desc, &sg, sg.length);
60158+
60159+ crypto_hash_final(&desc, temp_sum);
60160+
60161+ memset(entry->pw, 0, GR_PW_LEN);
60162+
60163+ for (i = 0; i < GR_SHA_LEN; i++)
60164+ if (sum[i] != temp_sum[i])
60165+ retval = 1;
60166+ else
60167+ dummy = 1; // waste a cycle
60168+
60169+ crypto_free_hash(tfm);
60170+
60171+ return retval;
60172+}
60173diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
60174index 6cd5b64..f620d2d 100644
60175--- a/include/acpi/acpi_bus.h
60176+++ b/include/acpi/acpi_bus.h
60177@@ -107,7 +107,7 @@ struct acpi_device_ops {
60178 acpi_op_bind bind;
60179 acpi_op_unbind unbind;
60180 acpi_op_notify notify;
60181-};
60182+} __no_const;
60183
60184 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
60185
60186diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
60187index b7babf0..71e4e74 100644
60188--- a/include/asm-generic/atomic-long.h
60189+++ b/include/asm-generic/atomic-long.h
60190@@ -22,6 +22,12 @@
60191
60192 typedef atomic64_t atomic_long_t;
60193
60194+#ifdef CONFIG_PAX_REFCOUNT
60195+typedef atomic64_unchecked_t atomic_long_unchecked_t;
60196+#else
60197+typedef atomic64_t atomic_long_unchecked_t;
60198+#endif
60199+
60200 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
60201
60202 static inline long atomic_long_read(atomic_long_t *l)
60203@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
60204 return (long)atomic64_read(v);
60205 }
60206
60207+#ifdef CONFIG_PAX_REFCOUNT
60208+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60209+{
60210+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60211+
60212+ return (long)atomic64_read_unchecked(v);
60213+}
60214+#endif
60215+
60216 static inline void atomic_long_set(atomic_long_t *l, long i)
60217 {
60218 atomic64_t *v = (atomic64_t *)l;
60219@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
60220 atomic64_set(v, i);
60221 }
60222
60223+#ifdef CONFIG_PAX_REFCOUNT
60224+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60225+{
60226+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60227+
60228+ atomic64_set_unchecked(v, i);
60229+}
60230+#endif
60231+
60232 static inline void atomic_long_inc(atomic_long_t *l)
60233 {
60234 atomic64_t *v = (atomic64_t *)l;
60235@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
60236 atomic64_inc(v);
60237 }
60238
60239+#ifdef CONFIG_PAX_REFCOUNT
60240+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60241+{
60242+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60243+
60244+ atomic64_inc_unchecked(v);
60245+}
60246+#endif
60247+
60248 static inline void atomic_long_dec(atomic_long_t *l)
60249 {
60250 atomic64_t *v = (atomic64_t *)l;
60251@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
60252 atomic64_dec(v);
60253 }
60254
60255+#ifdef CONFIG_PAX_REFCOUNT
60256+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60257+{
60258+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60259+
60260+ atomic64_dec_unchecked(v);
60261+}
60262+#endif
60263+
60264 static inline void atomic_long_add(long i, atomic_long_t *l)
60265 {
60266 atomic64_t *v = (atomic64_t *)l;
60267@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
60268 atomic64_add(i, v);
60269 }
60270
60271+#ifdef CONFIG_PAX_REFCOUNT
60272+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60273+{
60274+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60275+
60276+ atomic64_add_unchecked(i, v);
60277+}
60278+#endif
60279+
60280 static inline void atomic_long_sub(long i, atomic_long_t *l)
60281 {
60282 atomic64_t *v = (atomic64_t *)l;
60283@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
60284 atomic64_sub(i, v);
60285 }
60286
60287+#ifdef CONFIG_PAX_REFCOUNT
60288+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
60289+{
60290+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60291+
60292+ atomic64_sub_unchecked(i, v);
60293+}
60294+#endif
60295+
60296 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
60297 {
60298 atomic64_t *v = (atomic64_t *)l;
60299@@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
60300 return (long)atomic64_inc_return(v);
60301 }
60302
60303+#ifdef CONFIG_PAX_REFCOUNT
60304+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60305+{
60306+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60307+
60308+ return (long)atomic64_inc_return_unchecked(v);
60309+}
60310+#endif
60311+
60312 static inline long atomic_long_dec_return(atomic_long_t *l)
60313 {
60314 atomic64_t *v = (atomic64_t *)l;
60315@@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
60316
60317 typedef atomic_t atomic_long_t;
60318
60319+#ifdef CONFIG_PAX_REFCOUNT
60320+typedef atomic_unchecked_t atomic_long_unchecked_t;
60321+#else
60322+typedef atomic_t atomic_long_unchecked_t;
60323+#endif
60324+
60325 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
60326 static inline long atomic_long_read(atomic_long_t *l)
60327 {
60328@@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
60329 return (long)atomic_read(v);
60330 }
60331
60332+#ifdef CONFIG_PAX_REFCOUNT
60333+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60334+{
60335+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60336+
60337+ return (long)atomic_read_unchecked(v);
60338+}
60339+#endif
60340+
60341 static inline void atomic_long_set(atomic_long_t *l, long i)
60342 {
60343 atomic_t *v = (atomic_t *)l;
60344@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
60345 atomic_set(v, i);
60346 }
60347
60348+#ifdef CONFIG_PAX_REFCOUNT
60349+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60350+{
60351+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60352+
60353+ atomic_set_unchecked(v, i);
60354+}
60355+#endif
60356+
60357 static inline void atomic_long_inc(atomic_long_t *l)
60358 {
60359 atomic_t *v = (atomic_t *)l;
60360@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
60361 atomic_inc(v);
60362 }
60363
60364+#ifdef CONFIG_PAX_REFCOUNT
60365+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60366+{
60367+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60368+
60369+ atomic_inc_unchecked(v);
60370+}
60371+#endif
60372+
60373 static inline void atomic_long_dec(atomic_long_t *l)
60374 {
60375 atomic_t *v = (atomic_t *)l;
60376@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
60377 atomic_dec(v);
60378 }
60379
60380+#ifdef CONFIG_PAX_REFCOUNT
60381+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60382+{
60383+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60384+
60385+ atomic_dec_unchecked(v);
60386+}
60387+#endif
60388+
60389 static inline void atomic_long_add(long i, atomic_long_t *l)
60390 {
60391 atomic_t *v = (atomic_t *)l;
60392@@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
60393 atomic_add(i, v);
60394 }
60395
60396+#ifdef CONFIG_PAX_REFCOUNT
60397+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60398+{
60399+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60400+
60401+ atomic_add_unchecked(i, v);
60402+}
60403+#endif
60404+
60405 static inline void atomic_long_sub(long i, atomic_long_t *l)
60406 {
60407 atomic_t *v = (atomic_t *)l;
60408@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
60409 atomic_sub(i, v);
60410 }
60411
60412+#ifdef CONFIG_PAX_REFCOUNT
60413+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
60414+{
60415+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60416+
60417+ atomic_sub_unchecked(i, v);
60418+}
60419+#endif
60420+
60421 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
60422 {
60423 atomic_t *v = (atomic_t *)l;
60424@@ -232,6 +361,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
60425 return (long)atomic_inc_return(v);
60426 }
60427
60428+#ifdef CONFIG_PAX_REFCOUNT
60429+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60430+{
60431+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60432+
60433+ return (long)atomic_inc_return_unchecked(v);
60434+}
60435+#endif
60436+
60437 static inline long atomic_long_dec_return(atomic_long_t *l)
60438 {
60439 atomic_t *v = (atomic_t *)l;
60440@@ -255,4 +393,49 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
60441
60442 #endif /* BITS_PER_LONG == 64 */
60443
60444+#ifdef CONFIG_PAX_REFCOUNT
60445+static inline void pax_refcount_needs_these_functions(void)
60446+{
60447+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
60448+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
60449+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
60450+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
60451+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
60452+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
60453+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
60454+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
60455+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
60456+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
60457+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
60458+
60459+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
60460+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
60461+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
60462+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
60463+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
60464+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
60465+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
60466+}
60467+#else
60468+#define atomic_read_unchecked(v) atomic_read(v)
60469+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
60470+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
60471+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
60472+#define atomic_inc_unchecked(v) atomic_inc(v)
60473+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
60474+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
60475+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
60476+#define atomic_dec_unchecked(v) atomic_dec(v)
60477+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
60478+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
60479+
60480+#define atomic_long_read_unchecked(v) atomic_long_read(v)
60481+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
60482+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
60483+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
60484+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
60485+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
60486+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
60487+#endif
60488+
60489 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
60490diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
60491index b18ce4f..2ee2843 100644
60492--- a/include/asm-generic/atomic64.h
60493+++ b/include/asm-generic/atomic64.h
60494@@ -16,6 +16,8 @@ typedef struct {
60495 long long counter;
60496 } atomic64_t;
60497
60498+typedef atomic64_t atomic64_unchecked_t;
60499+
60500 #define ATOMIC64_INIT(i) { (i) }
60501
60502 extern long long atomic64_read(const atomic64_t *v);
60503@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
60504 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
60505 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
60506
60507+#define atomic64_read_unchecked(v) atomic64_read(v)
60508+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
60509+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
60510+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
60511+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
60512+#define atomic64_inc_unchecked(v) atomic64_inc(v)
60513+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
60514+#define atomic64_dec_unchecked(v) atomic64_dec(v)
60515+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
60516+
60517 #endif /* _ASM_GENERIC_ATOMIC64_H */
60518diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
60519index 1bfcfe5..e04c5c9 100644
60520--- a/include/asm-generic/cache.h
60521+++ b/include/asm-generic/cache.h
60522@@ -6,7 +6,7 @@
60523 * cache lines need to provide their own cache.h.
60524 */
60525
60526-#define L1_CACHE_SHIFT 5
60527-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
60528+#define L1_CACHE_SHIFT 5UL
60529+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
60530
60531 #endif /* __ASM_GENERIC_CACHE_H */
60532diff --git a/include/asm-generic/int-l64.h b/include/asm-generic/int-l64.h
60533index 1ca3efc..e3dc852 100644
60534--- a/include/asm-generic/int-l64.h
60535+++ b/include/asm-generic/int-l64.h
60536@@ -46,6 +46,8 @@ typedef unsigned int u32;
60537 typedef signed long s64;
60538 typedef unsigned long u64;
60539
60540+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
60541+
60542 #define S8_C(x) x
60543 #define U8_C(x) x ## U
60544 #define S16_C(x) x
60545diff --git a/include/asm-generic/int-ll64.h b/include/asm-generic/int-ll64.h
60546index f394147..b6152b9 100644
60547--- a/include/asm-generic/int-ll64.h
60548+++ b/include/asm-generic/int-ll64.h
60549@@ -51,6 +51,8 @@ typedef unsigned int u32;
60550 typedef signed long long s64;
60551 typedef unsigned long long u64;
60552
60553+typedef unsigned long long intoverflow_t;
60554+
60555 #define S8_C(x) x
60556 #define U8_C(x) x ## U
60557 #define S16_C(x) x
60558diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
60559index 0232ccb..13d9165 100644
60560--- a/include/asm-generic/kmap_types.h
60561+++ b/include/asm-generic/kmap_types.h
60562@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
60563 KMAP_D(17) KM_NMI,
60564 KMAP_D(18) KM_NMI_PTE,
60565 KMAP_D(19) KM_KDB,
60566+KMAP_D(20) KM_CLEARPAGE,
60567 /*
60568 * Remember to update debug_kmap_atomic() when adding new kmap types!
60569 */
60570-KMAP_D(20) KM_TYPE_NR
60571+KMAP_D(21) KM_TYPE_NR
60572 };
60573
60574 #undef KMAP_D
60575diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
60576index 725612b..9cc513a 100644
60577--- a/include/asm-generic/pgtable-nopmd.h
60578+++ b/include/asm-generic/pgtable-nopmd.h
60579@@ -1,14 +1,19 @@
60580 #ifndef _PGTABLE_NOPMD_H
60581 #define _PGTABLE_NOPMD_H
60582
60583-#ifndef __ASSEMBLY__
60584-
60585 #include <asm-generic/pgtable-nopud.h>
60586
60587-struct mm_struct;
60588-
60589 #define __PAGETABLE_PMD_FOLDED
60590
60591+#define PMD_SHIFT PUD_SHIFT
60592+#define PTRS_PER_PMD 1
60593+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
60594+#define PMD_MASK (~(PMD_SIZE-1))
60595+
60596+#ifndef __ASSEMBLY__
60597+
60598+struct mm_struct;
60599+
60600 /*
60601 * Having the pmd type consist of a pud gets the size right, and allows
60602 * us to conceptually access the pud entry that this pmd is folded into
60603@@ -16,11 +21,6 @@ struct mm_struct;
60604 */
60605 typedef struct { pud_t pud; } pmd_t;
60606
60607-#define PMD_SHIFT PUD_SHIFT
60608-#define PTRS_PER_PMD 1
60609-#define PMD_SIZE (1UL << PMD_SHIFT)
60610-#define PMD_MASK (~(PMD_SIZE-1))
60611-
60612 /*
60613 * The "pud_xxx()" functions here are trivial for a folded two-level
60614 * setup: the pmd is never bad, and a pmd always exists (as it's folded
60615diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
60616index 810431d..ccc3638 100644
60617--- a/include/asm-generic/pgtable-nopud.h
60618+++ b/include/asm-generic/pgtable-nopud.h
60619@@ -1,10 +1,15 @@
60620 #ifndef _PGTABLE_NOPUD_H
60621 #define _PGTABLE_NOPUD_H
60622
60623-#ifndef __ASSEMBLY__
60624-
60625 #define __PAGETABLE_PUD_FOLDED
60626
60627+#define PUD_SHIFT PGDIR_SHIFT
60628+#define PTRS_PER_PUD 1
60629+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
60630+#define PUD_MASK (~(PUD_SIZE-1))
60631+
60632+#ifndef __ASSEMBLY__
60633+
60634 /*
60635 * Having the pud type consist of a pgd gets the size right, and allows
60636 * us to conceptually access the pgd entry that this pud is folded into
60637@@ -12,11 +17,6 @@
60638 */
60639 typedef struct { pgd_t pgd; } pud_t;
60640
60641-#define PUD_SHIFT PGDIR_SHIFT
60642-#define PTRS_PER_PUD 1
60643-#define PUD_SIZE (1UL << PUD_SHIFT)
60644-#define PUD_MASK (~(PUD_SIZE-1))
60645-
60646 /*
60647 * The "pgd_xxx()" functions here are trivial for a folded two-level
60648 * setup: the pud is never bad, and a pud always exists (as it's folded
60649diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
60650index 76bff2b..c7a14e2 100644
60651--- a/include/asm-generic/pgtable.h
60652+++ b/include/asm-generic/pgtable.h
60653@@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
60654 #endif /* __HAVE_ARCH_PMD_WRITE */
60655 #endif
60656
60657+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
60658+static inline unsigned long pax_open_kernel(void) { return 0; }
60659+#endif
60660+
60661+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
60662+static inline unsigned long pax_close_kernel(void) { return 0; }
60663+#endif
60664+
60665 #endif /* !__ASSEMBLY__ */
60666
60667 #endif /* _ASM_GENERIC_PGTABLE_H */
60668diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
60669index db22d13..1f2e3e1 100644
60670--- a/include/asm-generic/vmlinux.lds.h
60671+++ b/include/asm-generic/vmlinux.lds.h
60672@@ -217,6 +217,7 @@
60673 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
60674 VMLINUX_SYMBOL(__start_rodata) = .; \
60675 *(.rodata) *(.rodata.*) \
60676+ *(.data..read_only) \
60677 *(__vermagic) /* Kernel version magic */ \
60678 . = ALIGN(8); \
60679 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
60680@@ -723,17 +724,18 @@
60681 * section in the linker script will go there too. @phdr should have
60682 * a leading colon.
60683 *
60684- * Note that this macros defines __per_cpu_load as an absolute symbol.
60685+ * Note that this macros defines per_cpu_load as an absolute symbol.
60686 * If there is no need to put the percpu section at a predetermined
60687 * address, use PERCPU_SECTION.
60688 */
60689 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
60690- VMLINUX_SYMBOL(__per_cpu_load) = .; \
60691- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
60692+ per_cpu_load = .; \
60693+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
60694 - LOAD_OFFSET) { \
60695+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
60696 PERCPU_INPUT(cacheline) \
60697 } phdr \
60698- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
60699+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
60700
60701 /**
60702 * PERCPU_SECTION - define output section for percpu area, simple version
60703diff --git a/include/drm/drmP.h b/include/drm/drmP.h
60704index 9b7c2bb..76b7d1e 100644
60705--- a/include/drm/drmP.h
60706+++ b/include/drm/drmP.h
60707@@ -73,6 +73,7 @@
60708 #include <linux/workqueue.h>
60709 #include <linux/poll.h>
60710 #include <asm/pgalloc.h>
60711+#include <asm/local.h>
60712 #include "drm.h"
60713
60714 #include <linux/idr.h>
60715@@ -1035,7 +1036,7 @@ struct drm_device {
60716
60717 /** \name Usage Counters */
60718 /*@{ */
60719- int open_count; /**< Outstanding files open */
60720+ local_t open_count; /**< Outstanding files open */
60721 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
60722 atomic_t vma_count; /**< Outstanding vma areas open */
60723 int buf_use; /**< Buffers in use -- cannot alloc */
60724@@ -1046,7 +1047,7 @@ struct drm_device {
60725 /*@{ */
60726 unsigned long counters;
60727 enum drm_stat_type types[15];
60728- atomic_t counts[15];
60729+ atomic_unchecked_t counts[15];
60730 /*@} */
60731
60732 struct list_head filelist;
60733diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
60734index 73b0712..0b7ef2f 100644
60735--- a/include/drm/drm_crtc_helper.h
60736+++ b/include/drm/drm_crtc_helper.h
60737@@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
60738
60739 /* disable crtc when not in use - more explicit than dpms off */
60740 void (*disable)(struct drm_crtc *crtc);
60741-};
60742+} __no_const;
60743
60744 struct drm_encoder_helper_funcs {
60745 void (*dpms)(struct drm_encoder *encoder, int mode);
60746@@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
60747 struct drm_connector *connector);
60748 /* disable encoder when not in use - more explicit than dpms off */
60749 void (*disable)(struct drm_encoder *encoder);
60750-};
60751+} __no_const;
60752
60753 struct drm_connector_helper_funcs {
60754 int (*get_modes)(struct drm_connector *connector);
60755diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
60756index 26c1f78..6722682 100644
60757--- a/include/drm/ttm/ttm_memory.h
60758+++ b/include/drm/ttm/ttm_memory.h
60759@@ -47,7 +47,7 @@
60760
60761 struct ttm_mem_shrink {
60762 int (*do_shrink) (struct ttm_mem_shrink *);
60763-};
60764+} __no_const;
60765
60766 /**
60767 * struct ttm_mem_global - Global memory accounting structure.
60768diff --git a/include/linux/a.out.h b/include/linux/a.out.h
60769index e86dfca..40cc55f 100644
60770--- a/include/linux/a.out.h
60771+++ b/include/linux/a.out.h
60772@@ -39,6 +39,14 @@ enum machine_type {
60773 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
60774 };
60775
60776+/* Constants for the N_FLAGS field */
60777+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60778+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
60779+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
60780+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
60781+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60782+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60783+
60784 #if !defined (N_MAGIC)
60785 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
60786 #endif
60787diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
60788index 49a83ca..df96b54 100644
60789--- a/include/linux/atmdev.h
60790+++ b/include/linux/atmdev.h
60791@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
60792 #endif
60793
60794 struct k_atm_aal_stats {
60795-#define __HANDLE_ITEM(i) atomic_t i
60796+#define __HANDLE_ITEM(i) atomic_unchecked_t i
60797 __AAL_STAT_ITEMS
60798 #undef __HANDLE_ITEM
60799 };
60800diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
60801index fd88a39..f4d0bad 100644
60802--- a/include/linux/binfmts.h
60803+++ b/include/linux/binfmts.h
60804@@ -88,6 +88,7 @@ struct linux_binfmt {
60805 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
60806 int (*load_shlib)(struct file *);
60807 int (*core_dump)(struct coredump_params *cprm);
60808+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
60809 unsigned long min_coredump; /* minimal dump size */
60810 };
60811
60812diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
60813index 5e30b45..5b41b49 100644
60814--- a/include/linux/blkdev.h
60815+++ b/include/linux/blkdev.h
60816@@ -675,6 +675,9 @@ extern int blk_insert_cloned_request(struct request_queue *q,
60817 struct request *rq);
60818 extern void blk_delay_queue(struct request_queue *, unsigned long);
60819 extern void blk_recount_segments(struct request_queue *, struct bio *);
60820+extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
60821+extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
60822+ unsigned int, void __user *);
60823 extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
60824 unsigned int, void __user *);
60825 extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
60826@@ -1318,7 +1321,7 @@ struct block_device_operations {
60827 /* this callback is with swap_lock and sometimes page table lock held */
60828 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
60829 struct module *owner;
60830-};
60831+} __do_const;
60832
60833 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60834 unsigned long);
60835diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
60836index 8e9e4bc..88bd457 100644
60837--- a/include/linux/blktrace_api.h
60838+++ b/include/linux/blktrace_api.h
60839@@ -162,7 +162,7 @@ struct blk_trace {
60840 struct dentry *dir;
60841 struct dentry *dropped_file;
60842 struct dentry *msg_file;
60843- atomic_t dropped;
60844+ atomic_unchecked_t dropped;
60845 };
60846
60847 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60848diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
60849index 83195fb..0b0f77d 100644
60850--- a/include/linux/byteorder/little_endian.h
60851+++ b/include/linux/byteorder/little_endian.h
60852@@ -42,51 +42,51 @@
60853
60854 static inline __le64 __cpu_to_le64p(const __u64 *p)
60855 {
60856- return (__force __le64)*p;
60857+ return (__force const __le64)*p;
60858 }
60859 static inline __u64 __le64_to_cpup(const __le64 *p)
60860 {
60861- return (__force __u64)*p;
60862+ return (__force const __u64)*p;
60863 }
60864 static inline __le32 __cpu_to_le32p(const __u32 *p)
60865 {
60866- return (__force __le32)*p;
60867+ return (__force const __le32)*p;
60868 }
60869 static inline __u32 __le32_to_cpup(const __le32 *p)
60870 {
60871- return (__force __u32)*p;
60872+ return (__force const __u32)*p;
60873 }
60874 static inline __le16 __cpu_to_le16p(const __u16 *p)
60875 {
60876- return (__force __le16)*p;
60877+ return (__force const __le16)*p;
60878 }
60879 static inline __u16 __le16_to_cpup(const __le16 *p)
60880 {
60881- return (__force __u16)*p;
60882+ return (__force const __u16)*p;
60883 }
60884 static inline __be64 __cpu_to_be64p(const __u64 *p)
60885 {
60886- return (__force __be64)__swab64p(p);
60887+ return (__force const __be64)__swab64p(p);
60888 }
60889 static inline __u64 __be64_to_cpup(const __be64 *p)
60890 {
60891- return __swab64p((__u64 *)p);
60892+ return __swab64p((const __u64 *)p);
60893 }
60894 static inline __be32 __cpu_to_be32p(const __u32 *p)
60895 {
60896- return (__force __be32)__swab32p(p);
60897+ return (__force const __be32)__swab32p(p);
60898 }
60899 static inline __u32 __be32_to_cpup(const __be32 *p)
60900 {
60901- return __swab32p((__u32 *)p);
60902+ return __swab32p((const __u32 *)p);
60903 }
60904 static inline __be16 __cpu_to_be16p(const __u16 *p)
60905 {
60906- return (__force __be16)__swab16p(p);
60907+ return (__force const __be16)__swab16p(p);
60908 }
60909 static inline __u16 __be16_to_cpup(const __be16 *p)
60910 {
60911- return __swab16p((__u16 *)p);
60912+ return __swab16p((const __u16 *)p);
60913 }
60914 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60915 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60916diff --git a/include/linux/cache.h b/include/linux/cache.h
60917index 4c57065..4307975 100644
60918--- a/include/linux/cache.h
60919+++ b/include/linux/cache.h
60920@@ -16,6 +16,10 @@
60921 #define __read_mostly
60922 #endif
60923
60924+#ifndef __read_only
60925+#define __read_only __read_mostly
60926+#endif
60927+
60928 #ifndef ____cacheline_aligned
60929 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60930 #endif
60931diff --git a/include/linux/capability.h b/include/linux/capability.h
60932index c421123..e343179 100644
60933--- a/include/linux/capability.h
60934+++ b/include/linux/capability.h
60935@@ -547,6 +547,9 @@ extern bool capable(int cap);
60936 extern bool ns_capable(struct user_namespace *ns, int cap);
60937 extern bool task_ns_capable(struct task_struct *t, int cap);
60938 extern bool nsown_capable(int cap);
60939+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
60940+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
60941+extern bool capable_nolog(int cap);
60942
60943 /* audit system wants to get cap info from files as well */
60944 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
60945diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
60946index 04ffb2e..6799180 100644
60947--- a/include/linux/cleancache.h
60948+++ b/include/linux/cleancache.h
60949@@ -31,7 +31,7 @@ struct cleancache_ops {
60950 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
60951 void (*flush_inode)(int, struct cleancache_filekey);
60952 void (*flush_fs)(int);
60953-};
60954+} __no_const;
60955
60956 extern struct cleancache_ops
60957 cleancache_register_ops(struct cleancache_ops *ops);
60958diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
60959index dfadc96..c0e70c1 100644
60960--- a/include/linux/compiler-gcc4.h
60961+++ b/include/linux/compiler-gcc4.h
60962@@ -31,6 +31,12 @@
60963
60964
60965 #if __GNUC_MINOR__ >= 5
60966+
60967+#ifdef CONSTIFY_PLUGIN
60968+#define __no_const __attribute__((no_const))
60969+#define __do_const __attribute__((do_const))
60970+#endif
60971+
60972 /*
60973 * Mark a position in code as unreachable. This can be used to
60974 * suppress control flow warnings after asm blocks that transfer
60975@@ -46,6 +52,11 @@
60976 #define __noclone __attribute__((__noclone__))
60977
60978 #endif
60979+
60980+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60981+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60982+#define __bos0(ptr) __bos((ptr), 0)
60983+#define __bos1(ptr) __bos((ptr), 1)
60984 #endif
60985
60986 #if __GNUC_MINOR__ > 0
60987diff --git a/include/linux/compiler.h b/include/linux/compiler.h
60988index 320d6c9..8573a1c 100644
60989--- a/include/linux/compiler.h
60990+++ b/include/linux/compiler.h
60991@@ -5,31 +5,62 @@
60992
60993 #ifdef __CHECKER__
60994 # define __user __attribute__((noderef, address_space(1)))
60995+# define __force_user __force __user
60996 # define __kernel __attribute__((address_space(0)))
60997+# define __force_kernel __force __kernel
60998 # define __safe __attribute__((safe))
60999 # define __force __attribute__((force))
61000 # define __nocast __attribute__((nocast))
61001 # define __iomem __attribute__((noderef, address_space(2)))
61002+# define __force_iomem __force __iomem
61003 # define __acquires(x) __attribute__((context(x,0,1)))
61004 # define __releases(x) __attribute__((context(x,1,0)))
61005 # define __acquire(x) __context__(x,1)
61006 # define __release(x) __context__(x,-1)
61007 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
61008 # define __percpu __attribute__((noderef, address_space(3)))
61009+# define __force_percpu __force __percpu
61010 #ifdef CONFIG_SPARSE_RCU_POINTER
61011 # define __rcu __attribute__((noderef, address_space(4)))
61012+# define __force_rcu __force __rcu
61013 #else
61014 # define __rcu
61015+# define __force_rcu
61016 #endif
61017 extern void __chk_user_ptr(const volatile void __user *);
61018 extern void __chk_io_ptr(const volatile void __iomem *);
61019+#elif defined(CHECKER_PLUGIN)
61020+//# define __user
61021+//# define __force_user
61022+//# define __kernel
61023+//# define __force_kernel
61024+# define __safe
61025+# define __force
61026+# define __nocast
61027+# define __iomem
61028+# define __force_iomem
61029+# define __chk_user_ptr(x) (void)0
61030+# define __chk_io_ptr(x) (void)0
61031+# define __builtin_warning(x, y...) (1)
61032+# define __acquires(x)
61033+# define __releases(x)
61034+# define __acquire(x) (void)0
61035+# define __release(x) (void)0
61036+# define __cond_lock(x,c) (c)
61037+# define __percpu
61038+# define __force_percpu
61039+# define __rcu
61040+# define __force_rcu
61041 #else
61042 # define __user
61043+# define __force_user
61044 # define __kernel
61045+# define __force_kernel
61046 # define __safe
61047 # define __force
61048 # define __nocast
61049 # define __iomem
61050+# define __force_iomem
61051 # define __chk_user_ptr(x) (void)0
61052 # define __chk_io_ptr(x) (void)0
61053 # define __builtin_warning(x, y...) (1)
61054@@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
61055 # define __release(x) (void)0
61056 # define __cond_lock(x,c) (c)
61057 # define __percpu
61058+# define __force_percpu
61059 # define __rcu
61060+# define __force_rcu
61061 #endif
61062
61063 #ifdef __KERNEL__
61064@@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
61065 # define __attribute_const__ /* unimplemented */
61066 #endif
61067
61068+#ifndef __no_const
61069+# define __no_const
61070+#endif
61071+
61072+#ifndef __do_const
61073+# define __do_const
61074+#endif
61075+
61076 /*
61077 * Tell gcc if a function is cold. The compiler will assume any path
61078 * directly leading to the call is unlikely.
61079@@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
61080 #define __cold
61081 #endif
61082
61083+#ifndef __alloc_size
61084+#define __alloc_size(...)
61085+#endif
61086+
61087+#ifndef __bos
61088+#define __bos(ptr, arg)
61089+#endif
61090+
61091+#ifndef __bos0
61092+#define __bos0(ptr)
61093+#endif
61094+
61095+#ifndef __bos1
61096+#define __bos1(ptr)
61097+#endif
61098+
61099 /* Simple shorthand for a section definition */
61100 #ifndef __section
61101 # define __section(S) __attribute__ ((__section__(#S)))
61102@@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
61103 * use is to mediate communication between process-level code and irq/NMI
61104 * handlers, all running on the same CPU.
61105 */
61106-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61107+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61108+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61109
61110 #endif /* __LINUX_COMPILER_H */
61111diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
61112index e9eaec5..bfeb9bb 100644
61113--- a/include/linux/cpuset.h
61114+++ b/include/linux/cpuset.h
61115@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void)
61116 * nodemask.
61117 */
61118 smp_mb();
61119- --ACCESS_ONCE(current->mems_allowed_change_disable);
61120+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
61121 }
61122
61123 static inline void set_mems_allowed(nodemask_t nodemask)
61124diff --git a/include/linux/cred.h b/include/linux/cred.h
61125index 4030896..8d6f342 100644
61126--- a/include/linux/cred.h
61127+++ b/include/linux/cred.h
61128@@ -207,6 +207,9 @@ static inline void validate_creds_for_do_exit(struct task_struct *tsk)
61129 static inline void validate_process_creds(void)
61130 {
61131 }
61132+static inline void validate_task_creds(struct task_struct *task)
61133+{
61134+}
61135 #endif
61136
61137 /**
61138diff --git a/include/linux/crypto.h b/include/linux/crypto.h
61139index e5e468e..f079672 100644
61140--- a/include/linux/crypto.h
61141+++ b/include/linux/crypto.h
61142@@ -361,7 +361,7 @@ struct cipher_tfm {
61143 const u8 *key, unsigned int keylen);
61144 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61145 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61146-};
61147+} __no_const;
61148
61149 struct hash_tfm {
61150 int (*init)(struct hash_desc *desc);
61151@@ -382,13 +382,13 @@ struct compress_tfm {
61152 int (*cot_decompress)(struct crypto_tfm *tfm,
61153 const u8 *src, unsigned int slen,
61154 u8 *dst, unsigned int *dlen);
61155-};
61156+} __no_const;
61157
61158 struct rng_tfm {
61159 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
61160 unsigned int dlen);
61161 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
61162-};
61163+} __no_const;
61164
61165 #define crt_ablkcipher crt_u.ablkcipher
61166 #define crt_aead crt_u.aead
61167diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
61168index 7925bf0..d5143d2 100644
61169--- a/include/linux/decompress/mm.h
61170+++ b/include/linux/decompress/mm.h
61171@@ -77,7 +77,7 @@ static void free(void *where)
61172 * warnings when not needed (indeed large_malloc / large_free are not
61173 * needed by inflate */
61174
61175-#define malloc(a) kmalloc(a, GFP_KERNEL)
61176+#define malloc(a) kmalloc((a), GFP_KERNEL)
61177 #define free(a) kfree(a)
61178
61179 #define large_malloc(a) vmalloc(a)
61180diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
61181index 347fdc3..cd01657 100644
61182--- a/include/linux/dma-mapping.h
61183+++ b/include/linux/dma-mapping.h
61184@@ -42,7 +42,7 @@ struct dma_map_ops {
61185 int (*dma_supported)(struct device *dev, u64 mask);
61186 int (*set_dma_mask)(struct device *dev, u64 mask);
61187 int is_phys;
61188-};
61189+} __do_const;
61190
61191 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
61192
61193diff --git a/include/linux/efi.h b/include/linux/efi.h
61194index 2362a0b..cfaf8fcc 100644
61195--- a/include/linux/efi.h
61196+++ b/include/linux/efi.h
61197@@ -446,7 +446,7 @@ struct efivar_operations {
61198 efi_get_variable_t *get_variable;
61199 efi_get_next_variable_t *get_next_variable;
61200 efi_set_variable_t *set_variable;
61201-};
61202+} __no_const;
61203
61204 struct efivars {
61205 /*
61206diff --git a/include/linux/elf.h b/include/linux/elf.h
61207index 110821c..cb14c08 100644
61208--- a/include/linux/elf.h
61209+++ b/include/linux/elf.h
61210@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
61211 #define PT_GNU_EH_FRAME 0x6474e550
61212
61213 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
61214+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
61215+
61216+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
61217+
61218+/* Constants for the e_flags field */
61219+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61220+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
61221+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
61222+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
61223+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61224+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61225
61226 /*
61227 * Extended Numbering
61228@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
61229 #define DT_DEBUG 21
61230 #define DT_TEXTREL 22
61231 #define DT_JMPREL 23
61232+#define DT_FLAGS 30
61233+ #define DF_TEXTREL 0x00000004
61234 #define DT_ENCODING 32
61235 #define OLD_DT_LOOS 0x60000000
61236 #define DT_LOOS 0x6000000d
61237@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
61238 #define PF_W 0x2
61239 #define PF_X 0x1
61240
61241+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
61242+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
61243+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
61244+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
61245+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
61246+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
61247+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
61248+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
61249+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
61250+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
61251+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
61252+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
61253+
61254 typedef struct elf32_phdr{
61255 Elf32_Word p_type;
61256 Elf32_Off p_offset;
61257@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
61258 #define EI_OSABI 7
61259 #define EI_PAD 8
61260
61261+#define EI_PAX 14
61262+
61263 #define ELFMAG0 0x7f /* EI_MAG */
61264 #define ELFMAG1 'E'
61265 #define ELFMAG2 'L'
61266@@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
61267 #define elf_note elf32_note
61268 #define elf_addr_t Elf32_Off
61269 #define Elf_Half Elf32_Half
61270+#define elf_dyn Elf32_Dyn
61271
61272 #else
61273
61274@@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
61275 #define elf_note elf64_note
61276 #define elf_addr_t Elf64_Off
61277 #define Elf_Half Elf64_Half
61278+#define elf_dyn Elf64_Dyn
61279
61280 #endif
61281
61282diff --git a/include/linux/filter.h b/include/linux/filter.h
61283index 741956f..f02f482 100644
61284--- a/include/linux/filter.h
61285+++ b/include/linux/filter.h
61286@@ -134,6 +134,7 @@ struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
61287
61288 struct sk_buff;
61289 struct sock;
61290+struct bpf_jit_work;
61291
61292 struct sk_filter
61293 {
61294@@ -141,6 +142,9 @@ struct sk_filter
61295 unsigned int len; /* Number of filter blocks */
61296 unsigned int (*bpf_func)(const struct sk_buff *skb,
61297 const struct sock_filter *filter);
61298+#ifdef CONFIG_BPF_JIT
61299+ struct bpf_jit_work *work;
61300+#endif
61301 struct rcu_head rcu;
61302 struct sock_filter insns[0];
61303 };
61304diff --git a/include/linux/firewire.h b/include/linux/firewire.h
61305index 84ccf8e..2e9b14c 100644
61306--- a/include/linux/firewire.h
61307+++ b/include/linux/firewire.h
61308@@ -428,7 +428,7 @@ struct fw_iso_context {
61309 union {
61310 fw_iso_callback_t sc;
61311 fw_iso_mc_callback_t mc;
61312- } callback;
61313+ } __no_const callback;
61314 void *callback_data;
61315 };
61316
61317diff --git a/include/linux/fs.h b/include/linux/fs.h
61318index cf7bc25..0d2babf 100644
61319--- a/include/linux/fs.h
61320+++ b/include/linux/fs.h
61321@@ -1588,7 +1588,8 @@ struct file_operations {
61322 int (*setlease)(struct file *, long, struct file_lock **);
61323 long (*fallocate)(struct file *file, int mode, loff_t offset,
61324 loff_t len);
61325-};
61326+} __do_const;
61327+typedef struct file_operations __no_const file_operations_no_const;
61328
61329 struct inode_operations {
61330 struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
61331diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
61332index 003dc0f..3c4ea97 100644
61333--- a/include/linux/fs_struct.h
61334+++ b/include/linux/fs_struct.h
61335@@ -6,7 +6,7 @@
61336 #include <linux/seqlock.h>
61337
61338 struct fs_struct {
61339- int users;
61340+ atomic_t users;
61341 spinlock_t lock;
61342 seqcount_t seq;
61343 int umask;
61344diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
61345index af095b5..cf1220c 100644
61346--- a/include/linux/fscache-cache.h
61347+++ b/include/linux/fscache-cache.h
61348@@ -102,7 +102,7 @@ struct fscache_operation {
61349 fscache_operation_release_t release;
61350 };
61351
61352-extern atomic_t fscache_op_debug_id;
61353+extern atomic_unchecked_t fscache_op_debug_id;
61354 extern void fscache_op_work_func(struct work_struct *work);
61355
61356 extern void fscache_enqueue_operation(struct fscache_operation *);
61357@@ -122,7 +122,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
61358 {
61359 INIT_WORK(&op->work, fscache_op_work_func);
61360 atomic_set(&op->usage, 1);
61361- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
61362+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
61363 op->processor = processor;
61364 op->release = release;
61365 INIT_LIST_HEAD(&op->pend_link);
61366diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
61367index 2a53f10..0187fdf 100644
61368--- a/include/linux/fsnotify.h
61369+++ b/include/linux/fsnotify.h
61370@@ -314,7 +314,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
61371 */
61372 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
61373 {
61374- return kstrdup(name, GFP_KERNEL);
61375+ return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
61376 }
61377
61378 /*
61379diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
61380index 91d0e0a3..035666b 100644
61381--- a/include/linux/fsnotify_backend.h
61382+++ b/include/linux/fsnotify_backend.h
61383@@ -105,6 +105,7 @@ struct fsnotify_ops {
61384 void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
61385 void (*free_event_priv)(struct fsnotify_event_private_data *priv);
61386 };
61387+typedef struct fsnotify_ops __no_const fsnotify_ops_no_const;
61388
61389 /*
61390 * A group is a "thing" that wants to receive notification about filesystem
61391diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
61392index 96efa67..1261547 100644
61393--- a/include/linux/ftrace_event.h
61394+++ b/include/linux/ftrace_event.h
61395@@ -97,7 +97,7 @@ struct trace_event_functions {
61396 trace_print_func raw;
61397 trace_print_func hex;
61398 trace_print_func binary;
61399-};
61400+} __no_const;
61401
61402 struct trace_event {
61403 struct hlist_node node;
61404@@ -252,7 +252,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
61405 extern int trace_add_event_call(struct ftrace_event_call *call);
61406 extern void trace_remove_event_call(struct ftrace_event_call *call);
61407
61408-#define is_signed_type(type) (((type)(-1)) < 0)
61409+#define is_signed_type(type) (((type)(-1)) < (type)1)
61410
61411 int trace_set_clr_event(const char *system, const char *event, int set);
61412
61413diff --git a/include/linux/genhd.h b/include/linux/genhd.h
61414index 02fa469..a15f279 100644
61415--- a/include/linux/genhd.h
61416+++ b/include/linux/genhd.h
61417@@ -184,7 +184,7 @@ struct gendisk {
61418 struct kobject *slave_dir;
61419
61420 struct timer_rand_state *random;
61421- atomic_t sync_io; /* RAID */
61422+ atomic_unchecked_t sync_io; /* RAID */
61423 struct disk_events *ev;
61424 #ifdef CONFIG_BLK_DEV_INTEGRITY
61425 struct blk_integrity *integrity;
61426diff --git a/include/linux/gracl.h b/include/linux/gracl.h
61427new file mode 100644
61428index 0000000..0dc3943
61429--- /dev/null
61430+++ b/include/linux/gracl.h
61431@@ -0,0 +1,317 @@
61432+#ifndef GR_ACL_H
61433+#define GR_ACL_H
61434+
61435+#include <linux/grdefs.h>
61436+#include <linux/resource.h>
61437+#include <linux/capability.h>
61438+#include <linux/dcache.h>
61439+#include <asm/resource.h>
61440+
61441+/* Major status information */
61442+
61443+#define GR_VERSION "grsecurity 2.2.2"
61444+#define GRSECURITY_VERSION 0x2202
61445+
61446+enum {
61447+ GR_SHUTDOWN = 0,
61448+ GR_ENABLE = 1,
61449+ GR_SPROLE = 2,
61450+ GR_RELOAD = 3,
61451+ GR_SEGVMOD = 4,
61452+ GR_STATUS = 5,
61453+ GR_UNSPROLE = 6,
61454+ GR_PASSSET = 7,
61455+ GR_SPROLEPAM = 8,
61456+};
61457+
61458+/* Password setup definitions
61459+ * kernel/grhash.c */
61460+enum {
61461+ GR_PW_LEN = 128,
61462+ GR_SALT_LEN = 16,
61463+ GR_SHA_LEN = 32,
61464+};
61465+
61466+enum {
61467+ GR_SPROLE_LEN = 64,
61468+};
61469+
61470+enum {
61471+ GR_NO_GLOB = 0,
61472+ GR_REG_GLOB,
61473+ GR_CREATE_GLOB
61474+};
61475+
61476+#define GR_NLIMITS 32
61477+
61478+/* Begin Data Structures */
61479+
61480+struct sprole_pw {
61481+ unsigned char *rolename;
61482+ unsigned char salt[GR_SALT_LEN];
61483+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
61484+};
61485+
61486+struct name_entry {
61487+ __u32 key;
61488+ ino_t inode;
61489+ dev_t device;
61490+ char *name;
61491+ __u16 len;
61492+ __u8 deleted;
61493+ struct name_entry *prev;
61494+ struct name_entry *next;
61495+};
61496+
61497+struct inodev_entry {
61498+ struct name_entry *nentry;
61499+ struct inodev_entry *prev;
61500+ struct inodev_entry *next;
61501+};
61502+
61503+struct acl_role_db {
61504+ struct acl_role_label **r_hash;
61505+ __u32 r_size;
61506+};
61507+
61508+struct inodev_db {
61509+ struct inodev_entry **i_hash;
61510+ __u32 i_size;
61511+};
61512+
61513+struct name_db {
61514+ struct name_entry **n_hash;
61515+ __u32 n_size;
61516+};
61517+
61518+struct crash_uid {
61519+ uid_t uid;
61520+ unsigned long expires;
61521+};
61522+
61523+struct gr_hash_struct {
61524+ void **table;
61525+ void **nametable;
61526+ void *first;
61527+ __u32 table_size;
61528+ __u32 used_size;
61529+ int type;
61530+};
61531+
61532+/* Userspace Grsecurity ACL data structures */
61533+
61534+struct acl_subject_label {
61535+ char *filename;
61536+ ino_t inode;
61537+ dev_t device;
61538+ __u32 mode;
61539+ kernel_cap_t cap_mask;
61540+ kernel_cap_t cap_lower;
61541+ kernel_cap_t cap_invert_audit;
61542+
61543+ struct rlimit res[GR_NLIMITS];
61544+ __u32 resmask;
61545+
61546+ __u8 user_trans_type;
61547+ __u8 group_trans_type;
61548+ uid_t *user_transitions;
61549+ gid_t *group_transitions;
61550+ __u16 user_trans_num;
61551+ __u16 group_trans_num;
61552+
61553+ __u32 sock_families[2];
61554+ __u32 ip_proto[8];
61555+ __u32 ip_type;
61556+ struct acl_ip_label **ips;
61557+ __u32 ip_num;
61558+ __u32 inaddr_any_override;
61559+
61560+ __u32 crashes;
61561+ unsigned long expires;
61562+
61563+ struct acl_subject_label *parent_subject;
61564+ struct gr_hash_struct *hash;
61565+ struct acl_subject_label *prev;
61566+ struct acl_subject_label *next;
61567+
61568+ struct acl_object_label **obj_hash;
61569+ __u32 obj_hash_size;
61570+ __u16 pax_flags;
61571+};
61572+
61573+struct role_allowed_ip {
61574+ __u32 addr;
61575+ __u32 netmask;
61576+
61577+ struct role_allowed_ip *prev;
61578+ struct role_allowed_ip *next;
61579+};
61580+
61581+struct role_transition {
61582+ char *rolename;
61583+
61584+ struct role_transition *prev;
61585+ struct role_transition *next;
61586+};
61587+
61588+struct acl_role_label {
61589+ char *rolename;
61590+ uid_t uidgid;
61591+ __u16 roletype;
61592+
61593+ __u16 auth_attempts;
61594+ unsigned long expires;
61595+
61596+ struct acl_subject_label *root_label;
61597+ struct gr_hash_struct *hash;
61598+
61599+ struct acl_role_label *prev;
61600+ struct acl_role_label *next;
61601+
61602+ struct role_transition *transitions;
61603+ struct role_allowed_ip *allowed_ips;
61604+ uid_t *domain_children;
61605+ __u16 domain_child_num;
61606+
61607+ struct acl_subject_label **subj_hash;
61608+ __u32 subj_hash_size;
61609+};
61610+
61611+struct user_acl_role_db {
61612+ struct acl_role_label **r_table;
61613+ __u32 num_pointers; /* Number of allocations to track */
61614+ __u32 num_roles; /* Number of roles */
61615+ __u32 num_domain_children; /* Number of domain children */
61616+ __u32 num_subjects; /* Number of subjects */
61617+ __u32 num_objects; /* Number of objects */
61618+};
61619+
61620+struct acl_object_label {
61621+ char *filename;
61622+ ino_t inode;
61623+ dev_t device;
61624+ __u32 mode;
61625+
61626+ struct acl_subject_label *nested;
61627+ struct acl_object_label *globbed;
61628+
61629+ /* next two structures not used */
61630+
61631+ struct acl_object_label *prev;
61632+ struct acl_object_label *next;
61633+};
61634+
61635+struct acl_ip_label {
61636+ char *iface;
61637+ __u32 addr;
61638+ __u32 netmask;
61639+ __u16 low, high;
61640+ __u8 mode;
61641+ __u32 type;
61642+ __u32 proto[8];
61643+
61644+ /* next two structures not used */
61645+
61646+ struct acl_ip_label *prev;
61647+ struct acl_ip_label *next;
61648+};
61649+
61650+struct gr_arg {
61651+ struct user_acl_role_db role_db;
61652+ unsigned char pw[GR_PW_LEN];
61653+ unsigned char salt[GR_SALT_LEN];
61654+ unsigned char sum[GR_SHA_LEN];
61655+ unsigned char sp_role[GR_SPROLE_LEN];
61656+ struct sprole_pw *sprole_pws;
61657+ dev_t segv_device;
61658+ ino_t segv_inode;
61659+ uid_t segv_uid;
61660+ __u16 num_sprole_pws;
61661+ __u16 mode;
61662+};
61663+
61664+struct gr_arg_wrapper {
61665+ struct gr_arg *arg;
61666+ __u32 version;
61667+ __u32 size;
61668+};
61669+
61670+struct subject_map {
61671+ struct acl_subject_label *user;
61672+ struct acl_subject_label *kernel;
61673+ struct subject_map *prev;
61674+ struct subject_map *next;
61675+};
61676+
61677+struct acl_subj_map_db {
61678+ struct subject_map **s_hash;
61679+ __u32 s_size;
61680+};
61681+
61682+/* End Data Structures Section */
61683+
61684+/* Hash functions generated by empirical testing by Brad Spengler
61685+ Makes good use of the low bits of the inode. Generally 0-1 times
61686+ in loop for successful match. 0-3 for unsuccessful match.
61687+ Shift/add algorithm with modulus of table size and an XOR*/
61688+
61689+static __inline__ unsigned int
61690+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
61691+{
61692+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
61693+}
61694+
61695+ static __inline__ unsigned int
61696+shash(const struct acl_subject_label *userp, const unsigned int sz)
61697+{
61698+ return ((const unsigned long)userp % sz);
61699+}
61700+
61701+static __inline__ unsigned int
61702+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
61703+{
61704+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
61705+}
61706+
61707+static __inline__ unsigned int
61708+nhash(const char *name, const __u16 len, const unsigned int sz)
61709+{
61710+ return full_name_hash((const unsigned char *)name, len) % sz;
61711+}
61712+
61713+#define FOR_EACH_ROLE_START(role) \
61714+ role = role_list; \
61715+ while (role) {
61716+
61717+#define FOR_EACH_ROLE_END(role) \
61718+ role = role->prev; \
61719+ }
61720+
61721+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
61722+ subj = NULL; \
61723+ iter = 0; \
61724+ while (iter < role->subj_hash_size) { \
61725+ if (subj == NULL) \
61726+ subj = role->subj_hash[iter]; \
61727+ if (subj == NULL) { \
61728+ iter++; \
61729+ continue; \
61730+ }
61731+
61732+#define FOR_EACH_SUBJECT_END(subj,iter) \
61733+ subj = subj->next; \
61734+ if (subj == NULL) \
61735+ iter++; \
61736+ }
61737+
61738+
61739+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
61740+ subj = role->hash->first; \
61741+ while (subj != NULL) {
61742+
61743+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
61744+ subj = subj->next; \
61745+ }
61746+
61747+#endif
61748+
61749diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
61750new file mode 100644
61751index 0000000..323ecf2
61752--- /dev/null
61753+++ b/include/linux/gralloc.h
61754@@ -0,0 +1,9 @@
61755+#ifndef __GRALLOC_H
61756+#define __GRALLOC_H
61757+
61758+void acl_free_all(void);
61759+int acl_alloc_stack_init(unsigned long size);
61760+void *acl_alloc(unsigned long len);
61761+void *acl_alloc_num(unsigned long num, unsigned long len);
61762+
61763+#endif
61764diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
61765new file mode 100644
61766index 0000000..b30e9bc
61767--- /dev/null
61768+++ b/include/linux/grdefs.h
61769@@ -0,0 +1,140 @@
61770+#ifndef GRDEFS_H
61771+#define GRDEFS_H
61772+
61773+/* Begin grsecurity status declarations */
61774+
61775+enum {
61776+ GR_READY = 0x01,
61777+ GR_STATUS_INIT = 0x00 // disabled state
61778+};
61779+
61780+/* Begin ACL declarations */
61781+
61782+/* Role flags */
61783+
61784+enum {
61785+ GR_ROLE_USER = 0x0001,
61786+ GR_ROLE_GROUP = 0x0002,
61787+ GR_ROLE_DEFAULT = 0x0004,
61788+ GR_ROLE_SPECIAL = 0x0008,
61789+ GR_ROLE_AUTH = 0x0010,
61790+ GR_ROLE_NOPW = 0x0020,
61791+ GR_ROLE_GOD = 0x0040,
61792+ GR_ROLE_LEARN = 0x0080,
61793+ GR_ROLE_TPE = 0x0100,
61794+ GR_ROLE_DOMAIN = 0x0200,
61795+ GR_ROLE_PAM = 0x0400,
61796+ GR_ROLE_PERSIST = 0x0800
61797+};
61798+
61799+/* ACL Subject and Object mode flags */
61800+enum {
61801+ GR_DELETED = 0x80000000
61802+};
61803+
61804+/* ACL Object-only mode flags */
61805+enum {
61806+ GR_READ = 0x00000001,
61807+ GR_APPEND = 0x00000002,
61808+ GR_WRITE = 0x00000004,
61809+ GR_EXEC = 0x00000008,
61810+ GR_FIND = 0x00000010,
61811+ GR_INHERIT = 0x00000020,
61812+ GR_SETID = 0x00000040,
61813+ GR_CREATE = 0x00000080,
61814+ GR_DELETE = 0x00000100,
61815+ GR_LINK = 0x00000200,
61816+ GR_AUDIT_READ = 0x00000400,
61817+ GR_AUDIT_APPEND = 0x00000800,
61818+ GR_AUDIT_WRITE = 0x00001000,
61819+ GR_AUDIT_EXEC = 0x00002000,
61820+ GR_AUDIT_FIND = 0x00004000,
61821+ GR_AUDIT_INHERIT= 0x00008000,
61822+ GR_AUDIT_SETID = 0x00010000,
61823+ GR_AUDIT_CREATE = 0x00020000,
61824+ GR_AUDIT_DELETE = 0x00040000,
61825+ GR_AUDIT_LINK = 0x00080000,
61826+ GR_PTRACERD = 0x00100000,
61827+ GR_NOPTRACE = 0x00200000,
61828+ GR_SUPPRESS = 0x00400000,
61829+ GR_NOLEARN = 0x00800000,
61830+ GR_INIT_TRANSFER= 0x01000000
61831+};
61832+
61833+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61834+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61835+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61836+
61837+/* ACL subject-only mode flags */
61838+enum {
61839+ GR_KILL = 0x00000001,
61840+ GR_VIEW = 0x00000002,
61841+ GR_PROTECTED = 0x00000004,
61842+ GR_LEARN = 0x00000008,
61843+ GR_OVERRIDE = 0x00000010,
61844+ /* just a placeholder, this mode is only used in userspace */
61845+ GR_DUMMY = 0x00000020,
61846+ GR_PROTSHM = 0x00000040,
61847+ GR_KILLPROC = 0x00000080,
61848+ GR_KILLIPPROC = 0x00000100,
61849+ /* just a placeholder, this mode is only used in userspace */
61850+ GR_NOTROJAN = 0x00000200,
61851+ GR_PROTPROCFD = 0x00000400,
61852+ GR_PROCACCT = 0x00000800,
61853+ GR_RELAXPTRACE = 0x00001000,
61854+ GR_NESTED = 0x00002000,
61855+ GR_INHERITLEARN = 0x00004000,
61856+ GR_PROCFIND = 0x00008000,
61857+ GR_POVERRIDE = 0x00010000,
61858+ GR_KERNELAUTH = 0x00020000,
61859+ GR_ATSECURE = 0x00040000,
61860+ GR_SHMEXEC = 0x00080000
61861+};
61862+
61863+enum {
61864+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61865+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61866+ GR_PAX_ENABLE_MPROTECT = 0x0004,
61867+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
61868+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61869+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61870+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61871+ GR_PAX_DISABLE_MPROTECT = 0x0400,
61872+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
61873+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61874+};
61875+
61876+enum {
61877+ GR_ID_USER = 0x01,
61878+ GR_ID_GROUP = 0x02,
61879+};
61880+
61881+enum {
61882+ GR_ID_ALLOW = 0x01,
61883+ GR_ID_DENY = 0x02,
61884+};
61885+
61886+#define GR_CRASH_RES 31
61887+#define GR_UIDTABLE_MAX 500
61888+
61889+/* begin resource learning section */
61890+enum {
61891+ GR_RLIM_CPU_BUMP = 60,
61892+ GR_RLIM_FSIZE_BUMP = 50000,
61893+ GR_RLIM_DATA_BUMP = 10000,
61894+ GR_RLIM_STACK_BUMP = 1000,
61895+ GR_RLIM_CORE_BUMP = 10000,
61896+ GR_RLIM_RSS_BUMP = 500000,
61897+ GR_RLIM_NPROC_BUMP = 1,
61898+ GR_RLIM_NOFILE_BUMP = 5,
61899+ GR_RLIM_MEMLOCK_BUMP = 50000,
61900+ GR_RLIM_AS_BUMP = 500000,
61901+ GR_RLIM_LOCKS_BUMP = 2,
61902+ GR_RLIM_SIGPENDING_BUMP = 5,
61903+ GR_RLIM_MSGQUEUE_BUMP = 10000,
61904+ GR_RLIM_NICE_BUMP = 1,
61905+ GR_RLIM_RTPRIO_BUMP = 1,
61906+ GR_RLIM_RTTIME_BUMP = 1000000
61907+};
61908+
61909+#endif
61910diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
61911new file mode 100644
61912index 0000000..60cda84
61913--- /dev/null
61914+++ b/include/linux/grinternal.h
61915@@ -0,0 +1,220 @@
61916+#ifndef __GRINTERNAL_H
61917+#define __GRINTERNAL_H
61918+
61919+#ifdef CONFIG_GRKERNSEC
61920+
61921+#include <linux/fs.h>
61922+#include <linux/mnt_namespace.h>
61923+#include <linux/nsproxy.h>
61924+#include <linux/gracl.h>
61925+#include <linux/grdefs.h>
61926+#include <linux/grmsg.h>
61927+
61928+void gr_add_learn_entry(const char *fmt, ...)
61929+ __attribute__ ((format (printf, 1, 2)));
61930+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61931+ const struct vfsmount *mnt);
61932+__u32 gr_check_create(const struct dentry *new_dentry,
61933+ const struct dentry *parent,
61934+ const struct vfsmount *mnt, const __u32 mode);
61935+int gr_check_protected_task(const struct task_struct *task);
61936+__u32 to_gr_audit(const __u32 reqmode);
61937+int gr_set_acls(const int type);
61938+int gr_apply_subject_to_task(struct task_struct *task);
61939+int gr_acl_is_enabled(void);
61940+char gr_roletype_to_char(void);
61941+
61942+void gr_handle_alertkill(struct task_struct *task);
61943+char *gr_to_filename(const struct dentry *dentry,
61944+ const struct vfsmount *mnt);
61945+char *gr_to_filename1(const struct dentry *dentry,
61946+ const struct vfsmount *mnt);
61947+char *gr_to_filename2(const struct dentry *dentry,
61948+ const struct vfsmount *mnt);
61949+char *gr_to_filename3(const struct dentry *dentry,
61950+ const struct vfsmount *mnt);
61951+
61952+extern int grsec_enable_harden_ptrace;
61953+extern int grsec_enable_link;
61954+extern int grsec_enable_fifo;
61955+extern int grsec_enable_execve;
61956+extern int grsec_enable_shm;
61957+extern int grsec_enable_execlog;
61958+extern int grsec_enable_signal;
61959+extern int grsec_enable_audit_ptrace;
61960+extern int grsec_enable_forkfail;
61961+extern int grsec_enable_time;
61962+extern int grsec_enable_rofs;
61963+extern int grsec_enable_chroot_shmat;
61964+extern int grsec_enable_chroot_mount;
61965+extern int grsec_enable_chroot_double;
61966+extern int grsec_enable_chroot_pivot;
61967+extern int grsec_enable_chroot_chdir;
61968+extern int grsec_enable_chroot_chmod;
61969+extern int grsec_enable_chroot_mknod;
61970+extern int grsec_enable_chroot_fchdir;
61971+extern int grsec_enable_chroot_nice;
61972+extern int grsec_enable_chroot_execlog;
61973+extern int grsec_enable_chroot_caps;
61974+extern int grsec_enable_chroot_sysctl;
61975+extern int grsec_enable_chroot_unix;
61976+extern int grsec_enable_tpe;
61977+extern int grsec_tpe_gid;
61978+extern int grsec_enable_tpe_all;
61979+extern int grsec_enable_tpe_invert;
61980+extern int grsec_enable_socket_all;
61981+extern int grsec_socket_all_gid;
61982+extern int grsec_enable_socket_client;
61983+extern int grsec_socket_client_gid;
61984+extern int grsec_enable_socket_server;
61985+extern int grsec_socket_server_gid;
61986+extern int grsec_audit_gid;
61987+extern int grsec_enable_group;
61988+extern int grsec_enable_audit_textrel;
61989+extern int grsec_enable_log_rwxmaps;
61990+extern int grsec_enable_mount;
61991+extern int grsec_enable_chdir;
61992+extern int grsec_resource_logging;
61993+extern int grsec_enable_blackhole;
61994+extern int grsec_lastack_retries;
61995+extern int grsec_enable_brute;
61996+extern int grsec_lock;
61997+
61998+extern spinlock_t grsec_alert_lock;
61999+extern unsigned long grsec_alert_wtime;
62000+extern unsigned long grsec_alert_fyet;
62001+
62002+extern spinlock_t grsec_audit_lock;
62003+
62004+extern rwlock_t grsec_exec_file_lock;
62005+
62006+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62007+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62008+ (tsk)->exec_file->f_vfsmnt) : "/")
62009+
62010+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62011+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62012+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62013+
62014+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62015+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
62016+ (tsk)->exec_file->f_vfsmnt) : "/")
62017+
62018+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62019+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62020+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62021+
62022+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
62023+
62024+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
62025+
62026+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62027+ (task)->pid, (cred)->uid, \
62028+ (cred)->euid, (cred)->gid, (cred)->egid, \
62029+ gr_parent_task_fullpath(task), \
62030+ (task)->real_parent->comm, (task)->real_parent->pid, \
62031+ (pcred)->uid, (pcred)->euid, \
62032+ (pcred)->gid, (pcred)->egid
62033+
62034+#define GR_CHROOT_CAPS {{ \
62035+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62036+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62037+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62038+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62039+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62040+ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
62041+ CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
62042+
62043+#define security_learn(normal_msg,args...) \
62044+({ \
62045+ read_lock(&grsec_exec_file_lock); \
62046+ gr_add_learn_entry(normal_msg "\n", ## args); \
62047+ read_unlock(&grsec_exec_file_lock); \
62048+})
62049+
62050+enum {
62051+ GR_DO_AUDIT,
62052+ GR_DONT_AUDIT,
62053+ /* used for non-audit messages that we shouldn't kill the task on */
62054+ GR_DONT_AUDIT_GOOD
62055+};
62056+
62057+enum {
62058+ GR_TTYSNIFF,
62059+ GR_RBAC,
62060+ GR_RBAC_STR,
62061+ GR_STR_RBAC,
62062+ GR_RBAC_MODE2,
62063+ GR_RBAC_MODE3,
62064+ GR_FILENAME,
62065+ GR_SYSCTL_HIDDEN,
62066+ GR_NOARGS,
62067+ GR_ONE_INT,
62068+ GR_ONE_INT_TWO_STR,
62069+ GR_ONE_STR,
62070+ GR_STR_INT,
62071+ GR_TWO_STR_INT,
62072+ GR_TWO_INT,
62073+ GR_TWO_U64,
62074+ GR_THREE_INT,
62075+ GR_FIVE_INT_TWO_STR,
62076+ GR_TWO_STR,
62077+ GR_THREE_STR,
62078+ GR_FOUR_STR,
62079+ GR_STR_FILENAME,
62080+ GR_FILENAME_STR,
62081+ GR_FILENAME_TWO_INT,
62082+ GR_FILENAME_TWO_INT_STR,
62083+ GR_TEXTREL,
62084+ GR_PTRACE,
62085+ GR_RESOURCE,
62086+ GR_CAP,
62087+ GR_SIG,
62088+ GR_SIG2,
62089+ GR_CRASH1,
62090+ GR_CRASH2,
62091+ GR_PSACCT,
62092+ GR_RWXMAP
62093+};
62094+
62095+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62096+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62097+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62098+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62099+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62100+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62101+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62102+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62103+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
62104+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
62105+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
62106+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
62107+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
62108+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
62109+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
62110+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
62111+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
62112+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
62113+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
62114+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
62115+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
62116+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
62117+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
62118+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
62119+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
62120+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
62121+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
62122+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
62123+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
62124+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
62125+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
62126+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
62127+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
62128+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
62129+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
62130+
62131+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
62132+
62133+#endif
62134+
62135+#endif
62136diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
62137new file mode 100644
62138index 0000000..9d5fd4a
62139--- /dev/null
62140+++ b/include/linux/grmsg.h
62141@@ -0,0 +1,108 @@
62142+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
62143+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
62144+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
62145+#define GR_STOPMOD_MSG "denied modification of module state by "
62146+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
62147+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
62148+#define GR_IOPERM_MSG "denied use of ioperm() by "
62149+#define GR_IOPL_MSG "denied use of iopl() by "
62150+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
62151+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
62152+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
62153+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
62154+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
62155+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
62156+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
62157+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
62158+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
62159+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
62160+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
62161+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
62162+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
62163+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
62164+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
62165+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
62166+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
62167+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
62168+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
62169+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
62170+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
62171+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
62172+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
62173+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
62174+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
62175+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
62176+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
62177+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
62178+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
62179+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
62180+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
62181+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
62182+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
62183+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
62184+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
62185+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
62186+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
62187+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
62188+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
62189+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
62190+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
62191+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
62192+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
62193+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
62194+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
62195+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
62196+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
62197+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
62198+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
62199+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
62200+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
62201+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
62202+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
62203+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
62204+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
62205+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
62206+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
62207+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
62208+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
62209+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
62210+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
62211+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
62212+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
62213+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
62214+#define GR_FAILFORK_MSG "failed fork with errno %s by "
62215+#define GR_NICE_CHROOT_MSG "denied priority change by "
62216+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
62217+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
62218+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
62219+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
62220+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
62221+#define GR_TIME_MSG "time set by "
62222+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
62223+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
62224+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
62225+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
62226+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
62227+#define GR_BIND_MSG "denied bind() by "
62228+#define GR_CONNECT_MSG "denied connect() by "
62229+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
62230+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
62231+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
62232+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
62233+#define GR_CAP_ACL_MSG "use of %s denied for "
62234+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
62235+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
62236+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
62237+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
62238+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
62239+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
62240+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
62241+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
62242+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
62243+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
62244+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
62245+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
62246+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
62247+#define GR_VM86_MSG "denied use of vm86 by "
62248+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
62249+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
62250diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
62251new file mode 100644
62252index 0000000..4620f36
62253--- /dev/null
62254+++ b/include/linux/grsecurity.h
62255@@ -0,0 +1,231 @@
62256+#ifndef GR_SECURITY_H
62257+#define GR_SECURITY_H
62258+#include <linux/fs.h>
62259+#include <linux/fs_struct.h>
62260+#include <linux/binfmts.h>
62261+#include <linux/gracl.h>
62262+
62263+/* notify of brain-dead configs */
62264+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62265+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
62266+#endif
62267+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
62268+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
62269+#endif
62270+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
62271+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
62272+#endif
62273+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
62274+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
62275+#endif
62276+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
62277+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
62278+#endif
62279+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
62280+#error "CONFIG_PAX enabled, but no PaX options are enabled."
62281+#endif
62282+
62283+#include <linux/compat.h>
62284+
62285+struct user_arg_ptr {
62286+#ifdef CONFIG_COMPAT
62287+ bool is_compat;
62288+#endif
62289+ union {
62290+ const char __user *const __user *native;
62291+#ifdef CONFIG_COMPAT
62292+ compat_uptr_t __user *compat;
62293+#endif
62294+ } ptr;
62295+};
62296+
62297+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
62298+void gr_handle_brute_check(void);
62299+void gr_handle_kernel_exploit(void);
62300+int gr_process_user_ban(void);
62301+
62302+char gr_roletype_to_char(void);
62303+
62304+int gr_acl_enable_at_secure(void);
62305+
62306+int gr_check_user_change(int real, int effective, int fs);
62307+int gr_check_group_change(int real, int effective, int fs);
62308+
62309+void gr_del_task_from_ip_table(struct task_struct *p);
62310+
62311+int gr_pid_is_chrooted(struct task_struct *p);
62312+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
62313+int gr_handle_chroot_nice(void);
62314+int gr_handle_chroot_sysctl(const int op);
62315+int gr_handle_chroot_setpriority(struct task_struct *p,
62316+ const int niceval);
62317+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
62318+int gr_handle_chroot_chroot(const struct dentry *dentry,
62319+ const struct vfsmount *mnt);
62320+void gr_handle_chroot_chdir(struct path *path);
62321+int gr_handle_chroot_chmod(const struct dentry *dentry,
62322+ const struct vfsmount *mnt, const int mode);
62323+int gr_handle_chroot_mknod(const struct dentry *dentry,
62324+ const struct vfsmount *mnt, const int mode);
62325+int gr_handle_chroot_mount(const struct dentry *dentry,
62326+ const struct vfsmount *mnt,
62327+ const char *dev_name);
62328+int gr_handle_chroot_pivot(void);
62329+int gr_handle_chroot_unix(const pid_t pid);
62330+
62331+int gr_handle_rawio(const struct inode *inode);
62332+
62333+void gr_handle_ioperm(void);
62334+void gr_handle_iopl(void);
62335+
62336+int gr_tpe_allow(const struct file *file);
62337+
62338+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
62339+void gr_clear_chroot_entries(struct task_struct *task);
62340+
62341+void gr_log_forkfail(const int retval);
62342+void gr_log_timechange(void);
62343+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
62344+void gr_log_chdir(const struct dentry *dentry,
62345+ const struct vfsmount *mnt);
62346+void gr_log_chroot_exec(const struct dentry *dentry,
62347+ const struct vfsmount *mnt);
62348+void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
62349+void gr_log_remount(const char *devname, const int retval);
62350+void gr_log_unmount(const char *devname, const int retval);
62351+void gr_log_mount(const char *from, const char *to, const int retval);
62352+void gr_log_textrel(struct vm_area_struct *vma);
62353+void gr_log_rwxmmap(struct file *file);
62354+void gr_log_rwxmprotect(struct file *file);
62355+
62356+int gr_handle_follow_link(const struct inode *parent,
62357+ const struct inode *inode,
62358+ const struct dentry *dentry,
62359+ const struct vfsmount *mnt);
62360+int gr_handle_fifo(const struct dentry *dentry,
62361+ const struct vfsmount *mnt,
62362+ const struct dentry *dir, const int flag,
62363+ const int acc_mode);
62364+int gr_handle_hardlink(const struct dentry *dentry,
62365+ const struct vfsmount *mnt,
62366+ struct inode *inode,
62367+ const int mode, const char *to);
62368+
62369+int gr_is_capable(const int cap);
62370+int gr_is_capable_nolog(const int cap);
62371+void gr_learn_resource(const struct task_struct *task, const int limit,
62372+ const unsigned long wanted, const int gt);
62373+void gr_copy_label(struct task_struct *tsk);
62374+void gr_handle_crash(struct task_struct *task, const int sig);
62375+int gr_handle_signal(const struct task_struct *p, const int sig);
62376+int gr_check_crash_uid(const uid_t uid);
62377+int gr_check_protected_task(const struct task_struct *task);
62378+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
62379+int gr_acl_handle_mmap(const struct file *file,
62380+ const unsigned long prot);
62381+int gr_acl_handle_mprotect(const struct file *file,
62382+ const unsigned long prot);
62383+int gr_check_hidden_task(const struct task_struct *tsk);
62384+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
62385+ const struct vfsmount *mnt);
62386+__u32 gr_acl_handle_utime(const struct dentry *dentry,
62387+ const struct vfsmount *mnt);
62388+__u32 gr_acl_handle_access(const struct dentry *dentry,
62389+ const struct vfsmount *mnt, const int fmode);
62390+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
62391+ const struct vfsmount *mnt, mode_t mode);
62392+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
62393+ const struct vfsmount *mnt, mode_t mode);
62394+__u32 gr_acl_handle_chown(const struct dentry *dentry,
62395+ const struct vfsmount *mnt);
62396+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
62397+ const struct vfsmount *mnt);
62398+int gr_handle_ptrace(struct task_struct *task, const long request);
62399+int gr_handle_proc_ptrace(struct task_struct *task);
62400+__u32 gr_acl_handle_execve(const struct dentry *dentry,
62401+ const struct vfsmount *mnt);
62402+int gr_check_crash_exec(const struct file *filp);
62403+int gr_acl_is_enabled(void);
62404+void gr_set_kernel_label(struct task_struct *task);
62405+void gr_set_role_label(struct task_struct *task, const uid_t uid,
62406+ const gid_t gid);
62407+int gr_set_proc_label(const struct dentry *dentry,
62408+ const struct vfsmount *mnt,
62409+ const int unsafe_share);
62410+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
62411+ const struct vfsmount *mnt);
62412+__u32 gr_acl_handle_open(const struct dentry *dentry,
62413+ const struct vfsmount *mnt, int acc_mode);
62414+__u32 gr_acl_handle_creat(const struct dentry *dentry,
62415+ const struct dentry *p_dentry,
62416+ const struct vfsmount *p_mnt,
62417+ int open_flags, int acc_mode, const int imode);
62418+void gr_handle_create(const struct dentry *dentry,
62419+ const struct vfsmount *mnt);
62420+void gr_handle_proc_create(const struct dentry *dentry,
62421+ const struct inode *inode);
62422+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
62423+ const struct dentry *parent_dentry,
62424+ const struct vfsmount *parent_mnt,
62425+ const int mode);
62426+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
62427+ const struct dentry *parent_dentry,
62428+ const struct vfsmount *parent_mnt);
62429+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
62430+ const struct vfsmount *mnt);
62431+void gr_handle_delete(const ino_t ino, const dev_t dev);
62432+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
62433+ const struct vfsmount *mnt);
62434+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
62435+ const struct dentry *parent_dentry,
62436+ const struct vfsmount *parent_mnt,
62437+ const char *from);
62438+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
62439+ const struct dentry *parent_dentry,
62440+ const struct vfsmount *parent_mnt,
62441+ const struct dentry *old_dentry,
62442+ const struct vfsmount *old_mnt, const char *to);
62443+int gr_acl_handle_rename(struct dentry *new_dentry,
62444+ struct dentry *parent_dentry,
62445+ const struct vfsmount *parent_mnt,
62446+ struct dentry *old_dentry,
62447+ struct inode *old_parent_inode,
62448+ struct vfsmount *old_mnt, const char *newname);
62449+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
62450+ struct dentry *old_dentry,
62451+ struct dentry *new_dentry,
62452+ struct vfsmount *mnt, const __u8 replace);
62453+__u32 gr_check_link(const struct dentry *new_dentry,
62454+ const struct dentry *parent_dentry,
62455+ const struct vfsmount *parent_mnt,
62456+ const struct dentry *old_dentry,
62457+ const struct vfsmount *old_mnt);
62458+int gr_acl_handle_filldir(const struct file *file, const char *name,
62459+ const unsigned int namelen, const ino_t ino);
62460+
62461+__u32 gr_acl_handle_unix(const struct dentry *dentry,
62462+ const struct vfsmount *mnt);
62463+void gr_acl_handle_exit(void);
62464+void gr_acl_handle_psacct(struct task_struct *task, const long code);
62465+int gr_acl_handle_procpidmem(const struct task_struct *task);
62466+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
62467+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
62468+void gr_audit_ptrace(struct task_struct *task);
62469+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
62470+
62471+#ifdef CONFIG_GRKERNSEC
62472+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
62473+void gr_handle_vm86(void);
62474+void gr_handle_mem_readwrite(u64 from, u64 to);
62475+
62476+extern int grsec_enable_dmesg;
62477+extern int grsec_disable_privio;
62478+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
62479+extern int grsec_enable_chroot_findtask;
62480+#endif
62481+#ifdef CONFIG_GRKERNSEC_SETXID
62482+extern int grsec_enable_setxid;
62483+#endif
62484+#endif
62485+
62486+#endif
62487diff --git a/include/linux/grsock.h b/include/linux/grsock.h
62488new file mode 100644
62489index 0000000..e7ffaaf
62490--- /dev/null
62491+++ b/include/linux/grsock.h
62492@@ -0,0 +1,19 @@
62493+#ifndef __GRSOCK_H
62494+#define __GRSOCK_H
62495+
62496+extern void gr_attach_curr_ip(const struct sock *sk);
62497+extern int gr_handle_sock_all(const int family, const int type,
62498+ const int protocol);
62499+extern int gr_handle_sock_server(const struct sockaddr *sck);
62500+extern int gr_handle_sock_server_other(const struct sock *sck);
62501+extern int gr_handle_sock_client(const struct sockaddr *sck);
62502+extern int gr_search_connect(struct socket * sock,
62503+ struct sockaddr_in * addr);
62504+extern int gr_search_bind(struct socket * sock,
62505+ struct sockaddr_in * addr);
62506+extern int gr_search_listen(struct socket * sock);
62507+extern int gr_search_accept(struct socket * sock);
62508+extern int gr_search_socket(const int domain, const int type,
62509+ const int protocol);
62510+
62511+#endif
62512diff --git a/include/linux/hid.h b/include/linux/hid.h
62513index 9cf8e7a..5ec94d0 100644
62514--- a/include/linux/hid.h
62515+++ b/include/linux/hid.h
62516@@ -676,7 +676,7 @@ struct hid_ll_driver {
62517 unsigned int code, int value);
62518
62519 int (*parse)(struct hid_device *hdev);
62520-};
62521+} __no_const;
62522
62523 #define PM_HINT_FULLON 1<<5
62524 #define PM_HINT_NORMAL 1<<1
62525diff --git a/include/linux/highmem.h b/include/linux/highmem.h
62526index 3a93f73..b19d0b3 100644
62527--- a/include/linux/highmem.h
62528+++ b/include/linux/highmem.h
62529@@ -185,6 +185,18 @@ static inline void clear_highpage(struct page *page)
62530 kunmap_atomic(kaddr, KM_USER0);
62531 }
62532
62533+static inline void sanitize_highpage(struct page *page)
62534+{
62535+ void *kaddr;
62536+ unsigned long flags;
62537+
62538+ local_irq_save(flags);
62539+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
62540+ clear_page(kaddr);
62541+ kunmap_atomic(kaddr, KM_CLEARPAGE);
62542+ local_irq_restore(flags);
62543+}
62544+
62545 static inline void zero_user_segments(struct page *page,
62546 unsigned start1, unsigned end1,
62547 unsigned start2, unsigned end2)
62548diff --git a/include/linux/i2c.h b/include/linux/i2c.h
62549index a6c652e..1f5878f 100644
62550--- a/include/linux/i2c.h
62551+++ b/include/linux/i2c.h
62552@@ -346,6 +346,7 @@ struct i2c_algorithm {
62553 /* To determine what the adapter supports */
62554 u32 (*functionality) (struct i2c_adapter *);
62555 };
62556+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
62557
62558 /*
62559 * i2c_adapter is the structure used to identify a physical i2c bus along
62560diff --git a/include/linux/i2o.h b/include/linux/i2o.h
62561index a6deef4..c56a7f2 100644
62562--- a/include/linux/i2o.h
62563+++ b/include/linux/i2o.h
62564@@ -564,7 +564,7 @@ struct i2o_controller {
62565 struct i2o_device *exec; /* Executive */
62566 #if BITS_PER_LONG == 64
62567 spinlock_t context_list_lock; /* lock for context_list */
62568- atomic_t context_list_counter; /* needed for unique contexts */
62569+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
62570 struct list_head context_list; /* list of context id's
62571 and pointers */
62572 #endif
62573diff --git a/include/linux/init.h b/include/linux/init.h
62574index 9146f39..885354d 100644
62575--- a/include/linux/init.h
62576+++ b/include/linux/init.h
62577@@ -293,13 +293,13 @@ void __init parse_early_options(char *cmdline);
62578
62579 /* Each module must use one module_init(). */
62580 #define module_init(initfn) \
62581- static inline initcall_t __inittest(void) \
62582+ static inline __used initcall_t __inittest(void) \
62583 { return initfn; } \
62584 int init_module(void) __attribute__((alias(#initfn)));
62585
62586 /* This is only required if you want to be unloadable. */
62587 #define module_exit(exitfn) \
62588- static inline exitcall_t __exittest(void) \
62589+ static inline __used exitcall_t __exittest(void) \
62590 { return exitfn; } \
62591 void cleanup_module(void) __attribute__((alias(#exitfn)));
62592
62593diff --git a/include/linux/init_task.h b/include/linux/init_task.h
62594index d14e058..4162929 100644
62595--- a/include/linux/init_task.h
62596+++ b/include/linux/init_task.h
62597@@ -126,6 +126,12 @@ extern struct cred init_cred;
62598 # define INIT_PERF_EVENTS(tsk)
62599 #endif
62600
62601+#ifdef CONFIG_X86
62602+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
62603+#else
62604+#define INIT_TASK_THREAD_INFO
62605+#endif
62606+
62607 /*
62608 * INIT_TASK is used to set up the first task table, touch at
62609 * your own risk!. Base=0, limit=0x1fffff (=2MB)
62610@@ -164,6 +170,7 @@ extern struct cred init_cred;
62611 RCU_INIT_POINTER(.cred, &init_cred), \
62612 .comm = "swapper", \
62613 .thread = INIT_THREAD, \
62614+ INIT_TASK_THREAD_INFO \
62615 .fs = &init_fs, \
62616 .files = &init_files, \
62617 .signal = &init_signals, \
62618diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
62619index 9310c69..6ebb244 100644
62620--- a/include/linux/intel-iommu.h
62621+++ b/include/linux/intel-iommu.h
62622@@ -296,7 +296,7 @@ struct iommu_flush {
62623 u8 fm, u64 type);
62624 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
62625 unsigned int size_order, u64 type);
62626-};
62627+} __no_const;
62628
62629 enum {
62630 SR_DMAR_FECTL_REG,
62631diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
62632index f51a81b..adfcb44 100644
62633--- a/include/linux/interrupt.h
62634+++ b/include/linux/interrupt.h
62635@@ -425,7 +425,7 @@ enum
62636 /* map softirq index to softirq name. update 'softirq_to_name' in
62637 * kernel/softirq.c when adding a new softirq.
62638 */
62639-extern char *softirq_to_name[NR_SOFTIRQS];
62640+extern const char * const softirq_to_name[NR_SOFTIRQS];
62641
62642 /* softirq mask and active fields moved to irq_cpustat_t in
62643 * asm/hardirq.h to get better cache usage. KAO
62644@@ -433,12 +433,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
62645
62646 struct softirq_action
62647 {
62648- void (*action)(struct softirq_action *);
62649+ void (*action)(void);
62650 };
62651
62652 asmlinkage void do_softirq(void);
62653 asmlinkage void __do_softirq(void);
62654-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
62655+extern void open_softirq(int nr, void (*action)(void));
62656 extern void softirq_init(void);
62657 static inline void __raise_softirq_irqoff(unsigned int nr)
62658 {
62659diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
62660index 0df513b..fe901a2 100644
62661--- a/include/linux/kallsyms.h
62662+++ b/include/linux/kallsyms.h
62663@@ -15,7 +15,8 @@
62664
62665 struct module;
62666
62667-#ifdef CONFIG_KALLSYMS
62668+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
62669+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
62670 /* Lookup the address for a symbol. Returns 0 if not found. */
62671 unsigned long kallsyms_lookup_name(const char *name);
62672
62673@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
62674 /* Stupid that this does nothing, but I didn't create this mess. */
62675 #define __print_symbol(fmt, addr)
62676 #endif /*CONFIG_KALLSYMS*/
62677+#else /* when included by kallsyms.c, vsnprintf.c, or
62678+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
62679+extern void __print_symbol(const char *fmt, unsigned long address);
62680+extern int sprint_backtrace(char *buffer, unsigned long address);
62681+extern int sprint_symbol(char *buffer, unsigned long address);
62682+const char *kallsyms_lookup(unsigned long addr,
62683+ unsigned long *symbolsize,
62684+ unsigned long *offset,
62685+ char **modname, char *namebuf);
62686+#endif
62687
62688 /* This macro allows us to keep printk typechecking */
62689 static void __check_printsym_format(const char *fmt, ...)
62690diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
62691index fa39183..40160be 100644
62692--- a/include/linux/kgdb.h
62693+++ b/include/linux/kgdb.h
62694@@ -53,7 +53,7 @@ extern int kgdb_connected;
62695 extern int kgdb_io_module_registered;
62696
62697 extern atomic_t kgdb_setting_breakpoint;
62698-extern atomic_t kgdb_cpu_doing_single_step;
62699+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
62700
62701 extern struct task_struct *kgdb_usethread;
62702 extern struct task_struct *kgdb_contthread;
62703@@ -251,7 +251,7 @@ struct kgdb_arch {
62704 void (*disable_hw_break)(struct pt_regs *regs);
62705 void (*remove_all_hw_break)(void);
62706 void (*correct_hw_break)(void);
62707-};
62708+} __do_const;
62709
62710 /**
62711 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
62712@@ -276,7 +276,7 @@ struct kgdb_io {
62713 void (*pre_exception) (void);
62714 void (*post_exception) (void);
62715 int is_console;
62716-};
62717+} __do_const;
62718
62719 extern struct kgdb_arch arch_kgdb_ops;
62720
62721diff --git a/include/linux/kmod.h b/include/linux/kmod.h
62722index 0da38cf..d23f05f 100644
62723--- a/include/linux/kmod.h
62724+++ b/include/linux/kmod.h
62725@@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
62726 * usually useless though. */
62727 extern int __request_module(bool wait, const char *name, ...) \
62728 __attribute__((format(printf, 2, 3)));
62729+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
62730+ __attribute__((format(printf, 3, 4)));
62731 #define request_module(mod...) __request_module(true, mod)
62732 #define request_module_nowait(mod...) __request_module(false, mod)
62733 #define try_then_request_module(x, mod...) \
62734diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
62735index eabb21a..3f030f4 100644
62736--- a/include/linux/kvm_host.h
62737+++ b/include/linux/kvm_host.h
62738@@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
62739 void vcpu_load(struct kvm_vcpu *vcpu);
62740 void vcpu_put(struct kvm_vcpu *vcpu);
62741
62742-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62743+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62744 struct module *module);
62745 void kvm_exit(void);
62746
62747@@ -454,7 +454,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
62748 struct kvm_guest_debug *dbg);
62749 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
62750
62751-int kvm_arch_init(void *opaque);
62752+int kvm_arch_init(const void *opaque);
62753 void kvm_arch_exit(void);
62754
62755 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
62756diff --git a/include/linux/libata.h b/include/linux/libata.h
62757index efd6f98..5f5fd37 100644
62758--- a/include/linux/libata.h
62759+++ b/include/linux/libata.h
62760@@ -909,7 +909,7 @@ struct ata_port_operations {
62761 * fields must be pointers.
62762 */
62763 const struct ata_port_operations *inherits;
62764-};
62765+} __do_const;
62766
62767 struct ata_port_info {
62768 unsigned long flags;
62769diff --git a/include/linux/mca.h b/include/linux/mca.h
62770index 3797270..7765ede 100644
62771--- a/include/linux/mca.h
62772+++ b/include/linux/mca.h
62773@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
62774 int region);
62775 void * (*mca_transform_memory)(struct mca_device *,
62776 void *memory);
62777-};
62778+} __no_const;
62779
62780 struct mca_bus {
62781 u64 default_dma_mask;
62782diff --git a/include/linux/memory.h b/include/linux/memory.h
62783index 935699b..11042cc 100644
62784--- a/include/linux/memory.h
62785+++ b/include/linux/memory.h
62786@@ -144,7 +144,7 @@ struct memory_accessor {
62787 size_t count);
62788 ssize_t (*write)(struct memory_accessor *, const char *buf,
62789 off_t offset, size_t count);
62790-};
62791+} __no_const;
62792
62793 /*
62794 * Kernel text modification mutex, used for code patching. Users of this lock
62795diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
62796index 896b5e4..1159ad0 100644
62797--- a/include/linux/mfd/abx500.h
62798+++ b/include/linux/mfd/abx500.h
62799@@ -234,6 +234,7 @@ struct abx500_ops {
62800 int (*event_registers_startup_state_get) (struct device *, u8 *);
62801 int (*startup_irq_enabled) (struct device *, unsigned int);
62802 };
62803+typedef struct abx500_ops __no_const abx500_ops_no_const;
62804
62805 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
62806 void abx500_remove_ops(struct device *dev);
62807diff --git a/include/linux/mm.h b/include/linux/mm.h
62808index fedc5f0..7cedb6d 100644
62809--- a/include/linux/mm.h
62810+++ b/include/linux/mm.h
62811@@ -114,7 +114,14 @@ extern unsigned int kobjsize(const void *objp);
62812
62813 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
62814 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
62815+
62816+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
62817+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62818+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62819+#else
62820 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62821+#endif
62822+
62823 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62824 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62825
62826@@ -1011,34 +1018,6 @@ int set_page_dirty(struct page *page);
62827 int set_page_dirty_lock(struct page *page);
62828 int clear_page_dirty_for_io(struct page *page);
62829
62830-/* Is the vma a continuation of the stack vma above it? */
62831-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
62832-{
62833- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62834-}
62835-
62836-static inline int stack_guard_page_start(struct vm_area_struct *vma,
62837- unsigned long addr)
62838-{
62839- return (vma->vm_flags & VM_GROWSDOWN) &&
62840- (vma->vm_start == addr) &&
62841- !vma_growsdown(vma->vm_prev, addr);
62842-}
62843-
62844-/* Is the vma a continuation of the stack vma below it? */
62845-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
62846-{
62847- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
62848-}
62849-
62850-static inline int stack_guard_page_end(struct vm_area_struct *vma,
62851- unsigned long addr)
62852-{
62853- return (vma->vm_flags & VM_GROWSUP) &&
62854- (vma->vm_end == addr) &&
62855- !vma_growsup(vma->vm_next, addr);
62856-}
62857-
62858 extern unsigned long move_page_tables(struct vm_area_struct *vma,
62859 unsigned long old_addr, struct vm_area_struct *new_vma,
62860 unsigned long new_addr, unsigned long len);
62861@@ -1133,6 +1112,15 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
62862 }
62863 #endif
62864
62865+#ifdef CONFIG_MMU
62866+pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
62867+#else
62868+static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
62869+{
62870+ return __pgprot(0);
62871+}
62872+#endif
62873+
62874 int vma_wants_writenotify(struct vm_area_struct *vma);
62875
62876 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
62877@@ -1417,6 +1405,7 @@ out:
62878 }
62879
62880 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62881+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62882
62883 extern unsigned long do_brk(unsigned long, unsigned long);
62884
62885@@ -1474,6 +1463,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
62886 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
62887 struct vm_area_struct **pprev);
62888
62889+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
62890+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
62891+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
62892+
62893 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
62894 NULL if none. Assume start_addr < end_addr. */
62895 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
62896@@ -1490,15 +1483,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
62897 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
62898 }
62899
62900-#ifdef CONFIG_MMU
62901-pgprot_t vm_get_page_prot(unsigned long vm_flags);
62902-#else
62903-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
62904-{
62905- return __pgprot(0);
62906-}
62907-#endif
62908-
62909 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
62910 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
62911 unsigned long pfn, unsigned long size, pgprot_t);
62912@@ -1612,7 +1596,7 @@ extern int unpoison_memory(unsigned long pfn);
62913 extern int sysctl_memory_failure_early_kill;
62914 extern int sysctl_memory_failure_recovery;
62915 extern void shake_page(struct page *p, int access);
62916-extern atomic_long_t mce_bad_pages;
62917+extern atomic_long_unchecked_t mce_bad_pages;
62918 extern int soft_offline_page(struct page *page, int flags);
62919
62920 extern void dump_page(struct page *page);
62921@@ -1626,5 +1610,11 @@ extern void copy_user_huge_page(struct page *dst, struct page *src,
62922 unsigned int pages_per_huge_page);
62923 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
62924
62925+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
62926+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
62927+#else
62928+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
62929+#endif
62930+
62931 #endif /* __KERNEL__ */
62932 #endif /* _LINUX_MM_H */
62933diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
62934index 10a2f62..d655142 100644
62935--- a/include/linux/mm_types.h
62936+++ b/include/linux/mm_types.h
62937@@ -230,6 +230,8 @@ struct vm_area_struct {
62938 #ifdef CONFIG_NUMA
62939 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
62940 #endif
62941+
62942+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
62943 };
62944
62945 struct core_thread {
62946@@ -362,6 +364,24 @@ struct mm_struct {
62947 #ifdef CONFIG_CPUMASK_OFFSTACK
62948 struct cpumask cpumask_allocation;
62949 #endif
62950+
62951+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62952+ unsigned long pax_flags;
62953+#endif
62954+
62955+#ifdef CONFIG_PAX_DLRESOLVE
62956+ unsigned long call_dl_resolve;
62957+#endif
62958+
62959+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
62960+ unsigned long call_syscall;
62961+#endif
62962+
62963+#ifdef CONFIG_PAX_ASLR
62964+ unsigned long delta_mmap; /* randomized offset */
62965+ unsigned long delta_stack; /* randomized offset */
62966+#endif
62967+
62968 };
62969
62970 static inline void mm_init_cpumask(struct mm_struct *mm)
62971diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
62972index 1d1b1e1..2a13c78 100644
62973--- a/include/linux/mmu_notifier.h
62974+++ b/include/linux/mmu_notifier.h
62975@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
62976 */
62977 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
62978 ({ \
62979- pte_t __pte; \
62980+ pte_t ___pte; \
62981 struct vm_area_struct *___vma = __vma; \
62982 unsigned long ___address = __address; \
62983- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
62984+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
62985 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
62986- __pte; \
62987+ ___pte; \
62988 })
62989
62990 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
62991diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
62992index be1ac8d..26868ce 100644
62993--- a/include/linux/mmzone.h
62994+++ b/include/linux/mmzone.h
62995@@ -356,7 +356,7 @@ struct zone {
62996 unsigned long flags; /* zone flags, see below */
62997
62998 /* Zone statistics */
62999- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63000+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63001
63002 /*
63003 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
63004diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
63005index ae28e93..1ac2233 100644
63006--- a/include/linux/mod_devicetable.h
63007+++ b/include/linux/mod_devicetable.h
63008@@ -12,7 +12,7 @@
63009 typedef unsigned long kernel_ulong_t;
63010 #endif
63011
63012-#define PCI_ANY_ID (~0)
63013+#define PCI_ANY_ID ((__u16)~0)
63014
63015 struct pci_device_id {
63016 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63017@@ -131,7 +131,7 @@ struct usb_device_id {
63018 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63019 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63020
63021-#define HID_ANY_ID (~0)
63022+#define HID_ANY_ID (~0U)
63023
63024 struct hid_device_id {
63025 __u16 bus;
63026diff --git a/include/linux/module.h b/include/linux/module.h
63027index 1c30087..fc2a442 100644
63028--- a/include/linux/module.h
63029+++ b/include/linux/module.h
63030@@ -16,6 +16,7 @@
63031 #include <linux/kobject.h>
63032 #include <linux/moduleparam.h>
63033 #include <linux/tracepoint.h>
63034+#include <linux/fs.h>
63035
63036 #include <linux/percpu.h>
63037 #include <asm/module.h>
63038@@ -327,19 +328,16 @@ struct module
63039 int (*init)(void);
63040
63041 /* If this is non-NULL, vfree after init() returns */
63042- void *module_init;
63043+ void *module_init_rx, *module_init_rw;
63044
63045 /* Here is the actual code + data, vfree'd on unload. */
63046- void *module_core;
63047+ void *module_core_rx, *module_core_rw;
63048
63049 /* Here are the sizes of the init and core sections */
63050- unsigned int init_size, core_size;
63051+ unsigned int init_size_rw, core_size_rw;
63052
63053 /* The size of the executable code in each section. */
63054- unsigned int init_text_size, core_text_size;
63055-
63056- /* Size of RO sections of the module (text+rodata) */
63057- unsigned int init_ro_size, core_ro_size;
63058+ unsigned int init_size_rx, core_size_rx;
63059
63060 /* Arch-specific module values */
63061 struct mod_arch_specific arch;
63062@@ -395,6 +393,10 @@ struct module
63063 #ifdef CONFIG_EVENT_TRACING
63064 struct ftrace_event_call **trace_events;
63065 unsigned int num_trace_events;
63066+ struct file_operations trace_id;
63067+ struct file_operations trace_enable;
63068+ struct file_operations trace_format;
63069+ struct file_operations trace_filter;
63070 #endif
63071 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
63072 unsigned int num_ftrace_callsites;
63073@@ -445,16 +447,46 @@ bool is_module_address(unsigned long addr);
63074 bool is_module_percpu_address(unsigned long addr);
63075 bool is_module_text_address(unsigned long addr);
63076
63077+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63078+{
63079+
63080+#ifdef CONFIG_PAX_KERNEXEC
63081+ if (ktla_ktva(addr) >= (unsigned long)start &&
63082+ ktla_ktva(addr) < (unsigned long)start + size)
63083+ return 1;
63084+#endif
63085+
63086+ return ((void *)addr >= start && (void *)addr < start + size);
63087+}
63088+
63089+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
63090+{
63091+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
63092+}
63093+
63094+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
63095+{
63096+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
63097+}
63098+
63099+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
63100+{
63101+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
63102+}
63103+
63104+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
63105+{
63106+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
63107+}
63108+
63109 static inline int within_module_core(unsigned long addr, struct module *mod)
63110 {
63111- return (unsigned long)mod->module_core <= addr &&
63112- addr < (unsigned long)mod->module_core + mod->core_size;
63113+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
63114 }
63115
63116 static inline int within_module_init(unsigned long addr, struct module *mod)
63117 {
63118- return (unsigned long)mod->module_init <= addr &&
63119- addr < (unsigned long)mod->module_init + mod->init_size;
63120+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
63121 }
63122
63123 /* Search for module by name: must hold module_mutex. */
63124diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
63125index b2be02e..6a9fdb1 100644
63126--- a/include/linux/moduleloader.h
63127+++ b/include/linux/moduleloader.h
63128@@ -25,9 +25,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
63129 sections. Returns NULL on failure. */
63130 void *module_alloc(unsigned long size);
63131
63132+#ifdef CONFIG_PAX_KERNEXEC
63133+void *module_alloc_exec(unsigned long size);
63134+#else
63135+#define module_alloc_exec(x) module_alloc(x)
63136+#endif
63137+
63138 /* Free memory returned from module_alloc. */
63139 void module_free(struct module *mod, void *module_region);
63140
63141+#ifdef CONFIG_PAX_KERNEXEC
63142+void module_free_exec(struct module *mod, void *module_region);
63143+#else
63144+#define module_free_exec(x, y) module_free((x), (y))
63145+#endif
63146+
63147 /* Apply the given relocation to the (simplified) ELF. Return -error
63148 or 0. */
63149 int apply_relocate(Elf_Shdr *sechdrs,
63150diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
63151index ddaae98..3c70938 100644
63152--- a/include/linux/moduleparam.h
63153+++ b/include/linux/moduleparam.h
63154@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock(void)
63155 * @len is usually just sizeof(string).
63156 */
63157 #define module_param_string(name, string, len, perm) \
63158- static const struct kparam_string __param_string_##name \
63159+ static const struct kparam_string __param_string_##name __used \
63160 = { len, string }; \
63161 __module_param_call(MODULE_PARAM_PREFIX, name, \
63162 &param_ops_string, \
63163@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
63164 * module_param_named() for why this might be necessary.
63165 */
63166 #define module_param_array_named(name, array, type, nump, perm) \
63167- static const struct kparam_array __param_arr_##name \
63168+ static const struct kparam_array __param_arr_##name __used \
63169 = { .max = ARRAY_SIZE(array), .num = nump, \
63170 .ops = &param_ops_##type, \
63171 .elemsize = sizeof(array[0]), .elem = array }; \
63172diff --git a/include/linux/namei.h b/include/linux/namei.h
63173index ffc0213..2c1f2cb 100644
63174--- a/include/linux/namei.h
63175+++ b/include/linux/namei.h
63176@@ -24,7 +24,7 @@ struct nameidata {
63177 unsigned seq;
63178 int last_type;
63179 unsigned depth;
63180- char *saved_names[MAX_NESTED_LINKS + 1];
63181+ const char *saved_names[MAX_NESTED_LINKS + 1];
63182
63183 /* Intent data */
63184 union {
63185@@ -94,12 +94,12 @@ extern int follow_up(struct path *);
63186 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
63187 extern void unlock_rename(struct dentry *, struct dentry *);
63188
63189-static inline void nd_set_link(struct nameidata *nd, char *path)
63190+static inline void nd_set_link(struct nameidata *nd, const char *path)
63191 {
63192 nd->saved_names[nd->depth] = path;
63193 }
63194
63195-static inline char *nd_get_link(struct nameidata *nd)
63196+static inline const char *nd_get_link(const struct nameidata *nd)
63197 {
63198 return nd->saved_names[nd->depth];
63199 }
63200diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
63201index ddee79b..67af106 100644
63202--- a/include/linux/netdevice.h
63203+++ b/include/linux/netdevice.h
63204@@ -944,6 +944,7 @@ struct net_device_ops {
63205 int (*ndo_set_features)(struct net_device *dev,
63206 u32 features);
63207 };
63208+typedef struct net_device_ops __no_const net_device_ops_no_const;
63209
63210 /*
63211 * The DEVICE structure.
63212diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
63213new file mode 100644
63214index 0000000..33f4af8
63215--- /dev/null
63216+++ b/include/linux/netfilter/xt_gradm.h
63217@@ -0,0 +1,9 @@
63218+#ifndef _LINUX_NETFILTER_XT_GRADM_H
63219+#define _LINUX_NETFILTER_XT_GRADM_H 1
63220+
63221+struct xt_gradm_mtinfo {
63222+ __u16 flags;
63223+ __u16 invflags;
63224+};
63225+
63226+#endif
63227diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
63228index c65a18a..0c05f3a 100644
63229--- a/include/linux/of_pdt.h
63230+++ b/include/linux/of_pdt.h
63231@@ -32,7 +32,7 @@ struct of_pdt_ops {
63232
63233 /* return 0 on success; fill in 'len' with number of bytes in path */
63234 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
63235-};
63236+} __no_const;
63237
63238 extern void *prom_early_alloc(unsigned long size);
63239
63240diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
63241index 49c8727..34d2ae1 100644
63242--- a/include/linux/oprofile.h
63243+++ b/include/linux/oprofile.h
63244@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
63245 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
63246 char const * name, ulong * val);
63247
63248-/** Create a file for read-only access to an atomic_t. */
63249+/** Create a file for read-only access to an atomic_unchecked_t. */
63250 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
63251- char const * name, atomic_t * val);
63252+ char const * name, atomic_unchecked_t * val);
63253
63254 /** create a directory */
63255 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
63256diff --git a/include/linux/padata.h b/include/linux/padata.h
63257index 4633b2f..988bc08 100644
63258--- a/include/linux/padata.h
63259+++ b/include/linux/padata.h
63260@@ -129,7 +129,7 @@ struct parallel_data {
63261 struct padata_instance *pinst;
63262 struct padata_parallel_queue __percpu *pqueue;
63263 struct padata_serial_queue __percpu *squeue;
63264- atomic_t seq_nr;
63265+ atomic_unchecked_t seq_nr;
63266 atomic_t reorder_objects;
63267 atomic_t refcnt;
63268 unsigned int max_seq_nr;
63269diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
63270index c816075..cd28c4d 100644
63271--- a/include/linux/perf_event.h
63272+++ b/include/linux/perf_event.h
63273@@ -745,8 +745,8 @@ struct perf_event {
63274
63275 enum perf_event_active_state state;
63276 unsigned int attach_state;
63277- local64_t count;
63278- atomic64_t child_count;
63279+ local64_t count; /* PaX: fix it one day */
63280+ atomic64_unchecked_t child_count;
63281
63282 /*
63283 * These are the total time in nanoseconds that the event
63284@@ -797,8 +797,8 @@ struct perf_event {
63285 * These accumulate total time (in nanoseconds) that children
63286 * events have been enabled and running, respectively.
63287 */
63288- atomic64_t child_total_time_enabled;
63289- atomic64_t child_total_time_running;
63290+ atomic64_unchecked_t child_total_time_enabled;
63291+ atomic64_unchecked_t child_total_time_running;
63292
63293 /*
63294 * Protect attach/detach and child_list:
63295diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
63296index 77257c9..51d473a 100644
63297--- a/include/linux/pipe_fs_i.h
63298+++ b/include/linux/pipe_fs_i.h
63299@@ -46,9 +46,9 @@ struct pipe_buffer {
63300 struct pipe_inode_info {
63301 wait_queue_head_t wait;
63302 unsigned int nrbufs, curbuf, buffers;
63303- unsigned int readers;
63304- unsigned int writers;
63305- unsigned int waiting_writers;
63306+ atomic_t readers;
63307+ atomic_t writers;
63308+ atomic_t waiting_writers;
63309 unsigned int r_counter;
63310 unsigned int w_counter;
63311 struct page *tmp_page;
63312diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
63313index daac05d..c6802ce 100644
63314--- a/include/linux/pm_runtime.h
63315+++ b/include/linux/pm_runtime.h
63316@@ -99,7 +99,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
63317
63318 static inline void pm_runtime_mark_last_busy(struct device *dev)
63319 {
63320- ACCESS_ONCE(dev->power.last_busy) = jiffies;
63321+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
63322 }
63323
63324 #else /* !CONFIG_PM_RUNTIME */
63325diff --git a/include/linux/poison.h b/include/linux/poison.h
63326index 79159de..f1233a9 100644
63327--- a/include/linux/poison.h
63328+++ b/include/linux/poison.h
63329@@ -19,8 +19,8 @@
63330 * under normal circumstances, used to verify that nobody uses
63331 * non-initialized list entries.
63332 */
63333-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
63334-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
63335+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
63336+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
63337
63338 /********** include/linux/timer.h **********/
63339 /*
63340diff --git a/include/linux/preempt.h b/include/linux/preempt.h
63341index 58969b2..ead129b 100644
63342--- a/include/linux/preempt.h
63343+++ b/include/linux/preempt.h
63344@@ -123,7 +123,7 @@ struct preempt_ops {
63345 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
63346 void (*sched_out)(struct preempt_notifier *notifier,
63347 struct task_struct *next);
63348-};
63349+} __no_const;
63350
63351 /**
63352 * preempt_notifier - key for installing preemption notifiers
63353diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
63354index 643b96c..ef55a9c 100644
63355--- a/include/linux/proc_fs.h
63356+++ b/include/linux/proc_fs.h
63357@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
63358 return proc_create_data(name, mode, parent, proc_fops, NULL);
63359 }
63360
63361+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
63362+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
63363+{
63364+#ifdef CONFIG_GRKERNSEC_PROC_USER
63365+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
63366+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63367+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
63368+#else
63369+ return proc_create_data(name, mode, parent, proc_fops, NULL);
63370+#endif
63371+}
63372+
63373+
63374 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
63375 mode_t mode, struct proc_dir_entry *base,
63376 read_proc_t *read_proc, void * data)
63377@@ -258,7 +271,7 @@ union proc_op {
63378 int (*proc_show)(struct seq_file *m,
63379 struct pid_namespace *ns, struct pid *pid,
63380 struct task_struct *task);
63381-};
63382+} __no_const;
63383
63384 struct ctl_table_header;
63385 struct ctl_table;
63386diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
63387index 800f113..af90cc8 100644
63388--- a/include/linux/ptrace.h
63389+++ b/include/linux/ptrace.h
63390@@ -129,10 +129,10 @@ extern void __ptrace_unlink(struct task_struct *child);
63391 extern void exit_ptrace(struct task_struct *tracer);
63392 #define PTRACE_MODE_READ 1
63393 #define PTRACE_MODE_ATTACH 2
63394-/* Returns 0 on success, -errno on denial. */
63395-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
63396 /* Returns true on success, false on denial. */
63397 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
63398+/* Returns true on success, false on denial. */
63399+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
63400
63401 static inline int ptrace_reparented(struct task_struct *child)
63402 {
63403diff --git a/include/linux/random.h b/include/linux/random.h
63404index d13059f..2eaafaa 100644
63405--- a/include/linux/random.h
63406+++ b/include/linux/random.h
63407@@ -69,12 +69,17 @@ void srandom32(u32 seed);
63408
63409 u32 prandom32(struct rnd_state *);
63410
63411+static inline unsigned long pax_get_random_long(void)
63412+{
63413+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
63414+}
63415+
63416 /*
63417 * Handle minimum values for seeds
63418 */
63419 static inline u32 __seed(u32 x, u32 m)
63420 {
63421- return (x < m) ? x + m : x;
63422+ return (x <= m) ? x + m + 1 : x;
63423 }
63424
63425 /**
63426diff --git a/include/linux/reboot.h b/include/linux/reboot.h
63427index e0879a7..a12f962 100644
63428--- a/include/linux/reboot.h
63429+++ b/include/linux/reboot.h
63430@@ -52,9 +52,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
63431 * Architecture-specific implementations of sys_reboot commands.
63432 */
63433
63434-extern void machine_restart(char *cmd);
63435-extern void machine_halt(void);
63436-extern void machine_power_off(void);
63437+extern void machine_restart(char *cmd) __noreturn;
63438+extern void machine_halt(void) __noreturn;
63439+extern void machine_power_off(void) __noreturn;
63440
63441 extern void machine_shutdown(void);
63442 struct pt_regs;
63443@@ -65,9 +65,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
63444 */
63445
63446 extern void kernel_restart_prepare(char *cmd);
63447-extern void kernel_restart(char *cmd);
63448-extern void kernel_halt(void);
63449-extern void kernel_power_off(void);
63450+extern void kernel_restart(char *cmd) __noreturn;
63451+extern void kernel_halt(void) __noreturn;
63452+extern void kernel_power_off(void) __noreturn;
63453
63454 extern int C_A_D; /* for sysctl */
63455 void ctrl_alt_del(void);
63456@@ -81,7 +81,7 @@ extern int orderly_poweroff(bool force);
63457 * Emergency restart, callable from an interrupt handler.
63458 */
63459
63460-extern void emergency_restart(void);
63461+extern void emergency_restart(void) __noreturn;
63462 #include <asm/emergency-restart.h>
63463
63464 #endif
63465diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
63466index 96d465f..b084e05 100644
63467--- a/include/linux/reiserfs_fs.h
63468+++ b/include/linux/reiserfs_fs.h
63469@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
63470 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
63471
63472 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
63473-#define get_generation(s) atomic_read (&fs_generation(s))
63474+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
63475 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
63476 #define __fs_changed(gen,s) (gen != get_generation (s))
63477 #define fs_changed(gen,s) \
63478diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
63479index 52c83b6..18ed7eb 100644
63480--- a/include/linux/reiserfs_fs_sb.h
63481+++ b/include/linux/reiserfs_fs_sb.h
63482@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
63483 /* Comment? -Hans */
63484 wait_queue_head_t s_wait;
63485 /* To be obsoleted soon by per buffer seals.. -Hans */
63486- atomic_t s_generation_counter; // increased by one every time the
63487+ atomic_unchecked_t s_generation_counter; // increased by one every time the
63488 // tree gets re-balanced
63489 unsigned long s_properties; /* File system properties. Currently holds
63490 on-disk FS format */
63491diff --git a/include/linux/relay.h b/include/linux/relay.h
63492index 14a86bc..17d0700 100644
63493--- a/include/linux/relay.h
63494+++ b/include/linux/relay.h
63495@@ -159,7 +159,7 @@ struct rchan_callbacks
63496 * The callback should return 0 if successful, negative if not.
63497 */
63498 int (*remove_buf_file)(struct dentry *dentry);
63499-};
63500+} __no_const;
63501
63502 /*
63503 * CONFIG_RELAY kernel API, kernel/relay.c
63504diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
63505index c6c6084..5bf1212 100644
63506--- a/include/linux/rfkill.h
63507+++ b/include/linux/rfkill.h
63508@@ -147,6 +147,7 @@ struct rfkill_ops {
63509 void (*query)(struct rfkill *rfkill, void *data);
63510 int (*set_block)(void *data, bool blocked);
63511 };
63512+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
63513
63514 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
63515 /**
63516diff --git a/include/linux/rmap.h b/include/linux/rmap.h
63517index 2148b12..519b820 100644
63518--- a/include/linux/rmap.h
63519+++ b/include/linux/rmap.h
63520@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma)
63521 void anon_vma_init(void); /* create anon_vma_cachep */
63522 int anon_vma_prepare(struct vm_area_struct *);
63523 void unlink_anon_vmas(struct vm_area_struct *);
63524-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
63525-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
63526+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
63527+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
63528 void __anon_vma_link(struct vm_area_struct *);
63529
63530 static inline void anon_vma_merge(struct vm_area_struct *vma,
63531diff --git a/include/linux/sched.h b/include/linux/sched.h
63532index 41d0237..51dd96c 100644
63533--- a/include/linux/sched.h
63534+++ b/include/linux/sched.h
63535@@ -100,6 +100,7 @@ struct bio_list;
63536 struct fs_struct;
63537 struct perf_event_context;
63538 struct blk_plug;
63539+struct linux_binprm;
63540
63541 /*
63542 * List of flags we want to share for kernel threads,
63543@@ -380,10 +381,13 @@ struct user_namespace;
63544 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
63545
63546 extern int sysctl_max_map_count;
63547+extern unsigned long sysctl_heap_stack_gap;
63548
63549 #include <linux/aio.h>
63550
63551 #ifdef CONFIG_MMU
63552+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
63553+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
63554 extern void arch_pick_mmap_layout(struct mm_struct *mm);
63555 extern unsigned long
63556 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
63557@@ -629,6 +633,17 @@ struct signal_struct {
63558 #ifdef CONFIG_TASKSTATS
63559 struct taskstats *stats;
63560 #endif
63561+
63562+#ifdef CONFIG_GRKERNSEC
63563+ u32 curr_ip;
63564+ u32 saved_ip;
63565+ u32 gr_saddr;
63566+ u32 gr_daddr;
63567+ u16 gr_sport;
63568+ u16 gr_dport;
63569+ u8 used_accept:1;
63570+#endif
63571+
63572 #ifdef CONFIG_AUDIT
63573 unsigned audit_tty;
63574 struct tty_audit_buf *tty_audit_buf;
63575@@ -710,6 +725,11 @@ struct user_struct {
63576 struct key *session_keyring; /* UID's default session keyring */
63577 #endif
63578
63579+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
63580+ unsigned int banned;
63581+ unsigned long ban_expires;
63582+#endif
63583+
63584 /* Hash table maintenance information */
63585 struct hlist_node uidhash_node;
63586 uid_t uid;
63587@@ -1340,8 +1360,8 @@ struct task_struct {
63588 struct list_head thread_group;
63589
63590 struct completion *vfork_done; /* for vfork() */
63591- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
63592- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
63593+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
63594+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
63595
63596 cputime_t utime, stime, utimescaled, stimescaled;
63597 cputime_t gtime;
63598@@ -1357,13 +1377,6 @@ struct task_struct {
63599 struct task_cputime cputime_expires;
63600 struct list_head cpu_timers[3];
63601
63602-/* process credentials */
63603- const struct cred __rcu *real_cred; /* objective and real subjective task
63604- * credentials (COW) */
63605- const struct cred __rcu *cred; /* effective (overridable) subjective task
63606- * credentials (COW) */
63607- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
63608-
63609 char comm[TASK_COMM_LEN]; /* executable name excluding path
63610 - access with [gs]et_task_comm (which lock
63611 it with task_lock())
63612@@ -1380,8 +1393,16 @@ struct task_struct {
63613 #endif
63614 /* CPU-specific state of this task */
63615 struct thread_struct thread;
63616+/* thread_info moved to task_struct */
63617+#ifdef CONFIG_X86
63618+ struct thread_info tinfo;
63619+#endif
63620 /* filesystem information */
63621 struct fs_struct *fs;
63622+
63623+ const struct cred __rcu *cred; /* effective (overridable) subjective task
63624+ * credentials (COW) */
63625+
63626 /* open file information */
63627 struct files_struct *files;
63628 /* namespaces */
63629@@ -1428,6 +1449,11 @@ struct task_struct {
63630 struct rt_mutex_waiter *pi_blocked_on;
63631 #endif
63632
63633+/* process credentials */
63634+ const struct cred __rcu *real_cred; /* objective and real subjective task
63635+ * credentials (COW) */
63636+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
63637+
63638 #ifdef CONFIG_DEBUG_MUTEXES
63639 /* mutex deadlock detection */
63640 struct mutex_waiter *blocked_on;
63641@@ -1537,6 +1563,22 @@ struct task_struct {
63642 unsigned long default_timer_slack_ns;
63643
63644 struct list_head *scm_work_list;
63645+
63646+#ifdef CONFIG_GRKERNSEC
63647+ /* grsecurity */
63648+ const struct cred *delayed_cred;
63649+ struct dentry *gr_chroot_dentry;
63650+ struct acl_subject_label *acl;
63651+ struct acl_role_label *role;
63652+ struct file *exec_file;
63653+ u16 acl_role_id;
63654+ /* is this the task that authenticated to the special role */
63655+ u8 acl_sp_role;
63656+ u8 is_writable;
63657+ u8 brute;
63658+ u8 gr_is_chrooted;
63659+#endif
63660+
63661 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
63662 /* Index of current stored address in ret_stack */
63663 int curr_ret_stack;
63664@@ -1571,6 +1613,57 @@ struct task_struct {
63665 #endif
63666 };
63667
63668+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
63669+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
63670+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
63671+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
63672+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
63673+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
63674+
63675+#ifdef CONFIG_PAX_SOFTMODE
63676+extern int pax_softmode;
63677+#endif
63678+
63679+extern int pax_check_flags(unsigned long *);
63680+
63681+/* if tsk != current then task_lock must be held on it */
63682+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63683+static inline unsigned long pax_get_flags(struct task_struct *tsk)
63684+{
63685+ if (likely(tsk->mm))
63686+ return tsk->mm->pax_flags;
63687+ else
63688+ return 0UL;
63689+}
63690+
63691+/* if tsk != current then task_lock must be held on it */
63692+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
63693+{
63694+ if (likely(tsk->mm)) {
63695+ tsk->mm->pax_flags = flags;
63696+ return 0;
63697+ }
63698+ return -EINVAL;
63699+}
63700+#endif
63701+
63702+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
63703+extern void pax_set_initial_flags(struct linux_binprm *bprm);
63704+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
63705+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
63706+#endif
63707+
63708+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
63709+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
63710+extern void pax_report_refcount_overflow(struct pt_regs *regs);
63711+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
63712+
63713+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
63714+extern void pax_track_stack(void);
63715+#else
63716+static inline void pax_track_stack(void) {}
63717+#endif
63718+
63719 /* Future-safe accessor for struct task_struct's cpus_allowed. */
63720 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
63721
63722@@ -2074,7 +2167,9 @@ void yield(void);
63723 extern struct exec_domain default_exec_domain;
63724
63725 union thread_union {
63726+#ifndef CONFIG_X86
63727 struct thread_info thread_info;
63728+#endif
63729 unsigned long stack[THREAD_SIZE/sizeof(long)];
63730 };
63731
63732@@ -2107,6 +2202,7 @@ extern struct pid_namespace init_pid_ns;
63733 */
63734
63735 extern struct task_struct *find_task_by_vpid(pid_t nr);
63736+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
63737 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
63738 struct pid_namespace *ns);
63739
63740@@ -2243,7 +2339,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
63741 extern void exit_itimers(struct signal_struct *);
63742 extern void flush_itimer_signals(void);
63743
63744-extern NORET_TYPE void do_group_exit(int);
63745+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
63746
63747 extern void daemonize(const char *, ...);
63748 extern int allow_signal(int);
63749@@ -2408,13 +2504,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
63750
63751 #endif
63752
63753-static inline int object_is_on_stack(void *obj)
63754+static inline int object_starts_on_stack(void *obj)
63755 {
63756- void *stack = task_stack_page(current);
63757+ const void *stack = task_stack_page(current);
63758
63759 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
63760 }
63761
63762+#ifdef CONFIG_PAX_USERCOPY
63763+extern int object_is_on_stack(const void *obj, unsigned long len);
63764+#endif
63765+
63766 extern void thread_info_cache_init(void);
63767
63768 #ifdef CONFIG_DEBUG_STACK_USAGE
63769diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
63770index 899fbb4..1cb4138 100644
63771--- a/include/linux/screen_info.h
63772+++ b/include/linux/screen_info.h
63773@@ -43,7 +43,8 @@ struct screen_info {
63774 __u16 pages; /* 0x32 */
63775 __u16 vesa_attributes; /* 0x34 */
63776 __u32 capabilities; /* 0x36 */
63777- __u8 _reserved[6]; /* 0x3a */
63778+ __u16 vesapm_size; /* 0x3a */
63779+ __u8 _reserved[4]; /* 0x3c */
63780 } __attribute__((packed));
63781
63782 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
63783diff --git a/include/linux/security.h b/include/linux/security.h
63784index ebd2a53..2d949ae 100644
63785--- a/include/linux/security.h
63786+++ b/include/linux/security.h
63787@@ -36,6 +36,7 @@
63788 #include <linux/key.h>
63789 #include <linux/xfrm.h>
63790 #include <linux/slab.h>
63791+#include <linux/grsecurity.h>
63792 #include <net/flow.h>
63793
63794 /* Maximum number of letters for an LSM name string */
63795diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
63796index be720cd..a0e1b94 100644
63797--- a/include/linux/seq_file.h
63798+++ b/include/linux/seq_file.h
63799@@ -33,6 +33,7 @@ struct seq_operations {
63800 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
63801 int (*show) (struct seq_file *m, void *v);
63802 };
63803+typedef struct seq_operations __no_const seq_operations_no_const;
63804
63805 #define SEQ_SKIP 1
63806
63807diff --git a/include/linux/shm.h b/include/linux/shm.h
63808index 92808b8..c28cac4 100644
63809--- a/include/linux/shm.h
63810+++ b/include/linux/shm.h
63811@@ -98,6 +98,10 @@ struct shmid_kernel /* private to the kernel */
63812
63813 /* The task created the shm object. NULL if the task is dead. */
63814 struct task_struct *shm_creator;
63815+#ifdef CONFIG_GRKERNSEC
63816+ time_t shm_createtime;
63817+ pid_t shm_lapid;
63818+#endif
63819 };
63820
63821 /* shm_mode upper byte flags */
63822diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
63823index 0f96646..cfb757a 100644
63824--- a/include/linux/skbuff.h
63825+++ b/include/linux/skbuff.h
63826@@ -610,7 +610,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
63827 */
63828 static inline int skb_queue_empty(const struct sk_buff_head *list)
63829 {
63830- return list->next == (struct sk_buff *)list;
63831+ return list->next == (const struct sk_buff *)list;
63832 }
63833
63834 /**
63835@@ -623,7 +623,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
63836 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63837 const struct sk_buff *skb)
63838 {
63839- return skb->next == (struct sk_buff *)list;
63840+ return skb->next == (const struct sk_buff *)list;
63841 }
63842
63843 /**
63844@@ -636,7 +636,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63845 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
63846 const struct sk_buff *skb)
63847 {
63848- return skb->prev == (struct sk_buff *)list;
63849+ return skb->prev == (const struct sk_buff *)list;
63850 }
63851
63852 /**
63853@@ -1458,7 +1458,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
63854 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
63855 */
63856 #ifndef NET_SKB_PAD
63857-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
63858+#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
63859 #endif
63860
63861 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
63862diff --git a/include/linux/slab.h b/include/linux/slab.h
63863index 573c809..e84c132 100644
63864--- a/include/linux/slab.h
63865+++ b/include/linux/slab.h
63866@@ -11,12 +11,20 @@
63867
63868 #include <linux/gfp.h>
63869 #include <linux/types.h>
63870+#include <linux/err.h>
63871
63872 /*
63873 * Flags to pass to kmem_cache_create().
63874 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
63875 */
63876 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
63877+
63878+#ifdef CONFIG_PAX_USERCOPY
63879+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
63880+#else
63881+#define SLAB_USERCOPY 0x00000000UL
63882+#endif
63883+
63884 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
63885 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
63886 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
63887@@ -87,10 +95,13 @@
63888 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
63889 * Both make kfree a no-op.
63890 */
63891-#define ZERO_SIZE_PTR ((void *)16)
63892+#define ZERO_SIZE_PTR \
63893+({ \
63894+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
63895+ (void *)(-MAX_ERRNO-1L); \
63896+})
63897
63898-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
63899- (unsigned long)ZERO_SIZE_PTR)
63900+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
63901
63902 /*
63903 * struct kmem_cache related prototypes
63904@@ -161,6 +172,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
63905 void kfree(const void *);
63906 void kzfree(const void *);
63907 size_t ksize(const void *);
63908+void check_object_size(const void *ptr, unsigned long n, bool to);
63909
63910 /*
63911 * Allocator specific definitions. These are mainly used to establish optimized
63912@@ -353,4 +365,59 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
63913
63914 void __init kmem_cache_init_late(void);
63915
63916+#define kmalloc(x, y) \
63917+({ \
63918+ void *___retval; \
63919+ intoverflow_t ___x = (intoverflow_t)x; \
63920+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
63921+ ___retval = NULL; \
63922+ else \
63923+ ___retval = kmalloc((size_t)___x, (y)); \
63924+ ___retval; \
63925+})
63926+
63927+#define kmalloc_node(x, y, z) \
63928+({ \
63929+ void *___retval; \
63930+ intoverflow_t ___x = (intoverflow_t)x; \
63931+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
63932+ ___retval = NULL; \
63933+ else \
63934+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
63935+ ___retval; \
63936+})
63937+
63938+#define kzalloc(x, y) \
63939+({ \
63940+ void *___retval; \
63941+ intoverflow_t ___x = (intoverflow_t)x; \
63942+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
63943+ ___retval = NULL; \
63944+ else \
63945+ ___retval = kzalloc((size_t)___x, (y)); \
63946+ ___retval; \
63947+})
63948+
63949+#define __krealloc(x, y, z) \
63950+({ \
63951+ void *___retval; \
63952+ intoverflow_t ___y = (intoverflow_t)y; \
63953+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
63954+ ___retval = NULL; \
63955+ else \
63956+ ___retval = __krealloc((x), (size_t)___y, (z)); \
63957+ ___retval; \
63958+})
63959+
63960+#define krealloc(x, y, z) \
63961+({ \
63962+ void *___retval; \
63963+ intoverflow_t ___y = (intoverflow_t)y; \
63964+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
63965+ ___retval = NULL; \
63966+ else \
63967+ ___retval = krealloc((x), (size_t)___y, (z)); \
63968+ ___retval; \
63969+})
63970+
63971 #endif /* _LINUX_SLAB_H */
63972diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
63973index d00e0ba..1b3bf7b 100644
63974--- a/include/linux/slab_def.h
63975+++ b/include/linux/slab_def.h
63976@@ -68,10 +68,10 @@ struct kmem_cache {
63977 unsigned long node_allocs;
63978 unsigned long node_frees;
63979 unsigned long node_overflow;
63980- atomic_t allochit;
63981- atomic_t allocmiss;
63982- atomic_t freehit;
63983- atomic_t freemiss;
63984+ atomic_unchecked_t allochit;
63985+ atomic_unchecked_t allocmiss;
63986+ atomic_unchecked_t freehit;
63987+ atomic_unchecked_t freemiss;
63988
63989 /*
63990 * If debugging is enabled, then the allocator can add additional
63991diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
63992index f58d641..c56bf9c 100644
63993--- a/include/linux/slub_def.h
63994+++ b/include/linux/slub_def.h
63995@@ -85,7 +85,7 @@ struct kmem_cache {
63996 struct kmem_cache_order_objects max;
63997 struct kmem_cache_order_objects min;
63998 gfp_t allocflags; /* gfp flags to use on each alloc */
63999- int refcount; /* Refcount for slab cache destroy */
64000+ atomic_t refcount; /* Refcount for slab cache destroy */
64001 void (*ctor)(void *);
64002 int inuse; /* Offset to metadata */
64003 int align; /* Alignment */
64004@@ -211,7 +211,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
64005 }
64006
64007 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
64008-void *__kmalloc(size_t size, gfp_t flags);
64009+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
64010
64011 static __always_inline void *
64012 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
64013diff --git a/include/linux/sonet.h b/include/linux/sonet.h
64014index de8832d..0147b46 100644
64015--- a/include/linux/sonet.h
64016+++ b/include/linux/sonet.h
64017@@ -61,7 +61,7 @@ struct sonet_stats {
64018 #include <linux/atomic.h>
64019
64020 struct k_sonet_stats {
64021-#define __HANDLE_ITEM(i) atomic_t i
64022+#define __HANDLE_ITEM(i) atomic_unchecked_t i
64023 __SONET_ITEMS
64024 #undef __HANDLE_ITEM
64025 };
64026diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
64027index db7bcaf..1aca77e 100644
64028--- a/include/linux/sunrpc/clnt.h
64029+++ b/include/linux/sunrpc/clnt.h
64030@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
64031 {
64032 switch (sap->sa_family) {
64033 case AF_INET:
64034- return ntohs(((struct sockaddr_in *)sap)->sin_port);
64035+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
64036 case AF_INET6:
64037- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
64038+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
64039 }
64040 return 0;
64041 }
64042@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
64043 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
64044 const struct sockaddr *src)
64045 {
64046- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
64047+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
64048 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
64049
64050 dsin->sin_family = ssin->sin_family;
64051@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
64052 if (sa->sa_family != AF_INET6)
64053 return 0;
64054
64055- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
64056+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
64057 }
64058
64059 #endif /* __KERNEL__ */
64060diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
64061index e775689..9e206d9 100644
64062--- a/include/linux/sunrpc/sched.h
64063+++ b/include/linux/sunrpc/sched.h
64064@@ -105,6 +105,7 @@ struct rpc_call_ops {
64065 void (*rpc_call_done)(struct rpc_task *, void *);
64066 void (*rpc_release)(void *);
64067 };
64068+typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
64069
64070 struct rpc_task_setup {
64071 struct rpc_task *task;
64072diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
64073index c14fe86..393245e 100644
64074--- a/include/linux/sunrpc/svc_rdma.h
64075+++ b/include/linux/sunrpc/svc_rdma.h
64076@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
64077 extern unsigned int svcrdma_max_requests;
64078 extern unsigned int svcrdma_max_req_size;
64079
64080-extern atomic_t rdma_stat_recv;
64081-extern atomic_t rdma_stat_read;
64082-extern atomic_t rdma_stat_write;
64083-extern atomic_t rdma_stat_sq_starve;
64084-extern atomic_t rdma_stat_rq_starve;
64085-extern atomic_t rdma_stat_rq_poll;
64086-extern atomic_t rdma_stat_rq_prod;
64087-extern atomic_t rdma_stat_sq_poll;
64088-extern atomic_t rdma_stat_sq_prod;
64089+extern atomic_unchecked_t rdma_stat_recv;
64090+extern atomic_unchecked_t rdma_stat_read;
64091+extern atomic_unchecked_t rdma_stat_write;
64092+extern atomic_unchecked_t rdma_stat_sq_starve;
64093+extern atomic_unchecked_t rdma_stat_rq_starve;
64094+extern atomic_unchecked_t rdma_stat_rq_poll;
64095+extern atomic_unchecked_t rdma_stat_rq_prod;
64096+extern atomic_unchecked_t rdma_stat_sq_poll;
64097+extern atomic_unchecked_t rdma_stat_sq_prod;
64098
64099 #define RPCRDMA_VERSION 1
64100
64101diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
64102index 11684d9..0d245eb 100644
64103--- a/include/linux/sysctl.h
64104+++ b/include/linux/sysctl.h
64105@@ -155,7 +155,11 @@ enum
64106 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
64107 };
64108
64109-
64110+#ifdef CONFIG_PAX_SOFTMODE
64111+enum {
64112+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
64113+};
64114+#endif
64115
64116 /* CTL_VM names: */
64117 enum
64118@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
64119
64120 extern int proc_dostring(struct ctl_table *, int,
64121 void __user *, size_t *, loff_t *);
64122+extern int proc_dostring_modpriv(struct ctl_table *, int,
64123+ void __user *, size_t *, loff_t *);
64124 extern int proc_dointvec(struct ctl_table *, int,
64125 void __user *, size_t *, loff_t *);
64126 extern int proc_dointvec_minmax(struct ctl_table *, int,
64127diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
64128index ff7dc08..893e1bd 100644
64129--- a/include/linux/tty_ldisc.h
64130+++ b/include/linux/tty_ldisc.h
64131@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
64132
64133 struct module *owner;
64134
64135- int refcount;
64136+ atomic_t refcount;
64137 };
64138
64139 struct tty_ldisc {
64140diff --git a/include/linux/types.h b/include/linux/types.h
64141index 176da8c..e45e473 100644
64142--- a/include/linux/types.h
64143+++ b/include/linux/types.h
64144@@ -213,10 +213,26 @@ typedef struct {
64145 int counter;
64146 } atomic_t;
64147
64148+#ifdef CONFIG_PAX_REFCOUNT
64149+typedef struct {
64150+ int counter;
64151+} atomic_unchecked_t;
64152+#else
64153+typedef atomic_t atomic_unchecked_t;
64154+#endif
64155+
64156 #ifdef CONFIG_64BIT
64157 typedef struct {
64158 long counter;
64159 } atomic64_t;
64160+
64161+#ifdef CONFIG_PAX_REFCOUNT
64162+typedef struct {
64163+ long counter;
64164+} atomic64_unchecked_t;
64165+#else
64166+typedef atomic64_t atomic64_unchecked_t;
64167+#endif
64168 #endif
64169
64170 struct list_head {
64171diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
64172index 5ca0951..ab496a5 100644
64173--- a/include/linux/uaccess.h
64174+++ b/include/linux/uaccess.h
64175@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
64176 long ret; \
64177 mm_segment_t old_fs = get_fs(); \
64178 \
64179- set_fs(KERNEL_DS); \
64180 pagefault_disable(); \
64181- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
64182- pagefault_enable(); \
64183+ set_fs(KERNEL_DS); \
64184+ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
64185 set_fs(old_fs); \
64186+ pagefault_enable(); \
64187 ret; \
64188 })
64189
64190diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
64191index 99c1b4d..bb94261 100644
64192--- a/include/linux/unaligned/access_ok.h
64193+++ b/include/linux/unaligned/access_ok.h
64194@@ -6,32 +6,32 @@
64195
64196 static inline u16 get_unaligned_le16(const void *p)
64197 {
64198- return le16_to_cpup((__le16 *)p);
64199+ return le16_to_cpup((const __le16 *)p);
64200 }
64201
64202 static inline u32 get_unaligned_le32(const void *p)
64203 {
64204- return le32_to_cpup((__le32 *)p);
64205+ return le32_to_cpup((const __le32 *)p);
64206 }
64207
64208 static inline u64 get_unaligned_le64(const void *p)
64209 {
64210- return le64_to_cpup((__le64 *)p);
64211+ return le64_to_cpup((const __le64 *)p);
64212 }
64213
64214 static inline u16 get_unaligned_be16(const void *p)
64215 {
64216- return be16_to_cpup((__be16 *)p);
64217+ return be16_to_cpup((const __be16 *)p);
64218 }
64219
64220 static inline u32 get_unaligned_be32(const void *p)
64221 {
64222- return be32_to_cpup((__be32 *)p);
64223+ return be32_to_cpup((const __be32 *)p);
64224 }
64225
64226 static inline u64 get_unaligned_be64(const void *p)
64227 {
64228- return be64_to_cpup((__be64 *)p);
64229+ return be64_to_cpup((const __be64 *)p);
64230 }
64231
64232 static inline void put_unaligned_le16(u16 val, void *p)
64233diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
64234index cf97b5b..40ebc87 100644
64235--- a/include/linux/vermagic.h
64236+++ b/include/linux/vermagic.h
64237@@ -26,9 +26,35 @@
64238 #define MODULE_ARCH_VERMAGIC ""
64239 #endif
64240
64241+#ifdef CONFIG_PAX_REFCOUNT
64242+#define MODULE_PAX_REFCOUNT "REFCOUNT "
64243+#else
64244+#define MODULE_PAX_REFCOUNT ""
64245+#endif
64246+
64247+#ifdef CONSTIFY_PLUGIN
64248+#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
64249+#else
64250+#define MODULE_CONSTIFY_PLUGIN ""
64251+#endif
64252+
64253+#ifdef STACKLEAK_PLUGIN
64254+#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
64255+#else
64256+#define MODULE_STACKLEAK_PLUGIN ""
64257+#endif
64258+
64259+#ifdef CONFIG_GRKERNSEC
64260+#define MODULE_GRSEC "GRSEC "
64261+#else
64262+#define MODULE_GRSEC ""
64263+#endif
64264+
64265 #define VERMAGIC_STRING \
64266 UTS_RELEASE " " \
64267 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
64268 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
64269- MODULE_ARCH_VERMAGIC
64270+ MODULE_ARCH_VERMAGIC \
64271+ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
64272+ MODULE_GRSEC
64273
64274diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
64275index 687fb11..b342358 100644
64276--- a/include/linux/vmalloc.h
64277+++ b/include/linux/vmalloc.h
64278@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
64279 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
64280 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
64281 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
64282+
64283+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
64284+#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
64285+#endif
64286+
64287 /* bits [20..32] reserved for arch specific ioremap internals */
64288
64289 /*
64290@@ -156,4 +161,103 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
64291 # endif
64292 #endif
64293
64294+#define vmalloc(x) \
64295+({ \
64296+ void *___retval; \
64297+ intoverflow_t ___x = (intoverflow_t)x; \
64298+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
64299+ ___retval = NULL; \
64300+ else \
64301+ ___retval = vmalloc((unsigned long)___x); \
64302+ ___retval; \
64303+})
64304+
64305+#define vzalloc(x) \
64306+({ \
64307+ void *___retval; \
64308+ intoverflow_t ___x = (intoverflow_t)x; \
64309+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
64310+ ___retval = NULL; \
64311+ else \
64312+ ___retval = vzalloc((unsigned long)___x); \
64313+ ___retval; \
64314+})
64315+
64316+#define __vmalloc(x, y, z) \
64317+({ \
64318+ void *___retval; \
64319+ intoverflow_t ___x = (intoverflow_t)x; \
64320+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
64321+ ___retval = NULL; \
64322+ else \
64323+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
64324+ ___retval; \
64325+})
64326+
64327+#define vmalloc_user(x) \
64328+({ \
64329+ void *___retval; \
64330+ intoverflow_t ___x = (intoverflow_t)x; \
64331+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
64332+ ___retval = NULL; \
64333+ else \
64334+ ___retval = vmalloc_user((unsigned long)___x); \
64335+ ___retval; \
64336+})
64337+
64338+#define vmalloc_exec(x) \
64339+({ \
64340+ void *___retval; \
64341+ intoverflow_t ___x = (intoverflow_t)x; \
64342+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
64343+ ___retval = NULL; \
64344+ else \
64345+ ___retval = vmalloc_exec((unsigned long)___x); \
64346+ ___retval; \
64347+})
64348+
64349+#define vmalloc_node(x, y) \
64350+({ \
64351+ void *___retval; \
64352+ intoverflow_t ___x = (intoverflow_t)x; \
64353+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
64354+ ___retval = NULL; \
64355+ else \
64356+ ___retval = vmalloc_node((unsigned long)___x, (y));\
64357+ ___retval; \
64358+})
64359+
64360+#define vzalloc_node(x, y) \
64361+({ \
64362+ void *___retval; \
64363+ intoverflow_t ___x = (intoverflow_t)x; \
64364+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
64365+ ___retval = NULL; \
64366+ else \
64367+ ___retval = vzalloc_node((unsigned long)___x, (y));\
64368+ ___retval; \
64369+})
64370+
64371+#define vmalloc_32(x) \
64372+({ \
64373+ void *___retval; \
64374+ intoverflow_t ___x = (intoverflow_t)x; \
64375+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
64376+ ___retval = NULL; \
64377+ else \
64378+ ___retval = vmalloc_32((unsigned long)___x); \
64379+ ___retval; \
64380+})
64381+
64382+#define vmalloc_32_user(x) \
64383+({ \
64384+void *___retval; \
64385+ intoverflow_t ___x = (intoverflow_t)x; \
64386+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
64387+ ___retval = NULL; \
64388+ else \
64389+ ___retval = vmalloc_32_user((unsigned long)___x);\
64390+ ___retval; \
64391+})
64392+
64393 #endif /* _LINUX_VMALLOC_H */
64394diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
64395index 65efb92..137adbb 100644
64396--- a/include/linux/vmstat.h
64397+++ b/include/linux/vmstat.h
64398@@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(int cpu)
64399 /*
64400 * Zone based page accounting with per cpu differentials.
64401 */
64402-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64403+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64404
64405 static inline void zone_page_state_add(long x, struct zone *zone,
64406 enum zone_stat_item item)
64407 {
64408- atomic_long_add(x, &zone->vm_stat[item]);
64409- atomic_long_add(x, &vm_stat[item]);
64410+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
64411+ atomic_long_add_unchecked(x, &vm_stat[item]);
64412 }
64413
64414 static inline unsigned long global_page_state(enum zone_stat_item item)
64415 {
64416- long x = atomic_long_read(&vm_stat[item]);
64417+ long x = atomic_long_read_unchecked(&vm_stat[item]);
64418 #ifdef CONFIG_SMP
64419 if (x < 0)
64420 x = 0;
64421@@ -109,7 +109,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
64422 static inline unsigned long zone_page_state(struct zone *zone,
64423 enum zone_stat_item item)
64424 {
64425- long x = atomic_long_read(&zone->vm_stat[item]);
64426+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
64427 #ifdef CONFIG_SMP
64428 if (x < 0)
64429 x = 0;
64430@@ -126,7 +126,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
64431 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
64432 enum zone_stat_item item)
64433 {
64434- long x = atomic_long_read(&zone->vm_stat[item]);
64435+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
64436
64437 #ifdef CONFIG_SMP
64438 int cpu;
64439@@ -221,8 +221,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
64440
64441 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
64442 {
64443- atomic_long_inc(&zone->vm_stat[item]);
64444- atomic_long_inc(&vm_stat[item]);
64445+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
64446+ atomic_long_inc_unchecked(&vm_stat[item]);
64447 }
64448
64449 static inline void __inc_zone_page_state(struct page *page,
64450@@ -233,8 +233,8 @@ static inline void __inc_zone_page_state(struct page *page,
64451
64452 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
64453 {
64454- atomic_long_dec(&zone->vm_stat[item]);
64455- atomic_long_dec(&vm_stat[item]);
64456+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
64457+ atomic_long_dec_unchecked(&vm_stat[item]);
64458 }
64459
64460 static inline void __dec_zone_page_state(struct page *page,
64461diff --git a/include/linux/xattr.h b/include/linux/xattr.h
64462index aed54c5..3e07f7a 100644
64463--- a/include/linux/xattr.h
64464+++ b/include/linux/xattr.h
64465@@ -49,6 +49,11 @@
64466 #define XATTR_CAPS_SUFFIX "capability"
64467 #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
64468
64469+/* User namespace */
64470+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
64471+#define XATTR_PAX_FLAGS_SUFFIX "flags"
64472+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
64473+
64474 #ifdef __KERNEL__
64475
64476 #include <linux/types.h>
64477diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
64478index 4aeff96..b378cdc 100644
64479--- a/include/media/saa7146_vv.h
64480+++ b/include/media/saa7146_vv.h
64481@@ -163,7 +163,7 @@ struct saa7146_ext_vv
64482 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
64483
64484 /* the extension can override this */
64485- struct v4l2_ioctl_ops ops;
64486+ v4l2_ioctl_ops_no_const ops;
64487 /* pointer to the saa7146 core ops */
64488 const struct v4l2_ioctl_ops *core_ops;
64489
64490diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
64491index c7c40f1..4f01585 100644
64492--- a/include/media/v4l2-dev.h
64493+++ b/include/media/v4l2-dev.h
64494@@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local);
64495
64496
64497 struct v4l2_file_operations {
64498- struct module *owner;
64499+ struct module * const owner;
64500 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
64501 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
64502 unsigned int (*poll) (struct file *, struct poll_table_struct *);
64503@@ -68,6 +68,7 @@ struct v4l2_file_operations {
64504 int (*open) (struct file *);
64505 int (*release) (struct file *);
64506 };
64507+typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
64508
64509 /*
64510 * Newer version of video_device, handled by videodev2.c
64511diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
64512index dd9f1e7..8c4dd86 100644
64513--- a/include/media/v4l2-ioctl.h
64514+++ b/include/media/v4l2-ioctl.h
64515@@ -272,7 +272,7 @@ struct v4l2_ioctl_ops {
64516 long (*vidioc_default) (struct file *file, void *fh,
64517 bool valid_prio, int cmd, void *arg);
64518 };
64519-
64520+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
64521
64522 /* v4l debugging and diagnostics */
64523
64524diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
64525index c5dedd8..a93b07b 100644
64526--- a/include/net/caif/caif_hsi.h
64527+++ b/include/net/caif/caif_hsi.h
64528@@ -94,7 +94,7 @@ struct cfhsi_drv {
64529 void (*rx_done_cb) (struct cfhsi_drv *drv);
64530 void (*wake_up_cb) (struct cfhsi_drv *drv);
64531 void (*wake_down_cb) (struct cfhsi_drv *drv);
64532-};
64533+} __no_const;
64534
64535 /* Structure implemented by HSI device. */
64536 struct cfhsi_dev {
64537diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
64538index 9e5425b..8136ffc 100644
64539--- a/include/net/caif/cfctrl.h
64540+++ b/include/net/caif/cfctrl.h
64541@@ -52,7 +52,7 @@ struct cfctrl_rsp {
64542 void (*radioset_rsp)(void);
64543 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
64544 struct cflayer *client_layer);
64545-};
64546+} __no_const;
64547
64548 /* Link Setup Parameters for CAIF-Links. */
64549 struct cfctrl_link_param {
64550@@ -101,8 +101,8 @@ struct cfctrl_request_info {
64551 struct cfctrl {
64552 struct cfsrvl serv;
64553 struct cfctrl_rsp res;
64554- atomic_t req_seq_no;
64555- atomic_t rsp_seq_no;
64556+ atomic_unchecked_t req_seq_no;
64557+ atomic_unchecked_t rsp_seq_no;
64558 struct list_head list;
64559 /* Protects from simultaneous access to first_req list */
64560 spinlock_t info_list_lock;
64561diff --git a/include/net/flow.h b/include/net/flow.h
64562index 57f15a7..0de26c6 100644
64563--- a/include/net/flow.h
64564+++ b/include/net/flow.h
64565@@ -208,6 +208,6 @@ extern struct flow_cache_object *flow_cache_lookup(
64566
64567 extern void flow_cache_flush(void);
64568 extern void flow_cache_flush_deferred(void);
64569-extern atomic_t flow_cache_genid;
64570+extern atomic_unchecked_t flow_cache_genid;
64571
64572 #endif
64573diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
64574index e9ff3fc..9d3e5c7 100644
64575--- a/include/net/inetpeer.h
64576+++ b/include/net/inetpeer.h
64577@@ -48,8 +48,8 @@ struct inet_peer {
64578 */
64579 union {
64580 struct {
64581- atomic_t rid; /* Frag reception counter */
64582- atomic_t ip_id_count; /* IP ID for the next packet */
64583+ atomic_unchecked_t rid; /* Frag reception counter */
64584+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
64585 __u32 tcp_ts;
64586 __u32 tcp_ts_stamp;
64587 };
64588@@ -113,11 +113,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
64589 more++;
64590 inet_peer_refcheck(p);
64591 do {
64592- old = atomic_read(&p->ip_id_count);
64593+ old = atomic_read_unchecked(&p->ip_id_count);
64594 new = old + more;
64595 if (!new)
64596 new = 1;
64597- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
64598+ } while (atomic_cmpxchg_unchecked(&p->ip_id_count, old, new) != old);
64599 return new;
64600 }
64601
64602diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
64603index 10422ef..662570f 100644
64604--- a/include/net/ip_fib.h
64605+++ b/include/net/ip_fib.h
64606@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
64607
64608 #define FIB_RES_SADDR(net, res) \
64609 ((FIB_RES_NH(res).nh_saddr_genid == \
64610- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
64611+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
64612 FIB_RES_NH(res).nh_saddr : \
64613 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
64614 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
64615diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
64616index 8fa4430..05dd772 100644
64617--- a/include/net/ip_vs.h
64618+++ b/include/net/ip_vs.h
64619@@ -509,7 +509,7 @@ struct ip_vs_conn {
64620 struct ip_vs_conn *control; /* Master control connection */
64621 atomic_t n_control; /* Number of controlled ones */
64622 struct ip_vs_dest *dest; /* real server */
64623- atomic_t in_pkts; /* incoming packet counter */
64624+ atomic_unchecked_t in_pkts; /* incoming packet counter */
64625
64626 /* packet transmitter for different forwarding methods. If it
64627 mangles the packet, it must return NF_DROP or better NF_STOLEN,
64628@@ -647,7 +647,7 @@ struct ip_vs_dest {
64629 __be16 port; /* port number of the server */
64630 union nf_inet_addr addr; /* IP address of the server */
64631 volatile unsigned flags; /* dest status flags */
64632- atomic_t conn_flags; /* flags to copy to conn */
64633+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
64634 atomic_t weight; /* server weight */
64635
64636 atomic_t refcnt; /* reference counter */
64637diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
64638index 69b610a..fe3962c 100644
64639--- a/include/net/irda/ircomm_core.h
64640+++ b/include/net/irda/ircomm_core.h
64641@@ -51,7 +51,7 @@ typedef struct {
64642 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
64643 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
64644 struct ircomm_info *);
64645-} call_t;
64646+} __no_const call_t;
64647
64648 struct ircomm_cb {
64649 irda_queue_t queue;
64650diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
64651index 59ba38bc..d515662 100644
64652--- a/include/net/irda/ircomm_tty.h
64653+++ b/include/net/irda/ircomm_tty.h
64654@@ -35,6 +35,7 @@
64655 #include <linux/termios.h>
64656 #include <linux/timer.h>
64657 #include <linux/tty.h> /* struct tty_struct */
64658+#include <asm/local.h>
64659
64660 #include <net/irda/irias_object.h>
64661 #include <net/irda/ircomm_core.h>
64662@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
64663 unsigned short close_delay;
64664 unsigned short closing_wait; /* time to wait before closing */
64665
64666- int open_count;
64667- int blocked_open; /* # of blocked opens */
64668+ local_t open_count;
64669+ local_t blocked_open; /* # of blocked opens */
64670
64671 /* Protect concurent access to :
64672 * o self->open_count
64673diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
64674index f82a1e8..82d81e8 100644
64675--- a/include/net/iucv/af_iucv.h
64676+++ b/include/net/iucv/af_iucv.h
64677@@ -87,7 +87,7 @@ struct iucv_sock {
64678 struct iucv_sock_list {
64679 struct hlist_head head;
64680 rwlock_t lock;
64681- atomic_t autobind_name;
64682+ atomic_unchecked_t autobind_name;
64683 };
64684
64685 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
64686diff --git a/include/net/lapb.h b/include/net/lapb.h
64687index 96cb5dd..25e8d4f 100644
64688--- a/include/net/lapb.h
64689+++ b/include/net/lapb.h
64690@@ -95,7 +95,7 @@ struct lapb_cb {
64691 struct sk_buff_head write_queue;
64692 struct sk_buff_head ack_queue;
64693 unsigned char window;
64694- struct lapb_register_struct callbacks;
64695+ struct lapb_register_struct *callbacks;
64696
64697 /* FRMR control information */
64698 struct lapb_frame frmr_data;
64699diff --git a/include/net/neighbour.h b/include/net/neighbour.h
64700index 2720884..3aa5c25 100644
64701--- a/include/net/neighbour.h
64702+++ b/include/net/neighbour.h
64703@@ -122,7 +122,7 @@ struct neigh_ops {
64704 void (*error_report)(struct neighbour *, struct sk_buff *);
64705 int (*output)(struct neighbour *, struct sk_buff *);
64706 int (*connected_output)(struct neighbour *, struct sk_buff *);
64707-};
64708+} __do_const;
64709
64710 struct pneigh_entry {
64711 struct pneigh_entry *next;
64712diff --git a/include/net/netlink.h b/include/net/netlink.h
64713index 98c1854..d4add7b 100644
64714--- a/include/net/netlink.h
64715+++ b/include/net/netlink.h
64716@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
64717 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
64718 {
64719 if (mark)
64720- skb_trim(skb, (unsigned char *) mark - skb->data);
64721+ skb_trim(skb, (const unsigned char *) mark - skb->data);
64722 }
64723
64724 /**
64725diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
64726index d786b4f..4c3dd41 100644
64727--- a/include/net/netns/ipv4.h
64728+++ b/include/net/netns/ipv4.h
64729@@ -56,8 +56,8 @@ struct netns_ipv4 {
64730
64731 unsigned int sysctl_ping_group_range[2];
64732
64733- atomic_t rt_genid;
64734- atomic_t dev_addr_genid;
64735+ atomic_unchecked_t rt_genid;
64736+ atomic_unchecked_t dev_addr_genid;
64737
64738 #ifdef CONFIG_IP_MROUTE
64739 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
64740diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
64741index 6a72a58..e6a127d 100644
64742--- a/include/net/sctp/sctp.h
64743+++ b/include/net/sctp/sctp.h
64744@@ -318,9 +318,9 @@ do { \
64745
64746 #else /* SCTP_DEBUG */
64747
64748-#define SCTP_DEBUG_PRINTK(whatever...)
64749-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
64750-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
64751+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
64752+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
64753+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
64754 #define SCTP_ENABLE_DEBUG
64755 #define SCTP_DISABLE_DEBUG
64756 #define SCTP_ASSERT(expr, str, func)
64757diff --git a/include/net/sock.h b/include/net/sock.h
64758index 8e4062f..77b041e 100644
64759--- a/include/net/sock.h
64760+++ b/include/net/sock.h
64761@@ -278,7 +278,7 @@ struct sock {
64762 #ifdef CONFIG_RPS
64763 __u32 sk_rxhash;
64764 #endif
64765- atomic_t sk_drops;
64766+ atomic_unchecked_t sk_drops;
64767 int sk_rcvbuf;
64768
64769 struct sk_filter __rcu *sk_filter;
64770@@ -1391,7 +1391,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
64771 }
64772
64773 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
64774- char __user *from, char *to,
64775+ char __user *from, unsigned char *to,
64776 int copy, int offset)
64777 {
64778 if (skb->ip_summed == CHECKSUM_NONE) {
64779diff --git a/include/net/tcp.h b/include/net/tcp.h
64780index acc620a..f4d99c6 100644
64781--- a/include/net/tcp.h
64782+++ b/include/net/tcp.h
64783@@ -1401,8 +1401,8 @@ enum tcp_seq_states {
64784 struct tcp_seq_afinfo {
64785 char *name;
64786 sa_family_t family;
64787- struct file_operations seq_fops;
64788- struct seq_operations seq_ops;
64789+ file_operations_no_const seq_fops;
64790+ seq_operations_no_const seq_ops;
64791 };
64792
64793 struct tcp_iter_state {
64794diff --git a/include/net/udp.h b/include/net/udp.h
64795index 67ea6fc..e42aee8 100644
64796--- a/include/net/udp.h
64797+++ b/include/net/udp.h
64798@@ -234,8 +234,8 @@ struct udp_seq_afinfo {
64799 char *name;
64800 sa_family_t family;
64801 struct udp_table *udp_table;
64802- struct file_operations seq_fops;
64803- struct seq_operations seq_ops;
64804+ file_operations_no_const seq_fops;
64805+ seq_operations_no_const seq_ops;
64806 };
64807
64808 struct udp_iter_state {
64809diff --git a/include/net/xfrm.h b/include/net/xfrm.h
64810index b203e14..1df3991 100644
64811--- a/include/net/xfrm.h
64812+++ b/include/net/xfrm.h
64813@@ -505,7 +505,7 @@ struct xfrm_policy {
64814 struct timer_list timer;
64815
64816 struct flow_cache_object flo;
64817- atomic_t genid;
64818+ atomic_unchecked_t genid;
64819 u32 priority;
64820 u32 index;
64821 struct xfrm_mark mark;
64822diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
64823index 2d0191c..a55797d 100644
64824--- a/include/rdma/iw_cm.h
64825+++ b/include/rdma/iw_cm.h
64826@@ -120,7 +120,7 @@ struct iw_cm_verbs {
64827 int backlog);
64828
64829 int (*destroy_listen)(struct iw_cm_id *cm_id);
64830-};
64831+} __no_const;
64832
64833 /**
64834 * iw_create_cm_id - Create an IW CM identifier.
64835diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
64836index 7d96829..4ba78d3 100644
64837--- a/include/scsi/libfc.h
64838+++ b/include/scsi/libfc.h
64839@@ -758,6 +758,7 @@ struct libfc_function_template {
64840 */
64841 void (*disc_stop_final) (struct fc_lport *);
64842 };
64843+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
64844
64845 /**
64846 * struct fc_disc - Discovery context
64847@@ -861,7 +862,7 @@ struct fc_lport {
64848 struct fc_vport *vport;
64849
64850 /* Operational Information */
64851- struct libfc_function_template tt;
64852+ libfc_function_template_no_const tt;
64853 u8 link_up;
64854 u8 qfull;
64855 enum fc_lport_state state;
64856diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
64857index d371c3c..e228a8c 100644
64858--- a/include/scsi/scsi_device.h
64859+++ b/include/scsi/scsi_device.h
64860@@ -161,9 +161,9 @@ struct scsi_device {
64861 unsigned int max_device_blocked; /* what device_blocked counts down from */
64862 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
64863
64864- atomic_t iorequest_cnt;
64865- atomic_t iodone_cnt;
64866- atomic_t ioerr_cnt;
64867+ atomic_unchecked_t iorequest_cnt;
64868+ atomic_unchecked_t iodone_cnt;
64869+ atomic_unchecked_t ioerr_cnt;
64870
64871 struct device sdev_gendev,
64872 sdev_dev;
64873diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
64874index 2a65167..91e01f8 100644
64875--- a/include/scsi/scsi_transport_fc.h
64876+++ b/include/scsi/scsi_transport_fc.h
64877@@ -711,7 +711,7 @@ struct fc_function_template {
64878 unsigned long show_host_system_hostname:1;
64879
64880 unsigned long disable_target_scan:1;
64881-};
64882+} __do_const;
64883
64884
64885 /**
64886diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
64887index 030b87c..98a6954 100644
64888--- a/include/sound/ak4xxx-adda.h
64889+++ b/include/sound/ak4xxx-adda.h
64890@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
64891 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
64892 unsigned char val);
64893 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
64894-};
64895+} __no_const;
64896
64897 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
64898
64899diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
64900index 8c05e47..2b5df97 100644
64901--- a/include/sound/hwdep.h
64902+++ b/include/sound/hwdep.h
64903@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
64904 struct snd_hwdep_dsp_status *status);
64905 int (*dsp_load)(struct snd_hwdep *hw,
64906 struct snd_hwdep_dsp_image *image);
64907-};
64908+} __no_const;
64909
64910 struct snd_hwdep {
64911 struct snd_card *card;
64912diff --git a/include/sound/info.h b/include/sound/info.h
64913index 4e94cf1..76748b1 100644
64914--- a/include/sound/info.h
64915+++ b/include/sound/info.h
64916@@ -44,7 +44,7 @@ struct snd_info_entry_text {
64917 struct snd_info_buffer *buffer);
64918 void (*write)(struct snd_info_entry *entry,
64919 struct snd_info_buffer *buffer);
64920-};
64921+} __no_const;
64922
64923 struct snd_info_entry_ops {
64924 int (*open)(struct snd_info_entry *entry,
64925diff --git a/include/sound/pcm.h b/include/sound/pcm.h
64926index 57e71fa..a2c7534 100644
64927--- a/include/sound/pcm.h
64928+++ b/include/sound/pcm.h
64929@@ -81,6 +81,7 @@ struct snd_pcm_ops {
64930 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
64931 int (*ack)(struct snd_pcm_substream *substream);
64932 };
64933+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
64934
64935 /*
64936 *
64937diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
64938index af1b49e..a5d55a5 100644
64939--- a/include/sound/sb16_csp.h
64940+++ b/include/sound/sb16_csp.h
64941@@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
64942 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
64943 int (*csp_stop) (struct snd_sb_csp * p);
64944 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
64945-};
64946+} __no_const;
64947
64948 /*
64949 * CSP private data
64950diff --git a/include/sound/soc.h b/include/sound/soc.h
64951index aa19f5a..a5b8208 100644
64952--- a/include/sound/soc.h
64953+++ b/include/sound/soc.h
64954@@ -676,7 +676,7 @@ struct snd_soc_platform_driver {
64955 /* platform IO - used for platform DAPM */
64956 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
64957 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
64958-};
64959+} __do_const;
64960
64961 struct snd_soc_platform {
64962 const char *name;
64963diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
64964index 444cd6b..3327cc5 100644
64965--- a/include/sound/ymfpci.h
64966+++ b/include/sound/ymfpci.h
64967@@ -358,7 +358,7 @@ struct snd_ymfpci {
64968 spinlock_t reg_lock;
64969 spinlock_t voice_lock;
64970 wait_queue_head_t interrupt_sleep;
64971- atomic_t interrupt_sleep_count;
64972+ atomic_unchecked_t interrupt_sleep_count;
64973 struct snd_info_entry *proc_entry;
64974 const struct firmware *dsp_microcode;
64975 const struct firmware *controller_microcode;
64976diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
64977index 2704065..e10f3ef 100644
64978--- a/include/target/target_core_base.h
64979+++ b/include/target/target_core_base.h
64980@@ -356,7 +356,7 @@ struct t10_reservation_ops {
64981 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
64982 int (*t10_pr_register)(struct se_cmd *);
64983 int (*t10_pr_clear)(struct se_cmd *);
64984-};
64985+} __no_const;
64986
64987 struct t10_reservation {
64988 /* Reservation effects all target ports */
64989@@ -496,8 +496,8 @@ struct se_cmd {
64990 atomic_t t_task_cdbs_left;
64991 atomic_t t_task_cdbs_ex_left;
64992 atomic_t t_task_cdbs_timeout_left;
64993- atomic_t t_task_cdbs_sent;
64994- atomic_t t_transport_aborted;
64995+ atomic_unchecked_t t_task_cdbs_sent;
64996+ atomic_unchecked_t t_transport_aborted;
64997 atomic_t t_transport_active;
64998 atomic_t t_transport_complete;
64999 atomic_t t_transport_queue_active;
65000@@ -744,7 +744,7 @@ struct se_device {
65001 atomic_t active_cmds;
65002 atomic_t simple_cmds;
65003 atomic_t depth_left;
65004- atomic_t dev_ordered_id;
65005+ atomic_unchecked_t dev_ordered_id;
65006 atomic_t dev_tur_active;
65007 atomic_t execute_tasks;
65008 atomic_t dev_status_thr_count;
65009diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
65010index 1c09820..7f5ec79 100644
65011--- a/include/trace/events/irq.h
65012+++ b/include/trace/events/irq.h
65013@@ -36,7 +36,7 @@ struct softirq_action;
65014 */
65015 TRACE_EVENT(irq_handler_entry,
65016
65017- TP_PROTO(int irq, struct irqaction *action),
65018+ TP_PROTO(int irq, const struct irqaction *action),
65019
65020 TP_ARGS(irq, action),
65021
65022@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
65023 */
65024 TRACE_EVENT(irq_handler_exit,
65025
65026- TP_PROTO(int irq, struct irqaction *action, int ret),
65027+ TP_PROTO(int irq, const struct irqaction *action, int ret),
65028
65029 TP_ARGS(irq, action, ret),
65030
65031diff --git a/include/video/udlfb.h b/include/video/udlfb.h
65032index 69d485a..dd0bee7 100644
65033--- a/include/video/udlfb.h
65034+++ b/include/video/udlfb.h
65035@@ -51,10 +51,10 @@ struct dlfb_data {
65036 int base8;
65037 u32 pseudo_palette[256];
65038 /* blit-only rendering path metrics, exposed through sysfs */
65039- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
65040- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
65041- atomic_t bytes_sent; /* to usb, after compression including overhead */
65042- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
65043+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
65044+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
65045+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
65046+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
65047 };
65048
65049 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
65050diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
65051index 0993a22..32ba2fe 100644
65052--- a/include/video/uvesafb.h
65053+++ b/include/video/uvesafb.h
65054@@ -177,6 +177,7 @@ struct uvesafb_par {
65055 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
65056 u8 pmi_setpal; /* PMI for palette changes */
65057 u16 *pmi_base; /* protected mode interface location */
65058+ u8 *pmi_code; /* protected mode code location */
65059 void *pmi_start;
65060 void *pmi_pal;
65061 u8 *vbe_state_orig; /*
65062diff --git a/init/Kconfig b/init/Kconfig
65063index d627783..693a9f3 100644
65064--- a/init/Kconfig
65065+++ b/init/Kconfig
65066@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
65067
65068 config COMPAT_BRK
65069 bool "Disable heap randomization"
65070- default y
65071+ default n
65072 help
65073 Randomizing heap placement makes heap exploits harder, but it
65074 also breaks ancient binaries (including anything libc5 based).
65075diff --git a/init/do_mounts.c b/init/do_mounts.c
65076index ef6478f..fdb0d8a 100644
65077--- a/init/do_mounts.c
65078+++ b/init/do_mounts.c
65079@@ -287,11 +287,11 @@ static void __init get_fs_names(char *page)
65080
65081 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
65082 {
65083- int err = sys_mount(name, "/root", fs, flags, data);
65084+ int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
65085 if (err)
65086 return err;
65087
65088- sys_chdir((const char __user __force *)"/root");
65089+ sys_chdir((const char __force_user*)"/root");
65090 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
65091 printk(KERN_INFO
65092 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
65093@@ -410,18 +410,18 @@ void __init change_floppy(char *fmt, ...)
65094 va_start(args, fmt);
65095 vsprintf(buf, fmt, args);
65096 va_end(args);
65097- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
65098+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
65099 if (fd >= 0) {
65100 sys_ioctl(fd, FDEJECT, 0);
65101 sys_close(fd);
65102 }
65103 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
65104- fd = sys_open("/dev/console", O_RDWR, 0);
65105+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
65106 if (fd >= 0) {
65107 sys_ioctl(fd, TCGETS, (long)&termios);
65108 termios.c_lflag &= ~ICANON;
65109 sys_ioctl(fd, TCSETSF, (long)&termios);
65110- sys_read(fd, &c, 1);
65111+ sys_read(fd, (char __user *)&c, 1);
65112 termios.c_lflag |= ICANON;
65113 sys_ioctl(fd, TCSETSF, (long)&termios);
65114 sys_close(fd);
65115@@ -515,6 +515,6 @@ void __init prepare_namespace(void)
65116 mount_root();
65117 out:
65118 devtmpfs_mount("dev");
65119- sys_mount(".", "/", NULL, MS_MOVE, NULL);
65120- sys_chroot((const char __user __force *)".");
65121+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
65122+ sys_chroot((const char __force_user *)".");
65123 }
65124diff --git a/init/do_mounts.h b/init/do_mounts.h
65125index f5b978a..69dbfe8 100644
65126--- a/init/do_mounts.h
65127+++ b/init/do_mounts.h
65128@@ -15,15 +15,15 @@ extern int root_mountflags;
65129
65130 static inline int create_dev(char *name, dev_t dev)
65131 {
65132- sys_unlink(name);
65133- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
65134+ sys_unlink((char __force_user *)name);
65135+ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
65136 }
65137
65138 #if BITS_PER_LONG == 32
65139 static inline u32 bstat(char *name)
65140 {
65141 struct stat64 stat;
65142- if (sys_stat64(name, &stat) != 0)
65143+ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
65144 return 0;
65145 if (!S_ISBLK(stat.st_mode))
65146 return 0;
65147@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
65148 static inline u32 bstat(char *name)
65149 {
65150 struct stat stat;
65151- if (sys_newstat(name, &stat) != 0)
65152+ if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
65153 return 0;
65154 if (!S_ISBLK(stat.st_mode))
65155 return 0;
65156diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
65157index 3098a38..253064e 100644
65158--- a/init/do_mounts_initrd.c
65159+++ b/init/do_mounts_initrd.c
65160@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
65161 create_dev("/dev/root.old", Root_RAM0);
65162 /* mount initrd on rootfs' /root */
65163 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
65164- sys_mkdir("/old", 0700);
65165- root_fd = sys_open("/", 0, 0);
65166- old_fd = sys_open("/old", 0, 0);
65167+ sys_mkdir((const char __force_user *)"/old", 0700);
65168+ root_fd = sys_open((const char __force_user *)"/", 0, 0);
65169+ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
65170 /* move initrd over / and chdir/chroot in initrd root */
65171- sys_chdir("/root");
65172- sys_mount(".", "/", NULL, MS_MOVE, NULL);
65173- sys_chroot(".");
65174+ sys_chdir((const char __force_user *)"/root");
65175+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
65176+ sys_chroot((const char __force_user *)".");
65177
65178 /*
65179 * In case that a resume from disk is carried out by linuxrc or one of
65180@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
65181
65182 /* move initrd to rootfs' /old */
65183 sys_fchdir(old_fd);
65184- sys_mount("/", ".", NULL, MS_MOVE, NULL);
65185+ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
65186 /* switch root and cwd back to / of rootfs */
65187 sys_fchdir(root_fd);
65188- sys_chroot(".");
65189+ sys_chroot((const char __force_user *)".");
65190 sys_close(old_fd);
65191 sys_close(root_fd);
65192
65193 if (new_decode_dev(real_root_dev) == Root_RAM0) {
65194- sys_chdir("/old");
65195+ sys_chdir((const char __force_user *)"/old");
65196 return;
65197 }
65198
65199@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
65200 mount_root();
65201
65202 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
65203- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
65204+ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
65205 if (!error)
65206 printk("okay\n");
65207 else {
65208- int fd = sys_open("/dev/root.old", O_RDWR, 0);
65209+ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
65210 if (error == -ENOENT)
65211 printk("/initrd does not exist. Ignored.\n");
65212 else
65213 printk("failed\n");
65214 printk(KERN_NOTICE "Unmounting old root\n");
65215- sys_umount("/old", MNT_DETACH);
65216+ sys_umount((char __force_user *)"/old", MNT_DETACH);
65217 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
65218 if (fd < 0) {
65219 error = fd;
65220@@ -116,11 +116,11 @@ int __init initrd_load(void)
65221 * mounted in the normal path.
65222 */
65223 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
65224- sys_unlink("/initrd.image");
65225+ sys_unlink((const char __force_user *)"/initrd.image");
65226 handle_initrd();
65227 return 1;
65228 }
65229 }
65230- sys_unlink("/initrd.image");
65231+ sys_unlink((const char __force_user *)"/initrd.image");
65232 return 0;
65233 }
65234diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
65235index 32c4799..c27ee74 100644
65236--- a/init/do_mounts_md.c
65237+++ b/init/do_mounts_md.c
65238@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
65239 partitioned ? "_d" : "", minor,
65240 md_setup_args[ent].device_names);
65241
65242- fd = sys_open(name, 0, 0);
65243+ fd = sys_open((char __force_user *)name, 0, 0);
65244 if (fd < 0) {
65245 printk(KERN_ERR "md: open failed - cannot start "
65246 "array %s\n", name);
65247@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
65248 * array without it
65249 */
65250 sys_close(fd);
65251- fd = sys_open(name, 0, 0);
65252+ fd = sys_open((char __force_user *)name, 0, 0);
65253 sys_ioctl(fd, BLKRRPART, 0);
65254 }
65255 sys_close(fd);
65256@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
65257
65258 wait_for_device_probe();
65259
65260- fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
65261+ fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
65262 if (fd >= 0) {
65263 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
65264 sys_close(fd);
65265diff --git a/init/initramfs.c b/init/initramfs.c
65266index 2531811..040d4d4 100644
65267--- a/init/initramfs.c
65268+++ b/init/initramfs.c
65269@@ -74,7 +74,7 @@ static void __init free_hash(void)
65270 }
65271 }
65272
65273-static long __init do_utime(char __user *filename, time_t mtime)
65274+static long __init do_utime(__force char __user *filename, time_t mtime)
65275 {
65276 struct timespec t[2];
65277
65278@@ -109,7 +109,7 @@ static void __init dir_utime(void)
65279 struct dir_entry *de, *tmp;
65280 list_for_each_entry_safe(de, tmp, &dir_list, list) {
65281 list_del(&de->list);
65282- do_utime(de->name, de->mtime);
65283+ do_utime((char __force_user *)de->name, de->mtime);
65284 kfree(de->name);
65285 kfree(de);
65286 }
65287@@ -271,7 +271,7 @@ static int __init maybe_link(void)
65288 if (nlink >= 2) {
65289 char *old = find_link(major, minor, ino, mode, collected);
65290 if (old)
65291- return (sys_link(old, collected) < 0) ? -1 : 1;
65292+ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
65293 }
65294 return 0;
65295 }
65296@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
65297 {
65298 struct stat st;
65299
65300- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
65301+ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
65302 if (S_ISDIR(st.st_mode))
65303- sys_rmdir(path);
65304+ sys_rmdir((char __force_user *)path);
65305 else
65306- sys_unlink(path);
65307+ sys_unlink((char __force_user *)path);
65308 }
65309 }
65310
65311@@ -305,7 +305,7 @@ static int __init do_name(void)
65312 int openflags = O_WRONLY|O_CREAT;
65313 if (ml != 1)
65314 openflags |= O_TRUNC;
65315- wfd = sys_open(collected, openflags, mode);
65316+ wfd = sys_open((char __force_user *)collected, openflags, mode);
65317
65318 if (wfd >= 0) {
65319 sys_fchown(wfd, uid, gid);
65320@@ -317,17 +317,17 @@ static int __init do_name(void)
65321 }
65322 }
65323 } else if (S_ISDIR(mode)) {
65324- sys_mkdir(collected, mode);
65325- sys_chown(collected, uid, gid);
65326- sys_chmod(collected, mode);
65327+ sys_mkdir((char __force_user *)collected, mode);
65328+ sys_chown((char __force_user *)collected, uid, gid);
65329+ sys_chmod((char __force_user *)collected, mode);
65330 dir_add(collected, mtime);
65331 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
65332 S_ISFIFO(mode) || S_ISSOCK(mode)) {
65333 if (maybe_link() == 0) {
65334- sys_mknod(collected, mode, rdev);
65335- sys_chown(collected, uid, gid);
65336- sys_chmod(collected, mode);
65337- do_utime(collected, mtime);
65338+ sys_mknod((char __force_user *)collected, mode, rdev);
65339+ sys_chown((char __force_user *)collected, uid, gid);
65340+ sys_chmod((char __force_user *)collected, mode);
65341+ do_utime((char __force_user *)collected, mtime);
65342 }
65343 }
65344 return 0;
65345@@ -336,15 +336,15 @@ static int __init do_name(void)
65346 static int __init do_copy(void)
65347 {
65348 if (count >= body_len) {
65349- sys_write(wfd, victim, body_len);
65350+ sys_write(wfd, (char __force_user *)victim, body_len);
65351 sys_close(wfd);
65352- do_utime(vcollected, mtime);
65353+ do_utime((char __force_user *)vcollected, mtime);
65354 kfree(vcollected);
65355 eat(body_len);
65356 state = SkipIt;
65357 return 0;
65358 } else {
65359- sys_write(wfd, victim, count);
65360+ sys_write(wfd, (char __force_user *)victim, count);
65361 body_len -= count;
65362 eat(count);
65363 return 1;
65364@@ -355,9 +355,9 @@ static int __init do_symlink(void)
65365 {
65366 collected[N_ALIGN(name_len) + body_len] = '\0';
65367 clean_path(collected, 0);
65368- sys_symlink(collected + N_ALIGN(name_len), collected);
65369- sys_lchown(collected, uid, gid);
65370- do_utime(collected, mtime);
65371+ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
65372+ sys_lchown((char __force_user *)collected, uid, gid);
65373+ do_utime((char __force_user *)collected, mtime);
65374 state = SkipIt;
65375 next_state = Reset;
65376 return 0;
65377diff --git a/init/main.c b/init/main.c
65378index 03b408d..5777f59 100644
65379--- a/init/main.c
65380+++ b/init/main.c
65381@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
65382 extern void tc_init(void);
65383 #endif
65384
65385+extern void grsecurity_init(void);
65386+
65387 /*
65388 * Debug helper: via this flag we know that we are in 'early bootup code'
65389 * where only the boot processor is running with IRQ disabled. This means
65390@@ -149,6 +151,49 @@ static int __init set_reset_devices(char *str)
65391
65392 __setup("reset_devices", set_reset_devices);
65393
65394+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
65395+extern char pax_enter_kernel_user[];
65396+extern char pax_exit_kernel_user[];
65397+extern pgdval_t clone_pgd_mask;
65398+#endif
65399+
65400+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
65401+static int __init setup_pax_nouderef(char *str)
65402+{
65403+#ifdef CONFIG_X86_32
65404+ unsigned int cpu;
65405+ struct desc_struct *gdt;
65406+
65407+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
65408+ gdt = get_cpu_gdt_table(cpu);
65409+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
65410+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
65411+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
65412+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
65413+ }
65414+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
65415+#else
65416+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
65417+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
65418+ clone_pgd_mask = ~(pgdval_t)0UL;
65419+#endif
65420+
65421+ return 0;
65422+}
65423+early_param("pax_nouderef", setup_pax_nouderef);
65424+#endif
65425+
65426+#ifdef CONFIG_PAX_SOFTMODE
65427+int pax_softmode;
65428+
65429+static int __init setup_pax_softmode(char *str)
65430+{
65431+ get_option(&str, &pax_softmode);
65432+ return 1;
65433+}
65434+__setup("pax_softmode=", setup_pax_softmode);
65435+#endif
65436+
65437 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
65438 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
65439 static const char *panic_later, *panic_param;
65440@@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
65441 {
65442 int count = preempt_count();
65443 int ret;
65444+ const char *msg1 = "", *msg2 = "";
65445
65446 if (initcall_debug)
65447 ret = do_one_initcall_debug(fn);
65448@@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
65449 sprintf(msgbuf, "error code %d ", ret);
65450
65451 if (preempt_count() != count) {
65452- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
65453+ msg1 = " preemption imbalance";
65454 preempt_count() = count;
65455 }
65456 if (irqs_disabled()) {
65457- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
65458+ msg2 = " disabled interrupts";
65459 local_irq_enable();
65460 }
65461- if (msgbuf[0]) {
65462- printk("initcall %pF returned with %s\n", fn, msgbuf);
65463+ if (msgbuf[0] || *msg1 || *msg2) {
65464+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
65465 }
65466
65467 return ret;
65468@@ -817,7 +863,7 @@ static int __init kernel_init(void * unused)
65469 do_basic_setup();
65470
65471 /* Open the /dev/console on the rootfs, this should never fail */
65472- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
65473+ if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
65474 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
65475
65476 (void) sys_dup(0);
65477@@ -830,11 +876,13 @@ static int __init kernel_init(void * unused)
65478 if (!ramdisk_execute_command)
65479 ramdisk_execute_command = "/init";
65480
65481- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
65482+ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
65483 ramdisk_execute_command = NULL;
65484 prepare_namespace();
65485 }
65486
65487+ grsecurity_init();
65488+
65489 /*
65490 * Ok, we have completed the initial bootup, and
65491 * we're essentially up and running. Get rid of the
65492diff --git a/ipc/mqueue.c b/ipc/mqueue.c
65493index ed049ea..6442f7f 100644
65494--- a/ipc/mqueue.c
65495+++ b/ipc/mqueue.c
65496@@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
65497 mq_bytes = (mq_msg_tblsz +
65498 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
65499
65500+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
65501 spin_lock(&mq_lock);
65502 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
65503 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
65504diff --git a/ipc/msg.c b/ipc/msg.c
65505index 7385de2..a8180e0 100644
65506--- a/ipc/msg.c
65507+++ b/ipc/msg.c
65508@@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
65509 return security_msg_queue_associate(msq, msgflg);
65510 }
65511
65512+static struct ipc_ops msg_ops = {
65513+ .getnew = newque,
65514+ .associate = msg_security,
65515+ .more_checks = NULL
65516+};
65517+
65518 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
65519 {
65520 struct ipc_namespace *ns;
65521- struct ipc_ops msg_ops;
65522 struct ipc_params msg_params;
65523
65524 ns = current->nsproxy->ipc_ns;
65525
65526- msg_ops.getnew = newque;
65527- msg_ops.associate = msg_security;
65528- msg_ops.more_checks = NULL;
65529-
65530 msg_params.key = key;
65531 msg_params.flg = msgflg;
65532
65533diff --git a/ipc/sem.c b/ipc/sem.c
65534index c8e00f8..1135c4e 100644
65535--- a/ipc/sem.c
65536+++ b/ipc/sem.c
65537@@ -318,10 +318,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
65538 return 0;
65539 }
65540
65541+static struct ipc_ops sem_ops = {
65542+ .getnew = newary,
65543+ .associate = sem_security,
65544+ .more_checks = sem_more_checks
65545+};
65546+
65547 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
65548 {
65549 struct ipc_namespace *ns;
65550- struct ipc_ops sem_ops;
65551 struct ipc_params sem_params;
65552
65553 ns = current->nsproxy->ipc_ns;
65554@@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
65555 if (nsems < 0 || nsems > ns->sc_semmsl)
65556 return -EINVAL;
65557
65558- sem_ops.getnew = newary;
65559- sem_ops.associate = sem_security;
65560- sem_ops.more_checks = sem_more_checks;
65561-
65562 sem_params.key = key;
65563 sem_params.flg = semflg;
65564 sem_params.u.nsems = nsems;
65565@@ -848,6 +849,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
65566 int nsems;
65567 struct list_head tasks;
65568
65569+ pax_track_stack();
65570+
65571 sma = sem_lock_check(ns, semid);
65572 if (IS_ERR(sma))
65573 return PTR_ERR(sma);
65574@@ -1295,6 +1298,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
65575 struct ipc_namespace *ns;
65576 struct list_head tasks;
65577
65578+ pax_track_stack();
65579+
65580 ns = current->nsproxy->ipc_ns;
65581
65582 if (nsops < 1 || semid < 0)
65583diff --git a/ipc/shm.c b/ipc/shm.c
65584index 02ecf2c..c8f5627 100644
65585--- a/ipc/shm.c
65586+++ b/ipc/shm.c
65587@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
65588 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
65589 #endif
65590
65591+#ifdef CONFIG_GRKERNSEC
65592+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
65593+ const time_t shm_createtime, const uid_t cuid,
65594+ const int shmid);
65595+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
65596+ const time_t shm_createtime);
65597+#endif
65598+
65599 void shm_init_ns(struct ipc_namespace *ns)
65600 {
65601 ns->shm_ctlmax = SHMMAX;
65602@@ -508,6 +516,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
65603 shp->shm_lprid = 0;
65604 shp->shm_atim = shp->shm_dtim = 0;
65605 shp->shm_ctim = get_seconds();
65606+#ifdef CONFIG_GRKERNSEC
65607+ {
65608+ struct timespec timeval;
65609+ do_posix_clock_monotonic_gettime(&timeval);
65610+
65611+ shp->shm_createtime = timeval.tv_sec;
65612+ }
65613+#endif
65614 shp->shm_segsz = size;
65615 shp->shm_nattch = 0;
65616 shp->shm_file = file;
65617@@ -559,18 +575,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
65618 return 0;
65619 }
65620
65621+static struct ipc_ops shm_ops = {
65622+ .getnew = newseg,
65623+ .associate = shm_security,
65624+ .more_checks = shm_more_checks
65625+};
65626+
65627 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
65628 {
65629 struct ipc_namespace *ns;
65630- struct ipc_ops shm_ops;
65631 struct ipc_params shm_params;
65632
65633 ns = current->nsproxy->ipc_ns;
65634
65635- shm_ops.getnew = newseg;
65636- shm_ops.associate = shm_security;
65637- shm_ops.more_checks = shm_more_checks;
65638-
65639 shm_params.key = key;
65640 shm_params.flg = shmflg;
65641 shm_params.u.size = size;
65642@@ -870,8 +887,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
65643 case SHM_LOCK:
65644 case SHM_UNLOCK:
65645 {
65646- struct file *uninitialized_var(shm_file);
65647-
65648 lru_add_drain_all(); /* drain pagevecs to lru lists */
65649
65650 shp = shm_lock_check(ns, shmid);
65651@@ -1004,9 +1019,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
65652 if (err)
65653 goto out_unlock;
65654
65655+#ifdef CONFIG_GRKERNSEC
65656+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
65657+ shp->shm_perm.cuid, shmid) ||
65658+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
65659+ err = -EACCES;
65660+ goto out_unlock;
65661+ }
65662+#endif
65663+
65664 path = shp->shm_file->f_path;
65665 path_get(&path);
65666 shp->shm_nattch++;
65667+#ifdef CONFIG_GRKERNSEC
65668+ shp->shm_lapid = current->pid;
65669+#endif
65670 size = i_size_read(path.dentry->d_inode);
65671 shm_unlock(shp);
65672
65673diff --git a/kernel/acct.c b/kernel/acct.c
65674index fa7eb3d..7faf116 100644
65675--- a/kernel/acct.c
65676+++ b/kernel/acct.c
65677@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
65678 */
65679 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
65680 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
65681- file->f_op->write(file, (char *)&ac,
65682+ file->f_op->write(file, (char __force_user *)&ac,
65683 sizeof(acct_t), &file->f_pos);
65684 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
65685 set_fs(fs);
65686diff --git a/kernel/audit.c b/kernel/audit.c
65687index 0a1355c..9359745 100644
65688--- a/kernel/audit.c
65689+++ b/kernel/audit.c
65690@@ -115,7 +115,7 @@ u32 audit_sig_sid = 0;
65691 3) suppressed due to audit_rate_limit
65692 4) suppressed due to audit_backlog_limit
65693 */
65694-static atomic_t audit_lost = ATOMIC_INIT(0);
65695+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
65696
65697 /* The netlink socket. */
65698 static struct sock *audit_sock;
65699@@ -237,7 +237,7 @@ void audit_log_lost(const char *message)
65700 unsigned long now;
65701 int print;
65702
65703- atomic_inc(&audit_lost);
65704+ atomic_inc_unchecked(&audit_lost);
65705
65706 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
65707
65708@@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
65709 printk(KERN_WARNING
65710 "audit: audit_lost=%d audit_rate_limit=%d "
65711 "audit_backlog_limit=%d\n",
65712- atomic_read(&audit_lost),
65713+ atomic_read_unchecked(&audit_lost),
65714 audit_rate_limit,
65715 audit_backlog_limit);
65716 audit_panic(message);
65717@@ -689,7 +689,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
65718 status_set.pid = audit_pid;
65719 status_set.rate_limit = audit_rate_limit;
65720 status_set.backlog_limit = audit_backlog_limit;
65721- status_set.lost = atomic_read(&audit_lost);
65722+ status_set.lost = atomic_read_unchecked(&audit_lost);
65723 status_set.backlog = skb_queue_len(&audit_skb_queue);
65724 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
65725 &status_set, sizeof(status_set));
65726@@ -1260,12 +1260,13 @@ static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
65727 avail = audit_expand(ab,
65728 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
65729 if (!avail)
65730- goto out;
65731+ goto out_va_end;
65732 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
65733 }
65734- va_end(args2);
65735 if (len > 0)
65736 skb_put(skb, len);
65737+out_va_end:
65738+ va_end(args2);
65739 out:
65740 return;
65741 }
65742diff --git a/kernel/auditsc.c b/kernel/auditsc.c
65743index ce4b054..aaa419e 100644
65744--- a/kernel/auditsc.c
65745+++ b/kernel/auditsc.c
65746@@ -1166,8 +1166,8 @@ static void audit_log_execve_info(struct audit_context *context,
65747 struct audit_buffer **ab,
65748 struct audit_aux_data_execve *axi)
65749 {
65750- int i;
65751- size_t len, len_sent = 0;
65752+ int i, len;
65753+ size_t len_sent = 0;
65754 const char __user *p;
65755 char *buf;
65756
65757@@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
65758 }
65759
65760 /* global counter which is incremented every time something logs in */
65761-static atomic_t session_id = ATOMIC_INIT(0);
65762+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
65763
65764 /**
65765 * audit_set_loginuid - set a task's audit_context loginuid
65766@@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
65767 */
65768 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
65769 {
65770- unsigned int sessionid = atomic_inc_return(&session_id);
65771+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
65772 struct audit_context *context = task->audit_context;
65773
65774 if (context && context->in_syscall) {
65775diff --git a/kernel/capability.c b/kernel/capability.c
65776index 283c529..36ac81e 100644
65777--- a/kernel/capability.c
65778+++ b/kernel/capability.c
65779@@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
65780 * before modification is attempted and the application
65781 * fails.
65782 */
65783+ if (tocopy > ARRAY_SIZE(kdata))
65784+ return -EFAULT;
65785+
65786 if (copy_to_user(dataptr, kdata, tocopy
65787 * sizeof(struct __user_cap_data_struct))) {
65788 return -EFAULT;
65789@@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
65790 BUG();
65791 }
65792
65793- if (security_capable(ns, current_cred(), cap) == 0) {
65794+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
65795 current->flags |= PF_SUPERPRIV;
65796 return true;
65797 }
65798@@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *ns, int cap)
65799 }
65800 EXPORT_SYMBOL(ns_capable);
65801
65802+bool ns_capable_nolog(struct user_namespace *ns, int cap)
65803+{
65804+ if (unlikely(!cap_valid(cap))) {
65805+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
65806+ BUG();
65807+ }
65808+
65809+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
65810+ current->flags |= PF_SUPERPRIV;
65811+ return true;
65812+ }
65813+ return false;
65814+}
65815+EXPORT_SYMBOL(ns_capable_nolog);
65816+
65817+bool capable_nolog(int cap)
65818+{
65819+ return ns_capable_nolog(&init_user_ns, cap);
65820+}
65821+EXPORT_SYMBOL(capable_nolog);
65822+
65823 /**
65824 * task_ns_capable - Determine whether current task has a superior
65825 * capability targeted at a specific task's user namespace.
65826@@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct *t, int cap)
65827 }
65828 EXPORT_SYMBOL(task_ns_capable);
65829
65830+bool task_ns_capable_nolog(struct task_struct *t, int cap)
65831+{
65832+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
65833+}
65834+EXPORT_SYMBOL(task_ns_capable_nolog);
65835+
65836 /**
65837 * nsown_capable - Check superior capability to one's own user_ns
65838 * @cap: The capability in question
65839diff --git a/kernel/cgroup.c b/kernel/cgroup.c
65840index e4cbdfb..191bec4 100644
65841--- a/kernel/cgroup.c
65842+++ b/kernel/cgroup.c
65843@@ -595,6 +595,8 @@ static struct css_set *find_css_set(
65844 struct hlist_head *hhead;
65845 struct cg_cgroup_link *link;
65846
65847+ pax_track_stack();
65848+
65849 /* First see if we already have a cgroup group that matches
65850 * the desired set */
65851 read_lock(&css_set_lock);
65852diff --git a/kernel/compat.c b/kernel/compat.c
65853index e2435ee..8e82199 100644
65854--- a/kernel/compat.c
65855+++ b/kernel/compat.c
65856@@ -13,6 +13,7 @@
65857
65858 #include <linux/linkage.h>
65859 #include <linux/compat.h>
65860+#include <linux/module.h>
65861 #include <linux/errno.h>
65862 #include <linux/time.h>
65863 #include <linux/signal.h>
65864@@ -167,7 +168,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
65865 mm_segment_t oldfs;
65866 long ret;
65867
65868- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
65869+ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
65870 oldfs = get_fs();
65871 set_fs(KERNEL_DS);
65872 ret = hrtimer_nanosleep_restart(restart);
65873@@ -199,7 +200,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
65874 oldfs = get_fs();
65875 set_fs(KERNEL_DS);
65876 ret = hrtimer_nanosleep(&tu,
65877- rmtp ? (struct timespec __user *)&rmt : NULL,
65878+ rmtp ? (struct timespec __force_user *)&rmt : NULL,
65879 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
65880 set_fs(oldfs);
65881
65882@@ -308,7 +309,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
65883 mm_segment_t old_fs = get_fs();
65884
65885 set_fs(KERNEL_DS);
65886- ret = sys_sigpending((old_sigset_t __user *) &s);
65887+ ret = sys_sigpending((old_sigset_t __force_user *) &s);
65888 set_fs(old_fs);
65889 if (ret == 0)
65890 ret = put_user(s, set);
65891@@ -331,8 +332,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
65892 old_fs = get_fs();
65893 set_fs(KERNEL_DS);
65894 ret = sys_sigprocmask(how,
65895- set ? (old_sigset_t __user *) &s : NULL,
65896- oset ? (old_sigset_t __user *) &s : NULL);
65897+ set ? (old_sigset_t __force_user *) &s : NULL,
65898+ oset ? (old_sigset_t __force_user *) &s : NULL);
65899 set_fs(old_fs);
65900 if (ret == 0)
65901 if (oset)
65902@@ -369,7 +370,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
65903 mm_segment_t old_fs = get_fs();
65904
65905 set_fs(KERNEL_DS);
65906- ret = sys_old_getrlimit(resource, &r);
65907+ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
65908 set_fs(old_fs);
65909
65910 if (!ret) {
65911@@ -441,7 +442,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
65912 mm_segment_t old_fs = get_fs();
65913
65914 set_fs(KERNEL_DS);
65915- ret = sys_getrusage(who, (struct rusage __user *) &r);
65916+ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
65917 set_fs(old_fs);
65918
65919 if (ret)
65920@@ -468,8 +469,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
65921 set_fs (KERNEL_DS);
65922 ret = sys_wait4(pid,
65923 (stat_addr ?
65924- (unsigned int __user *) &status : NULL),
65925- options, (struct rusage __user *) &r);
65926+ (unsigned int __force_user *) &status : NULL),
65927+ options, (struct rusage __force_user *) &r);
65928 set_fs (old_fs);
65929
65930 if (ret > 0) {
65931@@ -494,8 +495,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
65932 memset(&info, 0, sizeof(info));
65933
65934 set_fs(KERNEL_DS);
65935- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
65936- uru ? (struct rusage __user *)&ru : NULL);
65937+ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
65938+ uru ? (struct rusage __force_user *)&ru : NULL);
65939 set_fs(old_fs);
65940
65941 if ((ret < 0) || (info.si_signo == 0))
65942@@ -625,8 +626,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
65943 oldfs = get_fs();
65944 set_fs(KERNEL_DS);
65945 err = sys_timer_settime(timer_id, flags,
65946- (struct itimerspec __user *) &newts,
65947- (struct itimerspec __user *) &oldts);
65948+ (struct itimerspec __force_user *) &newts,
65949+ (struct itimerspec __force_user *) &oldts);
65950 set_fs(oldfs);
65951 if (!err && old && put_compat_itimerspec(old, &oldts))
65952 return -EFAULT;
65953@@ -643,7 +644,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
65954 oldfs = get_fs();
65955 set_fs(KERNEL_DS);
65956 err = sys_timer_gettime(timer_id,
65957- (struct itimerspec __user *) &ts);
65958+ (struct itimerspec __force_user *) &ts);
65959 set_fs(oldfs);
65960 if (!err && put_compat_itimerspec(setting, &ts))
65961 return -EFAULT;
65962@@ -662,7 +663,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
65963 oldfs = get_fs();
65964 set_fs(KERNEL_DS);
65965 err = sys_clock_settime(which_clock,
65966- (struct timespec __user *) &ts);
65967+ (struct timespec __force_user *) &ts);
65968 set_fs(oldfs);
65969 return err;
65970 }
65971@@ -677,7 +678,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
65972 oldfs = get_fs();
65973 set_fs(KERNEL_DS);
65974 err = sys_clock_gettime(which_clock,
65975- (struct timespec __user *) &ts);
65976+ (struct timespec __force_user *) &ts);
65977 set_fs(oldfs);
65978 if (!err && put_compat_timespec(&ts, tp))
65979 return -EFAULT;
65980@@ -697,7 +698,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
65981
65982 oldfs = get_fs();
65983 set_fs(KERNEL_DS);
65984- ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
65985+ ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
65986 set_fs(oldfs);
65987
65988 err = compat_put_timex(utp, &txc);
65989@@ -717,7 +718,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
65990 oldfs = get_fs();
65991 set_fs(KERNEL_DS);
65992 err = sys_clock_getres(which_clock,
65993- (struct timespec __user *) &ts);
65994+ (struct timespec __force_user *) &ts);
65995 set_fs(oldfs);
65996 if (!err && tp && put_compat_timespec(&ts, tp))
65997 return -EFAULT;
65998@@ -729,9 +730,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
65999 long err;
66000 mm_segment_t oldfs;
66001 struct timespec tu;
66002- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
66003+ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
66004
66005- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
66006+ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
66007 oldfs = get_fs();
66008 set_fs(KERNEL_DS);
66009 err = clock_nanosleep_restart(restart);
66010@@ -763,8 +764,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
66011 oldfs = get_fs();
66012 set_fs(KERNEL_DS);
66013 err = sys_clock_nanosleep(which_clock, flags,
66014- (struct timespec __user *) &in,
66015- (struct timespec __user *) &out);
66016+ (struct timespec __force_user *) &in,
66017+ (struct timespec __force_user *) &out);
66018 set_fs(oldfs);
66019
66020 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
66021diff --git a/kernel/configs.c b/kernel/configs.c
66022index 42e8fa0..9e7406b 100644
66023--- a/kernel/configs.c
66024+++ b/kernel/configs.c
66025@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
66026 struct proc_dir_entry *entry;
66027
66028 /* create the current config file */
66029+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66030+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66031+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66032+ &ikconfig_file_ops);
66033+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66034+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66035+ &ikconfig_file_ops);
66036+#endif
66037+#else
66038 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66039 &ikconfig_file_ops);
66040+#endif
66041+
66042 if (!entry)
66043 return -ENOMEM;
66044
66045diff --git a/kernel/cred.c b/kernel/cred.c
66046index 8ef31f5..bed28ea 100644
66047--- a/kernel/cred.c
66048+++ b/kernel/cred.c
66049@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
66050 */
66051 void __put_cred(struct cred *cred)
66052 {
66053+ pax_track_stack();
66054+
66055 kdebug("__put_cred(%p{%d,%d})", cred,
66056 atomic_read(&cred->usage),
66057 read_cred_subscribers(cred));
66058@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
66059 {
66060 struct cred *cred;
66061
66062+ pax_track_stack();
66063+
66064 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66065 atomic_read(&tsk->cred->usage),
66066 read_cred_subscribers(tsk->cred));
66067@@ -204,6 +208,15 @@ void exit_creds(struct task_struct *tsk)
66068 validate_creds(cred);
66069 put_cred(cred);
66070 }
66071+
66072+#ifdef CONFIG_GRKERNSEC_SETXID
66073+ cred = (struct cred *) tsk->delayed_cred;
66074+ if (cred) {
66075+ tsk->delayed_cred = NULL;
66076+ validate_creds(cred);
66077+ put_cred(cred);
66078+ }
66079+#endif
66080 }
66081
66082 /**
66083@@ -220,6 +233,8 @@ const struct cred *get_task_cred(struct task_struct *task)
66084 {
66085 const struct cred *cred;
66086
66087+ pax_track_stack();
66088+
66089 rcu_read_lock();
66090
66091 do {
66092@@ -239,6 +254,8 @@ struct cred *cred_alloc_blank(void)
66093 {
66094 struct cred *new;
66095
66096+ pax_track_stack();
66097+
66098 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
66099 if (!new)
66100 return NULL;
66101@@ -281,12 +298,15 @@ error:
66102 *
66103 * Call commit_creds() or abort_creds() to clean up.
66104 */
66105+
66106 struct cred *prepare_creds(void)
66107 {
66108 struct task_struct *task = current;
66109 const struct cred *old;
66110 struct cred *new;
66111
66112+ pax_track_stack();
66113+
66114 validate_process_creds();
66115
66116 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66117@@ -333,6 +353,8 @@ struct cred *prepare_exec_creds(void)
66118 struct thread_group_cred *tgcred = NULL;
66119 struct cred *new;
66120
66121+ pax_track_stack();
66122+
66123 #ifdef CONFIG_KEYS
66124 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
66125 if (!tgcred)
66126@@ -385,6 +407,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
66127 struct cred *new;
66128 int ret;
66129
66130+ pax_track_stack();
66131+
66132 if (
66133 #ifdef CONFIG_KEYS
66134 !p->cred->thread_keyring &&
66135@@ -470,11 +494,13 @@ error_put:
66136 * Always returns 0 thus allowing this function to be tail-called at the end
66137 * of, say, sys_setgid().
66138 */
66139-int commit_creds(struct cred *new)
66140+static int __commit_creds(struct cred *new)
66141 {
66142 struct task_struct *task = current;
66143 const struct cred *old = task->real_cred;
66144
66145+ pax_track_stack();
66146+
66147 kdebug("commit_creds(%p{%d,%d})", new,
66148 atomic_read(&new->usage),
66149 read_cred_subscribers(new));
66150@@ -489,6 +515,8 @@ int commit_creds(struct cred *new)
66151
66152 get_cred(new); /* we will require a ref for the subj creds too */
66153
66154+ gr_set_role_label(task, new->uid, new->gid);
66155+
66156 /* dumpability changes */
66157 if (old->euid != new->euid ||
66158 old->egid != new->egid ||
66159@@ -538,6 +566,92 @@ int commit_creds(struct cred *new)
66160 put_cred(old);
66161 return 0;
66162 }
66163+#ifdef CONFIG_GRKERNSEC_SETXID
66164+extern int set_user(struct cred *new);
66165+
66166+void gr_delayed_cred_worker(void)
66167+{
66168+ const struct cred *new = current->delayed_cred;
66169+ struct cred *ncred;
66170+
66171+ current->delayed_cred = NULL;
66172+
66173+ if (current_uid() && new != NULL) {
66174+ // from doing get_cred on it when queueing this
66175+ put_cred(new);
66176+ return;
66177+ } else if (new == NULL)
66178+ return;
66179+
66180+ ncred = prepare_creds();
66181+ if (!ncred)
66182+ goto die;
66183+ // uids
66184+ ncred->uid = new->uid;
66185+ ncred->euid = new->euid;
66186+ ncred->suid = new->suid;
66187+ ncred->fsuid = new->fsuid;
66188+ // gids
66189+ ncred->gid = new->gid;
66190+ ncred->egid = new->egid;
66191+ ncred->sgid = new->sgid;
66192+ ncred->fsgid = new->fsgid;
66193+ // groups
66194+ if (set_groups(ncred, new->group_info) < 0) {
66195+ abort_creds(ncred);
66196+ goto die;
66197+ }
66198+ // caps
66199+ ncred->securebits = new->securebits;
66200+ ncred->cap_inheritable = new->cap_inheritable;
66201+ ncred->cap_permitted = new->cap_permitted;
66202+ ncred->cap_effective = new->cap_effective;
66203+ ncred->cap_bset = new->cap_bset;
66204+
66205+ if (set_user(ncred)) {
66206+ abort_creds(ncred);
66207+ goto die;
66208+ }
66209+
66210+ // from doing get_cred on it when queueing this
66211+ put_cred(new);
66212+
66213+ __commit_creds(ncred);
66214+ return;
66215+die:
66216+ // from doing get_cred on it when queueing this
66217+ put_cred(new);
66218+ do_group_exit(SIGKILL);
66219+}
66220+#endif
66221+
66222+int commit_creds(struct cred *new)
66223+{
66224+#ifdef CONFIG_GRKERNSEC_SETXID
66225+ struct task_struct *t;
66226+
66227+ /* we won't get called with tasklist_lock held for writing
66228+ and interrupts disabled as the cred struct in that case is
66229+ init_cred
66230+ */
66231+ if (grsec_enable_setxid && !current_is_single_threaded() &&
66232+ !current_uid() && new->uid) {
66233+ rcu_read_lock();
66234+ read_lock(&tasklist_lock);
66235+ for (t = next_thread(current); t != current;
66236+ t = next_thread(t)) {
66237+ if (t->delayed_cred == NULL) {
66238+ t->delayed_cred = get_cred(new);
66239+ set_tsk_need_resched(t);
66240+ }
66241+ }
66242+ read_unlock(&tasklist_lock);
66243+ rcu_read_unlock();
66244+ }
66245+#endif
66246+ return __commit_creds(new);
66247+}
66248+
66249 EXPORT_SYMBOL(commit_creds);
66250
66251 /**
66252@@ -549,6 +663,8 @@ EXPORT_SYMBOL(commit_creds);
66253 */
66254 void abort_creds(struct cred *new)
66255 {
66256+ pax_track_stack();
66257+
66258 kdebug("abort_creds(%p{%d,%d})", new,
66259 atomic_read(&new->usage),
66260 read_cred_subscribers(new));
66261@@ -572,6 +688,8 @@ const struct cred *override_creds(const struct cred *new)
66262 {
66263 const struct cred *old = current->cred;
66264
66265+ pax_track_stack();
66266+
66267 kdebug("override_creds(%p{%d,%d})", new,
66268 atomic_read(&new->usage),
66269 read_cred_subscribers(new));
66270@@ -601,6 +719,8 @@ void revert_creds(const struct cred *old)
66271 {
66272 const struct cred *override = current->cred;
66273
66274+ pax_track_stack();
66275+
66276 kdebug("revert_creds(%p{%d,%d})", old,
66277 atomic_read(&old->usage),
66278 read_cred_subscribers(old));
66279@@ -647,6 +767,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
66280 const struct cred *old;
66281 struct cred *new;
66282
66283+ pax_track_stack();
66284+
66285 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66286 if (!new)
66287 return NULL;
66288@@ -701,6 +823,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
66289 */
66290 int set_security_override(struct cred *new, u32 secid)
66291 {
66292+ pax_track_stack();
66293+
66294 return security_kernel_act_as(new, secid);
66295 }
66296 EXPORT_SYMBOL(set_security_override);
66297@@ -720,6 +844,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
66298 u32 secid;
66299 int ret;
66300
66301+ pax_track_stack();
66302+
66303 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
66304 if (ret < 0)
66305 return ret;
66306diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
66307index 0d7c087..01b8cef 100644
66308--- a/kernel/debug/debug_core.c
66309+++ b/kernel/debug/debug_core.c
66310@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
66311 */
66312 static atomic_t masters_in_kgdb;
66313 static atomic_t slaves_in_kgdb;
66314-static atomic_t kgdb_break_tasklet_var;
66315+static atomic_unchecked_t kgdb_break_tasklet_var;
66316 atomic_t kgdb_setting_breakpoint;
66317
66318 struct task_struct *kgdb_usethread;
66319@@ -129,7 +129,7 @@ int kgdb_single_step;
66320 static pid_t kgdb_sstep_pid;
66321
66322 /* to keep track of the CPU which is doing the single stepping*/
66323-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66324+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66325
66326 /*
66327 * If you are debugging a problem where roundup (the collection of
66328@@ -542,7 +542,7 @@ return_normal:
66329 * kernel will only try for the value of sstep_tries before
66330 * giving up and continuing on.
66331 */
66332- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
66333+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
66334 (kgdb_info[cpu].task &&
66335 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
66336 atomic_set(&kgdb_active, -1);
66337@@ -636,8 +636,8 @@ cpu_master_loop:
66338 }
66339
66340 kgdb_restore:
66341- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
66342- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
66343+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
66344+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
66345 if (kgdb_info[sstep_cpu].task)
66346 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
66347 else
66348@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(void)
66349 static void kgdb_tasklet_bpt(unsigned long ing)
66350 {
66351 kgdb_breakpoint();
66352- atomic_set(&kgdb_break_tasklet_var, 0);
66353+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
66354 }
66355
66356 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
66357
66358 void kgdb_schedule_breakpoint(void)
66359 {
66360- if (atomic_read(&kgdb_break_tasklet_var) ||
66361+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
66362 atomic_read(&kgdb_active) != -1 ||
66363 atomic_read(&kgdb_setting_breakpoint))
66364 return;
66365- atomic_inc(&kgdb_break_tasklet_var);
66366+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
66367 tasklet_schedule(&kgdb_tasklet_breakpoint);
66368 }
66369 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
66370diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
66371index 63786e7..0780cac 100644
66372--- a/kernel/debug/kdb/kdb_main.c
66373+++ b/kernel/debug/kdb/kdb_main.c
66374@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const char **argv)
66375 list_for_each_entry(mod, kdb_modules, list) {
66376
66377 kdb_printf("%-20s%8u 0x%p ", mod->name,
66378- mod->core_size, (void *)mod);
66379+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
66380 #ifdef CONFIG_MODULE_UNLOAD
66381 kdb_printf("%4d ", module_refcount(mod));
66382 #endif
66383@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const char **argv)
66384 kdb_printf(" (Loading)");
66385 else
66386 kdb_printf(" (Live)");
66387- kdb_printf(" 0x%p", mod->module_core);
66388+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
66389
66390 #ifdef CONFIG_MODULE_UNLOAD
66391 {
66392diff --git a/kernel/events/core.c b/kernel/events/core.c
66393index 0f85778..0d43716 100644
66394--- a/kernel/events/core.c
66395+++ b/kernel/events/core.c
66396@@ -172,7 +172,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
66397 return 0;
66398 }
66399
66400-static atomic64_t perf_event_id;
66401+static atomic64_unchecked_t perf_event_id;
66402
66403 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
66404 enum event_type_t event_type);
66405@@ -2535,7 +2535,7 @@ static void __perf_event_read(void *info)
66406
66407 static inline u64 perf_event_count(struct perf_event *event)
66408 {
66409- return local64_read(&event->count) + atomic64_read(&event->child_count);
66410+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
66411 }
66412
66413 static u64 perf_event_read(struct perf_event *event)
66414@@ -3060,9 +3060,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
66415 mutex_lock(&event->child_mutex);
66416 total += perf_event_read(event);
66417 *enabled += event->total_time_enabled +
66418- atomic64_read(&event->child_total_time_enabled);
66419+ atomic64_read_unchecked(&event->child_total_time_enabled);
66420 *running += event->total_time_running +
66421- atomic64_read(&event->child_total_time_running);
66422+ atomic64_read_unchecked(&event->child_total_time_running);
66423
66424 list_for_each_entry(child, &event->child_list, child_list) {
66425 total += perf_event_read(child);
66426@@ -3448,10 +3448,10 @@ void perf_event_update_userpage(struct perf_event *event)
66427 userpg->offset -= local64_read(&event->hw.prev_count);
66428
66429 userpg->time_enabled = enabled +
66430- atomic64_read(&event->child_total_time_enabled);
66431+ atomic64_read_unchecked(&event->child_total_time_enabled);
66432
66433 userpg->time_running = running +
66434- atomic64_read(&event->child_total_time_running);
66435+ atomic64_read_unchecked(&event->child_total_time_running);
66436
66437 barrier();
66438 ++userpg->lock;
66439@@ -3822,11 +3822,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
66440 values[n++] = perf_event_count(event);
66441 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
66442 values[n++] = enabled +
66443- atomic64_read(&event->child_total_time_enabled);
66444+ atomic64_read_unchecked(&event->child_total_time_enabled);
66445 }
66446 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
66447 values[n++] = running +
66448- atomic64_read(&event->child_total_time_running);
66449+ atomic64_read_unchecked(&event->child_total_time_running);
66450 }
66451 if (read_format & PERF_FORMAT_ID)
66452 values[n++] = primary_event_id(event);
66453@@ -4477,12 +4477,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
66454 * need to add enough zero bytes after the string to handle
66455 * the 64bit alignment we do later.
66456 */
66457- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
66458+ buf = kzalloc(PATH_MAX, GFP_KERNEL);
66459 if (!buf) {
66460 name = strncpy(tmp, "//enomem", sizeof(tmp));
66461 goto got_name;
66462 }
66463- name = d_path(&file->f_path, buf, PATH_MAX);
66464+ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
66465 if (IS_ERR(name)) {
66466 name = strncpy(tmp, "//toolong", sizeof(tmp));
66467 goto got_name;
66468@@ -5833,7 +5833,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
66469 event->parent = parent_event;
66470
66471 event->ns = get_pid_ns(current->nsproxy->pid_ns);
66472- event->id = atomic64_inc_return(&perf_event_id);
66473+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
66474
66475 event->state = PERF_EVENT_STATE_INACTIVE;
66476
66477@@ -6355,10 +6355,10 @@ static void sync_child_event(struct perf_event *child_event,
66478 /*
66479 * Add back the child's count to the parent's count:
66480 */
66481- atomic64_add(child_val, &parent_event->child_count);
66482- atomic64_add(child_event->total_time_enabled,
66483+ atomic64_add_unchecked(child_val, &parent_event->child_count);
66484+ atomic64_add_unchecked(child_event->total_time_enabled,
66485 &parent_event->child_total_time_enabled);
66486- atomic64_add(child_event->total_time_running,
66487+ atomic64_add_unchecked(child_event->total_time_running,
66488 &parent_event->child_total_time_running);
66489
66490 /*
66491diff --git a/kernel/exit.c b/kernel/exit.c
66492index 9e316ae..b3656d5 100644
66493--- a/kernel/exit.c
66494+++ b/kernel/exit.c
66495@@ -57,6 +57,10 @@
66496 #include <asm/pgtable.h>
66497 #include <asm/mmu_context.h>
66498
66499+#ifdef CONFIG_GRKERNSEC
66500+extern rwlock_t grsec_exec_file_lock;
66501+#endif
66502+
66503 static void exit_mm(struct task_struct * tsk);
66504
66505 static void __unhash_process(struct task_struct *p, bool group_dead)
66506@@ -168,6 +172,10 @@ void release_task(struct task_struct * p)
66507 struct task_struct *leader;
66508 int zap_leader;
66509 repeat:
66510+#ifdef CONFIG_NET
66511+ gr_del_task_from_ip_table(p);
66512+#endif
66513+
66514 /* don't need to get the RCU readlock here - the process is dead and
66515 * can't be modifying its own credentials. But shut RCU-lockdep up */
66516 rcu_read_lock();
66517@@ -380,7 +388,7 @@ int allow_signal(int sig)
66518 * know it'll be handled, so that they don't get converted to
66519 * SIGKILL or just silently dropped.
66520 */
66521- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
66522+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
66523 recalc_sigpending();
66524 spin_unlock_irq(&current->sighand->siglock);
66525 return 0;
66526@@ -416,6 +424,17 @@ void daemonize(const char *name, ...)
66527 vsnprintf(current->comm, sizeof(current->comm), name, args);
66528 va_end(args);
66529
66530+#ifdef CONFIG_GRKERNSEC
66531+ write_lock(&grsec_exec_file_lock);
66532+ if (current->exec_file) {
66533+ fput(current->exec_file);
66534+ current->exec_file = NULL;
66535+ }
66536+ write_unlock(&grsec_exec_file_lock);
66537+#endif
66538+
66539+ gr_set_kernel_label(current);
66540+
66541 /*
66542 * If we were started as result of loading a module, close all of the
66543 * user space pages. We don't need them, and if we didn't close them
66544@@ -895,6 +914,8 @@ NORET_TYPE void do_exit(long code)
66545 struct task_struct *tsk = current;
66546 int group_dead;
66547
66548+ set_fs(USER_DS);
66549+
66550 profile_task_exit(tsk);
66551
66552 WARN_ON(blk_needs_flush_plug(tsk));
66553@@ -911,7 +932,6 @@ NORET_TYPE void do_exit(long code)
66554 * mm_release()->clear_child_tid() from writing to a user-controlled
66555 * kernel address.
66556 */
66557- set_fs(USER_DS);
66558
66559 ptrace_event(PTRACE_EVENT_EXIT, code);
66560
66561@@ -973,6 +993,9 @@ NORET_TYPE void do_exit(long code)
66562 tsk->exit_code = code;
66563 taskstats_exit(tsk, group_dead);
66564
66565+ gr_acl_handle_psacct(tsk, code);
66566+ gr_acl_handle_exit();
66567+
66568 exit_mm(tsk);
66569
66570 if (group_dead)
66571diff --git a/kernel/fork.c b/kernel/fork.c
66572index 8e6b6f4..9dccf00 100644
66573--- a/kernel/fork.c
66574+++ b/kernel/fork.c
66575@@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
66576 *stackend = STACK_END_MAGIC; /* for overflow detection */
66577
66578 #ifdef CONFIG_CC_STACKPROTECTOR
66579- tsk->stack_canary = get_random_int();
66580+ tsk->stack_canary = pax_get_random_long();
66581 #endif
66582
66583 /*
66584@@ -309,13 +309,77 @@ out:
66585 }
66586
66587 #ifdef CONFIG_MMU
66588+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
66589+{
66590+ struct vm_area_struct *tmp;
66591+ unsigned long charge;
66592+ struct mempolicy *pol;
66593+ struct file *file;
66594+
66595+ charge = 0;
66596+ if (mpnt->vm_flags & VM_ACCOUNT) {
66597+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
66598+ if (security_vm_enough_memory(len))
66599+ goto fail_nomem;
66600+ charge = len;
66601+ }
66602+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
66603+ if (!tmp)
66604+ goto fail_nomem;
66605+ *tmp = *mpnt;
66606+ tmp->vm_mm = mm;
66607+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
66608+ pol = mpol_dup(vma_policy(mpnt));
66609+ if (IS_ERR(pol))
66610+ goto fail_nomem_policy;
66611+ vma_set_policy(tmp, pol);
66612+ if (anon_vma_fork(tmp, mpnt))
66613+ goto fail_nomem_anon_vma_fork;
66614+ tmp->vm_flags &= ~VM_LOCKED;
66615+ tmp->vm_next = tmp->vm_prev = NULL;
66616+ tmp->vm_mirror = NULL;
66617+ file = tmp->vm_file;
66618+ if (file) {
66619+ struct inode *inode = file->f_path.dentry->d_inode;
66620+ struct address_space *mapping = file->f_mapping;
66621+
66622+ get_file(file);
66623+ if (tmp->vm_flags & VM_DENYWRITE)
66624+ atomic_dec(&inode->i_writecount);
66625+ mutex_lock(&mapping->i_mmap_mutex);
66626+ if (tmp->vm_flags & VM_SHARED)
66627+ mapping->i_mmap_writable++;
66628+ flush_dcache_mmap_lock(mapping);
66629+ /* insert tmp into the share list, just after mpnt */
66630+ vma_prio_tree_add(tmp, mpnt);
66631+ flush_dcache_mmap_unlock(mapping);
66632+ mutex_unlock(&mapping->i_mmap_mutex);
66633+ }
66634+
66635+ /*
66636+ * Clear hugetlb-related page reserves for children. This only
66637+ * affects MAP_PRIVATE mappings. Faults generated by the child
66638+ * are not guaranteed to succeed, even if read-only
66639+ */
66640+ if (is_vm_hugetlb_page(tmp))
66641+ reset_vma_resv_huge_pages(tmp);
66642+
66643+ return tmp;
66644+
66645+fail_nomem_anon_vma_fork:
66646+ mpol_put(pol);
66647+fail_nomem_policy:
66648+ kmem_cache_free(vm_area_cachep, tmp);
66649+fail_nomem:
66650+ vm_unacct_memory(charge);
66651+ return NULL;
66652+}
66653+
66654 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66655 {
66656 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
66657 struct rb_node **rb_link, *rb_parent;
66658 int retval;
66659- unsigned long charge;
66660- struct mempolicy *pol;
66661
66662 down_write(&oldmm->mmap_sem);
66663 flush_cache_dup_mm(oldmm);
66664@@ -327,8 +391,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66665 mm->locked_vm = 0;
66666 mm->mmap = NULL;
66667 mm->mmap_cache = NULL;
66668- mm->free_area_cache = oldmm->mmap_base;
66669- mm->cached_hole_size = ~0UL;
66670+ mm->free_area_cache = oldmm->free_area_cache;
66671+ mm->cached_hole_size = oldmm->cached_hole_size;
66672 mm->map_count = 0;
66673 cpumask_clear(mm_cpumask(mm));
66674 mm->mm_rb = RB_ROOT;
66675@@ -344,8 +408,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66676
66677 prev = NULL;
66678 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
66679- struct file *file;
66680-
66681 if (mpnt->vm_flags & VM_DONTCOPY) {
66682 long pages = vma_pages(mpnt);
66683 mm->total_vm -= pages;
66684@@ -353,53 +415,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66685 -pages);
66686 continue;
66687 }
66688- charge = 0;
66689- if (mpnt->vm_flags & VM_ACCOUNT) {
66690- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
66691- if (security_vm_enough_memory(len))
66692- goto fail_nomem;
66693- charge = len;
66694+ tmp = dup_vma(mm, mpnt);
66695+ if (!tmp) {
66696+ retval = -ENOMEM;
66697+ goto out;
66698 }
66699- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
66700- if (!tmp)
66701- goto fail_nomem;
66702- *tmp = *mpnt;
66703- INIT_LIST_HEAD(&tmp->anon_vma_chain);
66704- pol = mpol_dup(vma_policy(mpnt));
66705- retval = PTR_ERR(pol);
66706- if (IS_ERR(pol))
66707- goto fail_nomem_policy;
66708- vma_set_policy(tmp, pol);
66709- tmp->vm_mm = mm;
66710- if (anon_vma_fork(tmp, mpnt))
66711- goto fail_nomem_anon_vma_fork;
66712- tmp->vm_flags &= ~VM_LOCKED;
66713- tmp->vm_next = tmp->vm_prev = NULL;
66714- file = tmp->vm_file;
66715- if (file) {
66716- struct inode *inode = file->f_path.dentry->d_inode;
66717- struct address_space *mapping = file->f_mapping;
66718-
66719- get_file(file);
66720- if (tmp->vm_flags & VM_DENYWRITE)
66721- atomic_dec(&inode->i_writecount);
66722- mutex_lock(&mapping->i_mmap_mutex);
66723- if (tmp->vm_flags & VM_SHARED)
66724- mapping->i_mmap_writable++;
66725- flush_dcache_mmap_lock(mapping);
66726- /* insert tmp into the share list, just after mpnt */
66727- vma_prio_tree_add(tmp, mpnt);
66728- flush_dcache_mmap_unlock(mapping);
66729- mutex_unlock(&mapping->i_mmap_mutex);
66730- }
66731-
66732- /*
66733- * Clear hugetlb-related page reserves for children. This only
66734- * affects MAP_PRIVATE mappings. Faults generated by the child
66735- * are not guaranteed to succeed, even if read-only
66736- */
66737- if (is_vm_hugetlb_page(tmp))
66738- reset_vma_resv_huge_pages(tmp);
66739
66740 /*
66741 * Link in the new vma and copy the page table entries.
66742@@ -422,6 +442,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66743 if (retval)
66744 goto out;
66745 }
66746+
66747+#ifdef CONFIG_PAX_SEGMEXEC
66748+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
66749+ struct vm_area_struct *mpnt_m;
66750+
66751+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
66752+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
66753+
66754+ if (!mpnt->vm_mirror)
66755+ continue;
66756+
66757+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
66758+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
66759+ mpnt->vm_mirror = mpnt_m;
66760+ } else {
66761+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
66762+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
66763+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
66764+ mpnt->vm_mirror->vm_mirror = mpnt;
66765+ }
66766+ }
66767+ BUG_ON(mpnt_m);
66768+ }
66769+#endif
66770+
66771 /* a new mm has just been created */
66772 arch_dup_mmap(oldmm, mm);
66773 retval = 0;
66774@@ -430,14 +475,6 @@ out:
66775 flush_tlb_mm(oldmm);
66776 up_write(&oldmm->mmap_sem);
66777 return retval;
66778-fail_nomem_anon_vma_fork:
66779- mpol_put(pol);
66780-fail_nomem_policy:
66781- kmem_cache_free(vm_area_cachep, tmp);
66782-fail_nomem:
66783- retval = -ENOMEM;
66784- vm_unacct_memory(charge);
66785- goto out;
66786 }
66787
66788 static inline int mm_alloc_pgd(struct mm_struct *mm)
66789@@ -837,13 +874,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
66790 spin_unlock(&fs->lock);
66791 return -EAGAIN;
66792 }
66793- fs->users++;
66794+ atomic_inc(&fs->users);
66795 spin_unlock(&fs->lock);
66796 return 0;
66797 }
66798 tsk->fs = copy_fs_struct(fs);
66799 if (!tsk->fs)
66800 return -ENOMEM;
66801+ gr_set_chroot_entries(tsk, &tsk->fs->root);
66802 return 0;
66803 }
66804
66805@@ -1105,6 +1143,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66806 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
66807 #endif
66808 retval = -EAGAIN;
66809+
66810+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
66811+
66812 if (atomic_read(&p->real_cred->user->processes) >=
66813 task_rlimit(p, RLIMIT_NPROC)) {
66814 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
66815@@ -1264,6 +1305,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66816 if (clone_flags & CLONE_THREAD)
66817 p->tgid = current->tgid;
66818
66819+ gr_copy_label(p);
66820+
66821 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
66822 /*
66823 * Clear TID on mm_release()?
66824@@ -1428,6 +1471,8 @@ bad_fork_cleanup_count:
66825 bad_fork_free:
66826 free_task(p);
66827 fork_out:
66828+ gr_log_forkfail(retval);
66829+
66830 return ERR_PTR(retval);
66831 }
66832
66833@@ -1528,6 +1573,8 @@ long do_fork(unsigned long clone_flags,
66834 if (clone_flags & CLONE_PARENT_SETTID)
66835 put_user(nr, parent_tidptr);
66836
66837+ gr_handle_brute_check();
66838+
66839 if (clone_flags & CLONE_VFORK) {
66840 p->vfork_done = &vfork;
66841 init_completion(&vfork);
66842@@ -1637,7 +1684,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
66843 return 0;
66844
66845 /* don't need lock here; in the worst case we'll do useless copy */
66846- if (fs->users == 1)
66847+ if (atomic_read(&fs->users) == 1)
66848 return 0;
66849
66850 *new_fsp = copy_fs_struct(fs);
66851@@ -1726,7 +1773,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
66852 fs = current->fs;
66853 spin_lock(&fs->lock);
66854 current->fs = new_fs;
66855- if (--fs->users)
66856+ gr_set_chroot_entries(current, &current->fs->root);
66857+ if (atomic_dec_return(&fs->users))
66858 new_fs = NULL;
66859 else
66860 new_fs = fs;
66861diff --git a/kernel/futex.c b/kernel/futex.c
66862index e6160fa..edf9565 100644
66863--- a/kernel/futex.c
66864+++ b/kernel/futex.c
66865@@ -54,6 +54,7 @@
66866 #include <linux/mount.h>
66867 #include <linux/pagemap.h>
66868 #include <linux/syscalls.h>
66869+#include <linux/ptrace.h>
66870 #include <linux/signal.h>
66871 #include <linux/module.h>
66872 #include <linux/magic.h>
66873@@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
66874 struct page *page, *page_head;
66875 int err, ro = 0;
66876
66877+#ifdef CONFIG_PAX_SEGMEXEC
66878+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
66879+ return -EFAULT;
66880+#endif
66881+
66882 /*
66883 * The futex address must be "naturally" aligned.
66884 */
66885@@ -1875,6 +1881,8 @@ static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
66886 struct futex_q q = futex_q_init;
66887 int ret;
66888
66889+ pax_track_stack();
66890+
66891 if (!bitset)
66892 return -EINVAL;
66893 q.bitset = bitset;
66894@@ -2271,6 +2279,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
66895 struct futex_q q = futex_q_init;
66896 int res, ret;
66897
66898+ pax_track_stack();
66899+
66900 if (!bitset)
66901 return -EINVAL;
66902
66903@@ -2459,6 +2469,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
66904 if (!p)
66905 goto err_unlock;
66906 ret = -EPERM;
66907+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66908+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66909+ goto err_unlock;
66910+#endif
66911 pcred = __task_cred(p);
66912 /* If victim is in different user_ns, then uids are not
66913 comparable, so we must have CAP_SYS_PTRACE */
66914@@ -2724,6 +2738,7 @@ static int __init futex_init(void)
66915 {
66916 u32 curval;
66917 int i;
66918+ mm_segment_t oldfs;
66919
66920 /*
66921 * This will fail and we want it. Some arch implementations do
66922@@ -2735,8 +2750,11 @@ static int __init futex_init(void)
66923 * implementation, the non-functional ones will return
66924 * -ENOSYS.
66925 */
66926+ oldfs = get_fs();
66927+ set_fs(USER_DS);
66928 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
66929 futex_cmpxchg_enabled = 1;
66930+ set_fs(oldfs);
66931
66932 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
66933 plist_head_init(&futex_queues[i].chain);
66934diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
66935index 5f9e689..582d46d 100644
66936--- a/kernel/futex_compat.c
66937+++ b/kernel/futex_compat.c
66938@@ -10,6 +10,7 @@
66939 #include <linux/compat.h>
66940 #include <linux/nsproxy.h>
66941 #include <linux/futex.h>
66942+#include <linux/ptrace.h>
66943
66944 #include <asm/uaccess.h>
66945
66946@@ -136,7 +137,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66947 {
66948 struct compat_robust_list_head __user *head;
66949 unsigned long ret;
66950- const struct cred *cred = current_cred(), *pcred;
66951+ const struct cred *cred = current_cred();
66952+ const struct cred *pcred;
66953
66954 if (!futex_cmpxchg_enabled)
66955 return -ENOSYS;
66956@@ -152,6 +154,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66957 if (!p)
66958 goto err_unlock;
66959 ret = -EPERM;
66960+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66961+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66962+ goto err_unlock;
66963+#endif
66964 pcred = __task_cred(p);
66965 /* If victim is in different user_ns, then uids are not
66966 comparable, so we must have CAP_SYS_PTRACE */
66967diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
66968index 9b22d03..6295b62 100644
66969--- a/kernel/gcov/base.c
66970+++ b/kernel/gcov/base.c
66971@@ -102,11 +102,6 @@ void gcov_enable_events(void)
66972 }
66973
66974 #ifdef CONFIG_MODULES
66975-static inline int within(void *addr, void *start, unsigned long size)
66976-{
66977- return ((addr >= start) && (addr < start + size));
66978-}
66979-
66980 /* Update list and generate events when modules are unloaded. */
66981 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66982 void *data)
66983@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66984 prev = NULL;
66985 /* Remove entries located in module from linked list. */
66986 for (info = gcov_info_head; info; info = info->next) {
66987- if (within(info, mod->module_core, mod->core_size)) {
66988+ if (within_module_core_rw((unsigned long)info, mod)) {
66989 if (prev)
66990 prev->next = info->next;
66991 else
66992diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
66993index 2043c08..ec81a69 100644
66994--- a/kernel/hrtimer.c
66995+++ b/kernel/hrtimer.c
66996@@ -1393,7 +1393,7 @@ void hrtimer_peek_ahead_timers(void)
66997 local_irq_restore(flags);
66998 }
66999
67000-static void run_hrtimer_softirq(struct softirq_action *h)
67001+static void run_hrtimer_softirq(void)
67002 {
67003 hrtimer_peek_ahead_timers();
67004 }
67005diff --git a/kernel/jump_label.c b/kernel/jump_label.c
67006index e6f1f24..6c19597 100644
67007--- a/kernel/jump_label.c
67008+++ b/kernel/jump_label.c
67009@@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
67010
67011 size = (((unsigned long)stop - (unsigned long)start)
67012 / sizeof(struct jump_entry));
67013+ pax_open_kernel();
67014 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67015+ pax_close_kernel();
67016 }
67017
67018 static void jump_label_update(struct jump_label_key *key, int enable);
67019@@ -298,10 +300,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
67020 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
67021 struct jump_entry *iter;
67022
67023+ pax_open_kernel();
67024 for (iter = iter_start; iter < iter_stop; iter++) {
67025 if (within_module_init(iter->code, mod))
67026 iter->code = 0;
67027 }
67028+ pax_close_kernel();
67029 }
67030
67031 static int
67032diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
67033index 079f1d3..a407562 100644
67034--- a/kernel/kallsyms.c
67035+++ b/kernel/kallsyms.c
67036@@ -11,6 +11,9 @@
67037 * Changed the compression method from stem compression to "table lookup"
67038 * compression (see scripts/kallsyms.c for a more complete description)
67039 */
67040+#ifdef CONFIG_GRKERNSEC_HIDESYM
67041+#define __INCLUDED_BY_HIDESYM 1
67042+#endif
67043 #include <linux/kallsyms.h>
67044 #include <linux/module.h>
67045 #include <linux/init.h>
67046@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
67047
67048 static inline int is_kernel_inittext(unsigned long addr)
67049 {
67050+ if (system_state != SYSTEM_BOOTING)
67051+ return 0;
67052+
67053 if (addr >= (unsigned long)_sinittext
67054 && addr <= (unsigned long)_einittext)
67055 return 1;
67056 return 0;
67057 }
67058
67059+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67060+#ifdef CONFIG_MODULES
67061+static inline int is_module_text(unsigned long addr)
67062+{
67063+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67064+ return 1;
67065+
67066+ addr = ktla_ktva(addr);
67067+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67068+}
67069+#else
67070+static inline int is_module_text(unsigned long addr)
67071+{
67072+ return 0;
67073+}
67074+#endif
67075+#endif
67076+
67077 static inline int is_kernel_text(unsigned long addr)
67078 {
67079 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67080@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
67081
67082 static inline int is_kernel(unsigned long addr)
67083 {
67084+
67085+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67086+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
67087+ return 1;
67088+
67089+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67090+#else
67091 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67092+#endif
67093+
67094 return 1;
67095 return in_gate_area_no_mm(addr);
67096 }
67097
67098 static int is_ksym_addr(unsigned long addr)
67099 {
67100+
67101+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67102+ if (is_module_text(addr))
67103+ return 0;
67104+#endif
67105+
67106 if (all_var)
67107 return is_kernel(addr);
67108
67109@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
67110
67111 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67112 {
67113- iter->name[0] = '\0';
67114 iter->nameoff = get_symbol_offset(new_pos);
67115 iter->pos = new_pos;
67116 }
67117@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, void *p)
67118 {
67119 struct kallsym_iter *iter = m->private;
67120
67121+#ifdef CONFIG_GRKERNSEC_HIDESYM
67122+ if (current_uid())
67123+ return 0;
67124+#endif
67125+
67126 /* Some debugging symbols have no name. Ignore them. */
67127 if (!iter->name[0])
67128 return 0;
67129@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
67130 struct kallsym_iter *iter;
67131 int ret;
67132
67133- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67134+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67135 if (!iter)
67136 return -ENOMEM;
67137 reset_iter(iter, 0);
67138diff --git a/kernel/kexec.c b/kernel/kexec.c
67139index 296fbc8..84cb857 100644
67140--- a/kernel/kexec.c
67141+++ b/kernel/kexec.c
67142@@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
67143 unsigned long flags)
67144 {
67145 struct compat_kexec_segment in;
67146- struct kexec_segment out, __user *ksegments;
67147+ struct kexec_segment out;
67148+ struct kexec_segment __user *ksegments;
67149 unsigned long i, result;
67150
67151 /* Don't allow clients that don't understand the native
67152diff --git a/kernel/kmod.c b/kernel/kmod.c
67153index a4bea97..7a1ae9a 100644
67154--- a/kernel/kmod.c
67155+++ b/kernel/kmod.c
67156@@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
67157 * If module auto-loading support is disabled then this function
67158 * becomes a no-operation.
67159 */
67160-int __request_module(bool wait, const char *fmt, ...)
67161+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67162 {
67163- va_list args;
67164 char module_name[MODULE_NAME_LEN];
67165 unsigned int max_modprobes;
67166 int ret;
67167- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67168+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67169 static char *envp[] = { "HOME=/",
67170 "TERM=linux",
67171 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67172@@ -88,9 +87,7 @@ int __request_module(bool wait, const char *fmt, ...)
67173 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67174 static int kmod_loop_msg;
67175
67176- va_start(args, fmt);
67177- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67178- va_end(args);
67179+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67180 if (ret >= MODULE_NAME_LEN)
67181 return -ENAMETOOLONG;
67182
67183@@ -98,6 +95,20 @@ int __request_module(bool wait, const char *fmt, ...)
67184 if (ret)
67185 return ret;
67186
67187+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67188+ if (!current_uid()) {
67189+ /* hack to workaround consolekit/udisks stupidity */
67190+ read_lock(&tasklist_lock);
67191+ if (!strcmp(current->comm, "mount") &&
67192+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67193+ read_unlock(&tasklist_lock);
67194+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67195+ return -EPERM;
67196+ }
67197+ read_unlock(&tasklist_lock);
67198+ }
67199+#endif
67200+
67201 /* If modprobe needs a service that is in a module, we get a recursive
67202 * loop. Limit the number of running kmod threads to max_threads/2 or
67203 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
67204@@ -133,6 +144,47 @@ int __request_module(bool wait, const char *fmt, ...)
67205 atomic_dec(&kmod_concurrent);
67206 return ret;
67207 }
67208+
67209+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67210+{
67211+ va_list args;
67212+ int ret;
67213+
67214+ va_start(args, fmt);
67215+ ret = ____request_module(wait, module_param, fmt, args);
67216+ va_end(args);
67217+
67218+ return ret;
67219+}
67220+
67221+int __request_module(bool wait, const char *fmt, ...)
67222+{
67223+ va_list args;
67224+ int ret;
67225+
67226+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67227+ if (current_uid()) {
67228+ char module_param[MODULE_NAME_LEN];
67229+
67230+ memset(module_param, 0, sizeof(module_param));
67231+
67232+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67233+
67234+ va_start(args, fmt);
67235+ ret = ____request_module(wait, module_param, fmt, args);
67236+ va_end(args);
67237+
67238+ return ret;
67239+ }
67240+#endif
67241+
67242+ va_start(args, fmt);
67243+ ret = ____request_module(wait, NULL, fmt, args);
67244+ va_end(args);
67245+
67246+ return ret;
67247+}
67248+
67249 EXPORT_SYMBOL(__request_module);
67250 #endif /* CONFIG_MODULES */
67251
67252@@ -222,7 +274,7 @@ static int wait_for_helper(void *data)
67253 *
67254 * Thus the __user pointer cast is valid here.
67255 */
67256- sys_wait4(pid, (int __user *)&ret, 0, NULL);
67257+ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
67258
67259 /*
67260 * If ret is 0, either ____call_usermodehelper failed and the
67261diff --git a/kernel/kprobes.c b/kernel/kprobes.c
67262index b30fd54..11821ec 100644
67263--- a/kernel/kprobes.c
67264+++ b/kernel/kprobes.c
67265@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
67266 * kernel image and loaded module images reside. This is required
67267 * so x86_64 can correctly handle the %rip-relative fixups.
67268 */
67269- kip->insns = module_alloc(PAGE_SIZE);
67270+ kip->insns = module_alloc_exec(PAGE_SIZE);
67271 if (!kip->insns) {
67272 kfree(kip);
67273 return NULL;
67274@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
67275 */
67276 if (!list_is_singular(&kip->list)) {
67277 list_del(&kip->list);
67278- module_free(NULL, kip->insns);
67279+ module_free_exec(NULL, kip->insns);
67280 kfree(kip);
67281 }
67282 return 1;
67283@@ -1949,7 +1949,7 @@ static int __init init_kprobes(void)
67284 {
67285 int i, err = 0;
67286 unsigned long offset = 0, size = 0;
67287- char *modname, namebuf[128];
67288+ char *modname, namebuf[KSYM_NAME_LEN];
67289 const char *symbol_name;
67290 void *addr;
67291 struct kprobe_blackpoint *kb;
67292@@ -2075,7 +2075,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
67293 const char *sym = NULL;
67294 unsigned int i = *(loff_t *) v;
67295 unsigned long offset = 0;
67296- char *modname, namebuf[128];
67297+ char *modname, namebuf[KSYM_NAME_LEN];
67298
67299 head = &kprobe_table[i];
67300 preempt_disable();
67301diff --git a/kernel/lockdep.c b/kernel/lockdep.c
67302index 4479606..4036bea 100644
67303--- a/kernel/lockdep.c
67304+++ b/kernel/lockdep.c
67305@@ -584,6 +584,10 @@ static int static_obj(void *obj)
67306 end = (unsigned long) &_end,
67307 addr = (unsigned long) obj;
67308
67309+#ifdef CONFIG_PAX_KERNEXEC
67310+ start = ktla_ktva(start);
67311+#endif
67312+
67313 /*
67314 * static variable?
67315 */
67316@@ -719,6 +723,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
67317 if (!static_obj(lock->key)) {
67318 debug_locks_off();
67319 printk("INFO: trying to register non-static key.\n");
67320+ printk("lock:%pS key:%pS.\n", lock, lock->key);
67321 printk("the code is fine but needs lockdep annotation.\n");
67322 printk("turning off the locking correctness validator.\n");
67323 dump_stack();
67324@@ -2954,7 +2959,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
67325 if (!class)
67326 return 0;
67327 }
67328- atomic_inc((atomic_t *)&class->ops);
67329+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
67330 if (very_verbose(class)) {
67331 printk("\nacquire class [%p] %s", class->key, class->name);
67332 if (class->name_version > 1)
67333diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
67334index 71edd2f..e0542a5 100644
67335--- a/kernel/lockdep_proc.c
67336+++ b/kernel/lockdep_proc.c
67337@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
67338
67339 static void print_name(struct seq_file *m, struct lock_class *class)
67340 {
67341- char str[128];
67342+ char str[KSYM_NAME_LEN];
67343 const char *name = class->name;
67344
67345 if (!name) {
67346diff --git a/kernel/module.c b/kernel/module.c
67347index 04379f92..fba2faf 100644
67348--- a/kernel/module.c
67349+++ b/kernel/module.c
67350@@ -58,6 +58,7 @@
67351 #include <linux/jump_label.h>
67352 #include <linux/pfn.h>
67353 #include <linux/bsearch.h>
67354+#include <linux/grsecurity.h>
67355
67356 #define CREATE_TRACE_POINTS
67357 #include <trace/events/module.h>
67358@@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
67359
67360 /* Bounds of module allocation, for speeding __module_address.
67361 * Protected by module_mutex. */
67362-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
67363+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
67364+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
67365
67366 int register_module_notifier(struct notifier_block * nb)
67367 {
67368@@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
67369 return true;
67370
67371 list_for_each_entry_rcu(mod, &modules, list) {
67372- struct symsearch arr[] = {
67373+ struct symsearch modarr[] = {
67374 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
67375 NOT_GPL_ONLY, false },
67376 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
67377@@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
67378 #endif
67379 };
67380
67381- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
67382+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
67383 return true;
67384 }
67385 return false;
67386@@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(struct module *mod)
67387 static int percpu_modalloc(struct module *mod,
67388 unsigned long size, unsigned long align)
67389 {
67390- if (align > PAGE_SIZE) {
67391+ if (align-1 >= PAGE_SIZE) {
67392 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
67393 mod->name, align, PAGE_SIZE);
67394 align = PAGE_SIZE;
67395@@ -1183,7 +1185,7 @@ resolve_symbol_wait(struct module *mod,
67396 */
67397 #ifdef CONFIG_SYSFS
67398
67399-#ifdef CONFIG_KALLSYMS
67400+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
67401 static inline bool sect_empty(const Elf_Shdr *sect)
67402 {
67403 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
67404@@ -1649,21 +1651,21 @@ static void set_section_ro_nx(void *base,
67405
67406 static void unset_module_core_ro_nx(struct module *mod)
67407 {
67408- set_page_attributes(mod->module_core + mod->core_text_size,
67409- mod->module_core + mod->core_size,
67410+ set_page_attributes(mod->module_core_rw,
67411+ mod->module_core_rw + mod->core_size_rw,
67412 set_memory_x);
67413- set_page_attributes(mod->module_core,
67414- mod->module_core + mod->core_ro_size,
67415+ set_page_attributes(mod->module_core_rx,
67416+ mod->module_core_rx + mod->core_size_rx,
67417 set_memory_rw);
67418 }
67419
67420 static void unset_module_init_ro_nx(struct module *mod)
67421 {
67422- set_page_attributes(mod->module_init + mod->init_text_size,
67423- mod->module_init + mod->init_size,
67424+ set_page_attributes(mod->module_init_rw,
67425+ mod->module_init_rw + mod->init_size_rw,
67426 set_memory_x);
67427- set_page_attributes(mod->module_init,
67428- mod->module_init + mod->init_ro_size,
67429+ set_page_attributes(mod->module_init_rx,
67430+ mod->module_init_rx + mod->init_size_rx,
67431 set_memory_rw);
67432 }
67433
67434@@ -1674,14 +1676,14 @@ void set_all_modules_text_rw(void)
67435
67436 mutex_lock(&module_mutex);
67437 list_for_each_entry_rcu(mod, &modules, list) {
67438- if ((mod->module_core) && (mod->core_text_size)) {
67439- set_page_attributes(mod->module_core,
67440- mod->module_core + mod->core_text_size,
67441+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
67442+ set_page_attributes(mod->module_core_rx,
67443+ mod->module_core_rx + mod->core_size_rx,
67444 set_memory_rw);
67445 }
67446- if ((mod->module_init) && (mod->init_text_size)) {
67447- set_page_attributes(mod->module_init,
67448- mod->module_init + mod->init_text_size,
67449+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
67450+ set_page_attributes(mod->module_init_rx,
67451+ mod->module_init_rx + mod->init_size_rx,
67452 set_memory_rw);
67453 }
67454 }
67455@@ -1695,14 +1697,14 @@ void set_all_modules_text_ro(void)
67456
67457 mutex_lock(&module_mutex);
67458 list_for_each_entry_rcu(mod, &modules, list) {
67459- if ((mod->module_core) && (mod->core_text_size)) {
67460- set_page_attributes(mod->module_core,
67461- mod->module_core + mod->core_text_size,
67462+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
67463+ set_page_attributes(mod->module_core_rx,
67464+ mod->module_core_rx + mod->core_size_rx,
67465 set_memory_ro);
67466 }
67467- if ((mod->module_init) && (mod->init_text_size)) {
67468- set_page_attributes(mod->module_init,
67469- mod->module_init + mod->init_text_size,
67470+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
67471+ set_page_attributes(mod->module_init_rx,
67472+ mod->module_init_rx + mod->init_size_rx,
67473 set_memory_ro);
67474 }
67475 }
67476@@ -1748,16 +1750,19 @@ static void free_module(struct module *mod)
67477
67478 /* This may be NULL, but that's OK */
67479 unset_module_init_ro_nx(mod);
67480- module_free(mod, mod->module_init);
67481+ module_free(mod, mod->module_init_rw);
67482+ module_free_exec(mod, mod->module_init_rx);
67483 kfree(mod->args);
67484 percpu_modfree(mod);
67485
67486 /* Free lock-classes: */
67487- lockdep_free_key_range(mod->module_core, mod->core_size);
67488+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
67489+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
67490
67491 /* Finally, free the core (containing the module structure) */
67492 unset_module_core_ro_nx(mod);
67493- module_free(mod, mod->module_core);
67494+ module_free_exec(mod, mod->module_core_rx);
67495+ module_free(mod, mod->module_core_rw);
67496
67497 #ifdef CONFIG_MPU
67498 update_protections(current->mm);
67499@@ -1826,10 +1831,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67500 unsigned int i;
67501 int ret = 0;
67502 const struct kernel_symbol *ksym;
67503+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67504+ int is_fs_load = 0;
67505+ int register_filesystem_found = 0;
67506+ char *p;
67507+
67508+ p = strstr(mod->args, "grsec_modharden_fs");
67509+ if (p) {
67510+ char *endptr = p + strlen("grsec_modharden_fs");
67511+ /* copy \0 as well */
67512+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
67513+ is_fs_load = 1;
67514+ }
67515+#endif
67516
67517 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
67518 const char *name = info->strtab + sym[i].st_name;
67519
67520+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67521+ /* it's a real shame this will never get ripped and copied
67522+ upstream! ;(
67523+ */
67524+ if (is_fs_load && !strcmp(name, "register_filesystem"))
67525+ register_filesystem_found = 1;
67526+#endif
67527+
67528 switch (sym[i].st_shndx) {
67529 case SHN_COMMON:
67530 /* We compiled with -fno-common. These are not
67531@@ -1850,7 +1876,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67532 ksym = resolve_symbol_wait(mod, info, name);
67533 /* Ok if resolved. */
67534 if (ksym && !IS_ERR(ksym)) {
67535+ pax_open_kernel();
67536 sym[i].st_value = ksym->value;
67537+ pax_close_kernel();
67538 break;
67539 }
67540
67541@@ -1869,11 +1897,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67542 secbase = (unsigned long)mod_percpu(mod);
67543 else
67544 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
67545+ pax_open_kernel();
67546 sym[i].st_value += secbase;
67547+ pax_close_kernel();
67548 break;
67549 }
67550 }
67551
67552+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67553+ if (is_fs_load && !register_filesystem_found) {
67554+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
67555+ ret = -EPERM;
67556+ }
67557+#endif
67558+
67559 return ret;
67560 }
67561
67562@@ -1977,22 +2014,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
67563 || s->sh_entsize != ~0UL
67564 || strstarts(sname, ".init"))
67565 continue;
67566- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
67567+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67568+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
67569+ else
67570+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
67571 DEBUGP("\t%s\n", name);
67572 }
67573- switch (m) {
67574- case 0: /* executable */
67575- mod->core_size = debug_align(mod->core_size);
67576- mod->core_text_size = mod->core_size;
67577- break;
67578- case 1: /* RO: text and ro-data */
67579- mod->core_size = debug_align(mod->core_size);
67580- mod->core_ro_size = mod->core_size;
67581- break;
67582- case 3: /* whole core */
67583- mod->core_size = debug_align(mod->core_size);
67584- break;
67585- }
67586 }
67587
67588 DEBUGP("Init section allocation order:\n");
67589@@ -2006,23 +2033,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
67590 || s->sh_entsize != ~0UL
67591 || !strstarts(sname, ".init"))
67592 continue;
67593- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
67594- | INIT_OFFSET_MASK);
67595+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67596+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
67597+ else
67598+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
67599+ s->sh_entsize |= INIT_OFFSET_MASK;
67600 DEBUGP("\t%s\n", sname);
67601 }
67602- switch (m) {
67603- case 0: /* executable */
67604- mod->init_size = debug_align(mod->init_size);
67605- mod->init_text_size = mod->init_size;
67606- break;
67607- case 1: /* RO: text and ro-data */
67608- mod->init_size = debug_align(mod->init_size);
67609- mod->init_ro_size = mod->init_size;
67610- break;
67611- case 3: /* whole init */
67612- mod->init_size = debug_align(mod->init_size);
67613- break;
67614- }
67615 }
67616 }
67617
67618@@ -2187,7 +2204,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
67619
67620 /* Put symbol section at end of init part of module. */
67621 symsect->sh_flags |= SHF_ALLOC;
67622- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
67623+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
67624 info->index.sym) | INIT_OFFSET_MASK;
67625 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
67626
67627@@ -2204,19 +2221,19 @@ static void layout_symtab(struct module *mod, struct load_info *info)
67628 }
67629
67630 /* Append room for core symbols at end of core part. */
67631- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
67632- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
67633+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
67634+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
67635
67636 /* Put string table section at end of init part of module. */
67637 strsect->sh_flags |= SHF_ALLOC;
67638- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
67639+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
67640 info->index.str) | INIT_OFFSET_MASK;
67641 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
67642
67643 /* Append room for core symbols' strings at end of core part. */
67644- info->stroffs = mod->core_size;
67645+ info->stroffs = mod->core_size_rx;
67646 __set_bit(0, info->strmap);
67647- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
67648+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
67649 }
67650
67651 static void add_kallsyms(struct module *mod, const struct load_info *info)
67652@@ -2232,11 +2249,13 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
67653 /* Make sure we get permanent strtab: don't use info->strtab. */
67654 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
67655
67656+ pax_open_kernel();
67657+
67658 /* Set types up while we still have access to sections. */
67659 for (i = 0; i < mod->num_symtab; i++)
67660 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
67661
67662- mod->core_symtab = dst = mod->module_core + info->symoffs;
67663+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
67664 src = mod->symtab;
67665 *dst = *src;
67666 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
67667@@ -2249,10 +2268,12 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
67668 }
67669 mod->core_num_syms = ndst;
67670
67671- mod->core_strtab = s = mod->module_core + info->stroffs;
67672+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
67673 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
67674 if (test_bit(i, info->strmap))
67675 *++s = mod->strtab[i];
67676+
67677+ pax_close_kernel();
67678 }
67679 #else
67680 static inline void layout_symtab(struct module *mod, struct load_info *info)
67681@@ -2286,17 +2307,33 @@ void * __weak module_alloc(unsigned long size)
67682 return size == 0 ? NULL : vmalloc_exec(size);
67683 }
67684
67685-static void *module_alloc_update_bounds(unsigned long size)
67686+static void *module_alloc_update_bounds_rw(unsigned long size)
67687 {
67688 void *ret = module_alloc(size);
67689
67690 if (ret) {
67691 mutex_lock(&module_mutex);
67692 /* Update module bounds. */
67693- if ((unsigned long)ret < module_addr_min)
67694- module_addr_min = (unsigned long)ret;
67695- if ((unsigned long)ret + size > module_addr_max)
67696- module_addr_max = (unsigned long)ret + size;
67697+ if ((unsigned long)ret < module_addr_min_rw)
67698+ module_addr_min_rw = (unsigned long)ret;
67699+ if ((unsigned long)ret + size > module_addr_max_rw)
67700+ module_addr_max_rw = (unsigned long)ret + size;
67701+ mutex_unlock(&module_mutex);
67702+ }
67703+ return ret;
67704+}
67705+
67706+static void *module_alloc_update_bounds_rx(unsigned long size)
67707+{
67708+ void *ret = module_alloc_exec(size);
67709+
67710+ if (ret) {
67711+ mutex_lock(&module_mutex);
67712+ /* Update module bounds. */
67713+ if ((unsigned long)ret < module_addr_min_rx)
67714+ module_addr_min_rx = (unsigned long)ret;
67715+ if ((unsigned long)ret + size > module_addr_max_rx)
67716+ module_addr_max_rx = (unsigned long)ret + size;
67717 mutex_unlock(&module_mutex);
67718 }
67719 return ret;
67720@@ -2474,8 +2511,14 @@ static struct module *setup_load_info(struct load_info *info)
67721 static int check_modinfo(struct module *mod, struct load_info *info)
67722 {
67723 const char *modmagic = get_modinfo(info, "vermagic");
67724+ const char *license = get_modinfo(info, "license");
67725 int err;
67726
67727+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
67728+ if (!license || !license_is_gpl_compatible(license))
67729+ return -ENOEXEC;
67730+#endif
67731+
67732 /* This is allowed: modprobe --force will invalidate it. */
67733 if (!modmagic) {
67734 err = try_to_force_load(mod, "bad vermagic");
67735@@ -2495,7 +2538,7 @@ static int check_modinfo(struct module *mod, struct load_info *info)
67736 }
67737
67738 /* Set up license info based on the info section */
67739- set_license(mod, get_modinfo(info, "license"));
67740+ set_license(mod, license);
67741
67742 return 0;
67743 }
67744@@ -2589,7 +2632,7 @@ static int move_module(struct module *mod, struct load_info *info)
67745 void *ptr;
67746
67747 /* Do the allocs. */
67748- ptr = module_alloc_update_bounds(mod->core_size);
67749+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
67750 /*
67751 * The pointer to this block is stored in the module structure
67752 * which is inside the block. Just mark it as not being a
67753@@ -2599,23 +2642,50 @@ static int move_module(struct module *mod, struct load_info *info)
67754 if (!ptr)
67755 return -ENOMEM;
67756
67757- memset(ptr, 0, mod->core_size);
67758- mod->module_core = ptr;
67759+ memset(ptr, 0, mod->core_size_rw);
67760+ mod->module_core_rw = ptr;
67761
67762- ptr = module_alloc_update_bounds(mod->init_size);
67763+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
67764 /*
67765 * The pointer to this block is stored in the module structure
67766 * which is inside the block. This block doesn't need to be
67767 * scanned as it contains data and code that will be freed
67768 * after the module is initialized.
67769 */
67770- kmemleak_ignore(ptr);
67771- if (!ptr && mod->init_size) {
67772- module_free(mod, mod->module_core);
67773+ kmemleak_not_leak(ptr);
67774+ if (!ptr && mod->init_size_rw) {
67775+ module_free(mod, mod->module_core_rw);
67776 return -ENOMEM;
67777 }
67778- memset(ptr, 0, mod->init_size);
67779- mod->module_init = ptr;
67780+ memset(ptr, 0, mod->init_size_rw);
67781+ mod->module_init_rw = ptr;
67782+
67783+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
67784+ kmemleak_not_leak(ptr);
67785+ if (!ptr) {
67786+ module_free(mod, mod->module_init_rw);
67787+ module_free(mod, mod->module_core_rw);
67788+ return -ENOMEM;
67789+ }
67790+
67791+ pax_open_kernel();
67792+ memset(ptr, 0, mod->core_size_rx);
67793+ pax_close_kernel();
67794+ mod->module_core_rx = ptr;
67795+
67796+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
67797+ kmemleak_not_leak(ptr);
67798+ if (!ptr && mod->init_size_rx) {
67799+ module_free_exec(mod, mod->module_core_rx);
67800+ module_free(mod, mod->module_init_rw);
67801+ module_free(mod, mod->module_core_rw);
67802+ return -ENOMEM;
67803+ }
67804+
67805+ pax_open_kernel();
67806+ memset(ptr, 0, mod->init_size_rx);
67807+ pax_close_kernel();
67808+ mod->module_init_rx = ptr;
67809
67810 /* Transfer each section which specifies SHF_ALLOC */
67811 DEBUGP("final section addresses:\n");
67812@@ -2626,16 +2696,45 @@ static int move_module(struct module *mod, struct load_info *info)
67813 if (!(shdr->sh_flags & SHF_ALLOC))
67814 continue;
67815
67816- if (shdr->sh_entsize & INIT_OFFSET_MASK)
67817- dest = mod->module_init
67818- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67819- else
67820- dest = mod->module_core + shdr->sh_entsize;
67821+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
67822+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67823+ dest = mod->module_init_rw
67824+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67825+ else
67826+ dest = mod->module_init_rx
67827+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67828+ } else {
67829+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67830+ dest = mod->module_core_rw + shdr->sh_entsize;
67831+ else
67832+ dest = mod->module_core_rx + shdr->sh_entsize;
67833+ }
67834+
67835+ if (shdr->sh_type != SHT_NOBITS) {
67836+
67837+#ifdef CONFIG_PAX_KERNEXEC
67838+#ifdef CONFIG_X86_64
67839+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
67840+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
67841+#endif
67842+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
67843+ pax_open_kernel();
67844+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67845+ pax_close_kernel();
67846+ } else
67847+#endif
67848
67849- if (shdr->sh_type != SHT_NOBITS)
67850 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67851+ }
67852 /* Update sh_addr to point to copy in image. */
67853- shdr->sh_addr = (unsigned long)dest;
67854+
67855+#ifdef CONFIG_PAX_KERNEXEC
67856+ if (shdr->sh_flags & SHF_EXECINSTR)
67857+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
67858+ else
67859+#endif
67860+
67861+ shdr->sh_addr = (unsigned long)dest;
67862 DEBUGP("\t0x%lx %s\n",
67863 shdr->sh_addr, info->secstrings + shdr->sh_name);
67864 }
67865@@ -2686,12 +2785,12 @@ static void flush_module_icache(const struct module *mod)
67866 * Do it before processing of module parameters, so the module
67867 * can provide parameter accessor functions of its own.
67868 */
67869- if (mod->module_init)
67870- flush_icache_range((unsigned long)mod->module_init,
67871- (unsigned long)mod->module_init
67872- + mod->init_size);
67873- flush_icache_range((unsigned long)mod->module_core,
67874- (unsigned long)mod->module_core + mod->core_size);
67875+ if (mod->module_init_rx)
67876+ flush_icache_range((unsigned long)mod->module_init_rx,
67877+ (unsigned long)mod->module_init_rx
67878+ + mod->init_size_rx);
67879+ flush_icache_range((unsigned long)mod->module_core_rx,
67880+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
67881
67882 set_fs(old_fs);
67883 }
67884@@ -2771,8 +2870,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
67885 {
67886 kfree(info->strmap);
67887 percpu_modfree(mod);
67888- module_free(mod, mod->module_init);
67889- module_free(mod, mod->module_core);
67890+ module_free_exec(mod, mod->module_init_rx);
67891+ module_free_exec(mod, mod->module_core_rx);
67892+ module_free(mod, mod->module_init_rw);
67893+ module_free(mod, mod->module_core_rw);
67894 }
67895
67896 int __weak module_finalize(const Elf_Ehdr *hdr,
67897@@ -2836,9 +2937,38 @@ static struct module *load_module(void __user *umod,
67898 if (err)
67899 goto free_unload;
67900
67901+ /* Now copy in args */
67902+ mod->args = strndup_user(uargs, ~0UL >> 1);
67903+ if (IS_ERR(mod->args)) {
67904+ err = PTR_ERR(mod->args);
67905+ goto free_unload;
67906+ }
67907+
67908 /* Set up MODINFO_ATTR fields */
67909 setup_modinfo(mod, &info);
67910
67911+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67912+ {
67913+ char *p, *p2;
67914+
67915+ if (strstr(mod->args, "grsec_modharden_netdev")) {
67916+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
67917+ err = -EPERM;
67918+ goto free_modinfo;
67919+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
67920+ p += strlen("grsec_modharden_normal");
67921+ p2 = strstr(p, "_");
67922+ if (p2) {
67923+ *p2 = '\0';
67924+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
67925+ *p2 = '_';
67926+ }
67927+ err = -EPERM;
67928+ goto free_modinfo;
67929+ }
67930+ }
67931+#endif
67932+
67933 /* Fix up syms, so that st_value is a pointer to location. */
67934 err = simplify_symbols(mod, &info);
67935 if (err < 0)
67936@@ -2854,13 +2984,6 @@ static struct module *load_module(void __user *umod,
67937
67938 flush_module_icache(mod);
67939
67940- /* Now copy in args */
67941- mod->args = strndup_user(uargs, ~0UL >> 1);
67942- if (IS_ERR(mod->args)) {
67943- err = PTR_ERR(mod->args);
67944- goto free_arch_cleanup;
67945- }
67946-
67947 /* Mark state as coming so strong_try_module_get() ignores us. */
67948 mod->state = MODULE_STATE_COMING;
67949
67950@@ -2920,11 +3043,10 @@ static struct module *load_module(void __user *umod,
67951 unlock:
67952 mutex_unlock(&module_mutex);
67953 synchronize_sched();
67954- kfree(mod->args);
67955- free_arch_cleanup:
67956 module_arch_cleanup(mod);
67957 free_modinfo:
67958 free_modinfo(mod);
67959+ kfree(mod->args);
67960 free_unload:
67961 module_unload_free(mod);
67962 free_module:
67963@@ -2965,16 +3087,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67964 MODULE_STATE_COMING, mod);
67965
67966 /* Set RO and NX regions for core */
67967- set_section_ro_nx(mod->module_core,
67968- mod->core_text_size,
67969- mod->core_ro_size,
67970- mod->core_size);
67971+ set_section_ro_nx(mod->module_core_rx,
67972+ mod->core_size_rx,
67973+ mod->core_size_rx,
67974+ mod->core_size_rx);
67975
67976 /* Set RO and NX regions for init */
67977- set_section_ro_nx(mod->module_init,
67978- mod->init_text_size,
67979- mod->init_ro_size,
67980- mod->init_size);
67981+ set_section_ro_nx(mod->module_init_rx,
67982+ mod->init_size_rx,
67983+ mod->init_size_rx,
67984+ mod->init_size_rx);
67985
67986 do_mod_ctors(mod);
67987 /* Start the module */
67988@@ -3020,11 +3142,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67989 mod->strtab = mod->core_strtab;
67990 #endif
67991 unset_module_init_ro_nx(mod);
67992- module_free(mod, mod->module_init);
67993- mod->module_init = NULL;
67994- mod->init_size = 0;
67995- mod->init_ro_size = 0;
67996- mod->init_text_size = 0;
67997+ module_free(mod, mod->module_init_rw);
67998+ module_free_exec(mod, mod->module_init_rx);
67999+ mod->module_init_rw = NULL;
68000+ mod->module_init_rx = NULL;
68001+ mod->init_size_rw = 0;
68002+ mod->init_size_rx = 0;
68003 mutex_unlock(&module_mutex);
68004
68005 return 0;
68006@@ -3055,10 +3178,16 @@ static const char *get_ksymbol(struct module *mod,
68007 unsigned long nextval;
68008
68009 /* At worse, next value is at end of module */
68010- if (within_module_init(addr, mod))
68011- nextval = (unsigned long)mod->module_init+mod->init_text_size;
68012+ if (within_module_init_rx(addr, mod))
68013+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68014+ else if (within_module_init_rw(addr, mod))
68015+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68016+ else if (within_module_core_rx(addr, mod))
68017+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68018+ else if (within_module_core_rw(addr, mod))
68019+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68020 else
68021- nextval = (unsigned long)mod->module_core+mod->core_text_size;
68022+ return NULL;
68023
68024 /* Scan for closest preceding symbol, and next symbol. (ELF
68025 starts real symbols at 1). */
68026@@ -3304,7 +3433,7 @@ static int m_show(struct seq_file *m, void *p)
68027 char buf[8];
68028
68029 seq_printf(m, "%s %u",
68030- mod->name, mod->init_size + mod->core_size);
68031+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68032 print_unload_info(m, mod);
68033
68034 /* Informative for users. */
68035@@ -3313,7 +3442,7 @@ static int m_show(struct seq_file *m, void *p)
68036 mod->state == MODULE_STATE_COMING ? "Loading":
68037 "Live");
68038 /* Used by oprofile and other similar tools. */
68039- seq_printf(m, " 0x%pK", mod->module_core);
68040+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68041
68042 /* Taints info */
68043 if (mod->taints)
68044@@ -3349,7 +3478,17 @@ static const struct file_operations proc_modules_operations = {
68045
68046 static int __init proc_modules_init(void)
68047 {
68048+#ifndef CONFIG_GRKERNSEC_HIDESYM
68049+#ifdef CONFIG_GRKERNSEC_PROC_USER
68050+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68051+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68052+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68053+#else
68054 proc_create("modules", 0, NULL, &proc_modules_operations);
68055+#endif
68056+#else
68057+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68058+#endif
68059 return 0;
68060 }
68061 module_init(proc_modules_init);
68062@@ -3408,12 +3547,12 @@ struct module *__module_address(unsigned long addr)
68063 {
68064 struct module *mod;
68065
68066- if (addr < module_addr_min || addr > module_addr_max)
68067+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68068+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
68069 return NULL;
68070
68071 list_for_each_entry_rcu(mod, &modules, list)
68072- if (within_module_core(addr, mod)
68073- || within_module_init(addr, mod))
68074+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
68075 return mod;
68076 return NULL;
68077 }
68078@@ -3447,11 +3586,20 @@ bool is_module_text_address(unsigned long addr)
68079 */
68080 struct module *__module_text_address(unsigned long addr)
68081 {
68082- struct module *mod = __module_address(addr);
68083+ struct module *mod;
68084+
68085+#ifdef CONFIG_X86_32
68086+ addr = ktla_ktva(addr);
68087+#endif
68088+
68089+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68090+ return NULL;
68091+
68092+ mod = __module_address(addr);
68093+
68094 if (mod) {
68095 /* Make sure it's within the text section. */
68096- if (!within(addr, mod->module_init, mod->init_text_size)
68097- && !within(addr, mod->module_core, mod->core_text_size))
68098+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68099 mod = NULL;
68100 }
68101 return mod;
68102diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
68103index 73da83a..fe46e99 100644
68104--- a/kernel/mutex-debug.c
68105+++ b/kernel/mutex-debug.c
68106@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
68107 }
68108
68109 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68110- struct thread_info *ti)
68111+ struct task_struct *task)
68112 {
68113 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68114
68115 /* Mark the current thread as blocked on the lock: */
68116- ti->task->blocked_on = waiter;
68117+ task->blocked_on = waiter;
68118 }
68119
68120 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68121- struct thread_info *ti)
68122+ struct task_struct *task)
68123 {
68124 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68125- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68126- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68127- ti->task->blocked_on = NULL;
68128+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
68129+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68130+ task->blocked_on = NULL;
68131
68132 list_del_init(&waiter->list);
68133 waiter->task = NULL;
68134diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
68135index 0799fd3..d06ae3b 100644
68136--- a/kernel/mutex-debug.h
68137+++ b/kernel/mutex-debug.h
68138@@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
68139 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68140 extern void debug_mutex_add_waiter(struct mutex *lock,
68141 struct mutex_waiter *waiter,
68142- struct thread_info *ti);
68143+ struct task_struct *task);
68144 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68145- struct thread_info *ti);
68146+ struct task_struct *task);
68147 extern void debug_mutex_unlock(struct mutex *lock);
68148 extern void debug_mutex_init(struct mutex *lock, const char *name,
68149 struct lock_class_key *key);
68150diff --git a/kernel/mutex.c b/kernel/mutex.c
68151index d607ed5..58d0a52 100644
68152--- a/kernel/mutex.c
68153+++ b/kernel/mutex.c
68154@@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68155 spin_lock_mutex(&lock->wait_lock, flags);
68156
68157 debug_mutex_lock_common(lock, &waiter);
68158- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68159+ debug_mutex_add_waiter(lock, &waiter, task);
68160
68161 /* add waiting tasks to the end of the waitqueue (FIFO): */
68162 list_add_tail(&waiter.list, &lock->wait_list);
68163@@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68164 * TASK_UNINTERRUPTIBLE case.)
68165 */
68166 if (unlikely(signal_pending_state(state, task))) {
68167- mutex_remove_waiter(lock, &waiter,
68168- task_thread_info(task));
68169+ mutex_remove_waiter(lock, &waiter, task);
68170 mutex_release(&lock->dep_map, 1, ip);
68171 spin_unlock_mutex(&lock->wait_lock, flags);
68172
68173@@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68174 done:
68175 lock_acquired(&lock->dep_map, ip);
68176 /* got the lock - rejoice! */
68177- mutex_remove_waiter(lock, &waiter, current_thread_info());
68178+ mutex_remove_waiter(lock, &waiter, task);
68179 mutex_set_owner(lock);
68180
68181 /* set it to 0 if there are no waiters left: */
68182diff --git a/kernel/padata.c b/kernel/padata.c
68183index b91941d..0871d60 100644
68184--- a/kernel/padata.c
68185+++ b/kernel/padata.c
68186@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_instance *pinst,
68187 padata->pd = pd;
68188 padata->cb_cpu = cb_cpu;
68189
68190- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
68191- atomic_set(&pd->seq_nr, -1);
68192+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
68193+ atomic_set_unchecked(&pd->seq_nr, -1);
68194
68195- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
68196+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
68197
68198 target_cpu = padata_cpu_hash(padata);
68199 queue = per_cpu_ptr(pd->pqueue, target_cpu);
68200@@ -444,7 +444,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
68201 padata_init_pqueues(pd);
68202 padata_init_squeues(pd);
68203 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
68204- atomic_set(&pd->seq_nr, -1);
68205+ atomic_set_unchecked(&pd->seq_nr, -1);
68206 atomic_set(&pd->reorder_objects, 0);
68207 atomic_set(&pd->refcnt, 0);
68208 pd->pinst = pinst;
68209diff --git a/kernel/panic.c b/kernel/panic.c
68210index d7bb697..0ff55cc 100644
68211--- a/kernel/panic.c
68212+++ b/kernel/panic.c
68213@@ -78,7 +78,11 @@ NORET_TYPE void panic(const char * fmt, ...)
68214 va_end(args);
68215 printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
68216 #ifdef CONFIG_DEBUG_BUGVERBOSE
68217- dump_stack();
68218+ /*
68219+ * Avoid nested stack-dumping if a panic occurs during oops processing
68220+ */
68221+ if (!oops_in_progress)
68222+ dump_stack();
68223 #endif
68224
68225 /*
68226@@ -371,7 +375,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
68227 const char *board;
68228
68229 printk(KERN_WARNING "------------[ cut here ]------------\n");
68230- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68231+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68232 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68233 if (board)
68234 printk(KERN_WARNING "Hardware name: %s\n", board);
68235@@ -426,7 +430,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
68236 */
68237 void __stack_chk_fail(void)
68238 {
68239- panic("stack-protector: Kernel stack is corrupted in: %p\n",
68240+ dump_stack();
68241+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
68242 __builtin_return_address(0));
68243 }
68244 EXPORT_SYMBOL(__stack_chk_fail);
68245diff --git a/kernel/pid.c b/kernel/pid.c
68246index e432057..a2b2ac5 100644
68247--- a/kernel/pid.c
68248+++ b/kernel/pid.c
68249@@ -33,6 +33,7 @@
68250 #include <linux/rculist.h>
68251 #include <linux/bootmem.h>
68252 #include <linux/hash.h>
68253+#include <linux/security.h>
68254 #include <linux/pid_namespace.h>
68255 #include <linux/init_task.h>
68256 #include <linux/syscalls.h>
68257@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
68258
68259 int pid_max = PID_MAX_DEFAULT;
68260
68261-#define RESERVED_PIDS 300
68262+#define RESERVED_PIDS 500
68263
68264 int pid_max_min = RESERVED_PIDS + 1;
68265 int pid_max_max = PID_MAX_LIMIT;
68266@@ -418,8 +419,15 @@ EXPORT_SYMBOL(pid_task);
68267 */
68268 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
68269 {
68270+ struct task_struct *task;
68271+
68272 rcu_lockdep_assert(rcu_read_lock_held());
68273- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68274+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68275+
68276+ if (gr_pid_is_chrooted(task))
68277+ return NULL;
68278+
68279+ return task;
68280 }
68281
68282 struct task_struct *find_task_by_vpid(pid_t vnr)
68283@@ -427,6 +435,12 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
68284 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
68285 }
68286
68287+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
68288+{
68289+ rcu_lockdep_assert(rcu_read_lock_held());
68290+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
68291+}
68292+
68293 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
68294 {
68295 struct pid *pid;
68296diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
68297index 640ded8..3dafb85 100644
68298--- a/kernel/posix-cpu-timers.c
68299+++ b/kernel/posix-cpu-timers.c
68300@@ -6,6 +6,7 @@
68301 #include <linux/posix-timers.h>
68302 #include <linux/errno.h>
68303 #include <linux/math64.h>
68304+#include <linux/security.h>
68305 #include <asm/uaccess.h>
68306 #include <linux/kernel_stat.h>
68307 #include <trace/events/timer.h>
68308@@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
68309
68310 static __init int init_posix_cpu_timers(void)
68311 {
68312- struct k_clock process = {
68313+ static struct k_clock process = {
68314 .clock_getres = process_cpu_clock_getres,
68315 .clock_get = process_cpu_clock_get,
68316 .timer_create = process_cpu_timer_create,
68317 .nsleep = process_cpu_nsleep,
68318 .nsleep_restart = process_cpu_nsleep_restart,
68319 };
68320- struct k_clock thread = {
68321+ static struct k_clock thread = {
68322 .clock_getres = thread_cpu_clock_getres,
68323 .clock_get = thread_cpu_clock_get,
68324 .timer_create = thread_cpu_timer_create,
68325diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
68326index 4556182..9335419 100644
68327--- a/kernel/posix-timers.c
68328+++ b/kernel/posix-timers.c
68329@@ -43,6 +43,7 @@
68330 #include <linux/idr.h>
68331 #include <linux/posix-clock.h>
68332 #include <linux/posix-timers.h>
68333+#include <linux/grsecurity.h>
68334 #include <linux/syscalls.h>
68335 #include <linux/wait.h>
68336 #include <linux/workqueue.h>
68337@@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
68338 * which we beg off on and pass to do_sys_settimeofday().
68339 */
68340
68341-static struct k_clock posix_clocks[MAX_CLOCKS];
68342+static struct k_clock *posix_clocks[MAX_CLOCKS];
68343
68344 /*
68345 * These ones are defined below.
68346@@ -227,7 +228,7 @@ static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
68347 */
68348 static __init int init_posix_timers(void)
68349 {
68350- struct k_clock clock_realtime = {
68351+ static struct k_clock clock_realtime = {
68352 .clock_getres = hrtimer_get_res,
68353 .clock_get = posix_clock_realtime_get,
68354 .clock_set = posix_clock_realtime_set,
68355@@ -239,7 +240,7 @@ static __init int init_posix_timers(void)
68356 .timer_get = common_timer_get,
68357 .timer_del = common_timer_del,
68358 };
68359- struct k_clock clock_monotonic = {
68360+ static struct k_clock clock_monotonic = {
68361 .clock_getres = hrtimer_get_res,
68362 .clock_get = posix_ktime_get_ts,
68363 .nsleep = common_nsleep,
68364@@ -249,19 +250,19 @@ static __init int init_posix_timers(void)
68365 .timer_get = common_timer_get,
68366 .timer_del = common_timer_del,
68367 };
68368- struct k_clock clock_monotonic_raw = {
68369+ static struct k_clock clock_monotonic_raw = {
68370 .clock_getres = hrtimer_get_res,
68371 .clock_get = posix_get_monotonic_raw,
68372 };
68373- struct k_clock clock_realtime_coarse = {
68374+ static struct k_clock clock_realtime_coarse = {
68375 .clock_getres = posix_get_coarse_res,
68376 .clock_get = posix_get_realtime_coarse,
68377 };
68378- struct k_clock clock_monotonic_coarse = {
68379+ static struct k_clock clock_monotonic_coarse = {
68380 .clock_getres = posix_get_coarse_res,
68381 .clock_get = posix_get_monotonic_coarse,
68382 };
68383- struct k_clock clock_boottime = {
68384+ static struct k_clock clock_boottime = {
68385 .clock_getres = hrtimer_get_res,
68386 .clock_get = posix_get_boottime,
68387 .nsleep = common_nsleep,
68388@@ -272,6 +273,8 @@ static __init int init_posix_timers(void)
68389 .timer_del = common_timer_del,
68390 };
68391
68392+ pax_track_stack();
68393+
68394 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
68395 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
68396 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
68397@@ -473,7 +476,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
68398 return;
68399 }
68400
68401- posix_clocks[clock_id] = *new_clock;
68402+ posix_clocks[clock_id] = new_clock;
68403 }
68404 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
68405
68406@@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
68407 return (id & CLOCKFD_MASK) == CLOCKFD ?
68408 &clock_posix_dynamic : &clock_posix_cpu;
68409
68410- if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
68411+ if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
68412 return NULL;
68413- return &posix_clocks[id];
68414+ return posix_clocks[id];
68415 }
68416
68417 static int common_timer_create(struct k_itimer *new_timer)
68418@@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
68419 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
68420 return -EFAULT;
68421
68422+ /* only the CLOCK_REALTIME clock can be set, all other clocks
68423+ have their clock_set fptr set to a nosettime dummy function
68424+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
68425+ call common_clock_set, which calls do_sys_settimeofday, which
68426+ we hook
68427+ */
68428+
68429 return kc->clock_set(which_clock, &new_tp);
68430 }
68431
68432diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
68433index d523593..68197a4 100644
68434--- a/kernel/power/poweroff.c
68435+++ b/kernel/power/poweroff.c
68436@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
68437 .enable_mask = SYSRQ_ENABLE_BOOT,
68438 };
68439
68440-static int pm_sysrq_init(void)
68441+static int __init pm_sysrq_init(void)
68442 {
68443 register_sysrq_key('o', &sysrq_poweroff_op);
68444 return 0;
68445diff --git a/kernel/power/process.c b/kernel/power/process.c
68446index 0cf3a27..5481be4 100644
68447--- a/kernel/power/process.c
68448+++ b/kernel/power/process.c
68449@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_only)
68450 u64 elapsed_csecs64;
68451 unsigned int elapsed_csecs;
68452 bool wakeup = false;
68453+ bool timedout = false;
68454
68455 do_gettimeofday(&start);
68456
68457@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_only)
68458
68459 while (true) {
68460 todo = 0;
68461+ if (time_after(jiffies, end_time))
68462+ timedout = true;
68463 read_lock(&tasklist_lock);
68464 do_each_thread(g, p) {
68465 if (frozen(p) || !freezable(p))
68466@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_only)
68467 * try_to_stop() after schedule() in ptrace/signal
68468 * stop sees TIF_FREEZE.
68469 */
68470- if (!task_is_stopped_or_traced(p) &&
68471- !freezer_should_skip(p))
68472+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
68473 todo++;
68474+ if (timedout) {
68475+ printk(KERN_ERR "Task refusing to freeze:\n");
68476+ sched_show_task(p);
68477+ }
68478+ }
68479 } while_each_thread(g, p);
68480 read_unlock(&tasklist_lock);
68481
68482@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_only)
68483 todo += wq_busy;
68484 }
68485
68486- if (!todo || time_after(jiffies, end_time))
68487+ if (!todo || timedout)
68488 break;
68489
68490 if (pm_wakeup_pending()) {
68491diff --git a/kernel/printk.c b/kernel/printk.c
68492index 28a40d8..2411bec 100644
68493--- a/kernel/printk.c
68494+++ b/kernel/printk.c
68495@@ -313,6 +313,11 @@ static int check_syslog_permissions(int type, bool from_file)
68496 if (from_file && type != SYSLOG_ACTION_OPEN)
68497 return 0;
68498
68499+#ifdef CONFIG_GRKERNSEC_DMESG
68500+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
68501+ return -EPERM;
68502+#endif
68503+
68504 if (syslog_action_restricted(type)) {
68505 if (capable(CAP_SYSLOG))
68506 return 0;
68507diff --git a/kernel/profile.c b/kernel/profile.c
68508index 961b389..c451353 100644
68509--- a/kernel/profile.c
68510+++ b/kernel/profile.c
68511@@ -39,7 +39,7 @@ struct profile_hit {
68512 /* Oprofile timer tick hook */
68513 static int (*timer_hook)(struct pt_regs *) __read_mostly;
68514
68515-static atomic_t *prof_buffer;
68516+static atomic_unchecked_t *prof_buffer;
68517 static unsigned long prof_len, prof_shift;
68518
68519 int prof_on __read_mostly;
68520@@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
68521 hits[i].pc = 0;
68522 continue;
68523 }
68524- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
68525+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
68526 hits[i].hits = hits[i].pc = 0;
68527 }
68528 }
68529@@ -342,9 +342,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
68530 * Add the current hit(s) and flush the write-queue out
68531 * to the global buffer:
68532 */
68533- atomic_add(nr_hits, &prof_buffer[pc]);
68534+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
68535 for (i = 0; i < NR_PROFILE_HIT; ++i) {
68536- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
68537+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
68538 hits[i].pc = hits[i].hits = 0;
68539 }
68540 out:
68541@@ -419,7 +419,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
68542 {
68543 unsigned long pc;
68544 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
68545- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
68546+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
68547 }
68548 #endif /* !CONFIG_SMP */
68549
68550@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
68551 return -EFAULT;
68552 buf++; p++; count--; read++;
68553 }
68554- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
68555+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
68556 if (copy_to_user(buf, (void *)pnt, count))
68557 return -EFAULT;
68558 read += count;
68559@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
68560 }
68561 #endif
68562 profile_discard_flip_buffers();
68563- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
68564+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
68565 return count;
68566 }
68567
68568diff --git a/kernel/ptrace.c b/kernel/ptrace.c
68569index 67d1fdd..1af21e2 100644
68570--- a/kernel/ptrace.c
68571+++ b/kernel/ptrace.c
68572@@ -172,7 +172,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
68573 return ret;
68574 }
68575
68576-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
68577+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
68578+ unsigned int log)
68579 {
68580 const struct cred *cred = current_cred(), *tcred;
68581
68582@@ -198,7 +199,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
68583 cred->gid == tcred->sgid &&
68584 cred->gid == tcred->gid))
68585 goto ok;
68586- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
68587+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
68588+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
68589 goto ok;
68590 rcu_read_unlock();
68591 return -EPERM;
68592@@ -207,7 +209,9 @@ ok:
68593 smp_rmb();
68594 if (task->mm)
68595 dumpable = get_dumpable(task->mm);
68596- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
68597+ if (!dumpable &&
68598+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
68599+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
68600 return -EPERM;
68601
68602 return security_ptrace_access_check(task, mode);
68603@@ -217,7 +221,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
68604 {
68605 int err;
68606 task_lock(task);
68607- err = __ptrace_may_access(task, mode);
68608+ err = __ptrace_may_access(task, mode, 0);
68609+ task_unlock(task);
68610+ return !err;
68611+}
68612+
68613+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
68614+{
68615+ int err;
68616+ task_lock(task);
68617+ err = __ptrace_may_access(task, mode, 1);
68618 task_unlock(task);
68619 return !err;
68620 }
68621@@ -262,7 +275,7 @@ static int ptrace_attach(struct task_struct *task, long request,
68622 goto out;
68623
68624 task_lock(task);
68625- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
68626+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
68627 task_unlock(task);
68628 if (retval)
68629 goto unlock_creds;
68630@@ -277,7 +290,7 @@ static int ptrace_attach(struct task_struct *task, long request,
68631 task->ptrace = PT_PTRACED;
68632 if (seize)
68633 task->ptrace |= PT_SEIZED;
68634- if (task_ns_capable(task, CAP_SYS_PTRACE))
68635+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
68636 task->ptrace |= PT_PTRACE_CAP;
68637
68638 __ptrace_link(task, current);
68639@@ -472,6 +485,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
68640 {
68641 int copied = 0;
68642
68643+ pax_track_stack();
68644+
68645 while (len > 0) {
68646 char buf[128];
68647 int this_len, retval;
68648@@ -483,7 +498,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
68649 break;
68650 return -EIO;
68651 }
68652- if (copy_to_user(dst, buf, retval))
68653+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
68654 return -EFAULT;
68655 copied += retval;
68656 src += retval;
68657@@ -497,6 +512,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
68658 {
68659 int copied = 0;
68660
68661+ pax_track_stack();
68662+
68663 while (len > 0) {
68664 char buf[128];
68665 int this_len, retval;
68666@@ -680,10 +697,12 @@ int ptrace_request(struct task_struct *child, long request,
68667 bool seized = child->ptrace & PT_SEIZED;
68668 int ret = -EIO;
68669 siginfo_t siginfo, *si;
68670- void __user *datavp = (void __user *) data;
68671+ void __user *datavp = (__force void __user *) data;
68672 unsigned long __user *datalp = datavp;
68673 unsigned long flags;
68674
68675+ pax_track_stack();
68676+
68677 switch (request) {
68678 case PTRACE_PEEKTEXT:
68679 case PTRACE_PEEKDATA:
68680@@ -882,14 +901,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
68681 goto out;
68682 }
68683
68684+ if (gr_handle_ptrace(child, request)) {
68685+ ret = -EPERM;
68686+ goto out_put_task_struct;
68687+ }
68688+
68689 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
68690 ret = ptrace_attach(child, request, data);
68691 /*
68692 * Some architectures need to do book-keeping after
68693 * a ptrace attach.
68694 */
68695- if (!ret)
68696+ if (!ret) {
68697 arch_ptrace_attach(child);
68698+ gr_audit_ptrace(child);
68699+ }
68700 goto out_put_task_struct;
68701 }
68702
68703@@ -915,7 +941,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
68704 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
68705 if (copied != sizeof(tmp))
68706 return -EIO;
68707- return put_user(tmp, (unsigned long __user *)data);
68708+ return put_user(tmp, (__force unsigned long __user *)data);
68709 }
68710
68711 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
68712@@ -938,6 +964,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
68713 siginfo_t siginfo;
68714 int ret;
68715
68716+ pax_track_stack();
68717+
68718 switch (request) {
68719 case PTRACE_PEEKTEXT:
68720 case PTRACE_PEEKDATA:
68721@@ -1025,14 +1053,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
68722 goto out;
68723 }
68724
68725+ if (gr_handle_ptrace(child, request)) {
68726+ ret = -EPERM;
68727+ goto out_put_task_struct;
68728+ }
68729+
68730 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
68731 ret = ptrace_attach(child, request, data);
68732 /*
68733 * Some architectures need to do book-keeping after
68734 * a ptrace attach.
68735 */
68736- if (!ret)
68737+ if (!ret) {
68738 arch_ptrace_attach(child);
68739+ gr_audit_ptrace(child);
68740+ }
68741 goto out_put_task_struct;
68742 }
68743
68744diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
68745index 98f51b1..30b950c 100644
68746--- a/kernel/rcutorture.c
68747+++ b/kernel/rcutorture.c
68748@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
68749 { 0 };
68750 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
68751 { 0 };
68752-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
68753-static atomic_t n_rcu_torture_alloc;
68754-static atomic_t n_rcu_torture_alloc_fail;
68755-static atomic_t n_rcu_torture_free;
68756-static atomic_t n_rcu_torture_mberror;
68757-static atomic_t n_rcu_torture_error;
68758+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
68759+static atomic_unchecked_t n_rcu_torture_alloc;
68760+static atomic_unchecked_t n_rcu_torture_alloc_fail;
68761+static atomic_unchecked_t n_rcu_torture_free;
68762+static atomic_unchecked_t n_rcu_torture_mberror;
68763+static atomic_unchecked_t n_rcu_torture_error;
68764 static long n_rcu_torture_boost_ktrerror;
68765 static long n_rcu_torture_boost_rterror;
68766 static long n_rcu_torture_boost_failure;
68767@@ -223,11 +223,11 @@ rcu_torture_alloc(void)
68768
68769 spin_lock_bh(&rcu_torture_lock);
68770 if (list_empty(&rcu_torture_freelist)) {
68771- atomic_inc(&n_rcu_torture_alloc_fail);
68772+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
68773 spin_unlock_bh(&rcu_torture_lock);
68774 return NULL;
68775 }
68776- atomic_inc(&n_rcu_torture_alloc);
68777+ atomic_inc_unchecked(&n_rcu_torture_alloc);
68778 p = rcu_torture_freelist.next;
68779 list_del_init(p);
68780 spin_unlock_bh(&rcu_torture_lock);
68781@@ -240,7 +240,7 @@ rcu_torture_alloc(void)
68782 static void
68783 rcu_torture_free(struct rcu_torture *p)
68784 {
68785- atomic_inc(&n_rcu_torture_free);
68786+ atomic_inc_unchecked(&n_rcu_torture_free);
68787 spin_lock_bh(&rcu_torture_lock);
68788 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
68789 spin_unlock_bh(&rcu_torture_lock);
68790@@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
68791 i = rp->rtort_pipe_count;
68792 if (i > RCU_TORTURE_PIPE_LEN)
68793 i = RCU_TORTURE_PIPE_LEN;
68794- atomic_inc(&rcu_torture_wcount[i]);
68795+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
68796 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
68797 rp->rtort_mbtest = 0;
68798 rcu_torture_free(rp);
68799@@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
68800 i = rp->rtort_pipe_count;
68801 if (i > RCU_TORTURE_PIPE_LEN)
68802 i = RCU_TORTURE_PIPE_LEN;
68803- atomic_inc(&rcu_torture_wcount[i]);
68804+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
68805 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
68806 rp->rtort_mbtest = 0;
68807 list_del(&rp->rtort_free);
68808@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
68809 i = old_rp->rtort_pipe_count;
68810 if (i > RCU_TORTURE_PIPE_LEN)
68811 i = RCU_TORTURE_PIPE_LEN;
68812- atomic_inc(&rcu_torture_wcount[i]);
68813+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
68814 old_rp->rtort_pipe_count++;
68815 cur_ops->deferred_free(old_rp);
68816 }
68817@@ -950,7 +950,7 @@ static void rcu_torture_timer(unsigned long unused)
68818 return;
68819 }
68820 if (p->rtort_mbtest == 0)
68821- atomic_inc(&n_rcu_torture_mberror);
68822+ atomic_inc_unchecked(&n_rcu_torture_mberror);
68823 spin_lock(&rand_lock);
68824 cur_ops->read_delay(&rand);
68825 n_rcu_torture_timers++;
68826@@ -1011,7 +1011,7 @@ rcu_torture_reader(void *arg)
68827 continue;
68828 }
68829 if (p->rtort_mbtest == 0)
68830- atomic_inc(&n_rcu_torture_mberror);
68831+ atomic_inc_unchecked(&n_rcu_torture_mberror);
68832 cur_ops->read_delay(&rand);
68833 preempt_disable();
68834 pipe_count = p->rtort_pipe_count;
68835@@ -1070,16 +1070,16 @@ rcu_torture_printk(char *page)
68836 rcu_torture_current,
68837 rcu_torture_current_version,
68838 list_empty(&rcu_torture_freelist),
68839- atomic_read(&n_rcu_torture_alloc),
68840- atomic_read(&n_rcu_torture_alloc_fail),
68841- atomic_read(&n_rcu_torture_free),
68842- atomic_read(&n_rcu_torture_mberror),
68843+ atomic_read_unchecked(&n_rcu_torture_alloc),
68844+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
68845+ atomic_read_unchecked(&n_rcu_torture_free),
68846+ atomic_read_unchecked(&n_rcu_torture_mberror),
68847 n_rcu_torture_boost_ktrerror,
68848 n_rcu_torture_boost_rterror,
68849 n_rcu_torture_boost_failure,
68850 n_rcu_torture_boosts,
68851 n_rcu_torture_timers);
68852- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
68853+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
68854 n_rcu_torture_boost_ktrerror != 0 ||
68855 n_rcu_torture_boost_rterror != 0 ||
68856 n_rcu_torture_boost_failure != 0)
68857@@ -1087,7 +1087,7 @@ rcu_torture_printk(char *page)
68858 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
68859 if (i > 1) {
68860 cnt += sprintf(&page[cnt], "!!! ");
68861- atomic_inc(&n_rcu_torture_error);
68862+ atomic_inc_unchecked(&n_rcu_torture_error);
68863 WARN_ON_ONCE(1);
68864 }
68865 cnt += sprintf(&page[cnt], "Reader Pipe: ");
68866@@ -1101,7 +1101,7 @@ rcu_torture_printk(char *page)
68867 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
68868 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68869 cnt += sprintf(&page[cnt], " %d",
68870- atomic_read(&rcu_torture_wcount[i]));
68871+ atomic_read_unchecked(&rcu_torture_wcount[i]));
68872 }
68873 cnt += sprintf(&page[cnt], "\n");
68874 if (cur_ops->stats)
68875@@ -1410,7 +1410,7 @@ rcu_torture_cleanup(void)
68876
68877 if (cur_ops->cleanup)
68878 cur_ops->cleanup();
68879- if (atomic_read(&n_rcu_torture_error))
68880+ if (atomic_read_unchecked(&n_rcu_torture_error))
68881 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
68882 else
68883 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
68884@@ -1474,17 +1474,17 @@ rcu_torture_init(void)
68885
68886 rcu_torture_current = NULL;
68887 rcu_torture_current_version = 0;
68888- atomic_set(&n_rcu_torture_alloc, 0);
68889- atomic_set(&n_rcu_torture_alloc_fail, 0);
68890- atomic_set(&n_rcu_torture_free, 0);
68891- atomic_set(&n_rcu_torture_mberror, 0);
68892- atomic_set(&n_rcu_torture_error, 0);
68893+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
68894+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
68895+ atomic_set_unchecked(&n_rcu_torture_free, 0);
68896+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
68897+ atomic_set_unchecked(&n_rcu_torture_error, 0);
68898 n_rcu_torture_boost_ktrerror = 0;
68899 n_rcu_torture_boost_rterror = 0;
68900 n_rcu_torture_boost_failure = 0;
68901 n_rcu_torture_boosts = 0;
68902 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
68903- atomic_set(&rcu_torture_wcount[i], 0);
68904+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
68905 for_each_possible_cpu(cpu) {
68906 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68907 per_cpu(rcu_torture_count, cpu)[i] = 0;
68908diff --git a/kernel/rcutree.c b/kernel/rcutree.c
68909index ba06207..85d8ba8 100644
68910--- a/kernel/rcutree.c
68911+++ b/kernel/rcutree.c
68912@@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
68913 }
68914 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68915 smp_mb__before_atomic_inc(); /* See above. */
68916- atomic_inc(&rdtp->dynticks);
68917+ atomic_inc_unchecked(&rdtp->dynticks);
68918 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
68919- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68920+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68921 local_irq_restore(flags);
68922
68923 /* If the interrupt queued a callback, get out of dyntick mode. */
68924@@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
68925 return;
68926 }
68927 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
68928- atomic_inc(&rdtp->dynticks);
68929+ atomic_inc_unchecked(&rdtp->dynticks);
68930 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68931 smp_mb__after_atomic_inc(); /* See above. */
68932- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68933+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68934 local_irq_restore(flags);
68935 }
68936
68937@@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
68938 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
68939
68940 if (rdtp->dynticks_nmi_nesting == 0 &&
68941- (atomic_read(&rdtp->dynticks) & 0x1))
68942+ (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
68943 return;
68944 rdtp->dynticks_nmi_nesting++;
68945 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
68946- atomic_inc(&rdtp->dynticks);
68947+ atomic_inc_unchecked(&rdtp->dynticks);
68948 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68949 smp_mb__after_atomic_inc(); /* See above. */
68950- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68951+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68952 }
68953
68954 /**
68955@@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
68956 return;
68957 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68958 smp_mb__before_atomic_inc(); /* See above. */
68959- atomic_inc(&rdtp->dynticks);
68960+ atomic_inc_unchecked(&rdtp->dynticks);
68961 smp_mb__after_atomic_inc(); /* Force delay to next write. */
68962- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68963+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68964 }
68965
68966 /**
68967@@ -469,7 +469,7 @@ void rcu_irq_exit(void)
68968 */
68969 static int dyntick_save_progress_counter(struct rcu_data *rdp)
68970 {
68971- rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
68972+ rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68973 return 0;
68974 }
68975
68976@@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
68977 unsigned long curr;
68978 unsigned long snap;
68979
68980- curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
68981+ curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68982 snap = (unsigned long)rdp->dynticks_snap;
68983
68984 /*
68985@@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
68986 /*
68987 * Do softirq processing for the current CPU.
68988 */
68989-static void rcu_process_callbacks(struct softirq_action *unused)
68990+static void rcu_process_callbacks(void)
68991 {
68992 __rcu_process_callbacks(&rcu_sched_state,
68993 &__get_cpu_var(rcu_sched_data));
68994diff --git a/kernel/rcutree.h b/kernel/rcutree.h
68995index 01b2ccd..4f5d80a 100644
68996--- a/kernel/rcutree.h
68997+++ b/kernel/rcutree.h
68998@@ -86,7 +86,7 @@
68999 struct rcu_dynticks {
69000 int dynticks_nesting; /* Track irq/process nesting level. */
69001 int dynticks_nmi_nesting; /* Track NMI nesting level. */
69002- atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
69003+ atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
69004 };
69005
69006 /* RCU's kthread states for tracing. */
69007diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
69008index 8aafbb8..2fca109 100644
69009--- a/kernel/rcutree_plugin.h
69010+++ b/kernel/rcutree_plugin.h
69011@@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
69012
69013 /* Clean up and exit. */
69014 smp_mb(); /* ensure expedited GP seen before counter increment. */
69015- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69016+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69017 unlock_mb_ret:
69018 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69019 mb_ret:
69020@@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
69021
69022 #else /* #ifndef CONFIG_SMP */
69023
69024-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69025-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69026+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69027+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69028
69029 static int synchronize_sched_expedited_cpu_stop(void *data)
69030 {
69031@@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
69032 int firstsnap, s, snap, trycount = 0;
69033
69034 /* Note that atomic_inc_return() implies full memory barrier. */
69035- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69036+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69037 get_online_cpus();
69038
69039 /*
69040@@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
69041 }
69042
69043 /* Check to see if someone else did our work for us. */
69044- s = atomic_read(&sync_sched_expedited_done);
69045+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69046 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69047 smp_mb(); /* ensure test happens before caller kfree */
69048 return;
69049@@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
69050 * grace period works for us.
69051 */
69052 get_online_cpus();
69053- snap = atomic_read(&sync_sched_expedited_started) - 1;
69054+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
69055 smp_mb(); /* ensure read is before try_stop_cpus(). */
69056 }
69057
69058@@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
69059 * than we did beat us to the punch.
69060 */
69061 do {
69062- s = atomic_read(&sync_sched_expedited_done);
69063+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69064 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
69065 smp_mb(); /* ensure test happens before caller kfree */
69066 break;
69067 }
69068- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
69069+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
69070
69071 put_online_cpus();
69072 }
69073@@ -1953,7 +1953,7 @@ int rcu_needs_cpu(int cpu)
69074 for_each_online_cpu(thatcpu) {
69075 if (thatcpu == cpu)
69076 continue;
69077- snap = atomic_add_return(0, &per_cpu(rcu_dynticks,
69078+ snap = atomic_add_return_unchecked(0, &per_cpu(rcu_dynticks,
69079 thatcpu).dynticks);
69080 smp_mb(); /* Order sampling of snap with end of grace period. */
69081 if ((snap & 0x1) != 0) {
69082diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
69083index 3b0c098..43ba2d8 100644
69084--- a/kernel/rcutree_trace.c
69085+++ b/kernel/rcutree_trace.c
69086@@ -74,7 +74,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
69087 rdp->qs_pending);
69088 #ifdef CONFIG_NO_HZ
69089 seq_printf(m, " dt=%d/%d/%d df=%lu",
69090- atomic_read(&rdp->dynticks->dynticks),
69091+ atomic_read_unchecked(&rdp->dynticks->dynticks),
69092 rdp->dynticks->dynticks_nesting,
69093 rdp->dynticks->dynticks_nmi_nesting,
69094 rdp->dynticks_fqs);
69095@@ -148,7 +148,7 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
69096 rdp->qs_pending);
69097 #ifdef CONFIG_NO_HZ
69098 seq_printf(m, ",%d,%d,%d,%lu",
69099- atomic_read(&rdp->dynticks->dynticks),
69100+ atomic_read_unchecked(&rdp->dynticks->dynticks),
69101 rdp->dynticks->dynticks_nesting,
69102 rdp->dynticks->dynticks_nmi_nesting,
69103 rdp->dynticks_fqs);
69104diff --git a/kernel/relay.c b/kernel/relay.c
69105index 859ea5a..096e2fe 100644
69106--- a/kernel/relay.c
69107+++ b/kernel/relay.c
69108@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
69109 };
69110 ssize_t ret;
69111
69112+ pax_track_stack();
69113+
69114 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
69115 return 0;
69116 if (splice_grow_spd(pipe, &spd))
69117diff --git a/kernel/resource.c b/kernel/resource.c
69118index c8dc249..f1e2359 100644
69119--- a/kernel/resource.c
69120+++ b/kernel/resource.c
69121@@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = {
69122
69123 static int __init ioresources_init(void)
69124 {
69125+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69126+#ifdef CONFIG_GRKERNSEC_PROC_USER
69127+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69128+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69129+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69130+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69131+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69132+#endif
69133+#else
69134 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69135 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69136+#endif
69137 return 0;
69138 }
69139 __initcall(ioresources_init);
69140diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
69141index 5c9ccd3..a35e22b 100644
69142--- a/kernel/rtmutex-tester.c
69143+++ b/kernel/rtmutex-tester.c
69144@@ -20,7 +20,7 @@
69145 #define MAX_RT_TEST_MUTEXES 8
69146
69147 static spinlock_t rttest_lock;
69148-static atomic_t rttest_event;
69149+static atomic_unchecked_t rttest_event;
69150
69151 struct test_thread_data {
69152 int opcode;
69153@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69154
69155 case RTTEST_LOCKCONT:
69156 td->mutexes[td->opdata] = 1;
69157- td->event = atomic_add_return(1, &rttest_event);
69158+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69159 return 0;
69160
69161 case RTTEST_RESET:
69162@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69163 return 0;
69164
69165 case RTTEST_RESETEVENT:
69166- atomic_set(&rttest_event, 0);
69167+ atomic_set_unchecked(&rttest_event, 0);
69168 return 0;
69169
69170 default:
69171@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69172 return ret;
69173
69174 td->mutexes[id] = 1;
69175- td->event = atomic_add_return(1, &rttest_event);
69176+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69177 rt_mutex_lock(&mutexes[id]);
69178- td->event = atomic_add_return(1, &rttest_event);
69179+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69180 td->mutexes[id] = 4;
69181 return 0;
69182
69183@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69184 return ret;
69185
69186 td->mutexes[id] = 1;
69187- td->event = atomic_add_return(1, &rttest_event);
69188+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69189 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69190- td->event = atomic_add_return(1, &rttest_event);
69191+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69192 td->mutexes[id] = ret ? 0 : 4;
69193 return ret ? -EINTR : 0;
69194
69195@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69196 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
69197 return ret;
69198
69199- td->event = atomic_add_return(1, &rttest_event);
69200+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69201 rt_mutex_unlock(&mutexes[id]);
69202- td->event = atomic_add_return(1, &rttest_event);
69203+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69204 td->mutexes[id] = 0;
69205 return 0;
69206
69207@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69208 break;
69209
69210 td->mutexes[dat] = 2;
69211- td->event = atomic_add_return(1, &rttest_event);
69212+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69213 break;
69214
69215 default:
69216@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69217 return;
69218
69219 td->mutexes[dat] = 3;
69220- td->event = atomic_add_return(1, &rttest_event);
69221+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69222 break;
69223
69224 case RTTEST_LOCKNOWAIT:
69225@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69226 return;
69227
69228 td->mutexes[dat] = 1;
69229- td->event = atomic_add_return(1, &rttest_event);
69230+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69231 return;
69232
69233 default:
69234diff --git a/kernel/sched.c b/kernel/sched.c
69235index b50b0f0..91e9aed 100644
69236--- a/kernel/sched.c
69237+++ b/kernel/sched.c
69238@@ -4254,6 +4254,19 @@ pick_next_task(struct rq *rq)
69239 BUG(); /* the idle class will always have a runnable task */
69240 }
69241
69242+#ifdef CONFIG_GRKERNSEC_SETXID
69243+extern void gr_delayed_cred_worker(void);
69244+static inline void gr_cred_schedule(void)
69245+{
69246+ if (unlikely(current->delayed_cred))
69247+ gr_delayed_cred_worker();
69248+}
69249+#else
69250+static inline void gr_cred_schedule(void)
69251+{
69252+}
69253+#endif
69254+
69255 /*
69256 * __schedule() is the main scheduler function.
69257 */
69258@@ -4264,6 +4277,8 @@ static void __sched __schedule(void)
69259 struct rq *rq;
69260 int cpu;
69261
69262+ pax_track_stack();
69263+
69264 need_resched:
69265 preempt_disable();
69266 cpu = smp_processor_id();
69267@@ -4273,6 +4288,8 @@ need_resched:
69268
69269 schedule_debug(prev);
69270
69271+ gr_cred_schedule();
69272+
69273 if (sched_feat(HRTICK))
69274 hrtick_clear(rq);
69275
69276@@ -4950,6 +4967,8 @@ int can_nice(const struct task_struct *p, const int nice)
69277 /* convert nice value [19,-20] to rlimit style value [1,40] */
69278 int nice_rlim = 20 - nice;
69279
69280+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
69281+
69282 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
69283 capable(CAP_SYS_NICE));
69284 }
69285@@ -4983,7 +5002,8 @@ SYSCALL_DEFINE1(nice, int, increment)
69286 if (nice > 19)
69287 nice = 19;
69288
69289- if (increment < 0 && !can_nice(current, nice))
69290+ if (increment < 0 && (!can_nice(current, nice) ||
69291+ gr_handle_chroot_nice()))
69292 return -EPERM;
69293
69294 retval = security_task_setnice(current, nice);
69295@@ -5127,6 +5147,7 @@ recheck:
69296 unsigned long rlim_rtprio =
69297 task_rlimit(p, RLIMIT_RTPRIO);
69298
69299+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
69300 /* can't set/change the rt policy */
69301 if (policy != p->policy && !rlim_rtprio)
69302 return -EPERM;
69303diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
69304index 429242f..d7cca82 100644
69305--- a/kernel/sched_autogroup.c
69306+++ b/kernel/sched_autogroup.c
69307@@ -7,7 +7,7 @@
69308
69309 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
69310 static struct autogroup autogroup_default;
69311-static atomic_t autogroup_seq_nr;
69312+static atomic_unchecked_t autogroup_seq_nr;
69313
69314 static void __init autogroup_init(struct task_struct *init_task)
69315 {
69316@@ -78,7 +78,7 @@ static inline struct autogroup *autogroup_create(void)
69317
69318 kref_init(&ag->kref);
69319 init_rwsem(&ag->lock);
69320- ag->id = atomic_inc_return(&autogroup_seq_nr);
69321+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
69322 ag->tg = tg;
69323 #ifdef CONFIG_RT_GROUP_SCHED
69324 /*
69325diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
69326index bc8ee99..b6f6492 100644
69327--- a/kernel/sched_fair.c
69328+++ b/kernel/sched_fair.c
69329@@ -4062,7 +4062,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
69330 * run_rebalance_domains is triggered when needed from the scheduler tick.
69331 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
69332 */
69333-static void run_rebalance_domains(struct softirq_action *h)
69334+static void run_rebalance_domains(void)
69335 {
69336 int this_cpu = smp_processor_id();
69337 struct rq *this_rq = cpu_rq(this_cpu);
69338diff --git a/kernel/signal.c b/kernel/signal.c
69339index 195331c..e89634ce 100644
69340--- a/kernel/signal.c
69341+++ b/kernel/signal.c
69342@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
69343
69344 int print_fatal_signals __read_mostly;
69345
69346-static void __user *sig_handler(struct task_struct *t, int sig)
69347+static __sighandler_t sig_handler(struct task_struct *t, int sig)
69348 {
69349 return t->sighand->action[sig - 1].sa.sa_handler;
69350 }
69351
69352-static int sig_handler_ignored(void __user *handler, int sig)
69353+static int sig_handler_ignored(__sighandler_t handler, int sig)
69354 {
69355 /* Is it explicitly or implicitly ignored? */
69356 return handler == SIG_IGN ||
69357@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
69358 static int sig_task_ignored(struct task_struct *t, int sig,
69359 int from_ancestor_ns)
69360 {
69361- void __user *handler;
69362+ __sighandler_t handler;
69363
69364 handler = sig_handler(t, sig);
69365
69366@@ -364,6 +364,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
69367 atomic_inc(&user->sigpending);
69368 rcu_read_unlock();
69369
69370+ if (!override_rlimit)
69371+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
69372+
69373 if (override_rlimit ||
69374 atomic_read(&user->sigpending) <=
69375 task_rlimit(t, RLIMIT_SIGPENDING)) {
69376@@ -488,7 +491,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
69377
69378 int unhandled_signal(struct task_struct *tsk, int sig)
69379 {
69380- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
69381+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
69382 if (is_global_init(tsk))
69383 return 1;
69384 if (handler != SIG_IGN && handler != SIG_DFL)
69385@@ -815,6 +818,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
69386 }
69387 }
69388
69389+ /* allow glibc communication via tgkill to other threads in our
69390+ thread group */
69391+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
69392+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
69393+ && gr_handle_signal(t, sig))
69394+ return -EPERM;
69395+
69396 return security_task_kill(t, info, sig, 0);
69397 }
69398
69399@@ -1165,7 +1175,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
69400 return send_signal(sig, info, p, 1);
69401 }
69402
69403-static int
69404+int
69405 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69406 {
69407 return send_signal(sig, info, t, 0);
69408@@ -1202,6 +1212,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69409 unsigned long int flags;
69410 int ret, blocked, ignored;
69411 struct k_sigaction *action;
69412+ int is_unhandled = 0;
69413
69414 spin_lock_irqsave(&t->sighand->siglock, flags);
69415 action = &t->sighand->action[sig-1];
69416@@ -1216,9 +1227,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69417 }
69418 if (action->sa.sa_handler == SIG_DFL)
69419 t->signal->flags &= ~SIGNAL_UNKILLABLE;
69420+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
69421+ is_unhandled = 1;
69422 ret = specific_send_sig_info(sig, info, t);
69423 spin_unlock_irqrestore(&t->sighand->siglock, flags);
69424
69425+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
69426+ normal operation */
69427+ if (is_unhandled) {
69428+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
69429+ gr_handle_crash(t, sig);
69430+ }
69431+
69432 return ret;
69433 }
69434
69435@@ -1285,8 +1305,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
69436 ret = check_kill_permission(sig, info, p);
69437 rcu_read_unlock();
69438
69439- if (!ret && sig)
69440+ if (!ret && sig) {
69441 ret = do_send_sig_info(sig, info, p, true);
69442+ if (!ret)
69443+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
69444+ }
69445
69446 return ret;
69447 }
69448@@ -1909,6 +1932,8 @@ static void ptrace_do_notify(int signr, int exit_code, int why)
69449 {
69450 siginfo_t info;
69451
69452+ pax_track_stack();
69453+
69454 memset(&info, 0, sizeof info);
69455 info.si_signo = signr;
69456 info.si_code = exit_code;
69457@@ -2746,7 +2771,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
69458 int error = -ESRCH;
69459
69460 rcu_read_lock();
69461- p = find_task_by_vpid(pid);
69462+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
69463+ /* allow glibc communication via tgkill to other threads in our
69464+ thread group */
69465+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
69466+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
69467+ p = find_task_by_vpid_unrestricted(pid);
69468+ else
69469+#endif
69470+ p = find_task_by_vpid(pid);
69471 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
69472 error = check_kill_permission(sig, info, p);
69473 /*
69474diff --git a/kernel/smp.c b/kernel/smp.c
69475index fb67dfa..f819e2e 100644
69476--- a/kernel/smp.c
69477+++ b/kernel/smp.c
69478@@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait)
69479 }
69480 EXPORT_SYMBOL(smp_call_function);
69481
69482-void ipi_call_lock(void)
69483+void ipi_call_lock(void) __acquires(call_function.lock)
69484 {
69485 raw_spin_lock(&call_function.lock);
69486 }
69487
69488-void ipi_call_unlock(void)
69489+void ipi_call_unlock(void) __releases(call_function.lock)
69490 {
69491 raw_spin_unlock(&call_function.lock);
69492 }
69493
69494-void ipi_call_lock_irq(void)
69495+void ipi_call_lock_irq(void) __acquires(call_function.lock)
69496 {
69497 raw_spin_lock_irq(&call_function.lock);
69498 }
69499
69500-void ipi_call_unlock_irq(void)
69501+void ipi_call_unlock_irq(void) __releases(call_function.lock)
69502 {
69503 raw_spin_unlock_irq(&call_function.lock);
69504 }
69505diff --git a/kernel/softirq.c b/kernel/softirq.c
69506index fca82c3..1db9690 100644
69507--- a/kernel/softirq.c
69508+++ b/kernel/softirq.c
69509@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
69510
69511 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
69512
69513-char *softirq_to_name[NR_SOFTIRQS] = {
69514+const char * const softirq_to_name[NR_SOFTIRQS] = {
69515 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
69516 "TASKLET", "SCHED", "HRTIMER", "RCU"
69517 };
69518@@ -235,7 +235,7 @@ restart:
69519 kstat_incr_softirqs_this_cpu(vec_nr);
69520
69521 trace_softirq_entry(vec_nr);
69522- h->action(h);
69523+ h->action();
69524 trace_softirq_exit(vec_nr);
69525 if (unlikely(prev_count != preempt_count())) {
69526 printk(KERN_ERR "huh, entered softirq %u %s %p"
69527@@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
69528 local_irq_restore(flags);
69529 }
69530
69531-void open_softirq(int nr, void (*action)(struct softirq_action *))
69532+void open_softirq(int nr, void (*action)(void))
69533 {
69534- softirq_vec[nr].action = action;
69535+ pax_open_kernel();
69536+ *(void **)&softirq_vec[nr].action = action;
69537+ pax_close_kernel();
69538 }
69539
69540 /*
69541@@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
69542
69543 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
69544
69545-static void tasklet_action(struct softirq_action *a)
69546+static void tasklet_action(void)
69547 {
69548 struct tasklet_struct *list;
69549
69550@@ -476,7 +478,7 @@ static void tasklet_action(struct softirq_action *a)
69551 }
69552 }
69553
69554-static void tasklet_hi_action(struct softirq_action *a)
69555+static void tasklet_hi_action(void)
69556 {
69557 struct tasklet_struct *list;
69558
69559diff --git a/kernel/sys.c b/kernel/sys.c
69560index 1dbbe69..6d0c5d8 100644
69561--- a/kernel/sys.c
69562+++ b/kernel/sys.c
69563@@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
69564 error = -EACCES;
69565 goto out;
69566 }
69567+
69568+ if (gr_handle_chroot_setpriority(p, niceval)) {
69569+ error = -EACCES;
69570+ goto out;
69571+ }
69572+
69573 no_nice = security_task_setnice(p, niceval);
69574 if (no_nice) {
69575 error = no_nice;
69576@@ -571,6 +577,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
69577 goto error;
69578 }
69579
69580+ if (gr_check_group_change(new->gid, new->egid, -1))
69581+ goto error;
69582+
69583 if (rgid != (gid_t) -1 ||
69584 (egid != (gid_t) -1 && egid != old->gid))
69585 new->sgid = new->egid;
69586@@ -600,6 +609,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
69587 old = current_cred();
69588
69589 retval = -EPERM;
69590+
69591+ if (gr_check_group_change(gid, gid, gid))
69592+ goto error;
69593+
69594 if (nsown_capable(CAP_SETGID))
69595 new->gid = new->egid = new->sgid = new->fsgid = gid;
69596 else if (gid == old->gid || gid == old->sgid)
69597@@ -617,7 +630,7 @@ error:
69598 /*
69599 * change the user struct in a credentials set to match the new UID
69600 */
69601-static int set_user(struct cred *new)
69602+int set_user(struct cred *new)
69603 {
69604 struct user_struct *new_user;
69605
69606@@ -687,6 +700,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
69607 goto error;
69608 }
69609
69610+ if (gr_check_user_change(new->uid, new->euid, -1))
69611+ goto error;
69612+
69613 if (new->uid != old->uid) {
69614 retval = set_user(new);
69615 if (retval < 0)
69616@@ -731,6 +747,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
69617 old = current_cred();
69618
69619 retval = -EPERM;
69620+
69621+ if (gr_check_crash_uid(uid))
69622+ goto error;
69623+ if (gr_check_user_change(uid, uid, uid))
69624+ goto error;
69625+
69626 if (nsown_capable(CAP_SETUID)) {
69627 new->suid = new->uid = uid;
69628 if (uid != old->uid) {
69629@@ -785,6 +807,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
69630 goto error;
69631 }
69632
69633+ if (gr_check_user_change(ruid, euid, -1))
69634+ goto error;
69635+
69636 if (ruid != (uid_t) -1) {
69637 new->uid = ruid;
69638 if (ruid != old->uid) {
69639@@ -849,6 +874,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
69640 goto error;
69641 }
69642
69643+ if (gr_check_group_change(rgid, egid, -1))
69644+ goto error;
69645+
69646 if (rgid != (gid_t) -1)
69647 new->gid = rgid;
69648 if (egid != (gid_t) -1)
69649@@ -895,6 +923,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
69650 old = current_cred();
69651 old_fsuid = old->fsuid;
69652
69653+ if (gr_check_user_change(-1, -1, uid))
69654+ goto error;
69655+
69656 if (uid == old->uid || uid == old->euid ||
69657 uid == old->suid || uid == old->fsuid ||
69658 nsown_capable(CAP_SETUID)) {
69659@@ -905,6 +936,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
69660 }
69661 }
69662
69663+error:
69664 abort_creds(new);
69665 return old_fsuid;
69666
69667@@ -931,12 +963,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
69668 if (gid == old->gid || gid == old->egid ||
69669 gid == old->sgid || gid == old->fsgid ||
69670 nsown_capable(CAP_SETGID)) {
69671+ if (gr_check_group_change(-1, -1, gid))
69672+ goto error;
69673+
69674 if (gid != old_fsgid) {
69675 new->fsgid = gid;
69676 goto change_okay;
69677 }
69678 }
69679
69680+error:
69681 abort_creds(new);
69682 return old_fsgid;
69683
69684@@ -1188,7 +1224,10 @@ static int override_release(char __user *release, int len)
69685 }
69686 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
69687 snprintf(buf, len, "2.6.%u%s", v, rest);
69688- ret = copy_to_user(release, buf, len);
69689+ if (len > sizeof(buf))
69690+ ret = -EFAULT;
69691+ else
69692+ ret = copy_to_user(release, buf, len);
69693 }
69694 return ret;
69695 }
69696@@ -1242,19 +1281,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
69697 return -EFAULT;
69698
69699 down_read(&uts_sem);
69700- error = __copy_to_user(&name->sysname, &utsname()->sysname,
69701+ error = __copy_to_user(name->sysname, &utsname()->sysname,
69702 __OLD_UTS_LEN);
69703 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
69704- error |= __copy_to_user(&name->nodename, &utsname()->nodename,
69705+ error |= __copy_to_user(name->nodename, &utsname()->nodename,
69706 __OLD_UTS_LEN);
69707 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
69708- error |= __copy_to_user(&name->release, &utsname()->release,
69709+ error |= __copy_to_user(name->release, &utsname()->release,
69710 __OLD_UTS_LEN);
69711 error |= __put_user(0, name->release + __OLD_UTS_LEN);
69712- error |= __copy_to_user(&name->version, &utsname()->version,
69713+ error |= __copy_to_user(name->version, &utsname()->version,
69714 __OLD_UTS_LEN);
69715 error |= __put_user(0, name->version + __OLD_UTS_LEN);
69716- error |= __copy_to_user(&name->machine, &utsname()->machine,
69717+ error |= __copy_to_user(name->machine, &utsname()->machine,
69718 __OLD_UTS_LEN);
69719 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
69720 up_read(&uts_sem);
69721@@ -1717,7 +1756,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
69722 error = get_dumpable(me->mm);
69723 break;
69724 case PR_SET_DUMPABLE:
69725- if (arg2 < 0 || arg2 > 1) {
69726+ if (arg2 > 1) {
69727 error = -EINVAL;
69728 break;
69729 }
69730diff --git a/kernel/sysctl.c b/kernel/sysctl.c
69731index 11d65b5..6957b37 100644
69732--- a/kernel/sysctl.c
69733+++ b/kernel/sysctl.c
69734@@ -85,6 +85,13 @@
69735
69736
69737 #if defined(CONFIG_SYSCTL)
69738+#include <linux/grsecurity.h>
69739+#include <linux/grinternal.h>
69740+
69741+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
69742+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
69743+ const int op);
69744+extern int gr_handle_chroot_sysctl(const int op);
69745
69746 /* External variables not in a header file. */
69747 extern int sysctl_overcommit_memory;
69748@@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
69749 }
69750
69751 #endif
69752+extern struct ctl_table grsecurity_table[];
69753
69754 static struct ctl_table root_table[];
69755 static struct ctl_table_root sysctl_table_root;
69756@@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
69757 int sysctl_legacy_va_layout;
69758 #endif
69759
69760+#ifdef CONFIG_PAX_SOFTMODE
69761+static ctl_table pax_table[] = {
69762+ {
69763+ .procname = "softmode",
69764+ .data = &pax_softmode,
69765+ .maxlen = sizeof(unsigned int),
69766+ .mode = 0600,
69767+ .proc_handler = &proc_dointvec,
69768+ },
69769+
69770+ { }
69771+};
69772+#endif
69773+
69774 /* The default sysctl tables: */
69775
69776 static struct ctl_table root_table[] = {
69777@@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
69778 #endif
69779
69780 static struct ctl_table kern_table[] = {
69781+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
69782+ {
69783+ .procname = "grsecurity",
69784+ .mode = 0500,
69785+ .child = grsecurity_table,
69786+ },
69787+#endif
69788+
69789+#ifdef CONFIG_PAX_SOFTMODE
69790+ {
69791+ .procname = "pax",
69792+ .mode = 0500,
69793+ .child = pax_table,
69794+ },
69795+#endif
69796+
69797 {
69798 .procname = "sched_child_runs_first",
69799 .data = &sysctl_sched_child_runs_first,
69800@@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
69801 .data = &modprobe_path,
69802 .maxlen = KMOD_PATH_LEN,
69803 .mode = 0644,
69804- .proc_handler = proc_dostring,
69805+ .proc_handler = proc_dostring_modpriv,
69806 },
69807 {
69808 .procname = "modules_disabled",
69809@@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
69810 .extra1 = &zero,
69811 .extra2 = &one,
69812 },
69813+#endif
69814 {
69815 .procname = "kptr_restrict",
69816 .data = &kptr_restrict,
69817 .maxlen = sizeof(int),
69818 .mode = 0644,
69819 .proc_handler = proc_dmesg_restrict,
69820+#ifdef CONFIG_GRKERNSEC_HIDESYM
69821+ .extra1 = &two,
69822+#else
69823 .extra1 = &zero,
69824+#endif
69825 .extra2 = &two,
69826 },
69827-#endif
69828 {
69829 .procname = "ngroups_max",
69830 .data = &ngroups_max,
69831@@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
69832 .proc_handler = proc_dointvec_minmax,
69833 .extra1 = &zero,
69834 },
69835+ {
69836+ .procname = "heap_stack_gap",
69837+ .data = &sysctl_heap_stack_gap,
69838+ .maxlen = sizeof(sysctl_heap_stack_gap),
69839+ .mode = 0644,
69840+ .proc_handler = proc_doulongvec_minmax,
69841+ },
69842 #else
69843 {
69844 .procname = "nr_trim_pages",
69845@@ -1709,6 +1758,17 @@ static int test_perm(int mode, int op)
69846 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
69847 {
69848 int mode;
69849+ int error;
69850+
69851+ if (table->parent != NULL && table->parent->procname != NULL &&
69852+ table->procname != NULL &&
69853+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
69854+ return -EACCES;
69855+ if (gr_handle_chroot_sysctl(op))
69856+ return -EACCES;
69857+ error = gr_handle_sysctl(table, op);
69858+ if (error)
69859+ return error;
69860
69861 if (root->permissions)
69862 mode = root->permissions(root, current->nsproxy, table);
69863@@ -2113,6 +2173,16 @@ int proc_dostring(struct ctl_table *table, int write,
69864 buffer, lenp, ppos);
69865 }
69866
69867+int proc_dostring_modpriv(struct ctl_table *table, int write,
69868+ void __user *buffer, size_t *lenp, loff_t *ppos)
69869+{
69870+ if (write && !capable(CAP_SYS_MODULE))
69871+ return -EPERM;
69872+
69873+ return _proc_do_string(table->data, table->maxlen, write,
69874+ buffer, lenp, ppos);
69875+}
69876+
69877 static size_t proc_skip_spaces(char **buf)
69878 {
69879 size_t ret;
69880@@ -2218,6 +2288,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
69881 len = strlen(tmp);
69882 if (len > *size)
69883 len = *size;
69884+ if (len > sizeof(tmp))
69885+ len = sizeof(tmp);
69886 if (copy_to_user(*buf, tmp, len))
69887 return -EFAULT;
69888 *size -= len;
69889@@ -2534,8 +2606,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
69890 *i = val;
69891 } else {
69892 val = convdiv * (*i) / convmul;
69893- if (!first)
69894+ if (!first) {
69895 err = proc_put_char(&buffer, &left, '\t');
69896+ if (err)
69897+ break;
69898+ }
69899 err = proc_put_long(&buffer, &left, val, false);
69900 if (err)
69901 break;
69902@@ -2930,6 +3005,12 @@ int proc_dostring(struct ctl_table *table, int write,
69903 return -ENOSYS;
69904 }
69905
69906+int proc_dostring_modpriv(struct ctl_table *table, int write,
69907+ void __user *buffer, size_t *lenp, loff_t *ppos)
69908+{
69909+ return -ENOSYS;
69910+}
69911+
69912 int proc_dointvec(struct ctl_table *table, int write,
69913 void __user *buffer, size_t *lenp, loff_t *ppos)
69914 {
69915@@ -2986,6 +3067,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
69916 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
69917 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
69918 EXPORT_SYMBOL(proc_dostring);
69919+EXPORT_SYMBOL(proc_dostring_modpriv);
69920 EXPORT_SYMBOL(proc_doulongvec_minmax);
69921 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
69922 EXPORT_SYMBOL(register_sysctl_table);
69923diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
69924index 2ce1b30..82bf0a4 100644
69925--- a/kernel/sysctl_binary.c
69926+++ b/kernel/sysctl_binary.c
69927@@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
69928 int i;
69929
69930 set_fs(KERNEL_DS);
69931- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69932+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69933 set_fs(old_fs);
69934 if (result < 0)
69935 goto out_kfree;
69936@@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *file,
69937 }
69938
69939 set_fs(KERNEL_DS);
69940- result = vfs_write(file, buffer, str - buffer, &pos);
69941+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69942 set_fs(old_fs);
69943 if (result < 0)
69944 goto out_kfree;
69945@@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file *file,
69946 int i;
69947
69948 set_fs(KERNEL_DS);
69949- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69950+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69951 set_fs(old_fs);
69952 if (result < 0)
69953 goto out_kfree;
69954@@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file *file,
69955 }
69956
69957 set_fs(KERNEL_DS);
69958- result = vfs_write(file, buffer, str - buffer, &pos);
69959+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69960 set_fs(old_fs);
69961 if (result < 0)
69962 goto out_kfree;
69963@@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *file,
69964 int i;
69965
69966 set_fs(KERNEL_DS);
69967- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69968+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69969 set_fs(old_fs);
69970 if (result < 0)
69971 goto out;
69972@@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69973 __le16 dnaddr;
69974
69975 set_fs(KERNEL_DS);
69976- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69977+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69978 set_fs(old_fs);
69979 if (result < 0)
69980 goto out;
69981@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69982 le16_to_cpu(dnaddr) & 0x3ff);
69983
69984 set_fs(KERNEL_DS);
69985- result = vfs_write(file, buf, len, &pos);
69986+ result = vfs_write(file, (const char __force_user *)buf, len, &pos);
69987 set_fs(old_fs);
69988 if (result < 0)
69989 goto out;
69990diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
69991index 362da65..ab8ef8c 100644
69992--- a/kernel/sysctl_check.c
69993+++ b/kernel/sysctl_check.c
69994@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
69995 set_fail(&fail, table, "Directory with extra2");
69996 } else {
69997 if ((table->proc_handler == proc_dostring) ||
69998+ (table->proc_handler == proc_dostring_modpriv) ||
69999 (table->proc_handler == proc_dointvec) ||
70000 (table->proc_handler == proc_dointvec_minmax) ||
70001 (table->proc_handler == proc_dointvec_jiffies) ||
70002diff --git a/kernel/taskstats.c b/kernel/taskstats.c
70003index e660464..c8b9e67 100644
70004--- a/kernel/taskstats.c
70005+++ b/kernel/taskstats.c
70006@@ -27,9 +27,12 @@
70007 #include <linux/cgroup.h>
70008 #include <linux/fs.h>
70009 #include <linux/file.h>
70010+#include <linux/grsecurity.h>
70011 #include <net/genetlink.h>
70012 #include <linux/atomic.h>
70013
70014+extern int gr_is_taskstats_denied(int pid);
70015+
70016 /*
70017 * Maximum length of a cpumask that can be specified in
70018 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70019@@ -556,6 +559,9 @@ err:
70020
70021 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70022 {
70023+ if (gr_is_taskstats_denied(current->pid))
70024+ return -EACCES;
70025+
70026 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70027 return cmd_attr_register_cpumask(info);
70028 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70029diff --git a/kernel/time.c b/kernel/time.c
70030index d776062..fa8d186 100644
70031--- a/kernel/time.c
70032+++ b/kernel/time.c
70033@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
70034 return error;
70035
70036 if (tz) {
70037+ /* we log in do_settimeofday called below, so don't log twice
70038+ */
70039+ if (!tv)
70040+ gr_log_timechange();
70041+
70042 /* SMP safe, global irq locking makes it work. */
70043 sys_tz = *tz;
70044 update_vsyscall_tz();
70045diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
70046index 8b70c76..923e9f5 100644
70047--- a/kernel/time/alarmtimer.c
70048+++ b/kernel/time/alarmtimer.c
70049@@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
70050 {
70051 int error = 0;
70052 int i;
70053- struct k_clock alarm_clock = {
70054+ static struct k_clock alarm_clock = {
70055 .clock_getres = alarm_clock_getres,
70056 .clock_get = alarm_clock_get,
70057 .timer_create = alarm_timer_create,
70058diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
70059index 7a90d02..6d8585a 100644
70060--- a/kernel/time/tick-broadcast.c
70061+++ b/kernel/time/tick-broadcast.c
70062@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
70063 * then clear the broadcast bit.
70064 */
70065 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70066- int cpu = smp_processor_id();
70067+ cpu = smp_processor_id();
70068
70069 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70070 tick_broadcast_clear_oneshot(cpu);
70071diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
70072index 6f9798b..f8c4087 100644
70073--- a/kernel/time/timekeeping.c
70074+++ b/kernel/time/timekeeping.c
70075@@ -14,6 +14,7 @@
70076 #include <linux/init.h>
70077 #include <linux/mm.h>
70078 #include <linux/sched.h>
70079+#include <linux/grsecurity.h>
70080 #include <linux/syscore_ops.h>
70081 #include <linux/clocksource.h>
70082 #include <linux/jiffies.h>
70083@@ -365,6 +366,8 @@ int do_settimeofday(const struct timespec *tv)
70084 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70085 return -EINVAL;
70086
70087+ gr_log_timechange();
70088+
70089 write_seqlock_irqsave(&xtime_lock, flags);
70090
70091 timekeeping_forward_now();
70092diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
70093index 3258455..f35227d 100644
70094--- a/kernel/time/timer_list.c
70095+++ b/kernel/time/timer_list.c
70096@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
70097
70098 static void print_name_offset(struct seq_file *m, void *sym)
70099 {
70100+#ifdef CONFIG_GRKERNSEC_HIDESYM
70101+ SEQ_printf(m, "<%p>", NULL);
70102+#else
70103 char symname[KSYM_NAME_LEN];
70104
70105 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70106 SEQ_printf(m, "<%pK>", sym);
70107 else
70108 SEQ_printf(m, "%s", symname);
70109+#endif
70110 }
70111
70112 static void
70113@@ -112,7 +116,11 @@ next_one:
70114 static void
70115 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70116 {
70117+#ifdef CONFIG_GRKERNSEC_HIDESYM
70118+ SEQ_printf(m, " .base: %p\n", NULL);
70119+#else
70120 SEQ_printf(m, " .base: %pK\n", base);
70121+#endif
70122 SEQ_printf(m, " .index: %d\n",
70123 base->index);
70124 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70125@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs(void)
70126 {
70127 struct proc_dir_entry *pe;
70128
70129+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70130+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70131+#else
70132 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70133+#endif
70134 if (!pe)
70135 return -ENOMEM;
70136 return 0;
70137diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
70138index a5d0a3a..60c7948 100644
70139--- a/kernel/time/timer_stats.c
70140+++ b/kernel/time/timer_stats.c
70141@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70142 static unsigned long nr_entries;
70143 static struct entry entries[MAX_ENTRIES];
70144
70145-static atomic_t overflow_count;
70146+static atomic_unchecked_t overflow_count;
70147
70148 /*
70149 * The entries are in a hash-table, for fast lookup:
70150@@ -140,7 +140,7 @@ static void reset_entries(void)
70151 nr_entries = 0;
70152 memset(entries, 0, sizeof(entries));
70153 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70154- atomic_set(&overflow_count, 0);
70155+ atomic_set_unchecked(&overflow_count, 0);
70156 }
70157
70158 static struct entry *alloc_entry(void)
70159@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
70160 if (likely(entry))
70161 entry->count++;
70162 else
70163- atomic_inc(&overflow_count);
70164+ atomic_inc_unchecked(&overflow_count);
70165
70166 out_unlock:
70167 raw_spin_unlock_irqrestore(lock, flags);
70168@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
70169
70170 static void print_name_offset(struct seq_file *m, unsigned long addr)
70171 {
70172+#ifdef CONFIG_GRKERNSEC_HIDESYM
70173+ seq_printf(m, "<%p>", NULL);
70174+#else
70175 char symname[KSYM_NAME_LEN];
70176
70177 if (lookup_symbol_name(addr, symname) < 0)
70178 seq_printf(m, "<%p>", (void *)addr);
70179 else
70180 seq_printf(m, "%s", symname);
70181+#endif
70182 }
70183
70184 static int tstats_show(struct seq_file *m, void *v)
70185@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
70186
70187 seq_puts(m, "Timer Stats Version: v0.2\n");
70188 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70189- if (atomic_read(&overflow_count))
70190+ if (atomic_read_unchecked(&overflow_count))
70191 seq_printf(m, "Overflow: %d entries\n",
70192- atomic_read(&overflow_count));
70193+ atomic_read_unchecked(&overflow_count));
70194
70195 for (i = 0; i < nr_entries; i++) {
70196 entry = entries + i;
70197@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
70198 {
70199 struct proc_dir_entry *pe;
70200
70201+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70202+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70203+#else
70204 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70205+#endif
70206 if (!pe)
70207 return -ENOMEM;
70208 return 0;
70209diff --git a/kernel/timer.c b/kernel/timer.c
70210index 8cff361..0fb5cd8 100644
70211--- a/kernel/timer.c
70212+++ b/kernel/timer.c
70213@@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
70214 /*
70215 * This function runs timers and the timer-tq in bottom half context.
70216 */
70217-static void run_timer_softirq(struct softirq_action *h)
70218+static void run_timer_softirq(void)
70219 {
70220 struct tvec_base *base = __this_cpu_read(tvec_bases);
70221
70222diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
70223index 7c910a5..8b72104 100644
70224--- a/kernel/trace/blktrace.c
70225+++ b/kernel/trace/blktrace.c
70226@@ -323,7 +323,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
70227 struct blk_trace *bt = filp->private_data;
70228 char buf[16];
70229
70230- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70231+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70232
70233 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70234 }
70235@@ -388,7 +388,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
70236 return 1;
70237
70238 bt = buf->chan->private_data;
70239- atomic_inc(&bt->dropped);
70240+ atomic_inc_unchecked(&bt->dropped);
70241 return 0;
70242 }
70243
70244@@ -489,7 +489,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
70245
70246 bt->dir = dir;
70247 bt->dev = dev;
70248- atomic_set(&bt->dropped, 0);
70249+ atomic_set_unchecked(&bt->dropped, 0);
70250
70251 ret = -EIO;
70252 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
70253diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
70254index 48d3762..3b61fce 100644
70255--- a/kernel/trace/ftrace.c
70256+++ b/kernel/trace/ftrace.c
70257@@ -1584,12 +1584,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
70258 if (unlikely(ftrace_disabled))
70259 return 0;
70260
70261+ ret = ftrace_arch_code_modify_prepare();
70262+ FTRACE_WARN_ON(ret);
70263+ if (ret)
70264+ return 0;
70265+
70266 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70267+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70268 if (ret) {
70269 ftrace_bug(ret, ip);
70270- return 0;
70271 }
70272- return 1;
70273+ return ret ? 0 : 1;
70274 }
70275
70276 /*
70277@@ -2606,7 +2611,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
70278
70279 int
70280 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70281- void *data)
70282+ void *data)
70283 {
70284 struct ftrace_func_probe *entry;
70285 struct ftrace_page *pg;
70286diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
70287index 17a2d44..85907e2 100644
70288--- a/kernel/trace/trace.c
70289+++ b/kernel/trace/trace.c
70290@@ -3451,6 +3451,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
70291 size_t rem;
70292 unsigned int i;
70293
70294+ pax_track_stack();
70295+
70296 if (splice_grow_spd(pipe, &spd))
70297 return -ENOMEM;
70298
70299@@ -3926,6 +3928,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
70300 int entries, size, i;
70301 size_t ret;
70302
70303+ pax_track_stack();
70304+
70305 if (splice_grow_spd(pipe, &spd))
70306 return -ENOMEM;
70307
70308@@ -4093,10 +4097,9 @@ static const struct file_operations tracing_dyn_info_fops = {
70309 };
70310 #endif
70311
70312-static struct dentry *d_tracer;
70313-
70314 struct dentry *tracing_init_dentry(void)
70315 {
70316+ static struct dentry *d_tracer;
70317 static int once;
70318
70319 if (d_tracer)
70320@@ -4116,10 +4119,9 @@ struct dentry *tracing_init_dentry(void)
70321 return d_tracer;
70322 }
70323
70324-static struct dentry *d_percpu;
70325-
70326 struct dentry *tracing_dentry_percpu(void)
70327 {
70328+ static struct dentry *d_percpu;
70329 static int once;
70330 struct dentry *d_tracer;
70331
70332diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
70333index c212a7f..7b02394 100644
70334--- a/kernel/trace/trace_events.c
70335+++ b/kernel/trace/trace_events.c
70336@@ -1299,10 +1299,6 @@ static LIST_HEAD(ftrace_module_file_list);
70337 struct ftrace_module_file_ops {
70338 struct list_head list;
70339 struct module *mod;
70340- struct file_operations id;
70341- struct file_operations enable;
70342- struct file_operations format;
70343- struct file_operations filter;
70344 };
70345
70346 static struct ftrace_module_file_ops *
70347@@ -1323,17 +1319,12 @@ trace_create_file_ops(struct module *mod)
70348
70349 file_ops->mod = mod;
70350
70351- file_ops->id = ftrace_event_id_fops;
70352- file_ops->id.owner = mod;
70353-
70354- file_ops->enable = ftrace_enable_fops;
70355- file_ops->enable.owner = mod;
70356-
70357- file_ops->filter = ftrace_event_filter_fops;
70358- file_ops->filter.owner = mod;
70359-
70360- file_ops->format = ftrace_event_format_fops;
70361- file_ops->format.owner = mod;
70362+ pax_open_kernel();
70363+ *(void **)&mod->trace_id.owner = mod;
70364+ *(void **)&mod->trace_enable.owner = mod;
70365+ *(void **)&mod->trace_filter.owner = mod;
70366+ *(void **)&mod->trace_format.owner = mod;
70367+ pax_close_kernel();
70368
70369 list_add(&file_ops->list, &ftrace_module_file_list);
70370
70371@@ -1357,8 +1348,8 @@ static void trace_module_add_events(struct module *mod)
70372
70373 for_each_event(call, start, end) {
70374 __trace_add_event_call(*call, mod,
70375- &file_ops->id, &file_ops->enable,
70376- &file_ops->filter, &file_ops->format);
70377+ &mod->trace_id, &mod->trace_enable,
70378+ &mod->trace_filter, &mod->trace_format);
70379 }
70380 }
70381
70382diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
70383index 00d527c..7c5b1a3 100644
70384--- a/kernel/trace/trace_kprobe.c
70385+++ b/kernel/trace/trace_kprobe.c
70386@@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
70387 long ret;
70388 int maxlen = get_rloc_len(*(u32 *)dest);
70389 u8 *dst = get_rloc_data(dest);
70390- u8 *src = addr;
70391+ const u8 __user *src = (const u8 __force_user *)addr;
70392 mm_segment_t old_fs = get_fs();
70393 if (!maxlen)
70394 return;
70395@@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
70396 pagefault_disable();
70397 do
70398 ret = __copy_from_user_inatomic(dst++, src++, 1);
70399- while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
70400+ while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
70401 dst[-1] = '\0';
70402 pagefault_enable();
70403 set_fs(old_fs);
70404@@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
70405 ((u8 *)get_rloc_data(dest))[0] = '\0';
70406 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
70407 } else
70408- *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
70409+ *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
70410 get_rloc_offs(*(u32 *)dest));
70411 }
70412 /* Return the length of string -- including null terminal byte */
70413@@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs,
70414 set_fs(KERNEL_DS);
70415 pagefault_disable();
70416 do {
70417- ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
70418+ ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
70419 len++;
70420 } while (c && ret == 0 && len < MAX_STRING_SIZE);
70421 pagefault_enable();
70422diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
70423index fd3c8aa..5f324a6 100644
70424--- a/kernel/trace/trace_mmiotrace.c
70425+++ b/kernel/trace/trace_mmiotrace.c
70426@@ -24,7 +24,7 @@ struct header_iter {
70427 static struct trace_array *mmio_trace_array;
70428 static bool overrun_detected;
70429 static unsigned long prev_overruns;
70430-static atomic_t dropped_count;
70431+static atomic_unchecked_t dropped_count;
70432
70433 static void mmio_reset_data(struct trace_array *tr)
70434 {
70435@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
70436
70437 static unsigned long count_overruns(struct trace_iterator *iter)
70438 {
70439- unsigned long cnt = atomic_xchg(&dropped_count, 0);
70440+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
70441 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
70442
70443 if (over > prev_overruns)
70444@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
70445 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
70446 sizeof(*entry), 0, pc);
70447 if (!event) {
70448- atomic_inc(&dropped_count);
70449+ atomic_inc_unchecked(&dropped_count);
70450 return;
70451 }
70452 entry = ring_buffer_event_data(event);
70453@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
70454 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
70455 sizeof(*entry), 0, pc);
70456 if (!event) {
70457- atomic_inc(&dropped_count);
70458+ atomic_inc_unchecked(&dropped_count);
70459 return;
70460 }
70461 entry = ring_buffer_event_data(event);
70462diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
70463index 5199930..26c73a0 100644
70464--- a/kernel/trace/trace_output.c
70465+++ b/kernel/trace/trace_output.c
70466@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
70467
70468 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
70469 if (!IS_ERR(p)) {
70470- p = mangle_path(s->buffer + s->len, p, "\n");
70471+ p = mangle_path(s->buffer + s->len, p, "\n\\");
70472 if (p) {
70473 s->len = p - s->buffer;
70474 return 1;
70475diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
70476index 77575b3..6e623d1 100644
70477--- a/kernel/trace/trace_stack.c
70478+++ b/kernel/trace/trace_stack.c
70479@@ -50,7 +50,7 @@ static inline void check_stack(void)
70480 return;
70481
70482 /* we do not handle interrupt stacks yet */
70483- if (!object_is_on_stack(&this_size))
70484+ if (!object_starts_on_stack(&this_size))
70485 return;
70486
70487 local_irq_save(flags);
70488diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
70489index 209b379..7f76423 100644
70490--- a/kernel/trace/trace_workqueue.c
70491+++ b/kernel/trace/trace_workqueue.c
70492@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
70493 int cpu;
70494 pid_t pid;
70495 /* Can be inserted from interrupt or user context, need to be atomic */
70496- atomic_t inserted;
70497+ atomic_unchecked_t inserted;
70498 /*
70499 * Don't need to be atomic, works are serialized in a single workqueue thread
70500 * on a single CPU.
70501@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
70502 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
70503 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
70504 if (node->pid == wq_thread->pid) {
70505- atomic_inc(&node->inserted);
70506+ atomic_inc_unchecked(&node->inserted);
70507 goto found;
70508 }
70509 }
70510@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
70511 tsk = get_pid_task(pid, PIDTYPE_PID);
70512 if (tsk) {
70513 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
70514- atomic_read(&cws->inserted), cws->executed,
70515+ atomic_read_unchecked(&cws->inserted), cws->executed,
70516 tsk->comm);
70517 put_task_struct(tsk);
70518 }
70519diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
70520index c0cb9c4..f33aa89 100644
70521--- a/lib/Kconfig.debug
70522+++ b/lib/Kconfig.debug
70523@@ -1091,6 +1091,7 @@ config LATENCYTOP
70524 depends on DEBUG_KERNEL
70525 depends on STACKTRACE_SUPPORT
70526 depends on PROC_FS
70527+ depends on !GRKERNSEC_HIDESYM
70528 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
70529 select KALLSYMS
70530 select KALLSYMS_ALL
70531diff --git a/lib/bitmap.c b/lib/bitmap.c
70532index 2f4412e..a557e27 100644
70533--- a/lib/bitmap.c
70534+++ b/lib/bitmap.c
70535@@ -419,7 +419,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
70536 {
70537 int c, old_c, totaldigits, ndigits, nchunks, nbits;
70538 u32 chunk;
70539- const char __user *ubuf = buf;
70540+ const char __user *ubuf = (const char __force_user *)buf;
70541
70542 bitmap_zero(maskp, nmaskbits);
70543
70544@@ -504,7 +504,7 @@ int bitmap_parse_user(const char __user *ubuf,
70545 {
70546 if (!access_ok(VERIFY_READ, ubuf, ulen))
70547 return -EFAULT;
70548- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
70549+ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
70550 }
70551 EXPORT_SYMBOL(bitmap_parse_user);
70552
70553@@ -594,7 +594,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
70554 {
70555 unsigned a, b;
70556 int c, old_c, totaldigits;
70557- const char __user *ubuf = buf;
70558+ const char __user *ubuf = (const char __force_user *)buf;
70559 int exp_digit, in_range;
70560
70561 totaldigits = c = 0;
70562@@ -694,7 +694,7 @@ int bitmap_parselist_user(const char __user *ubuf,
70563 {
70564 if (!access_ok(VERIFY_READ, ubuf, ulen))
70565 return -EFAULT;
70566- return __bitmap_parselist((const char *)ubuf,
70567+ return __bitmap_parselist((const char __force_kernel *)ubuf,
70568 ulen, 1, maskp, nmaskbits);
70569 }
70570 EXPORT_SYMBOL(bitmap_parselist_user);
70571diff --git a/lib/bug.c b/lib/bug.c
70572index 1955209..cbbb2ad 100644
70573--- a/lib/bug.c
70574+++ b/lib/bug.c
70575@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
70576 return BUG_TRAP_TYPE_NONE;
70577
70578 bug = find_bug(bugaddr);
70579+ if (!bug)
70580+ return BUG_TRAP_TYPE_NONE;
70581
70582 file = NULL;
70583 line = 0;
70584diff --git a/lib/debugobjects.c b/lib/debugobjects.c
70585index a78b7c6..2c73084 100644
70586--- a/lib/debugobjects.c
70587+++ b/lib/debugobjects.c
70588@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
70589 if (limit > 4)
70590 return;
70591
70592- is_on_stack = object_is_on_stack(addr);
70593+ is_on_stack = object_starts_on_stack(addr);
70594 if (is_on_stack == onstack)
70595 return;
70596
70597diff --git a/lib/devres.c b/lib/devres.c
70598index 7c0e953..f642b5c 100644
70599--- a/lib/devres.c
70600+++ b/lib/devres.c
70601@@ -80,7 +80,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
70602 void devm_iounmap(struct device *dev, void __iomem *addr)
70603 {
70604 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
70605- (void *)addr));
70606+ (void __force *)addr));
70607 iounmap(addr);
70608 }
70609 EXPORT_SYMBOL(devm_iounmap);
70610@@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
70611 {
70612 ioport_unmap(addr);
70613 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
70614- devm_ioport_map_match, (void *)addr));
70615+ devm_ioport_map_match, (void __force *)addr));
70616 }
70617 EXPORT_SYMBOL(devm_ioport_unmap);
70618
70619diff --git a/lib/dma-debug.c b/lib/dma-debug.c
70620index db07bfd..719b5ab 100644
70621--- a/lib/dma-debug.c
70622+++ b/lib/dma-debug.c
70623@@ -870,7 +870,7 @@ out:
70624
70625 static void check_for_stack(struct device *dev, void *addr)
70626 {
70627- if (object_is_on_stack(addr))
70628+ if (object_starts_on_stack(addr))
70629 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
70630 "stack [addr=%p]\n", addr);
70631 }
70632diff --git a/lib/extable.c b/lib/extable.c
70633index 4cac81e..63e9b8f 100644
70634--- a/lib/extable.c
70635+++ b/lib/extable.c
70636@@ -13,6 +13,7 @@
70637 #include <linux/init.h>
70638 #include <linux/sort.h>
70639 #include <asm/uaccess.h>
70640+#include <asm/pgtable.h>
70641
70642 #ifndef ARCH_HAS_SORT_EXTABLE
70643 /*
70644@@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const void *b)
70645 void sort_extable(struct exception_table_entry *start,
70646 struct exception_table_entry *finish)
70647 {
70648+ pax_open_kernel();
70649 sort(start, finish - start, sizeof(struct exception_table_entry),
70650 cmp_ex, NULL);
70651+ pax_close_kernel();
70652 }
70653
70654 #ifdef CONFIG_MODULES
70655diff --git a/lib/inflate.c b/lib/inflate.c
70656index 013a761..c28f3fc 100644
70657--- a/lib/inflate.c
70658+++ b/lib/inflate.c
70659@@ -269,7 +269,7 @@ static void free(void *where)
70660 malloc_ptr = free_mem_ptr;
70661 }
70662 #else
70663-#define malloc(a) kmalloc(a, GFP_KERNEL)
70664+#define malloc(a) kmalloc((a), GFP_KERNEL)
70665 #define free(a) kfree(a)
70666 #endif
70667
70668diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
70669index bd2bea9..6b3c95e 100644
70670--- a/lib/is_single_threaded.c
70671+++ b/lib/is_single_threaded.c
70672@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
70673 struct task_struct *p, *t;
70674 bool ret;
70675
70676+ if (!mm)
70677+ return true;
70678+
70679 if (atomic_read(&task->signal->live) != 1)
70680 return false;
70681
70682diff --git a/lib/kref.c b/lib/kref.c
70683index 3efb882..8492f4c 100644
70684--- a/lib/kref.c
70685+++ b/lib/kref.c
70686@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
70687 */
70688 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
70689 {
70690- WARN_ON(release == NULL);
70691+ BUG_ON(release == NULL);
70692 WARN_ON(release == (void (*)(struct kref *))kfree);
70693
70694 if (atomic_dec_and_test(&kref->refcount)) {
70695diff --git a/lib/radix-tree.c b/lib/radix-tree.c
70696index a2f9da5..3bcadb6 100644
70697--- a/lib/radix-tree.c
70698+++ b/lib/radix-tree.c
70699@@ -80,7 +80,7 @@ struct radix_tree_preload {
70700 int nr;
70701 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
70702 };
70703-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
70704+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
70705
70706 static inline void *ptr_to_indirect(void *ptr)
70707 {
70708diff --git a/lib/vsprintf.c b/lib/vsprintf.c
70709index d7222a9..2172edc 100644
70710--- a/lib/vsprintf.c
70711+++ b/lib/vsprintf.c
70712@@ -16,6 +16,9 @@
70713 * - scnprintf and vscnprintf
70714 */
70715
70716+#ifdef CONFIG_GRKERNSEC_HIDESYM
70717+#define __INCLUDED_BY_HIDESYM 1
70718+#endif
70719 #include <stdarg.h>
70720 #include <linux/module.h>
70721 #include <linux/types.h>
70722@@ -432,7 +435,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
70723 char sym[KSYM_SYMBOL_LEN];
70724 if (ext == 'B')
70725 sprint_backtrace(sym, value);
70726- else if (ext != 'f' && ext != 's')
70727+ else if (ext != 'f' && ext != 's' && ext != 'a')
70728 sprint_symbol(sym, value);
70729 else
70730 kallsyms_lookup(value, NULL, NULL, NULL, sym);
70731@@ -796,7 +799,11 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
70732 return string(buf, end, uuid, spec);
70733 }
70734
70735+#ifdef CONFIG_GRKERNSEC_HIDESYM
70736+int kptr_restrict __read_mostly = 2;
70737+#else
70738 int kptr_restrict __read_mostly;
70739+#endif
70740
70741 /*
70742 * Show a '%p' thing. A kernel extension is that the '%p' is followed
70743@@ -810,6 +817,8 @@ int kptr_restrict __read_mostly;
70744 * - 'S' For symbolic direct pointers with offset
70745 * - 's' For symbolic direct pointers without offset
70746 * - 'B' For backtraced symbolic direct pointers with offset
70747+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
70748+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
70749 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
70750 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
70751 * - 'M' For a 6-byte MAC address, it prints the address in the
70752@@ -854,12 +863,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70753 {
70754 if (!ptr && *fmt != 'K') {
70755 /*
70756- * Print (null) with the same width as a pointer so it makes
70757+ * Print (nil) with the same width as a pointer so it makes
70758 * tabular output look nice.
70759 */
70760 if (spec.field_width == -1)
70761 spec.field_width = 2 * sizeof(void *);
70762- return string(buf, end, "(null)", spec);
70763+ return string(buf, end, "(nil)", spec);
70764 }
70765
70766 switch (*fmt) {
70767@@ -869,6 +878,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70768 /* Fallthrough */
70769 case 'S':
70770 case 's':
70771+#ifdef CONFIG_GRKERNSEC_HIDESYM
70772+ break;
70773+#else
70774+ return symbol_string(buf, end, ptr, spec, *fmt);
70775+#endif
70776+ case 'A':
70777+ case 'a':
70778 case 'B':
70779 return symbol_string(buf, end, ptr, spec, *fmt);
70780 case 'R':
70781@@ -1627,11 +1643,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
70782 typeof(type) value; \
70783 if (sizeof(type) == 8) { \
70784 args = PTR_ALIGN(args, sizeof(u32)); \
70785- *(u32 *)&value = *(u32 *)args; \
70786- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
70787+ *(u32 *)&value = *(const u32 *)args; \
70788+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
70789 } else { \
70790 args = PTR_ALIGN(args, sizeof(type)); \
70791- value = *(typeof(type) *)args; \
70792+ value = *(const typeof(type) *)args; \
70793 } \
70794 args += sizeof(type); \
70795 value; \
70796@@ -1694,7 +1710,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
70797 case FORMAT_TYPE_STR: {
70798 const char *str_arg = args;
70799 args += strlen(str_arg) + 1;
70800- str = string(str, end, (char *)str_arg, spec);
70801+ str = string(str, end, str_arg, spec);
70802 break;
70803 }
70804
70805diff --git a/localversion-grsec b/localversion-grsec
70806new file mode 100644
70807index 0000000..7cd6065
70808--- /dev/null
70809+++ b/localversion-grsec
70810@@ -0,0 +1 @@
70811+-grsec
70812diff --git a/mm/Kconfig b/mm/Kconfig
70813index f2f1ca1..0645f06 100644
70814--- a/mm/Kconfig
70815+++ b/mm/Kconfig
70816@@ -238,10 +238,10 @@ config KSM
70817 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
70818
70819 config DEFAULT_MMAP_MIN_ADDR
70820- int "Low address space to protect from user allocation"
70821+ int "Low address space to protect from user allocation"
70822 depends on MMU
70823- default 4096
70824- help
70825+ default 65536
70826+ help
70827 This is the portion of low virtual memory which should be protected
70828 from userspace allocation. Keeping a user from writing to low pages
70829 can help reduce the impact of kernel NULL pointer bugs.
70830diff --git a/mm/filemap.c b/mm/filemap.c
70831index 0eedbf8..b108990 100644
70832--- a/mm/filemap.c
70833+++ b/mm/filemap.c
70834@@ -1770,7 +1770,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
70835 struct address_space *mapping = file->f_mapping;
70836
70837 if (!mapping->a_ops->readpage)
70838- return -ENOEXEC;
70839+ return -ENODEV;
70840 file_accessed(file);
70841 vma->vm_ops = &generic_file_vm_ops;
70842 vma->vm_flags |= VM_CAN_NONLINEAR;
70843@@ -2173,6 +2173,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
70844 *pos = i_size_read(inode);
70845
70846 if (limit != RLIM_INFINITY) {
70847+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
70848 if (*pos >= limit) {
70849 send_sig(SIGXFSZ, current, 0);
70850 return -EFBIG;
70851diff --git a/mm/fremap.c b/mm/fremap.c
70852index b8e0e2d..076e171 100644
70853--- a/mm/fremap.c
70854+++ b/mm/fremap.c
70855@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
70856 retry:
70857 vma = find_vma(mm, start);
70858
70859+#ifdef CONFIG_PAX_SEGMEXEC
70860+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
70861+ goto out;
70862+#endif
70863+
70864 /*
70865 * Make sure the vma is shared, that it supports prefaulting,
70866 * and that the remapped range is valid and fully within
70867diff --git a/mm/highmem.c b/mm/highmem.c
70868index 5ef672c..d7660f4 100644
70869--- a/mm/highmem.c
70870+++ b/mm/highmem.c
70871@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
70872 * So no dangers, even with speculative execution.
70873 */
70874 page = pte_page(pkmap_page_table[i]);
70875+ pax_open_kernel();
70876 pte_clear(&init_mm, (unsigned long)page_address(page),
70877 &pkmap_page_table[i]);
70878-
70879+ pax_close_kernel();
70880 set_page_address(page, NULL);
70881 need_flush = 1;
70882 }
70883@@ -186,9 +187,11 @@ start:
70884 }
70885 }
70886 vaddr = PKMAP_ADDR(last_pkmap_nr);
70887+
70888+ pax_open_kernel();
70889 set_pte_at(&init_mm, vaddr,
70890 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
70891-
70892+ pax_close_kernel();
70893 pkmap_count[last_pkmap_nr] = 1;
70894 set_page_address(page, (void *)vaddr);
70895
70896diff --git a/mm/huge_memory.c b/mm/huge_memory.c
70897index d819d93..468e18f 100644
70898--- a/mm/huge_memory.c
70899+++ b/mm/huge_memory.c
70900@@ -702,7 +702,7 @@ out:
70901 * run pte_offset_map on the pmd, if an huge pmd could
70902 * materialize from under us from a different thread.
70903 */
70904- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
70905+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70906 return VM_FAULT_OOM;
70907 /* if an huge pmd materialized from under us just retry later */
70908 if (unlikely(pmd_trans_huge(*pmd)))
70909@@ -829,7 +829,7 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
70910
70911 for (i = 0; i < HPAGE_PMD_NR; i++) {
70912 copy_user_highpage(pages[i], page + i,
70913- haddr + PAGE_SHIFT*i, vma);
70914+ haddr + PAGE_SIZE*i, vma);
70915 __SetPageUptodate(pages[i]);
70916 cond_resched();
70917 }
70918diff --git a/mm/hugetlb.c b/mm/hugetlb.c
70919index 2316840..b418671 100644
70920--- a/mm/hugetlb.c
70921+++ b/mm/hugetlb.c
70922@@ -2347,6 +2347,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
70923 return 1;
70924 }
70925
70926+#ifdef CONFIG_PAX_SEGMEXEC
70927+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
70928+{
70929+ struct mm_struct *mm = vma->vm_mm;
70930+ struct vm_area_struct *vma_m;
70931+ unsigned long address_m;
70932+ pte_t *ptep_m;
70933+
70934+ vma_m = pax_find_mirror_vma(vma);
70935+ if (!vma_m)
70936+ return;
70937+
70938+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70939+ address_m = address + SEGMEXEC_TASK_SIZE;
70940+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
70941+ get_page(page_m);
70942+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
70943+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
70944+}
70945+#endif
70946+
70947 /*
70948 * Hugetlb_cow() should be called with page lock of the original hugepage held.
70949 */
70950@@ -2450,6 +2471,11 @@ retry_avoidcopy:
70951 make_huge_pte(vma, new_page, 1));
70952 page_remove_rmap(old_page);
70953 hugepage_add_new_anon_rmap(new_page, vma, address);
70954+
70955+#ifdef CONFIG_PAX_SEGMEXEC
70956+ pax_mirror_huge_pte(vma, address, new_page);
70957+#endif
70958+
70959 /* Make the old page be freed below */
70960 new_page = old_page;
70961 mmu_notifier_invalidate_range_end(mm,
70962@@ -2601,6 +2627,10 @@ retry:
70963 && (vma->vm_flags & VM_SHARED)));
70964 set_huge_pte_at(mm, address, ptep, new_pte);
70965
70966+#ifdef CONFIG_PAX_SEGMEXEC
70967+ pax_mirror_huge_pte(vma, address, page);
70968+#endif
70969+
70970 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
70971 /* Optimization, do the COW without a second fault */
70972 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
70973@@ -2630,6 +2660,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70974 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
70975 struct hstate *h = hstate_vma(vma);
70976
70977+#ifdef CONFIG_PAX_SEGMEXEC
70978+ struct vm_area_struct *vma_m;
70979+#endif
70980+
70981 ptep = huge_pte_offset(mm, address);
70982 if (ptep) {
70983 entry = huge_ptep_get(ptep);
70984@@ -2641,6 +2675,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70985 VM_FAULT_SET_HINDEX(h - hstates);
70986 }
70987
70988+#ifdef CONFIG_PAX_SEGMEXEC
70989+ vma_m = pax_find_mirror_vma(vma);
70990+ if (vma_m) {
70991+ unsigned long address_m;
70992+
70993+ if (vma->vm_start > vma_m->vm_start) {
70994+ address_m = address;
70995+ address -= SEGMEXEC_TASK_SIZE;
70996+ vma = vma_m;
70997+ h = hstate_vma(vma);
70998+ } else
70999+ address_m = address + SEGMEXEC_TASK_SIZE;
71000+
71001+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71002+ return VM_FAULT_OOM;
71003+ address_m &= HPAGE_MASK;
71004+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71005+ }
71006+#endif
71007+
71008 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71009 if (!ptep)
71010 return VM_FAULT_OOM;
71011diff --git a/mm/internal.h b/mm/internal.h
71012index 2189af4..f2ca332 100644
71013--- a/mm/internal.h
71014+++ b/mm/internal.h
71015@@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
71016 * in mm/page_alloc.c
71017 */
71018 extern void __free_pages_bootmem(struct page *page, unsigned int order);
71019+extern void free_compound_page(struct page *page);
71020 extern void prep_compound_page(struct page *page, unsigned long order);
71021 #ifdef CONFIG_MEMORY_FAILURE
71022 extern bool is_free_buddy_page(struct page *page);
71023diff --git a/mm/kmemleak.c b/mm/kmemleak.c
71024index d6880f5..ed77913 100644
71025--- a/mm/kmemleak.c
71026+++ b/mm/kmemleak.c
71027@@ -357,7 +357,7 @@ static void print_unreferenced(struct seq_file *seq,
71028
71029 for (i = 0; i < object->trace_len; i++) {
71030 void *ptr = (void *)object->trace[i];
71031- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71032+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71033 }
71034 }
71035
71036diff --git a/mm/maccess.c b/mm/maccess.c
71037index 4cee182..e00511d 100644
71038--- a/mm/maccess.c
71039+++ b/mm/maccess.c
71040@@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
71041 set_fs(KERNEL_DS);
71042 pagefault_disable();
71043 ret = __copy_from_user_inatomic(dst,
71044- (__force const void __user *)src, size);
71045+ (const void __force_user *)src, size);
71046 pagefault_enable();
71047 set_fs(old_fs);
71048
71049@@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
71050
71051 set_fs(KERNEL_DS);
71052 pagefault_disable();
71053- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
71054+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
71055 pagefault_enable();
71056 set_fs(old_fs);
71057
71058diff --git a/mm/madvise.c b/mm/madvise.c
71059index 74bf193..feb6fd3 100644
71060--- a/mm/madvise.c
71061+++ b/mm/madvise.c
71062@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
71063 pgoff_t pgoff;
71064 unsigned long new_flags = vma->vm_flags;
71065
71066+#ifdef CONFIG_PAX_SEGMEXEC
71067+ struct vm_area_struct *vma_m;
71068+#endif
71069+
71070 switch (behavior) {
71071 case MADV_NORMAL:
71072 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71073@@ -110,6 +114,13 @@ success:
71074 /*
71075 * vm_flags is protected by the mmap_sem held in write mode.
71076 */
71077+
71078+#ifdef CONFIG_PAX_SEGMEXEC
71079+ vma_m = pax_find_mirror_vma(vma);
71080+ if (vma_m)
71081+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71082+#endif
71083+
71084 vma->vm_flags = new_flags;
71085
71086 out:
71087@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
71088 struct vm_area_struct ** prev,
71089 unsigned long start, unsigned long end)
71090 {
71091+
71092+#ifdef CONFIG_PAX_SEGMEXEC
71093+ struct vm_area_struct *vma_m;
71094+#endif
71095+
71096 *prev = vma;
71097 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71098 return -EINVAL;
71099@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
71100 zap_page_range(vma, start, end - start, &details);
71101 } else
71102 zap_page_range(vma, start, end - start, NULL);
71103+
71104+#ifdef CONFIG_PAX_SEGMEXEC
71105+ vma_m = pax_find_mirror_vma(vma);
71106+ if (vma_m) {
71107+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71108+ struct zap_details details = {
71109+ .nonlinear_vma = vma_m,
71110+ .last_index = ULONG_MAX,
71111+ };
71112+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71113+ } else
71114+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71115+ }
71116+#endif
71117+
71118 return 0;
71119 }
71120
71121@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
71122 if (end < start)
71123 goto out;
71124
71125+#ifdef CONFIG_PAX_SEGMEXEC
71126+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71127+ if (end > SEGMEXEC_TASK_SIZE)
71128+ goto out;
71129+ } else
71130+#endif
71131+
71132+ if (end > TASK_SIZE)
71133+ goto out;
71134+
71135 error = 0;
71136 if (end == start)
71137 goto out;
71138diff --git a/mm/memory-failure.c b/mm/memory-failure.c
71139index 2b43ba0..fc09657 100644
71140--- a/mm/memory-failure.c
71141+++ b/mm/memory-failure.c
71142@@ -60,7 +60,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
71143
71144 int sysctl_memory_failure_recovery __read_mostly = 1;
71145
71146-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
71147+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
71148
71149 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
71150
71151@@ -201,7 +201,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
71152 si.si_signo = SIGBUS;
71153 si.si_errno = 0;
71154 si.si_code = BUS_MCEERR_AO;
71155- si.si_addr = (void *)addr;
71156+ si.si_addr = (void __user *)addr;
71157 #ifdef __ARCH_SI_TRAPNO
71158 si.si_trapno = trapno;
71159 #endif
71160@@ -1009,7 +1009,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
71161 }
71162
71163 nr_pages = 1 << compound_trans_order(hpage);
71164- atomic_long_add(nr_pages, &mce_bad_pages);
71165+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
71166
71167 /*
71168 * We need/can do nothing about count=0 pages.
71169@@ -1039,7 +1039,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
71170 if (!PageHWPoison(hpage)
71171 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
71172 || (p != hpage && TestSetPageHWPoison(hpage))) {
71173- atomic_long_sub(nr_pages, &mce_bad_pages);
71174+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71175 return 0;
71176 }
71177 set_page_hwpoison_huge_page(hpage);
71178@@ -1097,7 +1097,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
71179 }
71180 if (hwpoison_filter(p)) {
71181 if (TestClearPageHWPoison(p))
71182- atomic_long_sub(nr_pages, &mce_bad_pages);
71183+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71184 unlock_page(hpage);
71185 put_page(hpage);
71186 return 0;
71187@@ -1314,7 +1314,7 @@ int unpoison_memory(unsigned long pfn)
71188 return 0;
71189 }
71190 if (TestClearPageHWPoison(p))
71191- atomic_long_sub(nr_pages, &mce_bad_pages);
71192+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71193 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
71194 return 0;
71195 }
71196@@ -1328,7 +1328,7 @@ int unpoison_memory(unsigned long pfn)
71197 */
71198 if (TestClearPageHWPoison(page)) {
71199 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
71200- atomic_long_sub(nr_pages, &mce_bad_pages);
71201+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71202 freeit = 1;
71203 if (PageHuge(page))
71204 clear_page_hwpoison_huge_page(page);
71205@@ -1441,7 +1441,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
71206 }
71207 done:
71208 if (!PageHWPoison(hpage))
71209- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
71210+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
71211 set_page_hwpoison_huge_page(hpage);
71212 dequeue_hwpoisoned_huge_page(hpage);
71213 /* keep elevated page count for bad page */
71214@@ -1572,7 +1572,7 @@ int soft_offline_page(struct page *page, int flags)
71215 return ret;
71216
71217 done:
71218- atomic_long_add(1, &mce_bad_pages);
71219+ atomic_long_add_unchecked(1, &mce_bad_pages);
71220 SetPageHWPoison(page);
71221 /* keep elevated page count for bad page */
71222 return ret;
71223diff --git a/mm/memory.c b/mm/memory.c
71224index b2b8731..6080174 100644
71225--- a/mm/memory.c
71226+++ b/mm/memory.c
71227@@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
71228 return;
71229
71230 pmd = pmd_offset(pud, start);
71231+
71232+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71233 pud_clear(pud);
71234 pmd_free_tlb(tlb, pmd, start);
71235+#endif
71236+
71237 }
71238
71239 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71240@@ -489,9 +493,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71241 if (end - 1 > ceiling - 1)
71242 return;
71243
71244+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71245 pud = pud_offset(pgd, start);
71246 pgd_clear(pgd);
71247 pud_free_tlb(tlb, pud, start);
71248+#endif
71249+
71250 }
71251
71252 /*
71253@@ -1566,12 +1573,6 @@ no_page_table:
71254 return page;
71255 }
71256
71257-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71258-{
71259- return stack_guard_page_start(vma, addr) ||
71260- stack_guard_page_end(vma, addr+PAGE_SIZE);
71261-}
71262-
71263 /**
71264 * __get_user_pages() - pin user pages in memory
71265 * @tsk: task_struct of target task
71266@@ -1644,10 +1645,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71267 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71268 i = 0;
71269
71270- do {
71271+ while (nr_pages) {
71272 struct vm_area_struct *vma;
71273
71274- vma = find_extend_vma(mm, start);
71275+ vma = find_vma(mm, start);
71276 if (!vma && in_gate_area(mm, start)) {
71277 unsigned long pg = start & PAGE_MASK;
71278 pgd_t *pgd;
71279@@ -1695,7 +1696,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71280 goto next_page;
71281 }
71282
71283- if (!vma ||
71284+ if (!vma || start < vma->vm_start ||
71285 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71286 !(vm_flags & vma->vm_flags))
71287 return i ? : -EFAULT;
71288@@ -1722,11 +1723,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71289 int ret;
71290 unsigned int fault_flags = 0;
71291
71292- /* For mlock, just skip the stack guard page. */
71293- if (foll_flags & FOLL_MLOCK) {
71294- if (stack_guard_page(vma, start))
71295- goto next_page;
71296- }
71297 if (foll_flags & FOLL_WRITE)
71298 fault_flags |= FAULT_FLAG_WRITE;
71299 if (nonblocking)
71300@@ -1800,7 +1796,7 @@ next_page:
71301 start += PAGE_SIZE;
71302 nr_pages--;
71303 } while (nr_pages && start < vma->vm_end);
71304- } while (nr_pages);
71305+ }
71306 return i;
71307 }
71308 EXPORT_SYMBOL(__get_user_pages);
71309@@ -2007,6 +2003,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
71310 page_add_file_rmap(page);
71311 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71312
71313+#ifdef CONFIG_PAX_SEGMEXEC
71314+ pax_mirror_file_pte(vma, addr, page, ptl);
71315+#endif
71316+
71317 retval = 0;
71318 pte_unmap_unlock(pte, ptl);
71319 return retval;
71320@@ -2041,10 +2041,22 @@ out:
71321 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71322 struct page *page)
71323 {
71324+
71325+#ifdef CONFIG_PAX_SEGMEXEC
71326+ struct vm_area_struct *vma_m;
71327+#endif
71328+
71329 if (addr < vma->vm_start || addr >= vma->vm_end)
71330 return -EFAULT;
71331 if (!page_count(page))
71332 return -EINVAL;
71333+
71334+#ifdef CONFIG_PAX_SEGMEXEC
71335+ vma_m = pax_find_mirror_vma(vma);
71336+ if (vma_m)
71337+ vma_m->vm_flags |= VM_INSERTPAGE;
71338+#endif
71339+
71340 vma->vm_flags |= VM_INSERTPAGE;
71341 return insert_page(vma, addr, page, vma->vm_page_prot);
71342 }
71343@@ -2130,6 +2142,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
71344 unsigned long pfn)
71345 {
71346 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71347+ BUG_ON(vma->vm_mirror);
71348
71349 if (addr < vma->vm_start || addr >= vma->vm_end)
71350 return -EFAULT;
71351@@ -2445,6 +2458,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
71352 copy_user_highpage(dst, src, va, vma);
71353 }
71354
71355+#ifdef CONFIG_PAX_SEGMEXEC
71356+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71357+{
71358+ struct mm_struct *mm = vma->vm_mm;
71359+ spinlock_t *ptl;
71360+ pte_t *pte, entry;
71361+
71362+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71363+ entry = *pte;
71364+ if (!pte_present(entry)) {
71365+ if (!pte_none(entry)) {
71366+ BUG_ON(pte_file(entry));
71367+ free_swap_and_cache(pte_to_swp_entry(entry));
71368+ pte_clear_not_present_full(mm, address, pte, 0);
71369+ }
71370+ } else {
71371+ struct page *page;
71372+
71373+ flush_cache_page(vma, address, pte_pfn(entry));
71374+ entry = ptep_clear_flush(vma, address, pte);
71375+ BUG_ON(pte_dirty(entry));
71376+ page = vm_normal_page(vma, address, entry);
71377+ if (page) {
71378+ update_hiwater_rss(mm);
71379+ if (PageAnon(page))
71380+ dec_mm_counter_fast(mm, MM_ANONPAGES);
71381+ else
71382+ dec_mm_counter_fast(mm, MM_FILEPAGES);
71383+ page_remove_rmap(page);
71384+ page_cache_release(page);
71385+ }
71386+ }
71387+ pte_unmap_unlock(pte, ptl);
71388+}
71389+
71390+/* PaX: if vma is mirrored, synchronize the mirror's PTE
71391+ *
71392+ * the ptl of the lower mapped page is held on entry and is not released on exit
71393+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71394+ */
71395+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71396+{
71397+ struct mm_struct *mm = vma->vm_mm;
71398+ unsigned long address_m;
71399+ spinlock_t *ptl_m;
71400+ struct vm_area_struct *vma_m;
71401+ pmd_t *pmd_m;
71402+ pte_t *pte_m, entry_m;
71403+
71404+ BUG_ON(!page_m || !PageAnon(page_m));
71405+
71406+ vma_m = pax_find_mirror_vma(vma);
71407+ if (!vma_m)
71408+ return;
71409+
71410+ BUG_ON(!PageLocked(page_m));
71411+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71412+ address_m = address + SEGMEXEC_TASK_SIZE;
71413+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71414+ pte_m = pte_offset_map(pmd_m, address_m);
71415+ ptl_m = pte_lockptr(mm, pmd_m);
71416+ if (ptl != ptl_m) {
71417+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71418+ if (!pte_none(*pte_m))
71419+ goto out;
71420+ }
71421+
71422+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71423+ page_cache_get(page_m);
71424+ page_add_anon_rmap(page_m, vma_m, address_m);
71425+ inc_mm_counter_fast(mm, MM_ANONPAGES);
71426+ set_pte_at(mm, address_m, pte_m, entry_m);
71427+ update_mmu_cache(vma_m, address_m, entry_m);
71428+out:
71429+ if (ptl != ptl_m)
71430+ spin_unlock(ptl_m);
71431+ pte_unmap(pte_m);
71432+ unlock_page(page_m);
71433+}
71434+
71435+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71436+{
71437+ struct mm_struct *mm = vma->vm_mm;
71438+ unsigned long address_m;
71439+ spinlock_t *ptl_m;
71440+ struct vm_area_struct *vma_m;
71441+ pmd_t *pmd_m;
71442+ pte_t *pte_m, entry_m;
71443+
71444+ BUG_ON(!page_m || PageAnon(page_m));
71445+
71446+ vma_m = pax_find_mirror_vma(vma);
71447+ if (!vma_m)
71448+ return;
71449+
71450+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71451+ address_m = address + SEGMEXEC_TASK_SIZE;
71452+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71453+ pte_m = pte_offset_map(pmd_m, address_m);
71454+ ptl_m = pte_lockptr(mm, pmd_m);
71455+ if (ptl != ptl_m) {
71456+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71457+ if (!pte_none(*pte_m))
71458+ goto out;
71459+ }
71460+
71461+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71462+ page_cache_get(page_m);
71463+ page_add_file_rmap(page_m);
71464+ inc_mm_counter_fast(mm, MM_FILEPAGES);
71465+ set_pte_at(mm, address_m, pte_m, entry_m);
71466+ update_mmu_cache(vma_m, address_m, entry_m);
71467+out:
71468+ if (ptl != ptl_m)
71469+ spin_unlock(ptl_m);
71470+ pte_unmap(pte_m);
71471+}
71472+
71473+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71474+{
71475+ struct mm_struct *mm = vma->vm_mm;
71476+ unsigned long address_m;
71477+ spinlock_t *ptl_m;
71478+ struct vm_area_struct *vma_m;
71479+ pmd_t *pmd_m;
71480+ pte_t *pte_m, entry_m;
71481+
71482+ vma_m = pax_find_mirror_vma(vma);
71483+ if (!vma_m)
71484+ return;
71485+
71486+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71487+ address_m = address + SEGMEXEC_TASK_SIZE;
71488+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71489+ pte_m = pte_offset_map(pmd_m, address_m);
71490+ ptl_m = pte_lockptr(mm, pmd_m);
71491+ if (ptl != ptl_m) {
71492+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71493+ if (!pte_none(*pte_m))
71494+ goto out;
71495+ }
71496+
71497+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71498+ set_pte_at(mm, address_m, pte_m, entry_m);
71499+out:
71500+ if (ptl != ptl_m)
71501+ spin_unlock(ptl_m);
71502+ pte_unmap(pte_m);
71503+}
71504+
71505+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71506+{
71507+ struct page *page_m;
71508+ pte_t entry;
71509+
71510+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71511+ goto out;
71512+
71513+ entry = *pte;
71514+ page_m = vm_normal_page(vma, address, entry);
71515+ if (!page_m)
71516+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71517+ else if (PageAnon(page_m)) {
71518+ if (pax_find_mirror_vma(vma)) {
71519+ pte_unmap_unlock(pte, ptl);
71520+ lock_page(page_m);
71521+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
71522+ if (pte_same(entry, *pte))
71523+ pax_mirror_anon_pte(vma, address, page_m, ptl);
71524+ else
71525+ unlock_page(page_m);
71526+ }
71527+ } else
71528+ pax_mirror_file_pte(vma, address, page_m, ptl);
71529+
71530+out:
71531+ pte_unmap_unlock(pte, ptl);
71532+}
71533+#endif
71534+
71535 /*
71536 * This routine handles present pages, when users try to write
71537 * to a shared page. It is done by copying the page to a new address
71538@@ -2656,6 +2849,12 @@ gotten:
71539 */
71540 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71541 if (likely(pte_same(*page_table, orig_pte))) {
71542+
71543+#ifdef CONFIG_PAX_SEGMEXEC
71544+ if (pax_find_mirror_vma(vma))
71545+ BUG_ON(!trylock_page(new_page));
71546+#endif
71547+
71548 if (old_page) {
71549 if (!PageAnon(old_page)) {
71550 dec_mm_counter_fast(mm, MM_FILEPAGES);
71551@@ -2707,6 +2906,10 @@ gotten:
71552 page_remove_rmap(old_page);
71553 }
71554
71555+#ifdef CONFIG_PAX_SEGMEXEC
71556+ pax_mirror_anon_pte(vma, address, new_page, ptl);
71557+#endif
71558+
71559 /* Free the old page.. */
71560 new_page = old_page;
71561 ret |= VM_FAULT_WRITE;
71562@@ -2986,6 +3189,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
71563 swap_free(entry);
71564 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
71565 try_to_free_swap(page);
71566+
71567+#ifdef CONFIG_PAX_SEGMEXEC
71568+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
71569+#endif
71570+
71571 unlock_page(page);
71572 if (swapcache) {
71573 /*
71574@@ -3009,6 +3217,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
71575
71576 /* No need to invalidate - it was non-present before */
71577 update_mmu_cache(vma, address, page_table);
71578+
71579+#ifdef CONFIG_PAX_SEGMEXEC
71580+ pax_mirror_anon_pte(vma, address, page, ptl);
71581+#endif
71582+
71583 unlock:
71584 pte_unmap_unlock(page_table, ptl);
71585 out:
71586@@ -3028,40 +3241,6 @@ out_release:
71587 }
71588
71589 /*
71590- * This is like a special single-page "expand_{down|up}wards()",
71591- * except we must first make sure that 'address{-|+}PAGE_SIZE'
71592- * doesn't hit another vma.
71593- */
71594-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
71595-{
71596- address &= PAGE_MASK;
71597- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
71598- struct vm_area_struct *prev = vma->vm_prev;
71599-
71600- /*
71601- * Is there a mapping abutting this one below?
71602- *
71603- * That's only ok if it's the same stack mapping
71604- * that has gotten split..
71605- */
71606- if (prev && prev->vm_end == address)
71607- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
71608-
71609- expand_downwards(vma, address - PAGE_SIZE);
71610- }
71611- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
71612- struct vm_area_struct *next = vma->vm_next;
71613-
71614- /* As VM_GROWSDOWN but s/below/above/ */
71615- if (next && next->vm_start == address + PAGE_SIZE)
71616- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
71617-
71618- expand_upwards(vma, address + PAGE_SIZE);
71619- }
71620- return 0;
71621-}
71622-
71623-/*
71624 * We enter with non-exclusive mmap_sem (to exclude vma changes,
71625 * but allow concurrent faults), and pte mapped but not yet locked.
71626 * We return with mmap_sem still held, but pte unmapped and unlocked.
71627@@ -3070,27 +3249,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
71628 unsigned long address, pte_t *page_table, pmd_t *pmd,
71629 unsigned int flags)
71630 {
71631- struct page *page;
71632+ struct page *page = NULL;
71633 spinlock_t *ptl;
71634 pte_t entry;
71635
71636- pte_unmap(page_table);
71637-
71638- /* Check if we need to add a guard page to the stack */
71639- if (check_stack_guard_page(vma, address) < 0)
71640- return VM_FAULT_SIGBUS;
71641-
71642- /* Use the zero-page for reads */
71643 if (!(flags & FAULT_FLAG_WRITE)) {
71644 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
71645 vma->vm_page_prot));
71646- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71647+ ptl = pte_lockptr(mm, pmd);
71648+ spin_lock(ptl);
71649 if (!pte_none(*page_table))
71650 goto unlock;
71651 goto setpte;
71652 }
71653
71654 /* Allocate our own private page. */
71655+ pte_unmap(page_table);
71656+
71657 if (unlikely(anon_vma_prepare(vma)))
71658 goto oom;
71659 page = alloc_zeroed_user_highpage_movable(vma, address);
71660@@ -3109,6 +3284,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
71661 if (!pte_none(*page_table))
71662 goto release;
71663
71664+#ifdef CONFIG_PAX_SEGMEXEC
71665+ if (pax_find_mirror_vma(vma))
71666+ BUG_ON(!trylock_page(page));
71667+#endif
71668+
71669 inc_mm_counter_fast(mm, MM_ANONPAGES);
71670 page_add_new_anon_rmap(page, vma, address);
71671 setpte:
71672@@ -3116,6 +3296,12 @@ setpte:
71673
71674 /* No need to invalidate - it was non-present before */
71675 update_mmu_cache(vma, address, page_table);
71676+
71677+#ifdef CONFIG_PAX_SEGMEXEC
71678+ if (page)
71679+ pax_mirror_anon_pte(vma, address, page, ptl);
71680+#endif
71681+
71682 unlock:
71683 pte_unmap_unlock(page_table, ptl);
71684 return 0;
71685@@ -3259,6 +3445,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71686 */
71687 /* Only go through if we didn't race with anybody else... */
71688 if (likely(pte_same(*page_table, orig_pte))) {
71689+
71690+#ifdef CONFIG_PAX_SEGMEXEC
71691+ if (anon && pax_find_mirror_vma(vma))
71692+ BUG_ON(!trylock_page(page));
71693+#endif
71694+
71695 flush_icache_page(vma, page);
71696 entry = mk_pte(page, vma->vm_page_prot);
71697 if (flags & FAULT_FLAG_WRITE)
71698@@ -3278,6 +3470,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71699
71700 /* no need to invalidate: a not-present page won't be cached */
71701 update_mmu_cache(vma, address, page_table);
71702+
71703+#ifdef CONFIG_PAX_SEGMEXEC
71704+ if (anon)
71705+ pax_mirror_anon_pte(vma, address, page, ptl);
71706+ else
71707+ pax_mirror_file_pte(vma, address, page, ptl);
71708+#endif
71709+
71710 } else {
71711 if (cow_page)
71712 mem_cgroup_uncharge_page(cow_page);
71713@@ -3431,6 +3631,12 @@ int handle_pte_fault(struct mm_struct *mm,
71714 if (flags & FAULT_FLAG_WRITE)
71715 flush_tlb_fix_spurious_fault(vma, address);
71716 }
71717+
71718+#ifdef CONFIG_PAX_SEGMEXEC
71719+ pax_mirror_pte(vma, address, pte, pmd, ptl);
71720+ return 0;
71721+#endif
71722+
71723 unlock:
71724 pte_unmap_unlock(pte, ptl);
71725 return 0;
71726@@ -3447,6 +3653,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71727 pmd_t *pmd;
71728 pte_t *pte;
71729
71730+#ifdef CONFIG_PAX_SEGMEXEC
71731+ struct vm_area_struct *vma_m;
71732+#endif
71733+
71734 __set_current_state(TASK_RUNNING);
71735
71736 count_vm_event(PGFAULT);
71737@@ -3458,6 +3668,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71738 if (unlikely(is_vm_hugetlb_page(vma)))
71739 return hugetlb_fault(mm, vma, address, flags);
71740
71741+#ifdef CONFIG_PAX_SEGMEXEC
71742+ vma_m = pax_find_mirror_vma(vma);
71743+ if (vma_m) {
71744+ unsigned long address_m;
71745+ pgd_t *pgd_m;
71746+ pud_t *pud_m;
71747+ pmd_t *pmd_m;
71748+
71749+ if (vma->vm_start > vma_m->vm_start) {
71750+ address_m = address;
71751+ address -= SEGMEXEC_TASK_SIZE;
71752+ vma = vma_m;
71753+ } else
71754+ address_m = address + SEGMEXEC_TASK_SIZE;
71755+
71756+ pgd_m = pgd_offset(mm, address_m);
71757+ pud_m = pud_alloc(mm, pgd_m, address_m);
71758+ if (!pud_m)
71759+ return VM_FAULT_OOM;
71760+ pmd_m = pmd_alloc(mm, pud_m, address_m);
71761+ if (!pmd_m)
71762+ return VM_FAULT_OOM;
71763+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
71764+ return VM_FAULT_OOM;
71765+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
71766+ }
71767+#endif
71768+
71769 pgd = pgd_offset(mm, address);
71770 pud = pud_alloc(mm, pgd, address);
71771 if (!pud)
71772@@ -3487,7 +3725,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71773 * run pte_offset_map on the pmd, if an huge pmd could
71774 * materialize from under us from a different thread.
71775 */
71776- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
71777+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71778 return VM_FAULT_OOM;
71779 /* if an huge pmd materialized from under us just retry later */
71780 if (unlikely(pmd_trans_huge(*pmd)))
71781@@ -3591,7 +3829,7 @@ static int __init gate_vma_init(void)
71782 gate_vma.vm_start = FIXADDR_USER_START;
71783 gate_vma.vm_end = FIXADDR_USER_END;
71784 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
71785- gate_vma.vm_page_prot = __P101;
71786+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
71787 /*
71788 * Make sure the vDSO gets into every core dump.
71789 * Dumping its contents makes post-mortem fully interpretable later
71790diff --git a/mm/mempolicy.c b/mm/mempolicy.c
71791index 2775fd0..f2b1c49 100644
71792--- a/mm/mempolicy.c
71793+++ b/mm/mempolicy.c
71794@@ -640,6 +640,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
71795 unsigned long vmstart;
71796 unsigned long vmend;
71797
71798+#ifdef CONFIG_PAX_SEGMEXEC
71799+ struct vm_area_struct *vma_m;
71800+#endif
71801+
71802 vma = find_vma_prev(mm, start, &prev);
71803 if (!vma || vma->vm_start > start)
71804 return -EFAULT;
71805@@ -678,6 +682,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
71806 err = policy_vma(vma, new_pol);
71807 if (err)
71808 goto out;
71809+
71810+#ifdef CONFIG_PAX_SEGMEXEC
71811+ vma_m = pax_find_mirror_vma(vma);
71812+ if (vma_m) {
71813+ err = policy_vma(vma_m, new_pol);
71814+ if (err)
71815+ goto out;
71816+ }
71817+#endif
71818+
71819 }
71820
71821 out:
71822@@ -1111,6 +1125,17 @@ static long do_mbind(unsigned long start, unsigned long len,
71823
71824 if (end < start)
71825 return -EINVAL;
71826+
71827+#ifdef CONFIG_PAX_SEGMEXEC
71828+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
71829+ if (end > SEGMEXEC_TASK_SIZE)
71830+ return -EINVAL;
71831+ } else
71832+#endif
71833+
71834+ if (end > TASK_SIZE)
71835+ return -EINVAL;
71836+
71837 if (end == start)
71838 return 0;
71839
71840@@ -1329,6 +1354,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71841 if (!mm)
71842 goto out;
71843
71844+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71845+ if (mm != current->mm &&
71846+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71847+ err = -EPERM;
71848+ goto out;
71849+ }
71850+#endif
71851+
71852 /*
71853 * Check if this process has the right to modify the specified
71854 * process. The right exists if the process has administrative
71855@@ -1338,8 +1371,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71856 rcu_read_lock();
71857 tcred = __task_cred(task);
71858 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71859- cred->uid != tcred->suid && cred->uid != tcred->uid &&
71860- !capable(CAP_SYS_NICE)) {
71861+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71862 rcu_read_unlock();
71863 err = -EPERM;
71864 goto out;
71865diff --git a/mm/migrate.c b/mm/migrate.c
71866index 14d0a6a..0360908 100644
71867--- a/mm/migrate.c
71868+++ b/mm/migrate.c
71869@@ -866,9 +866,9 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
71870
71871 if (anon_vma)
71872 put_anon_vma(anon_vma);
71873-out:
71874 unlock_page(hpage);
71875
71876+out:
71877 if (rc != -EAGAIN) {
71878 list_del(&hpage->lru);
71879 put_page(hpage);
71880@@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
71881 unsigned long chunk_start;
71882 int err;
71883
71884+ pax_track_stack();
71885+
71886 task_nodes = cpuset_mems_allowed(task);
71887
71888 err = -ENOMEM;
71889@@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71890 if (!mm)
71891 return -EINVAL;
71892
71893+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71894+ if (mm != current->mm &&
71895+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71896+ err = -EPERM;
71897+ goto out;
71898+ }
71899+#endif
71900+
71901 /*
71902 * Check if this process has the right to modify the specified
71903 * process. The right exists if the process has administrative
71904@@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71905 rcu_read_lock();
71906 tcred = __task_cred(task);
71907 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71908- cred->uid != tcred->suid && cred->uid != tcred->uid &&
71909- !capable(CAP_SYS_NICE)) {
71910+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71911 rcu_read_unlock();
71912 err = -EPERM;
71913 goto out;
71914diff --git a/mm/mlock.c b/mm/mlock.c
71915index 048260c..57f4a4e 100644
71916--- a/mm/mlock.c
71917+++ b/mm/mlock.c
71918@@ -13,6 +13,7 @@
71919 #include <linux/pagemap.h>
71920 #include <linux/mempolicy.h>
71921 #include <linux/syscalls.h>
71922+#include <linux/security.h>
71923 #include <linux/sched.h>
71924 #include <linux/module.h>
71925 #include <linux/rmap.h>
71926@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
71927 return -EINVAL;
71928 if (end == start)
71929 return 0;
71930+ if (end > TASK_SIZE)
71931+ return -EINVAL;
71932+
71933 vma = find_vma_prev(current->mm, start, &prev);
71934 if (!vma || vma->vm_start > start)
71935 return -ENOMEM;
71936@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
71937 for (nstart = start ; ; ) {
71938 vm_flags_t newflags;
71939
71940+#ifdef CONFIG_PAX_SEGMEXEC
71941+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71942+ break;
71943+#endif
71944+
71945 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
71946
71947 newflags = vma->vm_flags | VM_LOCKED;
71948@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
71949 lock_limit >>= PAGE_SHIFT;
71950
71951 /* check against resource limits */
71952+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
71953 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
71954 error = do_mlock(start, len, 1);
71955 up_write(&current->mm->mmap_sem);
71956@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
71957 static int do_mlockall(int flags)
71958 {
71959 struct vm_area_struct * vma, * prev = NULL;
71960- unsigned int def_flags = 0;
71961
71962 if (flags & MCL_FUTURE)
71963- def_flags = VM_LOCKED;
71964- current->mm->def_flags = def_flags;
71965+ current->mm->def_flags |= VM_LOCKED;
71966+ else
71967+ current->mm->def_flags &= ~VM_LOCKED;
71968 if (flags == MCL_FUTURE)
71969 goto out;
71970
71971 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
71972 vm_flags_t newflags;
71973
71974+#ifdef CONFIG_PAX_SEGMEXEC
71975+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71976+ break;
71977+#endif
71978+
71979+ BUG_ON(vma->vm_end > TASK_SIZE);
71980 newflags = vma->vm_flags | VM_LOCKED;
71981 if (!(flags & MCL_CURRENT))
71982 newflags &= ~VM_LOCKED;
71983@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
71984 lock_limit >>= PAGE_SHIFT;
71985
71986 ret = -ENOMEM;
71987+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
71988 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
71989 capable(CAP_IPC_LOCK))
71990 ret = do_mlockall(flags);
71991diff --git a/mm/mmap.c b/mm/mmap.c
71992index a65efd4..17d61ff 100644
71993--- a/mm/mmap.c
71994+++ b/mm/mmap.c
71995@@ -46,6 +46,16 @@
71996 #define arch_rebalance_pgtables(addr, len) (addr)
71997 #endif
71998
71999+static inline void verify_mm_writelocked(struct mm_struct *mm)
72000+{
72001+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72002+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72003+ up_read(&mm->mmap_sem);
72004+ BUG();
72005+ }
72006+#endif
72007+}
72008+
72009 static void unmap_region(struct mm_struct *mm,
72010 struct vm_area_struct *vma, struct vm_area_struct *prev,
72011 unsigned long start, unsigned long end);
72012@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
72013 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72014 *
72015 */
72016-pgprot_t protection_map[16] = {
72017+pgprot_t protection_map[16] __read_only = {
72018 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72019 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72020 };
72021
72022-pgprot_t vm_get_page_prot(unsigned long vm_flags)
72023+pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
72024 {
72025- return __pgprot(pgprot_val(protection_map[vm_flags &
72026+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72027 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72028 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72029+
72030+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72031+ if (!(__supported_pte_mask & _PAGE_NX) &&
72032+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72033+ (vm_flags & (VM_READ | VM_WRITE)))
72034+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72035+#endif
72036+
72037+ return prot;
72038 }
72039 EXPORT_SYMBOL(vm_get_page_prot);
72040
72041 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
72042 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
72043 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72044+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72045 /*
72046 * Make sure vm_committed_as in one cacheline and not cacheline shared with
72047 * other variables. It can be updated by several CPUs frequently.
72048@@ -228,6 +248,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
72049 struct vm_area_struct *next = vma->vm_next;
72050
72051 might_sleep();
72052+ BUG_ON(vma->vm_mirror);
72053 if (vma->vm_ops && vma->vm_ops->close)
72054 vma->vm_ops->close(vma);
72055 if (vma->vm_file) {
72056@@ -272,6 +293,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72057 * not page aligned -Ram Gupta
72058 */
72059 rlim = rlimit(RLIMIT_DATA);
72060+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72061 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72062 (mm->end_data - mm->start_data) > rlim)
72063 goto out;
72064@@ -689,6 +711,12 @@ static int
72065 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72066 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72067 {
72068+
72069+#ifdef CONFIG_PAX_SEGMEXEC
72070+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72071+ return 0;
72072+#endif
72073+
72074 if (is_mergeable_vma(vma, file, vm_flags) &&
72075 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
72076 if (vma->vm_pgoff == vm_pgoff)
72077@@ -708,6 +736,12 @@ static int
72078 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72079 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72080 {
72081+
72082+#ifdef CONFIG_PAX_SEGMEXEC
72083+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72084+ return 0;
72085+#endif
72086+
72087 if (is_mergeable_vma(vma, file, vm_flags) &&
72088 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
72089 pgoff_t vm_pglen;
72090@@ -750,13 +784,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72091 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72092 struct vm_area_struct *prev, unsigned long addr,
72093 unsigned long end, unsigned long vm_flags,
72094- struct anon_vma *anon_vma, struct file *file,
72095+ struct anon_vma *anon_vma, struct file *file,
72096 pgoff_t pgoff, struct mempolicy *policy)
72097 {
72098 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72099 struct vm_area_struct *area, *next;
72100 int err;
72101
72102+#ifdef CONFIG_PAX_SEGMEXEC
72103+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72104+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72105+
72106+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72107+#endif
72108+
72109 /*
72110 * We later require that vma->vm_flags == vm_flags,
72111 * so this tests vma->vm_flags & VM_SPECIAL, too.
72112@@ -772,6 +813,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72113 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72114 next = next->vm_next;
72115
72116+#ifdef CONFIG_PAX_SEGMEXEC
72117+ if (prev)
72118+ prev_m = pax_find_mirror_vma(prev);
72119+ if (area)
72120+ area_m = pax_find_mirror_vma(area);
72121+ if (next)
72122+ next_m = pax_find_mirror_vma(next);
72123+#endif
72124+
72125 /*
72126 * Can it merge with the predecessor?
72127 */
72128@@ -791,9 +841,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72129 /* cases 1, 6 */
72130 err = vma_adjust(prev, prev->vm_start,
72131 next->vm_end, prev->vm_pgoff, NULL);
72132- } else /* cases 2, 5, 7 */
72133+
72134+#ifdef CONFIG_PAX_SEGMEXEC
72135+ if (!err && prev_m)
72136+ err = vma_adjust(prev_m, prev_m->vm_start,
72137+ next_m->vm_end, prev_m->vm_pgoff, NULL);
72138+#endif
72139+
72140+ } else { /* cases 2, 5, 7 */
72141 err = vma_adjust(prev, prev->vm_start,
72142 end, prev->vm_pgoff, NULL);
72143+
72144+#ifdef CONFIG_PAX_SEGMEXEC
72145+ if (!err && prev_m)
72146+ err = vma_adjust(prev_m, prev_m->vm_start,
72147+ end_m, prev_m->vm_pgoff, NULL);
72148+#endif
72149+
72150+ }
72151 if (err)
72152 return NULL;
72153 khugepaged_enter_vma_merge(prev);
72154@@ -807,12 +872,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72155 mpol_equal(policy, vma_policy(next)) &&
72156 can_vma_merge_before(next, vm_flags,
72157 anon_vma, file, pgoff+pglen)) {
72158- if (prev && addr < prev->vm_end) /* case 4 */
72159+ if (prev && addr < prev->vm_end) { /* case 4 */
72160 err = vma_adjust(prev, prev->vm_start,
72161 addr, prev->vm_pgoff, NULL);
72162- else /* cases 3, 8 */
72163+
72164+#ifdef CONFIG_PAX_SEGMEXEC
72165+ if (!err && prev_m)
72166+ err = vma_adjust(prev_m, prev_m->vm_start,
72167+ addr_m, prev_m->vm_pgoff, NULL);
72168+#endif
72169+
72170+ } else { /* cases 3, 8 */
72171 err = vma_adjust(area, addr, next->vm_end,
72172 next->vm_pgoff - pglen, NULL);
72173+
72174+#ifdef CONFIG_PAX_SEGMEXEC
72175+ if (!err && area_m)
72176+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
72177+ next_m->vm_pgoff - pglen, NULL);
72178+#endif
72179+
72180+ }
72181 if (err)
72182 return NULL;
72183 khugepaged_enter_vma_merge(area);
72184@@ -921,14 +1001,11 @@ none:
72185 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72186 struct file *file, long pages)
72187 {
72188- const unsigned long stack_flags
72189- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72190-
72191 if (file) {
72192 mm->shared_vm += pages;
72193 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72194 mm->exec_vm += pages;
72195- } else if (flags & stack_flags)
72196+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72197 mm->stack_vm += pages;
72198 if (flags & (VM_RESERVED|VM_IO))
72199 mm->reserved_vm += pages;
72200@@ -955,7 +1032,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72201 * (the exception is when the underlying filesystem is noexec
72202 * mounted, in which case we dont add PROT_EXEC.)
72203 */
72204- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72205+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72206 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72207 prot |= PROT_EXEC;
72208
72209@@ -981,7 +1058,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72210 /* Obtain the address to map to. we verify (or select) it and ensure
72211 * that it represents a valid section of the address space.
72212 */
72213- addr = get_unmapped_area(file, addr, len, pgoff, flags);
72214+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72215 if (addr & ~PAGE_MASK)
72216 return addr;
72217
72218@@ -992,6 +1069,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72219 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72220 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72221
72222+#ifdef CONFIG_PAX_MPROTECT
72223+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72224+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72225+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72226+ gr_log_rwxmmap(file);
72227+
72228+#ifdef CONFIG_PAX_EMUPLT
72229+ vm_flags &= ~VM_EXEC;
72230+#else
72231+ return -EPERM;
72232+#endif
72233+
72234+ }
72235+
72236+ if (!(vm_flags & VM_EXEC))
72237+ vm_flags &= ~VM_MAYEXEC;
72238+#else
72239+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72240+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72241+#endif
72242+ else
72243+ vm_flags &= ~VM_MAYWRITE;
72244+ }
72245+#endif
72246+
72247+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72248+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72249+ vm_flags &= ~VM_PAGEEXEC;
72250+#endif
72251+
72252 if (flags & MAP_LOCKED)
72253 if (!can_do_mlock())
72254 return -EPERM;
72255@@ -1003,6 +1110,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72256 locked += mm->locked_vm;
72257 lock_limit = rlimit(RLIMIT_MEMLOCK);
72258 lock_limit >>= PAGE_SHIFT;
72259+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72260 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72261 return -EAGAIN;
72262 }
72263@@ -1073,6 +1181,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72264 if (error)
72265 return error;
72266
72267+ if (!gr_acl_handle_mmap(file, prot))
72268+ return -EACCES;
72269+
72270 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72271 }
72272 EXPORT_SYMBOL(do_mmap_pgoff);
72273@@ -1153,7 +1264,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
72274 vm_flags_t vm_flags = vma->vm_flags;
72275
72276 /* If it was private or non-writable, the write bit is already clear */
72277- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72278+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72279 return 0;
72280
72281 /* The backer wishes to know when pages are first written to? */
72282@@ -1202,14 +1313,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
72283 unsigned long charged = 0;
72284 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72285
72286+#ifdef CONFIG_PAX_SEGMEXEC
72287+ struct vm_area_struct *vma_m = NULL;
72288+#endif
72289+
72290+ /*
72291+ * mm->mmap_sem is required to protect against another thread
72292+ * changing the mappings in case we sleep.
72293+ */
72294+ verify_mm_writelocked(mm);
72295+
72296 /* Clear old maps */
72297 error = -ENOMEM;
72298-munmap_back:
72299 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72300 if (vma && vma->vm_start < addr + len) {
72301 if (do_munmap(mm, addr, len))
72302 return -ENOMEM;
72303- goto munmap_back;
72304+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72305+ BUG_ON(vma && vma->vm_start < addr + len);
72306 }
72307
72308 /* Check against address space limit. */
72309@@ -1258,6 +1379,16 @@ munmap_back:
72310 goto unacct_error;
72311 }
72312
72313+#ifdef CONFIG_PAX_SEGMEXEC
72314+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72315+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72316+ if (!vma_m) {
72317+ error = -ENOMEM;
72318+ goto free_vma;
72319+ }
72320+ }
72321+#endif
72322+
72323 vma->vm_mm = mm;
72324 vma->vm_start = addr;
72325 vma->vm_end = addr + len;
72326@@ -1281,6 +1412,19 @@ munmap_back:
72327 error = file->f_op->mmap(file, vma);
72328 if (error)
72329 goto unmap_and_free_vma;
72330+
72331+#ifdef CONFIG_PAX_SEGMEXEC
72332+ if (vma_m && (vm_flags & VM_EXECUTABLE))
72333+ added_exe_file_vma(mm);
72334+#endif
72335+
72336+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72337+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72338+ vma->vm_flags |= VM_PAGEEXEC;
72339+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72340+ }
72341+#endif
72342+
72343 if (vm_flags & VM_EXECUTABLE)
72344 added_exe_file_vma(mm);
72345
72346@@ -1316,6 +1460,11 @@ munmap_back:
72347 vma_link(mm, vma, prev, rb_link, rb_parent);
72348 file = vma->vm_file;
72349
72350+#ifdef CONFIG_PAX_SEGMEXEC
72351+ if (vma_m)
72352+ BUG_ON(pax_mirror_vma(vma_m, vma));
72353+#endif
72354+
72355 /* Once vma denies write, undo our temporary denial count */
72356 if (correct_wcount)
72357 atomic_inc(&inode->i_writecount);
72358@@ -1324,6 +1473,7 @@ out:
72359
72360 mm->total_vm += len >> PAGE_SHIFT;
72361 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72362+ track_exec_limit(mm, addr, addr + len, vm_flags);
72363 if (vm_flags & VM_LOCKED) {
72364 if (!mlock_vma_pages_range(vma, addr, addr + len))
72365 mm->locked_vm += (len >> PAGE_SHIFT);
72366@@ -1341,6 +1491,12 @@ unmap_and_free_vma:
72367 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72368 charged = 0;
72369 free_vma:
72370+
72371+#ifdef CONFIG_PAX_SEGMEXEC
72372+ if (vma_m)
72373+ kmem_cache_free(vm_area_cachep, vma_m);
72374+#endif
72375+
72376 kmem_cache_free(vm_area_cachep, vma);
72377 unacct_error:
72378 if (charged)
72379@@ -1348,6 +1504,44 @@ unacct_error:
72380 return error;
72381 }
72382
72383+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
72384+{
72385+ if (!vma) {
72386+#ifdef CONFIG_STACK_GROWSUP
72387+ if (addr > sysctl_heap_stack_gap)
72388+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72389+ else
72390+ vma = find_vma(current->mm, 0);
72391+ if (vma && (vma->vm_flags & VM_GROWSUP))
72392+ return false;
72393+#endif
72394+ return true;
72395+ }
72396+
72397+ if (addr + len > vma->vm_start)
72398+ return false;
72399+
72400+ if (vma->vm_flags & VM_GROWSDOWN)
72401+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72402+#ifdef CONFIG_STACK_GROWSUP
72403+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72404+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72405+#endif
72406+
72407+ return true;
72408+}
72409+
72410+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72411+{
72412+ if (vma->vm_start < len)
72413+ return -ENOMEM;
72414+ if (!(vma->vm_flags & VM_GROWSDOWN))
72415+ return vma->vm_start - len;
72416+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
72417+ return vma->vm_start - len - sysctl_heap_stack_gap;
72418+ return -ENOMEM;
72419+}
72420+
72421 /* Get an address range which is currently unmapped.
72422 * For shmat() with addr=0.
72423 *
72424@@ -1374,18 +1568,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
72425 if (flags & MAP_FIXED)
72426 return addr;
72427
72428+#ifdef CONFIG_PAX_RANDMMAP
72429+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72430+#endif
72431+
72432 if (addr) {
72433 addr = PAGE_ALIGN(addr);
72434- vma = find_vma(mm, addr);
72435- if (TASK_SIZE - len >= addr &&
72436- (!vma || addr + len <= vma->vm_start))
72437- return addr;
72438+ if (TASK_SIZE - len >= addr) {
72439+ vma = find_vma(mm, addr);
72440+ if (check_heap_stack_gap(vma, addr, len))
72441+ return addr;
72442+ }
72443 }
72444 if (len > mm->cached_hole_size) {
72445- start_addr = addr = mm->free_area_cache;
72446+ start_addr = addr = mm->free_area_cache;
72447 } else {
72448- start_addr = addr = TASK_UNMAPPED_BASE;
72449- mm->cached_hole_size = 0;
72450+ start_addr = addr = mm->mmap_base;
72451+ mm->cached_hole_size = 0;
72452 }
72453
72454 full_search:
72455@@ -1396,34 +1595,40 @@ full_search:
72456 * Start a new search - just in case we missed
72457 * some holes.
72458 */
72459- if (start_addr != TASK_UNMAPPED_BASE) {
72460- addr = TASK_UNMAPPED_BASE;
72461- start_addr = addr;
72462+ if (start_addr != mm->mmap_base) {
72463+ start_addr = addr = mm->mmap_base;
72464 mm->cached_hole_size = 0;
72465 goto full_search;
72466 }
72467 return -ENOMEM;
72468 }
72469- if (!vma || addr + len <= vma->vm_start) {
72470- /*
72471- * Remember the place where we stopped the search:
72472- */
72473- mm->free_area_cache = addr + len;
72474- return addr;
72475- }
72476+ if (check_heap_stack_gap(vma, addr, len))
72477+ break;
72478 if (addr + mm->cached_hole_size < vma->vm_start)
72479 mm->cached_hole_size = vma->vm_start - addr;
72480 addr = vma->vm_end;
72481 }
72482+
72483+ /*
72484+ * Remember the place where we stopped the search:
72485+ */
72486+ mm->free_area_cache = addr + len;
72487+ return addr;
72488 }
72489 #endif
72490
72491 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
72492 {
72493+
72494+#ifdef CONFIG_PAX_SEGMEXEC
72495+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72496+ return;
72497+#endif
72498+
72499 /*
72500 * Is this a new hole at the lowest possible address?
72501 */
72502- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
72503+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
72504 mm->free_area_cache = addr;
72505 mm->cached_hole_size = ~0UL;
72506 }
72507@@ -1441,7 +1646,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72508 {
72509 struct vm_area_struct *vma;
72510 struct mm_struct *mm = current->mm;
72511- unsigned long addr = addr0;
72512+ unsigned long base = mm->mmap_base, addr = addr0;
72513
72514 /* requested length too big for entire address space */
72515 if (len > TASK_SIZE)
72516@@ -1450,13 +1655,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72517 if (flags & MAP_FIXED)
72518 return addr;
72519
72520+#ifdef CONFIG_PAX_RANDMMAP
72521+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72522+#endif
72523+
72524 /* requesting a specific address */
72525 if (addr) {
72526 addr = PAGE_ALIGN(addr);
72527- vma = find_vma(mm, addr);
72528- if (TASK_SIZE - len >= addr &&
72529- (!vma || addr + len <= vma->vm_start))
72530- return addr;
72531+ if (TASK_SIZE - len >= addr) {
72532+ vma = find_vma(mm, addr);
72533+ if (check_heap_stack_gap(vma, addr, len))
72534+ return addr;
72535+ }
72536 }
72537
72538 /* check if free_area_cache is useful for us */
72539@@ -1471,7 +1681,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72540 /* make sure it can fit in the remaining address space */
72541 if (addr > len) {
72542 vma = find_vma(mm, addr-len);
72543- if (!vma || addr <= vma->vm_start)
72544+ if (check_heap_stack_gap(vma, addr - len, len))
72545 /* remember the address as a hint for next time */
72546 return (mm->free_area_cache = addr-len);
72547 }
72548@@ -1488,7 +1698,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72549 * return with success:
72550 */
72551 vma = find_vma(mm, addr);
72552- if (!vma || addr+len <= vma->vm_start)
72553+ if (check_heap_stack_gap(vma, addr, len))
72554 /* remember the address as a hint for next time */
72555 return (mm->free_area_cache = addr);
72556
72557@@ -1497,8 +1707,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72558 mm->cached_hole_size = vma->vm_start - addr;
72559
72560 /* try just below the current vma->vm_start */
72561- addr = vma->vm_start-len;
72562- } while (len < vma->vm_start);
72563+ addr = skip_heap_stack_gap(vma, len);
72564+ } while (!IS_ERR_VALUE(addr));
72565
72566 bottomup:
72567 /*
72568@@ -1507,13 +1717,21 @@ bottomup:
72569 * can happen with large stack limits and large mmap()
72570 * allocations.
72571 */
72572+ mm->mmap_base = TASK_UNMAPPED_BASE;
72573+
72574+#ifdef CONFIG_PAX_RANDMMAP
72575+ if (mm->pax_flags & MF_PAX_RANDMMAP)
72576+ mm->mmap_base += mm->delta_mmap;
72577+#endif
72578+
72579+ mm->free_area_cache = mm->mmap_base;
72580 mm->cached_hole_size = ~0UL;
72581- mm->free_area_cache = TASK_UNMAPPED_BASE;
72582 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
72583 /*
72584 * Restore the topdown base:
72585 */
72586- mm->free_area_cache = mm->mmap_base;
72587+ mm->mmap_base = base;
72588+ mm->free_area_cache = base;
72589 mm->cached_hole_size = ~0UL;
72590
72591 return addr;
72592@@ -1522,6 +1740,12 @@ bottomup:
72593
72594 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
72595 {
72596+
72597+#ifdef CONFIG_PAX_SEGMEXEC
72598+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72599+ return;
72600+#endif
72601+
72602 /*
72603 * Is this a new hole at the highest possible address?
72604 */
72605@@ -1529,8 +1753,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
72606 mm->free_area_cache = addr;
72607
72608 /* dont allow allocations above current base */
72609- if (mm->free_area_cache > mm->mmap_base)
72610+ if (mm->free_area_cache > mm->mmap_base) {
72611 mm->free_area_cache = mm->mmap_base;
72612+ mm->cached_hole_size = ~0UL;
72613+ }
72614 }
72615
72616 unsigned long
72617@@ -1638,6 +1864,28 @@ out:
72618 return prev ? prev->vm_next : vma;
72619 }
72620
72621+#ifdef CONFIG_PAX_SEGMEXEC
72622+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
72623+{
72624+ struct vm_area_struct *vma_m;
72625+
72626+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
72627+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
72628+ BUG_ON(vma->vm_mirror);
72629+ return NULL;
72630+ }
72631+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
72632+ vma_m = vma->vm_mirror;
72633+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
72634+ BUG_ON(vma->vm_file != vma_m->vm_file);
72635+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
72636+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
72637+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
72638+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
72639+ return vma_m;
72640+}
72641+#endif
72642+
72643 /*
72644 * Verify that the stack growth is acceptable and
72645 * update accounting. This is shared with both the
72646@@ -1654,6 +1902,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72647 return -ENOMEM;
72648
72649 /* Stack limit test */
72650+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
72651 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
72652 return -ENOMEM;
72653
72654@@ -1664,6 +1913,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72655 locked = mm->locked_vm + grow;
72656 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
72657 limit >>= PAGE_SHIFT;
72658+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72659 if (locked > limit && !capable(CAP_IPC_LOCK))
72660 return -ENOMEM;
72661 }
72662@@ -1694,37 +1944,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72663 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
72664 * vma is the last one with address > vma->vm_end. Have to extend vma.
72665 */
72666+#ifndef CONFIG_IA64
72667+static
72668+#endif
72669 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
72670 {
72671 int error;
72672+ bool locknext;
72673
72674 if (!(vma->vm_flags & VM_GROWSUP))
72675 return -EFAULT;
72676
72677+ /* Also guard against wrapping around to address 0. */
72678+ if (address < PAGE_ALIGN(address+1))
72679+ address = PAGE_ALIGN(address+1);
72680+ else
72681+ return -ENOMEM;
72682+
72683 /*
72684 * We must make sure the anon_vma is allocated
72685 * so that the anon_vma locking is not a noop.
72686 */
72687 if (unlikely(anon_vma_prepare(vma)))
72688 return -ENOMEM;
72689+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
72690+ if (locknext && anon_vma_prepare(vma->vm_next))
72691+ return -ENOMEM;
72692 vma_lock_anon_vma(vma);
72693+ if (locknext)
72694+ vma_lock_anon_vma(vma->vm_next);
72695
72696 /*
72697 * vma->vm_start/vm_end cannot change under us because the caller
72698 * is required to hold the mmap_sem in read mode. We need the
72699- * anon_vma lock to serialize against concurrent expand_stacks.
72700- * Also guard against wrapping around to address 0.
72701+ * anon_vma locks to serialize against concurrent expand_stacks
72702+ * and expand_upwards.
72703 */
72704- if (address < PAGE_ALIGN(address+4))
72705- address = PAGE_ALIGN(address+4);
72706- else {
72707- vma_unlock_anon_vma(vma);
72708- return -ENOMEM;
72709- }
72710 error = 0;
72711
72712 /* Somebody else might have raced and expanded it already */
72713- if (address > vma->vm_end) {
72714+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
72715+ error = -ENOMEM;
72716+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
72717 unsigned long size, grow;
72718
72719 size = address - vma->vm_start;
72720@@ -1739,6 +2000,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
72721 }
72722 }
72723 }
72724+ if (locknext)
72725+ vma_unlock_anon_vma(vma->vm_next);
72726 vma_unlock_anon_vma(vma);
72727 khugepaged_enter_vma_merge(vma);
72728 return error;
72729@@ -1752,6 +2015,8 @@ int expand_downwards(struct vm_area_struct *vma,
72730 unsigned long address)
72731 {
72732 int error;
72733+ bool lockprev = false;
72734+ struct vm_area_struct *prev;
72735
72736 /*
72737 * We must make sure the anon_vma is allocated
72738@@ -1765,6 +2030,15 @@ int expand_downwards(struct vm_area_struct *vma,
72739 if (error)
72740 return error;
72741
72742+ prev = vma->vm_prev;
72743+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
72744+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
72745+#endif
72746+ if (lockprev && anon_vma_prepare(prev))
72747+ return -ENOMEM;
72748+ if (lockprev)
72749+ vma_lock_anon_vma(prev);
72750+
72751 vma_lock_anon_vma(vma);
72752
72753 /*
72754@@ -1774,9 +2048,17 @@ int expand_downwards(struct vm_area_struct *vma,
72755 */
72756
72757 /* Somebody else might have raced and expanded it already */
72758- if (address < vma->vm_start) {
72759+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
72760+ error = -ENOMEM;
72761+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
72762 unsigned long size, grow;
72763
72764+#ifdef CONFIG_PAX_SEGMEXEC
72765+ struct vm_area_struct *vma_m;
72766+
72767+ vma_m = pax_find_mirror_vma(vma);
72768+#endif
72769+
72770 size = vma->vm_end - address;
72771 grow = (vma->vm_start - address) >> PAGE_SHIFT;
72772
72773@@ -1786,11 +2068,22 @@ int expand_downwards(struct vm_area_struct *vma,
72774 if (!error) {
72775 vma->vm_start = address;
72776 vma->vm_pgoff -= grow;
72777+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
72778+
72779+#ifdef CONFIG_PAX_SEGMEXEC
72780+ if (vma_m) {
72781+ vma_m->vm_start -= grow << PAGE_SHIFT;
72782+ vma_m->vm_pgoff -= grow;
72783+ }
72784+#endif
72785+
72786 perf_event_mmap(vma);
72787 }
72788 }
72789 }
72790 vma_unlock_anon_vma(vma);
72791+ if (lockprev)
72792+ vma_unlock_anon_vma(prev);
72793 khugepaged_enter_vma_merge(vma);
72794 return error;
72795 }
72796@@ -1860,6 +2153,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
72797 do {
72798 long nrpages = vma_pages(vma);
72799
72800+#ifdef CONFIG_PAX_SEGMEXEC
72801+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
72802+ vma = remove_vma(vma);
72803+ continue;
72804+ }
72805+#endif
72806+
72807 mm->total_vm -= nrpages;
72808 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
72809 vma = remove_vma(vma);
72810@@ -1905,6 +2205,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
72811 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
72812 vma->vm_prev = NULL;
72813 do {
72814+
72815+#ifdef CONFIG_PAX_SEGMEXEC
72816+ if (vma->vm_mirror) {
72817+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
72818+ vma->vm_mirror->vm_mirror = NULL;
72819+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
72820+ vma->vm_mirror = NULL;
72821+ }
72822+#endif
72823+
72824 rb_erase(&vma->vm_rb, &mm->mm_rb);
72825 mm->map_count--;
72826 tail_vma = vma;
72827@@ -1933,14 +2243,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72828 struct vm_area_struct *new;
72829 int err = -ENOMEM;
72830
72831+#ifdef CONFIG_PAX_SEGMEXEC
72832+ struct vm_area_struct *vma_m, *new_m = NULL;
72833+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
72834+#endif
72835+
72836 if (is_vm_hugetlb_page(vma) && (addr &
72837 ~(huge_page_mask(hstate_vma(vma)))))
72838 return -EINVAL;
72839
72840+#ifdef CONFIG_PAX_SEGMEXEC
72841+ vma_m = pax_find_mirror_vma(vma);
72842+#endif
72843+
72844 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72845 if (!new)
72846 goto out_err;
72847
72848+#ifdef CONFIG_PAX_SEGMEXEC
72849+ if (vma_m) {
72850+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72851+ if (!new_m) {
72852+ kmem_cache_free(vm_area_cachep, new);
72853+ goto out_err;
72854+ }
72855+ }
72856+#endif
72857+
72858 /* most fields are the same, copy all, and then fixup */
72859 *new = *vma;
72860
72861@@ -1953,6 +2282,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72862 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
72863 }
72864
72865+#ifdef CONFIG_PAX_SEGMEXEC
72866+ if (vma_m) {
72867+ *new_m = *vma_m;
72868+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
72869+ new_m->vm_mirror = new;
72870+ new->vm_mirror = new_m;
72871+
72872+ if (new_below)
72873+ new_m->vm_end = addr_m;
72874+ else {
72875+ new_m->vm_start = addr_m;
72876+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
72877+ }
72878+ }
72879+#endif
72880+
72881 pol = mpol_dup(vma_policy(vma));
72882 if (IS_ERR(pol)) {
72883 err = PTR_ERR(pol);
72884@@ -1978,6 +2323,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72885 else
72886 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
72887
72888+#ifdef CONFIG_PAX_SEGMEXEC
72889+ if (!err && vma_m) {
72890+ if (anon_vma_clone(new_m, vma_m))
72891+ goto out_free_mpol;
72892+
72893+ mpol_get(pol);
72894+ vma_set_policy(new_m, pol);
72895+
72896+ if (new_m->vm_file) {
72897+ get_file(new_m->vm_file);
72898+ if (vma_m->vm_flags & VM_EXECUTABLE)
72899+ added_exe_file_vma(mm);
72900+ }
72901+
72902+ if (new_m->vm_ops && new_m->vm_ops->open)
72903+ new_m->vm_ops->open(new_m);
72904+
72905+ if (new_below)
72906+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
72907+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
72908+ else
72909+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
72910+
72911+ if (err) {
72912+ if (new_m->vm_ops && new_m->vm_ops->close)
72913+ new_m->vm_ops->close(new_m);
72914+ if (new_m->vm_file) {
72915+ if (vma_m->vm_flags & VM_EXECUTABLE)
72916+ removed_exe_file_vma(mm);
72917+ fput(new_m->vm_file);
72918+ }
72919+ mpol_put(pol);
72920+ }
72921+ }
72922+#endif
72923+
72924 /* Success. */
72925 if (!err)
72926 return 0;
72927@@ -1990,10 +2371,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72928 removed_exe_file_vma(mm);
72929 fput(new->vm_file);
72930 }
72931- unlink_anon_vmas(new);
72932 out_free_mpol:
72933 mpol_put(pol);
72934 out_free_vma:
72935+
72936+#ifdef CONFIG_PAX_SEGMEXEC
72937+ if (new_m) {
72938+ unlink_anon_vmas(new_m);
72939+ kmem_cache_free(vm_area_cachep, new_m);
72940+ }
72941+#endif
72942+
72943+ unlink_anon_vmas(new);
72944 kmem_cache_free(vm_area_cachep, new);
72945 out_err:
72946 return err;
72947@@ -2006,6 +2395,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72948 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72949 unsigned long addr, int new_below)
72950 {
72951+
72952+#ifdef CONFIG_PAX_SEGMEXEC
72953+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72954+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
72955+ if (mm->map_count >= sysctl_max_map_count-1)
72956+ return -ENOMEM;
72957+ } else
72958+#endif
72959+
72960 if (mm->map_count >= sysctl_max_map_count)
72961 return -ENOMEM;
72962
72963@@ -2017,11 +2415,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72964 * work. This now handles partial unmappings.
72965 * Jeremy Fitzhardinge <jeremy@goop.org>
72966 */
72967+#ifdef CONFIG_PAX_SEGMEXEC
72968 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72969 {
72970+ int ret = __do_munmap(mm, start, len);
72971+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
72972+ return ret;
72973+
72974+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
72975+}
72976+
72977+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72978+#else
72979+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72980+#endif
72981+{
72982 unsigned long end;
72983 struct vm_area_struct *vma, *prev, *last;
72984
72985+ /*
72986+ * mm->mmap_sem is required to protect against another thread
72987+ * changing the mappings in case we sleep.
72988+ */
72989+ verify_mm_writelocked(mm);
72990+
72991 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
72992 return -EINVAL;
72993
72994@@ -2096,6 +2513,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72995 /* Fix up all other VM information */
72996 remove_vma_list(mm, vma);
72997
72998+ track_exec_limit(mm, start, end, 0UL);
72999+
73000 return 0;
73001 }
73002
73003@@ -2108,22 +2527,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
73004
73005 profile_munmap(addr);
73006
73007+#ifdef CONFIG_PAX_SEGMEXEC
73008+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73009+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73010+ return -EINVAL;
73011+#endif
73012+
73013 down_write(&mm->mmap_sem);
73014 ret = do_munmap(mm, addr, len);
73015 up_write(&mm->mmap_sem);
73016 return ret;
73017 }
73018
73019-static inline void verify_mm_writelocked(struct mm_struct *mm)
73020-{
73021-#ifdef CONFIG_DEBUG_VM
73022- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73023- WARN_ON(1);
73024- up_read(&mm->mmap_sem);
73025- }
73026-#endif
73027-}
73028-
73029 /*
73030 * this is really a simplified "do_mmap". it only handles
73031 * anonymous maps. eventually we may be able to do some
73032@@ -2137,6 +2552,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
73033 struct rb_node ** rb_link, * rb_parent;
73034 pgoff_t pgoff = addr >> PAGE_SHIFT;
73035 int error;
73036+ unsigned long charged;
73037
73038 len = PAGE_ALIGN(len);
73039 if (!len)
73040@@ -2148,16 +2564,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
73041
73042 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73043
73044+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73045+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73046+ flags &= ~VM_EXEC;
73047+
73048+#ifdef CONFIG_PAX_MPROTECT
73049+ if (mm->pax_flags & MF_PAX_MPROTECT)
73050+ flags &= ~VM_MAYEXEC;
73051+#endif
73052+
73053+ }
73054+#endif
73055+
73056 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73057 if (error & ~PAGE_MASK)
73058 return error;
73059
73060+ charged = len >> PAGE_SHIFT;
73061+
73062 /*
73063 * mlock MCL_FUTURE?
73064 */
73065 if (mm->def_flags & VM_LOCKED) {
73066 unsigned long locked, lock_limit;
73067- locked = len >> PAGE_SHIFT;
73068+ locked = charged;
73069 locked += mm->locked_vm;
73070 lock_limit = rlimit(RLIMIT_MEMLOCK);
73071 lock_limit >>= PAGE_SHIFT;
73072@@ -2174,22 +2604,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
73073 /*
73074 * Clear old maps. this also does some error checking for us
73075 */
73076- munmap_back:
73077 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73078 if (vma && vma->vm_start < addr + len) {
73079 if (do_munmap(mm, addr, len))
73080 return -ENOMEM;
73081- goto munmap_back;
73082+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73083+ BUG_ON(vma && vma->vm_start < addr + len);
73084 }
73085
73086 /* Check against address space limits *after* clearing old maps... */
73087- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73088+ if (!may_expand_vm(mm, charged))
73089 return -ENOMEM;
73090
73091 if (mm->map_count > sysctl_max_map_count)
73092 return -ENOMEM;
73093
73094- if (security_vm_enough_memory(len >> PAGE_SHIFT))
73095+ if (security_vm_enough_memory(charged))
73096 return -ENOMEM;
73097
73098 /* Can we just expand an old private anonymous mapping? */
73099@@ -2203,7 +2633,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
73100 */
73101 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73102 if (!vma) {
73103- vm_unacct_memory(len >> PAGE_SHIFT);
73104+ vm_unacct_memory(charged);
73105 return -ENOMEM;
73106 }
73107
73108@@ -2217,11 +2647,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
73109 vma_link(mm, vma, prev, rb_link, rb_parent);
73110 out:
73111 perf_event_mmap(vma);
73112- mm->total_vm += len >> PAGE_SHIFT;
73113+ mm->total_vm += charged;
73114 if (flags & VM_LOCKED) {
73115 if (!mlock_vma_pages_range(vma, addr, addr + len))
73116- mm->locked_vm += (len >> PAGE_SHIFT);
73117+ mm->locked_vm += charged;
73118 }
73119+ track_exec_limit(mm, addr, addr + len, flags);
73120 return addr;
73121 }
73122
73123@@ -2268,8 +2699,10 @@ void exit_mmap(struct mm_struct *mm)
73124 * Walk the list again, actually closing and freeing it,
73125 * with preemption enabled, without holding any MM locks.
73126 */
73127- while (vma)
73128+ while (vma) {
73129+ vma->vm_mirror = NULL;
73130 vma = remove_vma(vma);
73131+ }
73132
73133 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73134 }
73135@@ -2283,6 +2716,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
73136 struct vm_area_struct * __vma, * prev;
73137 struct rb_node ** rb_link, * rb_parent;
73138
73139+#ifdef CONFIG_PAX_SEGMEXEC
73140+ struct vm_area_struct *vma_m = NULL;
73141+#endif
73142+
73143+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73144+ return -EPERM;
73145+
73146 /*
73147 * The vm_pgoff of a purely anonymous vma should be irrelevant
73148 * until its first write fault, when page's anon_vma and index
73149@@ -2305,7 +2745,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
73150 if ((vma->vm_flags & VM_ACCOUNT) &&
73151 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73152 return -ENOMEM;
73153+
73154+#ifdef CONFIG_PAX_SEGMEXEC
73155+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73156+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73157+ if (!vma_m)
73158+ return -ENOMEM;
73159+ }
73160+#endif
73161+
73162 vma_link(mm, vma, prev, rb_link, rb_parent);
73163+
73164+#ifdef CONFIG_PAX_SEGMEXEC
73165+ if (vma_m)
73166+ BUG_ON(pax_mirror_vma(vma_m, vma));
73167+#endif
73168+
73169 return 0;
73170 }
73171
73172@@ -2323,6 +2778,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
73173 struct rb_node **rb_link, *rb_parent;
73174 struct mempolicy *pol;
73175
73176+ BUG_ON(vma->vm_mirror);
73177+
73178 /*
73179 * If anonymous vma has not yet been faulted, update new pgoff
73180 * to match new location, to increase its chance of merging.
73181@@ -2373,6 +2830,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
73182 return NULL;
73183 }
73184
73185+#ifdef CONFIG_PAX_SEGMEXEC
73186+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73187+{
73188+ struct vm_area_struct *prev_m;
73189+ struct rb_node **rb_link_m, *rb_parent_m;
73190+ struct mempolicy *pol_m;
73191+
73192+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73193+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73194+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73195+ *vma_m = *vma;
73196+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73197+ if (anon_vma_clone(vma_m, vma))
73198+ return -ENOMEM;
73199+ pol_m = vma_policy(vma_m);
73200+ mpol_get(pol_m);
73201+ vma_set_policy(vma_m, pol_m);
73202+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73203+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73204+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73205+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73206+ if (vma_m->vm_file)
73207+ get_file(vma_m->vm_file);
73208+ if (vma_m->vm_ops && vma_m->vm_ops->open)
73209+ vma_m->vm_ops->open(vma_m);
73210+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73211+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73212+ vma_m->vm_mirror = vma;
73213+ vma->vm_mirror = vma_m;
73214+ return 0;
73215+}
73216+#endif
73217+
73218 /*
73219 * Return true if the calling process may expand its vm space by the passed
73220 * number of pages
73221@@ -2383,7 +2873,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
73222 unsigned long lim;
73223
73224 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
73225-
73226+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73227 if (cur + npages > lim)
73228 return 0;
73229 return 1;
73230@@ -2454,6 +2944,22 @@ int install_special_mapping(struct mm_struct *mm,
73231 vma->vm_start = addr;
73232 vma->vm_end = addr + len;
73233
73234+#ifdef CONFIG_PAX_MPROTECT
73235+ if (mm->pax_flags & MF_PAX_MPROTECT) {
73236+#ifndef CONFIG_PAX_MPROTECT_COMPAT
73237+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73238+ return -EPERM;
73239+ if (!(vm_flags & VM_EXEC))
73240+ vm_flags &= ~VM_MAYEXEC;
73241+#else
73242+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73243+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73244+#endif
73245+ else
73246+ vm_flags &= ~VM_MAYWRITE;
73247+ }
73248+#endif
73249+
73250 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73251 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73252
73253diff --git a/mm/mprotect.c b/mm/mprotect.c
73254index 5a688a2..27e031c 100644
73255--- a/mm/mprotect.c
73256+++ b/mm/mprotect.c
73257@@ -23,10 +23,16 @@
73258 #include <linux/mmu_notifier.h>
73259 #include <linux/migrate.h>
73260 #include <linux/perf_event.h>
73261+
73262+#ifdef CONFIG_PAX_MPROTECT
73263+#include <linux/elf.h>
73264+#endif
73265+
73266 #include <asm/uaccess.h>
73267 #include <asm/pgtable.h>
73268 #include <asm/cacheflush.h>
73269 #include <asm/tlbflush.h>
73270+#include <asm/mmu_context.h>
73271
73272 #ifndef pgprot_modify
73273 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73274@@ -141,6 +147,48 @@ static void change_protection(struct vm_area_struct *vma,
73275 flush_tlb_range(vma, start, end);
73276 }
73277
73278+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73279+/* called while holding the mmap semaphor for writing except stack expansion */
73280+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73281+{
73282+ unsigned long oldlimit, newlimit = 0UL;
73283+
73284+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
73285+ return;
73286+
73287+ spin_lock(&mm->page_table_lock);
73288+ oldlimit = mm->context.user_cs_limit;
73289+ if ((prot & VM_EXEC) && oldlimit < end)
73290+ /* USER_CS limit moved up */
73291+ newlimit = end;
73292+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73293+ /* USER_CS limit moved down */
73294+ newlimit = start;
73295+
73296+ if (newlimit) {
73297+ mm->context.user_cs_limit = newlimit;
73298+
73299+#ifdef CONFIG_SMP
73300+ wmb();
73301+ cpus_clear(mm->context.cpu_user_cs_mask);
73302+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73303+#endif
73304+
73305+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73306+ }
73307+ spin_unlock(&mm->page_table_lock);
73308+ if (newlimit == end) {
73309+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
73310+
73311+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
73312+ if (is_vm_hugetlb_page(vma))
73313+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73314+ else
73315+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73316+ }
73317+}
73318+#endif
73319+
73320 int
73321 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73322 unsigned long start, unsigned long end, unsigned long newflags)
73323@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73324 int error;
73325 int dirty_accountable = 0;
73326
73327+#ifdef CONFIG_PAX_SEGMEXEC
73328+ struct vm_area_struct *vma_m = NULL;
73329+ unsigned long start_m, end_m;
73330+
73331+ start_m = start + SEGMEXEC_TASK_SIZE;
73332+ end_m = end + SEGMEXEC_TASK_SIZE;
73333+#endif
73334+
73335 if (newflags == oldflags) {
73336 *pprev = vma;
73337 return 0;
73338 }
73339
73340+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73341+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73342+
73343+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73344+ return -ENOMEM;
73345+
73346+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73347+ return -ENOMEM;
73348+ }
73349+
73350 /*
73351 * If we make a private mapping writable we increase our commit;
73352 * but (without finer accounting) cannot reduce our commit if we
73353@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73354 }
73355 }
73356
73357+#ifdef CONFIG_PAX_SEGMEXEC
73358+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73359+ if (start != vma->vm_start) {
73360+ error = split_vma(mm, vma, start, 1);
73361+ if (error)
73362+ goto fail;
73363+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73364+ *pprev = (*pprev)->vm_next;
73365+ }
73366+
73367+ if (end != vma->vm_end) {
73368+ error = split_vma(mm, vma, end, 0);
73369+ if (error)
73370+ goto fail;
73371+ }
73372+
73373+ if (pax_find_mirror_vma(vma)) {
73374+ error = __do_munmap(mm, start_m, end_m - start_m);
73375+ if (error)
73376+ goto fail;
73377+ } else {
73378+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73379+ if (!vma_m) {
73380+ error = -ENOMEM;
73381+ goto fail;
73382+ }
73383+ vma->vm_flags = newflags;
73384+ error = pax_mirror_vma(vma_m, vma);
73385+ if (error) {
73386+ vma->vm_flags = oldflags;
73387+ goto fail;
73388+ }
73389+ }
73390+ }
73391+#endif
73392+
73393 /*
73394 * First try to merge with previous and/or next vma.
73395 */
73396@@ -204,9 +306,21 @@ success:
73397 * vm_flags and vm_page_prot are protected by the mmap_sem
73398 * held in write mode.
73399 */
73400+
73401+#ifdef CONFIG_PAX_SEGMEXEC
73402+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73403+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73404+#endif
73405+
73406 vma->vm_flags = newflags;
73407+
73408+#ifdef CONFIG_PAX_MPROTECT
73409+ if (mm->binfmt && mm->binfmt->handle_mprotect)
73410+ mm->binfmt->handle_mprotect(vma, newflags);
73411+#endif
73412+
73413 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73414- vm_get_page_prot(newflags));
73415+ vm_get_page_prot(vma->vm_flags));
73416
73417 if (vma_wants_writenotify(vma)) {
73418 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
73419@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73420 end = start + len;
73421 if (end <= start)
73422 return -ENOMEM;
73423+
73424+#ifdef CONFIG_PAX_SEGMEXEC
73425+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73426+ if (end > SEGMEXEC_TASK_SIZE)
73427+ return -EINVAL;
73428+ } else
73429+#endif
73430+
73431+ if (end > TASK_SIZE)
73432+ return -EINVAL;
73433+
73434 if (!arch_validate_prot(prot))
73435 return -EINVAL;
73436
73437@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73438 /*
73439 * Does the application expect PROT_READ to imply PROT_EXEC:
73440 */
73441- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73442+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73443 prot |= PROT_EXEC;
73444
73445 vm_flags = calc_vm_prot_bits(prot);
73446@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73447 if (start > vma->vm_start)
73448 prev = vma;
73449
73450+#ifdef CONFIG_PAX_MPROTECT
73451+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
73452+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
73453+#endif
73454+
73455 for (nstart = start ; ; ) {
73456 unsigned long newflags;
73457
73458@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73459
73460 /* newflags >> 4 shift VM_MAY% in place of VM_% */
73461 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
73462+ if (prot & (PROT_WRITE | PROT_EXEC))
73463+ gr_log_rwxmprotect(vma->vm_file);
73464+
73465+ error = -EACCES;
73466+ goto out;
73467+ }
73468+
73469+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
73470 error = -EACCES;
73471 goto out;
73472 }
73473@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73474 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
73475 if (error)
73476 goto out;
73477+
73478+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
73479+
73480 nstart = tmp;
73481
73482 if (nstart < prev->vm_end)
73483diff --git a/mm/mremap.c b/mm/mremap.c
73484index 506fa44..ccc0ba9 100644
73485--- a/mm/mremap.c
73486+++ b/mm/mremap.c
73487@@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
73488 continue;
73489 pte = ptep_clear_flush(vma, old_addr, old_pte);
73490 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
73491+
73492+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73493+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
73494+ pte = pte_exprotect(pte);
73495+#endif
73496+
73497 set_pte_at(mm, new_addr, new_pte, pte);
73498 }
73499
73500@@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
73501 if (is_vm_hugetlb_page(vma))
73502 goto Einval;
73503
73504+#ifdef CONFIG_PAX_SEGMEXEC
73505+ if (pax_find_mirror_vma(vma))
73506+ goto Einval;
73507+#endif
73508+
73509 /* We can't remap across vm area boundaries */
73510 if (old_len > vma->vm_end - addr)
73511 goto Efault;
73512@@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned long addr,
73513 unsigned long ret = -EINVAL;
73514 unsigned long charged = 0;
73515 unsigned long map_flags;
73516+ unsigned long pax_task_size = TASK_SIZE;
73517
73518 if (new_addr & ~PAGE_MASK)
73519 goto out;
73520
73521- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
73522+#ifdef CONFIG_PAX_SEGMEXEC
73523+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
73524+ pax_task_size = SEGMEXEC_TASK_SIZE;
73525+#endif
73526+
73527+ pax_task_size -= PAGE_SIZE;
73528+
73529+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
73530 goto out;
73531
73532 /* Check if the location we're moving into overlaps the
73533 * old location at all, and fail if it does.
73534 */
73535- if ((new_addr <= addr) && (new_addr+new_len) > addr)
73536- goto out;
73537-
73538- if ((addr <= new_addr) && (addr+old_len) > new_addr)
73539+ if (addr + old_len > new_addr && new_addr + new_len > addr)
73540 goto out;
73541
73542 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
73543@@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long addr,
73544 struct vm_area_struct *vma;
73545 unsigned long ret = -EINVAL;
73546 unsigned long charged = 0;
73547+ unsigned long pax_task_size = TASK_SIZE;
73548
73549 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
73550 goto out;
73551@@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long addr,
73552 if (!new_len)
73553 goto out;
73554
73555+#ifdef CONFIG_PAX_SEGMEXEC
73556+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
73557+ pax_task_size = SEGMEXEC_TASK_SIZE;
73558+#endif
73559+
73560+ pax_task_size -= PAGE_SIZE;
73561+
73562+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
73563+ old_len > pax_task_size || addr > pax_task_size-old_len)
73564+ goto out;
73565+
73566 if (flags & MREMAP_FIXED) {
73567 if (flags & MREMAP_MAYMOVE)
73568 ret = mremap_to(addr, old_len, new_addr, new_len);
73569@@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long addr,
73570 addr + new_len);
73571 }
73572 ret = addr;
73573+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
73574 goto out;
73575 }
73576 }
73577@@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long addr,
73578 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
73579 if (ret)
73580 goto out;
73581+
73582+ map_flags = vma->vm_flags;
73583 ret = move_vma(vma, addr, old_len, new_len, new_addr);
73584+ if (!(ret & ~PAGE_MASK)) {
73585+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
73586+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
73587+ }
73588 }
73589 out:
73590 if (ret & ~PAGE_MASK)
73591diff --git a/mm/nobootmem.c b/mm/nobootmem.c
73592index 6e93dc7..c98df0c 100644
73593--- a/mm/nobootmem.c
73594+++ b/mm/nobootmem.c
73595@@ -110,19 +110,30 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
73596 unsigned long __init free_all_memory_core_early(int nodeid)
73597 {
73598 int i;
73599- u64 start, end;
73600+ u64 start, end, startrange, endrange;
73601 unsigned long count = 0;
73602- struct range *range = NULL;
73603+ struct range *range = NULL, rangerange = { 0, 0 };
73604 int nr_range;
73605
73606 nr_range = get_free_all_memory_range(&range, nodeid);
73607+ startrange = __pa(range) >> PAGE_SHIFT;
73608+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
73609
73610 for (i = 0; i < nr_range; i++) {
73611 start = range[i].start;
73612 end = range[i].end;
73613+ if (start <= endrange && startrange < end) {
73614+ BUG_ON(rangerange.start | rangerange.end);
73615+ rangerange = range[i];
73616+ continue;
73617+ }
73618 count += end - start;
73619 __free_pages_memory(start, end);
73620 }
73621+ start = rangerange.start;
73622+ end = rangerange.end;
73623+ count += end - start;
73624+ __free_pages_memory(start, end);
73625
73626 return count;
73627 }
73628diff --git a/mm/nommu.c b/mm/nommu.c
73629index 4358032..e79b99f 100644
73630--- a/mm/nommu.c
73631+++ b/mm/nommu.c
73632@@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
73633 int sysctl_overcommit_ratio = 50; /* default is 50% */
73634 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
73635 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
73636-int heap_stack_gap = 0;
73637
73638 atomic_long_t mmap_pages_allocated;
73639
73640@@ -825,15 +824,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
73641 EXPORT_SYMBOL(find_vma);
73642
73643 /*
73644- * find a VMA
73645- * - we don't extend stack VMAs under NOMMU conditions
73646- */
73647-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
73648-{
73649- return find_vma(mm, addr);
73650-}
73651-
73652-/*
73653 * expand a stack to a given address
73654 * - not supported under NOMMU conditions
73655 */
73656@@ -1553,6 +1543,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73657
73658 /* most fields are the same, copy all, and then fixup */
73659 *new = *vma;
73660+ INIT_LIST_HEAD(&new->anon_vma_chain);
73661 *region = *vma->vm_region;
73662 new->vm_region = region;
73663
73664diff --git a/mm/page_alloc.c b/mm/page_alloc.c
73665index e8fae15..18c0442 100644
73666--- a/mm/page_alloc.c
73667+++ b/mm/page_alloc.c
73668@@ -340,7 +340,7 @@ out:
73669 * This usage means that zero-order pages may not be compound.
73670 */
73671
73672-static void free_compound_page(struct page *page)
73673+void free_compound_page(struct page *page)
73674 {
73675 __free_pages_ok(page, compound_order(page));
73676 }
73677@@ -653,6 +653,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
73678 int i;
73679 int bad = 0;
73680
73681+#ifdef CONFIG_PAX_MEMORY_SANITIZE
73682+ unsigned long index = 1UL << order;
73683+#endif
73684+
73685 trace_mm_page_free_direct(page, order);
73686 kmemcheck_free_shadow(page, order);
73687
73688@@ -668,6 +672,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
73689 debug_check_no_obj_freed(page_address(page),
73690 PAGE_SIZE << order);
73691 }
73692+
73693+#ifdef CONFIG_PAX_MEMORY_SANITIZE
73694+ for (; index; --index)
73695+ sanitize_highpage(page + index - 1);
73696+#endif
73697+
73698 arch_free_page(page, order);
73699 kernel_map_pages(page, 1 << order, 0);
73700
73701@@ -783,8 +793,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
73702 arch_alloc_page(page, order);
73703 kernel_map_pages(page, 1 << order, 1);
73704
73705+#ifndef CONFIG_PAX_MEMORY_SANITIZE
73706 if (gfp_flags & __GFP_ZERO)
73707 prep_zero_page(page, order, gfp_flags);
73708+#endif
73709
73710 if (order && (gfp_flags & __GFP_COMP))
73711 prep_compound_page(page, order);
73712@@ -2539,6 +2551,8 @@ void show_free_areas(unsigned int filter)
73713 int cpu;
73714 struct zone *zone;
73715
73716+ pax_track_stack();
73717+
73718 for_each_populated_zone(zone) {
73719 if (skip_free_areas_node(filter, zone_to_nid(zone)))
73720 continue;
73721@@ -3350,7 +3364,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
73722 unsigned long pfn;
73723
73724 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
73725+#ifdef CONFIG_X86_32
73726+ /* boot failures in VMware 8 on 32bit vanilla since
73727+ this change */
73728+ if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
73729+#else
73730 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
73731+#endif
73732 return 1;
73733 }
73734 return 0;
73735diff --git a/mm/percpu.c b/mm/percpu.c
73736index 0ae7a09..613118e 100644
73737--- a/mm/percpu.c
73738+++ b/mm/percpu.c
73739@@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
73740 static unsigned int pcpu_high_unit_cpu __read_mostly;
73741
73742 /* the address of the first chunk which starts with the kernel static area */
73743-void *pcpu_base_addr __read_mostly;
73744+void *pcpu_base_addr __read_only;
73745 EXPORT_SYMBOL_GPL(pcpu_base_addr);
73746
73747 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
73748diff --git a/mm/rmap.c b/mm/rmap.c
73749index 8005080..198c2cd 100644
73750--- a/mm/rmap.c
73751+++ b/mm/rmap.c
73752@@ -152,6 +152,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73753 struct anon_vma *anon_vma = vma->anon_vma;
73754 struct anon_vma_chain *avc;
73755
73756+#ifdef CONFIG_PAX_SEGMEXEC
73757+ struct anon_vma_chain *avc_m = NULL;
73758+#endif
73759+
73760 might_sleep();
73761 if (unlikely(!anon_vma)) {
73762 struct mm_struct *mm = vma->vm_mm;
73763@@ -161,6 +165,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73764 if (!avc)
73765 goto out_enomem;
73766
73767+#ifdef CONFIG_PAX_SEGMEXEC
73768+ avc_m = anon_vma_chain_alloc(GFP_KERNEL);
73769+ if (!avc_m)
73770+ goto out_enomem_free_avc;
73771+#endif
73772+
73773 anon_vma = find_mergeable_anon_vma(vma);
73774 allocated = NULL;
73775 if (!anon_vma) {
73776@@ -174,6 +184,21 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73777 /* page_table_lock to protect against threads */
73778 spin_lock(&mm->page_table_lock);
73779 if (likely(!vma->anon_vma)) {
73780+
73781+#ifdef CONFIG_PAX_SEGMEXEC
73782+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
73783+
73784+ if (vma_m) {
73785+ BUG_ON(vma_m->anon_vma);
73786+ vma_m->anon_vma = anon_vma;
73787+ avc_m->anon_vma = anon_vma;
73788+ avc_m->vma = vma;
73789+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
73790+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
73791+ avc_m = NULL;
73792+ }
73793+#endif
73794+
73795 vma->anon_vma = anon_vma;
73796 avc->anon_vma = anon_vma;
73797 avc->vma = vma;
73798@@ -187,12 +212,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73799
73800 if (unlikely(allocated))
73801 put_anon_vma(allocated);
73802+
73803+#ifdef CONFIG_PAX_SEGMEXEC
73804+ if (unlikely(avc_m))
73805+ anon_vma_chain_free(avc_m);
73806+#endif
73807+
73808 if (unlikely(avc))
73809 anon_vma_chain_free(avc);
73810 }
73811 return 0;
73812
73813 out_enomem_free_avc:
73814+
73815+#ifdef CONFIG_PAX_SEGMEXEC
73816+ if (avc_m)
73817+ anon_vma_chain_free(avc_m);
73818+#endif
73819+
73820 anon_vma_chain_free(avc);
73821 out_enomem:
73822 return -ENOMEM;
73823@@ -243,7 +280,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
73824 * Attach the anon_vmas from src to dst.
73825 * Returns 0 on success, -ENOMEM on failure.
73826 */
73827-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73828+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
73829 {
73830 struct anon_vma_chain *avc, *pavc;
73831 struct anon_vma *root = NULL;
73832@@ -276,7 +313,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73833 * the corresponding VMA in the parent process is attached to.
73834 * Returns 0 on success, non-zero on failure.
73835 */
73836-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
73837+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
73838 {
73839 struct anon_vma_chain *avc;
73840 struct anon_vma *anon_vma;
73841diff --git a/mm/shmem.c b/mm/shmem.c
73842index 32f6763..431c405 100644
73843--- a/mm/shmem.c
73844+++ b/mm/shmem.c
73845@@ -31,7 +31,7 @@
73846 #include <linux/module.h>
73847 #include <linux/swap.h>
73848
73849-static struct vfsmount *shm_mnt;
73850+struct vfsmount *shm_mnt;
73851
73852 #ifdef CONFIG_SHMEM
73853 /*
73854@@ -74,7 +74,7 @@ static struct vfsmount *shm_mnt;
73855 #define BOGO_DIRENT_SIZE 20
73856
73857 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
73858-#define SHORT_SYMLINK_LEN 128
73859+#define SHORT_SYMLINK_LEN 64
73860
73861 struct shmem_xattr {
73862 struct list_head list; /* anchored by shmem_inode_info->xattr_list */
73863@@ -769,6 +769,8 @@ static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
73864 struct mempolicy mpol, *spol;
73865 struct vm_area_struct pvma;
73866
73867+ pax_track_stack();
73868+
73869 spol = mpol_cond_copy(&mpol,
73870 mpol_shared_policy_lookup(&info->policy, index));
73871
73872@@ -2149,8 +2151,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
73873 int err = -ENOMEM;
73874
73875 /* Round up to L1_CACHE_BYTES to resist false sharing */
73876- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
73877- L1_CACHE_BYTES), GFP_KERNEL);
73878+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
73879 if (!sbinfo)
73880 return -ENOMEM;
73881
73882diff --git a/mm/slab.c b/mm/slab.c
73883index 893c76d..a742de2 100644
73884--- a/mm/slab.c
73885+++ b/mm/slab.c
73886@@ -151,7 +151,7 @@
73887
73888 /* Legal flag mask for kmem_cache_create(). */
73889 #if DEBUG
73890-# define CREATE_MASK (SLAB_RED_ZONE | \
73891+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
73892 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
73893 SLAB_CACHE_DMA | \
73894 SLAB_STORE_USER | \
73895@@ -159,7 +159,7 @@
73896 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73897 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
73898 #else
73899-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
73900+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
73901 SLAB_CACHE_DMA | \
73902 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
73903 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73904@@ -288,7 +288,7 @@ struct kmem_list3 {
73905 * Need this for bootstrapping a per node allocator.
73906 */
73907 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
73908-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
73909+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
73910 #define CACHE_CACHE 0
73911 #define SIZE_AC MAX_NUMNODES
73912 #define SIZE_L3 (2 * MAX_NUMNODES)
73913@@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
73914 if ((x)->max_freeable < i) \
73915 (x)->max_freeable = i; \
73916 } while (0)
73917-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
73918-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
73919-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
73920-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
73921+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
73922+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
73923+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
73924+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
73925 #else
73926 #define STATS_INC_ACTIVE(x) do { } while (0)
73927 #define STATS_DEC_ACTIVE(x) do { } while (0)
73928@@ -538,7 +538,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
73929 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
73930 */
73931 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
73932- const struct slab *slab, void *obj)
73933+ const struct slab *slab, const void *obj)
73934 {
73935 u32 offset = (obj - slab->s_mem);
73936 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
73937@@ -564,7 +564,7 @@ struct cache_names {
73938 static struct cache_names __initdata cache_names[] = {
73939 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
73940 #include <linux/kmalloc_sizes.h>
73941- {NULL,}
73942+ {NULL}
73943 #undef CACHE
73944 };
73945
73946@@ -1572,7 +1572,7 @@ void __init kmem_cache_init(void)
73947 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
73948 sizes[INDEX_AC].cs_size,
73949 ARCH_KMALLOC_MINALIGN,
73950- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73951+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73952 NULL);
73953
73954 if (INDEX_AC != INDEX_L3) {
73955@@ -1580,7 +1580,7 @@ void __init kmem_cache_init(void)
73956 kmem_cache_create(names[INDEX_L3].name,
73957 sizes[INDEX_L3].cs_size,
73958 ARCH_KMALLOC_MINALIGN,
73959- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73960+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73961 NULL);
73962 }
73963
73964@@ -1598,7 +1598,7 @@ void __init kmem_cache_init(void)
73965 sizes->cs_cachep = kmem_cache_create(names->name,
73966 sizes->cs_size,
73967 ARCH_KMALLOC_MINALIGN,
73968- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73969+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73970 NULL);
73971 }
73972 #ifdef CONFIG_ZONE_DMA
73973@@ -4327,10 +4327,10 @@ static int s_show(struct seq_file *m, void *p)
73974 }
73975 /* cpu stats */
73976 {
73977- unsigned long allochit = atomic_read(&cachep->allochit);
73978- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
73979- unsigned long freehit = atomic_read(&cachep->freehit);
73980- unsigned long freemiss = atomic_read(&cachep->freemiss);
73981+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
73982+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
73983+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
73984+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
73985
73986 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
73987 allochit, allocmiss, freehit, freemiss);
73988@@ -4587,15 +4587,70 @@ static const struct file_operations proc_slabstats_operations = {
73989
73990 static int __init slab_proc_init(void)
73991 {
73992- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
73993+ mode_t gr_mode = S_IRUGO;
73994+
73995+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73996+ gr_mode = S_IRUSR;
73997+#endif
73998+
73999+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74000 #ifdef CONFIG_DEBUG_SLAB_LEAK
74001- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74002+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74003 #endif
74004 return 0;
74005 }
74006 module_init(slab_proc_init);
74007 #endif
74008
74009+void check_object_size(const void *ptr, unsigned long n, bool to)
74010+{
74011+
74012+#ifdef CONFIG_PAX_USERCOPY
74013+ struct page *page;
74014+ struct kmem_cache *cachep = NULL;
74015+ struct slab *slabp;
74016+ unsigned int objnr;
74017+ unsigned long offset;
74018+ const char *type;
74019+
74020+ if (!n)
74021+ return;
74022+
74023+ type = "<null>";
74024+ if (ZERO_OR_NULL_PTR(ptr))
74025+ goto report;
74026+
74027+ if (!virt_addr_valid(ptr))
74028+ return;
74029+
74030+ page = virt_to_head_page(ptr);
74031+
74032+ type = "<process stack>";
74033+ if (!PageSlab(page)) {
74034+ if (object_is_on_stack(ptr, n) == -1)
74035+ goto report;
74036+ return;
74037+ }
74038+
74039+ cachep = page_get_cache(page);
74040+ type = cachep->name;
74041+ if (!(cachep->flags & SLAB_USERCOPY))
74042+ goto report;
74043+
74044+ slabp = page_get_slab(page);
74045+ objnr = obj_to_index(cachep, slabp, ptr);
74046+ BUG_ON(objnr >= cachep->num);
74047+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74048+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74049+ return;
74050+
74051+report:
74052+ pax_report_usercopy(ptr, n, to, type);
74053+#endif
74054+
74055+}
74056+EXPORT_SYMBOL(check_object_size);
74057+
74058 /**
74059 * ksize - get the actual amount of memory allocated for a given object
74060 * @objp: Pointer to the object
74061diff --git a/mm/slob.c b/mm/slob.c
74062index bf39181..727f7a3 100644
74063--- a/mm/slob.c
74064+++ b/mm/slob.c
74065@@ -29,7 +29,7 @@
74066 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74067 * alloc_pages() directly, allocating compound pages so the page order
74068 * does not have to be separately tracked, and also stores the exact
74069- * allocation size in page->private so that it can be used to accurately
74070+ * allocation size in slob_page->size so that it can be used to accurately
74071 * provide ksize(). These objects are detected in kfree() because slob_page()
74072 * is false for them.
74073 *
74074@@ -58,6 +58,7 @@
74075 */
74076
74077 #include <linux/kernel.h>
74078+#include <linux/sched.h>
74079 #include <linux/slab.h>
74080 #include <linux/mm.h>
74081 #include <linux/swap.h> /* struct reclaim_state */
74082@@ -102,7 +103,8 @@ struct slob_page {
74083 unsigned long flags; /* mandatory */
74084 atomic_t _count; /* mandatory */
74085 slobidx_t units; /* free units left in page */
74086- unsigned long pad[2];
74087+ unsigned long pad[1];
74088+ unsigned long size; /* size when >=PAGE_SIZE */
74089 slob_t *free; /* first free slob_t in page */
74090 struct list_head list; /* linked list of free pages */
74091 };
74092@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
74093 */
74094 static inline int is_slob_page(struct slob_page *sp)
74095 {
74096- return PageSlab((struct page *)sp);
74097+ return PageSlab((struct page *)sp) && !sp->size;
74098 }
74099
74100 static inline void set_slob_page(struct slob_page *sp)
74101@@ -150,7 +152,7 @@ static inline void clear_slob_page(struct slob_page *sp)
74102
74103 static inline struct slob_page *slob_page(const void *addr)
74104 {
74105- return (struct slob_page *)virt_to_page(addr);
74106+ return (struct slob_page *)virt_to_head_page(addr);
74107 }
74108
74109 /*
74110@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
74111 /*
74112 * Return the size of a slob block.
74113 */
74114-static slobidx_t slob_units(slob_t *s)
74115+static slobidx_t slob_units(const slob_t *s)
74116 {
74117 if (s->units > 0)
74118 return s->units;
74119@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
74120 /*
74121 * Return the next free slob block pointer after this one.
74122 */
74123-static slob_t *slob_next(slob_t *s)
74124+static slob_t *slob_next(const slob_t *s)
74125 {
74126 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74127 slobidx_t next;
74128@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
74129 /*
74130 * Returns true if s is the last free block in its page.
74131 */
74132-static int slob_last(slob_t *s)
74133+static int slob_last(const slob_t *s)
74134 {
74135 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74136 }
74137@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
74138 if (!page)
74139 return NULL;
74140
74141+ set_slob_page(page);
74142 return page_address(page);
74143 }
74144
74145@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
74146 if (!b)
74147 return NULL;
74148 sp = slob_page(b);
74149- set_slob_page(sp);
74150
74151 spin_lock_irqsave(&slob_lock, flags);
74152 sp->units = SLOB_UNITS(PAGE_SIZE);
74153 sp->free = b;
74154+ sp->size = 0;
74155 INIT_LIST_HEAD(&sp->list);
74156 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74157 set_slob_page_free(sp, slob_list);
74158@@ -476,10 +479,9 @@ out:
74159 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74160 */
74161
74162-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74163+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74164 {
74165- unsigned int *m;
74166- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74167+ slob_t *m;
74168 void *ret;
74169
74170 gfp &= gfp_allowed_mask;
74171@@ -494,7 +496,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74172
74173 if (!m)
74174 return NULL;
74175- *m = size;
74176+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74177+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74178+ m[0].units = size;
74179+ m[1].units = align;
74180 ret = (void *)m + align;
74181
74182 trace_kmalloc_node(_RET_IP_, ret,
74183@@ -506,16 +511,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74184 gfp |= __GFP_COMP;
74185 ret = slob_new_pages(gfp, order, node);
74186 if (ret) {
74187- struct page *page;
74188- page = virt_to_page(ret);
74189- page->private = size;
74190+ struct slob_page *sp;
74191+ sp = slob_page(ret);
74192+ sp->size = size;
74193 }
74194
74195 trace_kmalloc_node(_RET_IP_, ret,
74196 size, PAGE_SIZE << order, gfp, node);
74197 }
74198
74199- kmemleak_alloc(ret, size, 1, gfp);
74200+ return ret;
74201+}
74202+
74203+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74204+{
74205+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74206+ void *ret = __kmalloc_node_align(size, gfp, node, align);
74207+
74208+ if (!ZERO_OR_NULL_PTR(ret))
74209+ kmemleak_alloc(ret, size, 1, gfp);
74210 return ret;
74211 }
74212 EXPORT_SYMBOL(__kmalloc_node);
74213@@ -533,13 +547,92 @@ void kfree(const void *block)
74214 sp = slob_page(block);
74215 if (is_slob_page(sp)) {
74216 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74217- unsigned int *m = (unsigned int *)(block - align);
74218- slob_free(m, *m + align);
74219- } else
74220+ slob_t *m = (slob_t *)(block - align);
74221+ slob_free(m, m[0].units + align);
74222+ } else {
74223+ clear_slob_page(sp);
74224+ free_slob_page(sp);
74225+ sp->size = 0;
74226 put_page(&sp->page);
74227+ }
74228 }
74229 EXPORT_SYMBOL(kfree);
74230
74231+void check_object_size(const void *ptr, unsigned long n, bool to)
74232+{
74233+
74234+#ifdef CONFIG_PAX_USERCOPY
74235+ struct slob_page *sp;
74236+ const slob_t *free;
74237+ const void *base;
74238+ unsigned long flags;
74239+ const char *type;
74240+
74241+ if (!n)
74242+ return;
74243+
74244+ type = "<null>";
74245+ if (ZERO_OR_NULL_PTR(ptr))
74246+ goto report;
74247+
74248+ if (!virt_addr_valid(ptr))
74249+ return;
74250+
74251+ type = "<process stack>";
74252+ sp = slob_page(ptr);
74253+ if (!PageSlab((struct page*)sp)) {
74254+ if (object_is_on_stack(ptr, n) == -1)
74255+ goto report;
74256+ return;
74257+ }
74258+
74259+ type = "<slob>";
74260+ if (sp->size) {
74261+ base = page_address(&sp->page);
74262+ if (base <= ptr && n <= sp->size - (ptr - base))
74263+ return;
74264+ goto report;
74265+ }
74266+
74267+ /* some tricky double walking to find the chunk */
74268+ spin_lock_irqsave(&slob_lock, flags);
74269+ base = (void *)((unsigned long)ptr & PAGE_MASK);
74270+ free = sp->free;
74271+
74272+ while (!slob_last(free) && (void *)free <= ptr) {
74273+ base = free + slob_units(free);
74274+ free = slob_next(free);
74275+ }
74276+
74277+ while (base < (void *)free) {
74278+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74279+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
74280+ int offset;
74281+
74282+ if (ptr < base + align)
74283+ break;
74284+
74285+ offset = ptr - base - align;
74286+ if (offset >= m) {
74287+ base += size;
74288+ continue;
74289+ }
74290+
74291+ if (n > m - offset)
74292+ break;
74293+
74294+ spin_unlock_irqrestore(&slob_lock, flags);
74295+ return;
74296+ }
74297+
74298+ spin_unlock_irqrestore(&slob_lock, flags);
74299+report:
74300+ pax_report_usercopy(ptr, n, to, type);
74301+#endif
74302+
74303+}
74304+EXPORT_SYMBOL(check_object_size);
74305+
74306 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74307 size_t ksize(const void *block)
74308 {
74309@@ -552,10 +645,10 @@ size_t ksize(const void *block)
74310 sp = slob_page(block);
74311 if (is_slob_page(sp)) {
74312 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74313- unsigned int *m = (unsigned int *)(block - align);
74314- return SLOB_UNITS(*m) * SLOB_UNIT;
74315+ slob_t *m = (slob_t *)(block - align);
74316+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74317 } else
74318- return sp->page.private;
74319+ return sp->size;
74320 }
74321 EXPORT_SYMBOL(ksize);
74322
74323@@ -571,8 +664,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74324 {
74325 struct kmem_cache *c;
74326
74327+#ifdef CONFIG_PAX_USERCOPY
74328+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
74329+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
74330+#else
74331 c = slob_alloc(sizeof(struct kmem_cache),
74332 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
74333+#endif
74334
74335 if (c) {
74336 c->name = name;
74337@@ -614,17 +712,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
74338
74339 lockdep_trace_alloc(flags);
74340
74341+#ifdef CONFIG_PAX_USERCOPY
74342+ b = __kmalloc_node_align(c->size, flags, node, c->align);
74343+#else
74344 if (c->size < PAGE_SIZE) {
74345 b = slob_alloc(c->size, flags, c->align, node);
74346 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74347 SLOB_UNITS(c->size) * SLOB_UNIT,
74348 flags, node);
74349 } else {
74350+ struct slob_page *sp;
74351+
74352 b = slob_new_pages(flags, get_order(c->size), node);
74353+ sp = slob_page(b);
74354+ sp->size = c->size;
74355 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74356 PAGE_SIZE << get_order(c->size),
74357 flags, node);
74358 }
74359+#endif
74360
74361 if (c->ctor)
74362 c->ctor(b);
74363@@ -636,10 +742,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74364
74365 static void __kmem_cache_free(void *b, int size)
74366 {
74367- if (size < PAGE_SIZE)
74368+ struct slob_page *sp = slob_page(b);
74369+
74370+ if (is_slob_page(sp))
74371 slob_free(b, size);
74372- else
74373+ else {
74374+ clear_slob_page(sp);
74375+ free_slob_page(sp);
74376+ sp->size = 0;
74377 slob_free_pages(b, get_order(size));
74378+ }
74379 }
74380
74381 static void kmem_rcu_free(struct rcu_head *head)
74382@@ -652,17 +764,31 @@ static void kmem_rcu_free(struct rcu_head *head)
74383
74384 void kmem_cache_free(struct kmem_cache *c, void *b)
74385 {
74386+ int size = c->size;
74387+
74388+#ifdef CONFIG_PAX_USERCOPY
74389+ if (size + c->align < PAGE_SIZE) {
74390+ size += c->align;
74391+ b -= c->align;
74392+ }
74393+#endif
74394+
74395 kmemleak_free_recursive(b, c->flags);
74396 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74397 struct slob_rcu *slob_rcu;
74398- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
74399- slob_rcu->size = c->size;
74400+ slob_rcu = b + (size - sizeof(struct slob_rcu));
74401+ slob_rcu->size = size;
74402 call_rcu(&slob_rcu->head, kmem_rcu_free);
74403 } else {
74404- __kmem_cache_free(b, c->size);
74405+ __kmem_cache_free(b, size);
74406 }
74407
74408+#ifdef CONFIG_PAX_USERCOPY
74409+ trace_kfree(_RET_IP_, b);
74410+#else
74411 trace_kmem_cache_free(_RET_IP_, b);
74412+#endif
74413+
74414 }
74415 EXPORT_SYMBOL(kmem_cache_free);
74416
74417diff --git a/mm/slub.c b/mm/slub.c
74418index f73234d..ce9940d 100644
74419--- a/mm/slub.c
74420+++ b/mm/slub.c
74421@@ -208,7 +208,7 @@ struct track {
74422
74423 enum track_item { TRACK_ALLOC, TRACK_FREE };
74424
74425-#ifdef CONFIG_SYSFS
74426+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74427 static int sysfs_slab_add(struct kmem_cache *);
74428 static int sysfs_slab_alias(struct kmem_cache *, const char *);
74429 static void sysfs_slab_remove(struct kmem_cache *);
74430@@ -556,7 +556,7 @@ static void print_track(const char *s, struct track *t)
74431 if (!t->addr)
74432 return;
74433
74434- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74435+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74436 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74437 #ifdef CONFIG_STACKTRACE
74438 {
74439@@ -2461,6 +2461,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
74440
74441 page = virt_to_head_page(x);
74442
74443+ BUG_ON(!PageSlab(page));
74444+
74445 slab_free(s, page, x, _RET_IP_);
74446
74447 trace_kmem_cache_free(_RET_IP_, x);
74448@@ -2494,7 +2496,7 @@ static int slub_min_objects;
74449 * Merge control. If this is set then no merging of slab caches will occur.
74450 * (Could be removed. This was introduced to pacify the merge skeptics.)
74451 */
74452-static int slub_nomerge;
74453+static int slub_nomerge = 1;
74454
74455 /*
74456 * Calculate the order of allocation given an slab object size.
74457@@ -2917,7 +2919,7 @@ static int kmem_cache_open(struct kmem_cache *s,
74458 * list to avoid pounding the page allocator excessively.
74459 */
74460 set_min_partial(s, ilog2(s->size));
74461- s->refcount = 1;
74462+ atomic_set(&s->refcount, 1);
74463 #ifdef CONFIG_NUMA
74464 s->remote_node_defrag_ratio = 1000;
74465 #endif
74466@@ -3022,8 +3024,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
74467 void kmem_cache_destroy(struct kmem_cache *s)
74468 {
74469 down_write(&slub_lock);
74470- s->refcount--;
74471- if (!s->refcount) {
74472+ if (atomic_dec_and_test(&s->refcount)) {
74473 list_del(&s->list);
74474 if (kmem_cache_close(s)) {
74475 printk(KERN_ERR "SLUB %s: %s called for cache that "
74476@@ -3233,6 +3234,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
74477 EXPORT_SYMBOL(__kmalloc_node);
74478 #endif
74479
74480+void check_object_size(const void *ptr, unsigned long n, bool to)
74481+{
74482+
74483+#ifdef CONFIG_PAX_USERCOPY
74484+ struct page *page;
74485+ struct kmem_cache *s = NULL;
74486+ unsigned long offset;
74487+ const char *type;
74488+
74489+ if (!n)
74490+ return;
74491+
74492+ type = "<null>";
74493+ if (ZERO_OR_NULL_PTR(ptr))
74494+ goto report;
74495+
74496+ if (!virt_addr_valid(ptr))
74497+ return;
74498+
74499+ page = virt_to_head_page(ptr);
74500+
74501+ type = "<process stack>";
74502+ if (!PageSlab(page)) {
74503+ if (object_is_on_stack(ptr, n) == -1)
74504+ goto report;
74505+ return;
74506+ }
74507+
74508+ s = page->slab;
74509+ type = s->name;
74510+ if (!(s->flags & SLAB_USERCOPY))
74511+ goto report;
74512+
74513+ offset = (ptr - page_address(page)) % s->size;
74514+ if (offset <= s->objsize && n <= s->objsize - offset)
74515+ return;
74516+
74517+report:
74518+ pax_report_usercopy(ptr, n, to, type);
74519+#endif
74520+
74521+}
74522+EXPORT_SYMBOL(check_object_size);
74523+
74524 size_t ksize(const void *object)
74525 {
74526 struct page *page;
74527@@ -3507,7 +3552,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
74528 int node;
74529
74530 list_add(&s->list, &slab_caches);
74531- s->refcount = -1;
74532+ atomic_set(&s->refcount, -1);
74533
74534 for_each_node_state(node, N_NORMAL_MEMORY) {
74535 struct kmem_cache_node *n = get_node(s, node);
74536@@ -3624,17 +3669,17 @@ void __init kmem_cache_init(void)
74537
74538 /* Caches that are not of the two-to-the-power-of size */
74539 if (KMALLOC_MIN_SIZE <= 32) {
74540- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
74541+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
74542 caches++;
74543 }
74544
74545 if (KMALLOC_MIN_SIZE <= 64) {
74546- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
74547+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
74548 caches++;
74549 }
74550
74551 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
74552- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
74553+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
74554 caches++;
74555 }
74556
74557@@ -3702,7 +3747,7 @@ static int slab_unmergeable(struct kmem_cache *s)
74558 /*
74559 * We may have set a slab to be unmergeable during bootstrap.
74560 */
74561- if (s->refcount < 0)
74562+ if (atomic_read(&s->refcount) < 0)
74563 return 1;
74564
74565 return 0;
74566@@ -3761,7 +3806,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74567 down_write(&slub_lock);
74568 s = find_mergeable(size, align, flags, name, ctor);
74569 if (s) {
74570- s->refcount++;
74571+ atomic_inc(&s->refcount);
74572 /*
74573 * Adjust the object sizes so that we clear
74574 * the complete object on kzalloc.
74575@@ -3770,7 +3815,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74576 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
74577
74578 if (sysfs_slab_alias(s, name)) {
74579- s->refcount--;
74580+ atomic_dec(&s->refcount);
74581 goto err;
74582 }
74583 up_write(&slub_lock);
74584@@ -3898,7 +3943,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
74585 }
74586 #endif
74587
74588-#ifdef CONFIG_SYSFS
74589+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74590 static int count_inuse(struct page *page)
74591 {
74592 return page->inuse;
74593@@ -4285,12 +4330,12 @@ static void resiliency_test(void)
74594 validate_slab_cache(kmalloc_caches[9]);
74595 }
74596 #else
74597-#ifdef CONFIG_SYSFS
74598+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74599 static void resiliency_test(void) {};
74600 #endif
74601 #endif
74602
74603-#ifdef CONFIG_SYSFS
74604+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74605 enum slab_stat_type {
74606 SL_ALL, /* All slabs */
74607 SL_PARTIAL, /* Only partially allocated slabs */
74608@@ -4500,7 +4545,7 @@ SLAB_ATTR_RO(ctor);
74609
74610 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
74611 {
74612- return sprintf(buf, "%d\n", s->refcount - 1);
74613+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
74614 }
74615 SLAB_ATTR_RO(aliases);
74616
74617@@ -5030,6 +5075,7 @@ static char *create_unique_id(struct kmem_cache *s)
74618 return name;
74619 }
74620
74621+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74622 static int sysfs_slab_add(struct kmem_cache *s)
74623 {
74624 int err;
74625@@ -5092,6 +5138,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
74626 kobject_del(&s->kobj);
74627 kobject_put(&s->kobj);
74628 }
74629+#endif
74630
74631 /*
74632 * Need to buffer aliases during bootup until sysfs becomes
74633@@ -5105,6 +5152,7 @@ struct saved_alias {
74634
74635 static struct saved_alias *alias_list;
74636
74637+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74638 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
74639 {
74640 struct saved_alias *al;
74641@@ -5127,6 +5175,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
74642 alias_list = al;
74643 return 0;
74644 }
74645+#endif
74646
74647 static int __init slab_sysfs_init(void)
74648 {
74649@@ -5262,7 +5311,13 @@ static const struct file_operations proc_slabinfo_operations = {
74650
74651 static int __init slab_proc_init(void)
74652 {
74653- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
74654+ mode_t gr_mode = S_IRUGO;
74655+
74656+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74657+ gr_mode = S_IRUSR;
74658+#endif
74659+
74660+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
74661 return 0;
74662 }
74663 module_init(slab_proc_init);
74664diff --git a/mm/swap.c b/mm/swap.c
74665index 87627f1..8a9eb34 100644
74666--- a/mm/swap.c
74667+++ b/mm/swap.c
74668@@ -31,6 +31,7 @@
74669 #include <linux/backing-dev.h>
74670 #include <linux/memcontrol.h>
74671 #include <linux/gfp.h>
74672+#include <linux/hugetlb.h>
74673
74674 #include "internal.h"
74675
74676@@ -71,6 +72,8 @@ static void __put_compound_page(struct page *page)
74677
74678 __page_cache_release(page);
74679 dtor = get_compound_page_dtor(page);
74680+ if (!PageHuge(page))
74681+ BUG_ON(dtor != free_compound_page);
74682 (*dtor)(page);
74683 }
74684
74685diff --git a/mm/swapfile.c b/mm/swapfile.c
74686index 17bc224..1677059 100644
74687--- a/mm/swapfile.c
74688+++ b/mm/swapfile.c
74689@@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
74690
74691 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
74692 /* Activity counter to indicate that a swapon or swapoff has occurred */
74693-static atomic_t proc_poll_event = ATOMIC_INIT(0);
74694+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
74695
74696 static inline unsigned char swap_count(unsigned char ent)
74697 {
74698@@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
74699 }
74700 filp_close(swap_file, NULL);
74701 err = 0;
74702- atomic_inc(&proc_poll_event);
74703+ atomic_inc_unchecked(&proc_poll_event);
74704 wake_up_interruptible(&proc_poll_wait);
74705
74706 out_dput:
74707@@ -1687,8 +1687,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
74708
74709 poll_wait(file, &proc_poll_wait, wait);
74710
74711- if (seq->poll_event != atomic_read(&proc_poll_event)) {
74712- seq->poll_event = atomic_read(&proc_poll_event);
74713+ if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
74714+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
74715 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
74716 }
74717
74718@@ -1786,7 +1786,7 @@ static int swaps_open(struct inode *inode, struct file *file)
74719 return ret;
74720
74721 seq = file->private_data;
74722- seq->poll_event = atomic_read(&proc_poll_event);
74723+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
74724 return 0;
74725 }
74726
74727@@ -2124,7 +2124,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
74728 (p->flags & SWP_DISCARDABLE) ? "D" : "");
74729
74730 mutex_unlock(&swapon_mutex);
74731- atomic_inc(&proc_poll_event);
74732+ atomic_inc_unchecked(&proc_poll_event);
74733 wake_up_interruptible(&proc_poll_wait);
74734
74735 if (S_ISREG(inode->i_mode))
74736diff --git a/mm/util.c b/mm/util.c
74737index 88ea1bd..0f1dfdb 100644
74738--- a/mm/util.c
74739+++ b/mm/util.c
74740@@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
74741 * allocated buffer. Use this if you don't want to free the buffer immediately
74742 * like, for example, with RCU.
74743 */
74744+#undef __krealloc
74745 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
74746 {
74747 void *ret;
74748@@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
74749 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
74750 * %NULL pointer, the object pointed to is freed.
74751 */
74752+#undef krealloc
74753 void *krealloc(const void *p, size_t new_size, gfp_t flags)
74754 {
74755 void *ret;
74756@@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
74757 void arch_pick_mmap_layout(struct mm_struct *mm)
74758 {
74759 mm->mmap_base = TASK_UNMAPPED_BASE;
74760+
74761+#ifdef CONFIG_PAX_RANDMMAP
74762+ if (mm->pax_flags & MF_PAX_RANDMMAP)
74763+ mm->mmap_base += mm->delta_mmap;
74764+#endif
74765+
74766 mm->get_unmapped_area = arch_get_unmapped_area;
74767 mm->unmap_area = arch_unmap_area;
74768 }
74769diff --git a/mm/vmalloc.c b/mm/vmalloc.c
74770index 3a65d6f7..39d5e33 100644
74771--- a/mm/vmalloc.c
74772+++ b/mm/vmalloc.c
74773@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
74774
74775 pte = pte_offset_kernel(pmd, addr);
74776 do {
74777- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
74778- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
74779+
74780+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74781+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
74782+ BUG_ON(!pte_exec(*pte));
74783+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
74784+ continue;
74785+ }
74786+#endif
74787+
74788+ {
74789+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
74790+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
74791+ }
74792 } while (pte++, addr += PAGE_SIZE, addr != end);
74793 }
74794
74795@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
74796 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
74797 {
74798 pte_t *pte;
74799+ int ret = -ENOMEM;
74800
74801 /*
74802 * nr is a running index into the array which helps higher level
74803@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
74804 pte = pte_alloc_kernel(pmd, addr);
74805 if (!pte)
74806 return -ENOMEM;
74807+
74808+ pax_open_kernel();
74809 do {
74810 struct page *page = pages[*nr];
74811
74812- if (WARN_ON(!pte_none(*pte)))
74813- return -EBUSY;
74814- if (WARN_ON(!page))
74815- return -ENOMEM;
74816+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74817+ if (pgprot_val(prot) & _PAGE_NX)
74818+#endif
74819+
74820+ if (WARN_ON(!pte_none(*pte))) {
74821+ ret = -EBUSY;
74822+ goto out;
74823+ }
74824+ if (WARN_ON(!page)) {
74825+ ret = -ENOMEM;
74826+ goto out;
74827+ }
74828 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
74829 (*nr)++;
74830 } while (pte++, addr += PAGE_SIZE, addr != end);
74831- return 0;
74832+ ret = 0;
74833+out:
74834+ pax_close_kernel();
74835+ return ret;
74836 }
74837
74838 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
74839@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
74840 * and fall back on vmalloc() if that fails. Others
74841 * just put it in the vmalloc space.
74842 */
74843-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
74844+#ifdef CONFIG_MODULES
74845+#ifdef MODULES_VADDR
74846 unsigned long addr = (unsigned long)x;
74847 if (addr >= MODULES_VADDR && addr < MODULES_END)
74848 return 1;
74849 #endif
74850+
74851+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74852+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
74853+ return 1;
74854+#endif
74855+
74856+#endif
74857+
74858 return is_vmalloc_addr(x);
74859 }
74860
74861@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
74862
74863 if (!pgd_none(*pgd)) {
74864 pud_t *pud = pud_offset(pgd, addr);
74865+#ifdef CONFIG_X86
74866+ if (!pud_large(*pud))
74867+#endif
74868 if (!pud_none(*pud)) {
74869 pmd_t *pmd = pmd_offset(pud, addr);
74870+#ifdef CONFIG_X86
74871+ if (!pmd_large(*pmd))
74872+#endif
74873 if (!pmd_none(*pmd)) {
74874 pte_t *ptep, pte;
74875
74876@@ -1290,10 +1330,20 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
74877 unsigned long align, unsigned long flags, unsigned long start,
74878 unsigned long end, int node, gfp_t gfp_mask, void *caller)
74879 {
74880- static struct vmap_area *va;
74881+ struct vmap_area *va;
74882 struct vm_struct *area;
74883
74884 BUG_ON(in_interrupt());
74885+
74886+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74887+ if (flags & VM_KERNEXEC) {
74888+ if (start != VMALLOC_START || end != VMALLOC_END)
74889+ return NULL;
74890+ start = (unsigned long)MODULES_EXEC_VADDR;
74891+ end = (unsigned long)MODULES_EXEC_END;
74892+ }
74893+#endif
74894+
74895 if (flags & VM_IOREMAP) {
74896 int bit = fls(size);
74897
74898@@ -1526,6 +1576,11 @@ void *vmap(struct page **pages, unsigned int count,
74899 if (count > totalram_pages)
74900 return NULL;
74901
74902+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74903+ if (!(pgprot_val(prot) & _PAGE_NX))
74904+ flags |= VM_KERNEXEC;
74905+#endif
74906+
74907 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
74908 __builtin_return_address(0));
74909 if (!area)
74910@@ -1627,6 +1682,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
74911 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
74912 return NULL;
74913
74914+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74915+ if (!(pgprot_val(prot) & _PAGE_NX))
74916+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
74917+ VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
74918+ else
74919+#endif
74920+
74921 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
74922 start, end, node, gfp_mask, caller);
74923
74924@@ -1674,6 +1736,7 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
74925 gfp_mask, prot, node, caller);
74926 }
74927
74928+#undef __vmalloc
74929 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
74930 {
74931 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
74932@@ -1697,6 +1760,7 @@ static inline void *__vmalloc_node_flags(unsigned long size,
74933 * For tight control over page level allocator and protection flags
74934 * use __vmalloc() instead.
74935 */
74936+#undef vmalloc
74937 void *vmalloc(unsigned long size)
74938 {
74939 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
74940@@ -1713,6 +1777,7 @@ EXPORT_SYMBOL(vmalloc);
74941 * For tight control over page level allocator and protection flags
74942 * use __vmalloc() instead.
74943 */
74944+#undef vzalloc
74945 void *vzalloc(unsigned long size)
74946 {
74947 return __vmalloc_node_flags(size, -1,
74948@@ -1727,6 +1792,7 @@ EXPORT_SYMBOL(vzalloc);
74949 * The resulting memory area is zeroed so it can be mapped to userspace
74950 * without leaking data.
74951 */
74952+#undef vmalloc_user
74953 void *vmalloc_user(unsigned long size)
74954 {
74955 struct vm_struct *area;
74956@@ -1754,6 +1820,7 @@ EXPORT_SYMBOL(vmalloc_user);
74957 * For tight control over page level allocator and protection flags
74958 * use __vmalloc() instead.
74959 */
74960+#undef vmalloc_node
74961 void *vmalloc_node(unsigned long size, int node)
74962 {
74963 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
74964@@ -1773,6 +1840,7 @@ EXPORT_SYMBOL(vmalloc_node);
74965 * For tight control over page level allocator and protection flags
74966 * use __vmalloc_node() instead.
74967 */
74968+#undef vzalloc_node
74969 void *vzalloc_node(unsigned long size, int node)
74970 {
74971 return __vmalloc_node_flags(size, node,
74972@@ -1795,10 +1863,10 @@ EXPORT_SYMBOL(vzalloc_node);
74973 * For tight control over page level allocator and protection flags
74974 * use __vmalloc() instead.
74975 */
74976-
74977+#undef vmalloc_exec
74978 void *vmalloc_exec(unsigned long size)
74979 {
74980- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
74981+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
74982 -1, __builtin_return_address(0));
74983 }
74984
74985@@ -1817,6 +1885,7 @@ void *vmalloc_exec(unsigned long size)
74986 * Allocate enough 32bit PA addressable pages to cover @size from the
74987 * page level allocator and map them into contiguous kernel virtual space.
74988 */
74989+#undef vmalloc_32
74990 void *vmalloc_32(unsigned long size)
74991 {
74992 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
74993@@ -1831,6 +1900,7 @@ EXPORT_SYMBOL(vmalloc_32);
74994 * The resulting memory area is 32bit addressable and zeroed so it can be
74995 * mapped to userspace without leaking data.
74996 */
74997+#undef vmalloc_32_user
74998 void *vmalloc_32_user(unsigned long size)
74999 {
75000 struct vm_struct *area;
75001@@ -2093,6 +2163,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
75002 unsigned long uaddr = vma->vm_start;
75003 unsigned long usize = vma->vm_end - vma->vm_start;
75004
75005+ BUG_ON(vma->vm_mirror);
75006+
75007 if ((PAGE_SIZE-1) & (unsigned long)addr)
75008 return -EINVAL;
75009
75010diff --git a/mm/vmstat.c b/mm/vmstat.c
75011index d52b13d..381d1ac 100644
75012--- a/mm/vmstat.c
75013+++ b/mm/vmstat.c
75014@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75015 *
75016 * vm_stat contains the global counters
75017 */
75018-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75019+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75020 EXPORT_SYMBOL(vm_stat);
75021
75022 #ifdef CONFIG_SMP
75023@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75024 v = p->vm_stat_diff[i];
75025 p->vm_stat_diff[i] = 0;
75026 local_irq_restore(flags);
75027- atomic_long_add(v, &zone->vm_stat[i]);
75028+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75029 global_diff[i] += v;
75030 #ifdef CONFIG_NUMA
75031 /* 3 seconds idle till flush */
75032@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75033
75034 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75035 if (global_diff[i])
75036- atomic_long_add(global_diff[i], &vm_stat[i]);
75037+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75038 }
75039
75040 #endif
75041@@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
75042 start_cpu_timer(cpu);
75043 #endif
75044 #ifdef CONFIG_PROC_FS
75045- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75046- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75047- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75048- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75049+ {
75050+ mode_t gr_mode = S_IRUGO;
75051+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75052+ gr_mode = S_IRUSR;
75053+#endif
75054+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75055+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75056+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75057+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75058+#else
75059+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75060+#endif
75061+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75062+ }
75063 #endif
75064 return 0;
75065 }
75066diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
75067index 8970ba1..e3361fe 100644
75068--- a/net/8021q/vlan.c
75069+++ b/net/8021q/vlan.c
75070@@ -588,8 +588,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
75071 err = -EPERM;
75072 if (!capable(CAP_NET_ADMIN))
75073 break;
75074- if ((args.u.name_type >= 0) &&
75075- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75076+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75077 struct vlan_net *vn;
75078
75079 vn = net_generic(net, vlan_net_id);
75080diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
75081index fdfdb57..38d368c 100644
75082--- a/net/9p/trans_fd.c
75083+++ b/net/9p/trans_fd.c
75084@@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
75085 oldfs = get_fs();
75086 set_fs(get_ds());
75087 /* The cast to a user pointer is valid due to the set_fs() */
75088- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
75089+ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
75090 set_fs(oldfs);
75091
75092 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
75093diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
75094index e317583..3c8aeaf 100644
75095--- a/net/9p/trans_virtio.c
75096+++ b/net/9p/trans_virtio.c
75097@@ -327,7 +327,7 @@ req_retry_pinned:
75098 } else {
75099 char *pbuf;
75100 if (req->tc->pubuf)
75101- pbuf = (__force char *) req->tc->pubuf;
75102+ pbuf = (char __force_kernel *) req->tc->pubuf;
75103 else
75104 pbuf = req->tc->pkbuf;
75105 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
75106@@ -357,7 +357,7 @@ req_retry_pinned:
75107 } else {
75108 char *pbuf;
75109 if (req->tc->pubuf)
75110- pbuf = (__force char *) req->tc->pubuf;
75111+ pbuf = (char __force_kernel *) req->tc->pubuf;
75112 else
75113 pbuf = req->tc->pkbuf;
75114
75115diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
75116index f41f026..fe76ea8 100644
75117--- a/net/atm/atm_misc.c
75118+++ b/net/atm/atm_misc.c
75119@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
75120 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75121 return 1;
75122 atm_return(vcc, truesize);
75123- atomic_inc(&vcc->stats->rx_drop);
75124+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75125 return 0;
75126 }
75127 EXPORT_SYMBOL(atm_charge);
75128@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
75129 }
75130 }
75131 atm_return(vcc, guess);
75132- atomic_inc(&vcc->stats->rx_drop);
75133+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75134 return NULL;
75135 }
75136 EXPORT_SYMBOL(atm_alloc_charge);
75137@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75138
75139 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75140 {
75141-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75142+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75143 __SONET_ITEMS
75144 #undef __HANDLE_ITEM
75145 }
75146@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75147
75148 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75149 {
75150-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75151+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75152 __SONET_ITEMS
75153 #undef __HANDLE_ITEM
75154 }
75155diff --git a/net/atm/lec.h b/net/atm/lec.h
75156index dfc0719..47c5322 100644
75157--- a/net/atm/lec.h
75158+++ b/net/atm/lec.h
75159@@ -48,7 +48,7 @@ struct lane2_ops {
75160 const u8 *tlvs, u32 sizeoftlvs);
75161 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
75162 const u8 *tlvs, u32 sizeoftlvs);
75163-};
75164+} __no_const;
75165
75166 /*
75167 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
75168diff --git a/net/atm/mpc.h b/net/atm/mpc.h
75169index 0919a88..a23d54e 100644
75170--- a/net/atm/mpc.h
75171+++ b/net/atm/mpc.h
75172@@ -33,7 +33,7 @@ struct mpoa_client {
75173 struct mpc_parameters parameters; /* parameters for this client */
75174
75175 const struct net_device_ops *old_ops;
75176- struct net_device_ops new_ops;
75177+ net_device_ops_no_const new_ops;
75178 };
75179
75180
75181diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
75182index d1b2d9a..7cc2219 100644
75183--- a/net/atm/mpoa_caches.c
75184+++ b/net/atm/mpoa_caches.c
75185@@ -255,6 +255,8 @@ static void check_resolving_entries(struct mpoa_client *client)
75186 struct timeval now;
75187 struct k_message msg;
75188
75189+ pax_track_stack();
75190+
75191 do_gettimeofday(&now);
75192
75193 read_lock_bh(&client->ingress_lock);
75194diff --git a/net/atm/proc.c b/net/atm/proc.c
75195index 0d020de..011c7bb 100644
75196--- a/net/atm/proc.c
75197+++ b/net/atm/proc.c
75198@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
75199 const struct k_atm_aal_stats *stats)
75200 {
75201 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75202- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75203- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75204- atomic_read(&stats->rx_drop));
75205+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75206+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75207+ atomic_read_unchecked(&stats->rx_drop));
75208 }
75209
75210 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75211diff --git a/net/atm/resources.c b/net/atm/resources.c
75212index 23f45ce..c748f1a 100644
75213--- a/net/atm/resources.c
75214+++ b/net/atm/resources.c
75215@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75216 static void copy_aal_stats(struct k_atm_aal_stats *from,
75217 struct atm_aal_stats *to)
75218 {
75219-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75220+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75221 __AAL_STAT_ITEMS
75222 #undef __HANDLE_ITEM
75223 }
75224@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
75225 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75226 struct atm_aal_stats *to)
75227 {
75228-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75229+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75230 __AAL_STAT_ITEMS
75231 #undef __HANDLE_ITEM
75232 }
75233diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
75234index db7aacf..991e539 100644
75235--- a/net/batman-adv/hard-interface.c
75236+++ b/net/batman-adv/hard-interface.c
75237@@ -347,8 +347,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
75238 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75239 dev_add_pack(&hard_iface->batman_adv_ptype);
75240
75241- atomic_set(&hard_iface->seqno, 1);
75242- atomic_set(&hard_iface->frag_seqno, 1);
75243+ atomic_set_unchecked(&hard_iface->seqno, 1);
75244+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75245 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75246 hard_iface->net_dev->name);
75247
75248diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
75249index 0f32c81..82d1895 100644
75250--- a/net/batman-adv/routing.c
75251+++ b/net/batman-adv/routing.c
75252@@ -656,7 +656,7 @@ void receive_bat_packet(const struct ethhdr *ethhdr,
75253 return;
75254
75255 /* could be changed by schedule_own_packet() */
75256- if_incoming_seqno = atomic_read(&if_incoming->seqno);
75257+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75258
75259 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75260
75261diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
75262index 58d1447..2a66c8c 100644
75263--- a/net/batman-adv/send.c
75264+++ b/net/batman-adv/send.c
75265@@ -326,7 +326,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
75266
75267 /* change sequence number to network order */
75268 batman_packet->seqno =
75269- htonl((uint32_t)atomic_read(&hard_iface->seqno));
75270+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75271
75272 batman_packet->ttvn = atomic_read(&bat_priv->ttvn);
75273 batman_packet->tt_crc = htons((uint16_t)atomic_read(&bat_priv->tt_crc));
75274@@ -343,7 +343,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
75275 else
75276 batman_packet->gw_flags = NO_FLAGS;
75277
75278- atomic_inc(&hard_iface->seqno);
75279+ atomic_inc_unchecked(&hard_iface->seqno);
75280
75281 slide_own_bcast_window(hard_iface);
75282 send_time = own_send_time(bat_priv);
75283diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
75284index 05dd351..2ecd19b 100644
75285--- a/net/batman-adv/soft-interface.c
75286+++ b/net/batman-adv/soft-interface.c
75287@@ -632,7 +632,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
75288
75289 /* set broadcast sequence number */
75290 bcast_packet->seqno =
75291- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75292+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75293
75294 add_bcast_packet_to_list(bat_priv, skb, 1);
75295
75296@@ -824,7 +824,7 @@ struct net_device *softif_create(const char *name)
75297 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75298
75299 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75300- atomic_set(&bat_priv->bcast_seqno, 1);
75301+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75302 atomic_set(&bat_priv->ttvn, 0);
75303 atomic_set(&bat_priv->tt_local_changes, 0);
75304 atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
75305diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
75306index 51a0db7..b8a62be 100644
75307--- a/net/batman-adv/types.h
75308+++ b/net/batman-adv/types.h
75309@@ -38,8 +38,8 @@ struct hard_iface {
75310 int16_t if_num;
75311 char if_status;
75312 struct net_device *net_dev;
75313- atomic_t seqno;
75314- atomic_t frag_seqno;
75315+ atomic_unchecked_t seqno;
75316+ atomic_unchecked_t frag_seqno;
75317 unsigned char *packet_buff;
75318 int packet_len;
75319 struct kobject *hardif_obj;
75320@@ -153,7 +153,7 @@ struct bat_priv {
75321 atomic_t orig_interval; /* uint */
75322 atomic_t hop_penalty; /* uint */
75323 atomic_t log_level; /* uint */
75324- atomic_t bcast_seqno;
75325+ atomic_unchecked_t bcast_seqno;
75326 atomic_t bcast_queue_left;
75327 atomic_t batman_queue_left;
75328 atomic_t ttvn; /* tranlation table version number */
75329diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
75330index 32b125f..f1447e0 100644
75331--- a/net/batman-adv/unicast.c
75332+++ b/net/batman-adv/unicast.c
75333@@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
75334 frag1->flags = UNI_FRAG_HEAD | large_tail;
75335 frag2->flags = large_tail;
75336
75337- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75338+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75339 frag1->seqno = htons(seqno - 1);
75340 frag2->seqno = htons(seqno);
75341
75342diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
75343index ea7f031..0615edc 100644
75344--- a/net/bluetooth/hci_conn.c
75345+++ b/net/bluetooth/hci_conn.c
75346@@ -218,7 +218,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
75347 cp.handle = cpu_to_le16(conn->handle);
75348 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
75349 cp.ediv = ediv;
75350- memcpy(cp.rand, rand, sizeof(rand));
75351+ memcpy(cp.rand, rand, sizeof(cp.rand));
75352
75353 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
75354 }
75355@@ -234,7 +234,7 @@ void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
75356 memset(&cp, 0, sizeof(cp));
75357
75358 cp.handle = cpu_to_le16(conn->handle);
75359- memcpy(cp.ltk, ltk, sizeof(ltk));
75360+ memcpy(cp.ltk, ltk, sizeof(cp.ltk));
75361
75362 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
75363 }
75364diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
75365index b3bdb48..7ad90ac 100644
75366--- a/net/bluetooth/l2cap_core.c
75367+++ b/net/bluetooth/l2cap_core.c
75368@@ -2145,7 +2145,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
75369 void *ptr = req->data;
75370 int type, olen;
75371 unsigned long val;
75372- struct l2cap_conf_rfc rfc;
75373+ struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
75374
75375 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
75376
75377@@ -2169,8 +2169,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
75378 break;
75379
75380 case L2CAP_CONF_RFC:
75381- if (olen == sizeof(rfc))
75382- memcpy(&rfc, (void *)val, olen);
75383+ if (olen != sizeof(rfc))
75384+ break;
75385+
75386+ memcpy(&rfc, (void *)val, olen);
75387
75388 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
75389 rfc.mode != chan->mode)
75390@@ -2258,12 +2260,24 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
75391
75392 switch (type) {
75393 case L2CAP_CONF_RFC:
75394- if (olen == sizeof(rfc))
75395- memcpy(&rfc, (void *)val, olen);
75396+ if (olen != sizeof(rfc))
75397+ break;
75398+
75399+ memcpy(&rfc, (void *)val, olen);
75400 goto done;
75401 }
75402 }
75403
75404+ /* Use sane default values in case a misbehaving remote device
75405+ * did not send an RFC option.
75406+ */
75407+ rfc.mode = chan->mode;
75408+ rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
75409+ rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
75410+ rfc.max_pdu_size = cpu_to_le16(chan->imtu);
75411+
75412+ BT_ERR("Expected RFC option was not found, using defaults");
75413+
75414 done:
75415 switch (rfc.mode) {
75416 case L2CAP_MODE_ERTM:
75417diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
75418index e79ff75..215b57d 100644
75419--- a/net/bridge/br_multicast.c
75420+++ b/net/bridge/br_multicast.c
75421@@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
75422 nexthdr = ip6h->nexthdr;
75423 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
75424
75425- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
75426+ if (nexthdr != IPPROTO_ICMPV6)
75427 return 0;
75428
75429 /* Okay, we found ICMPv6 header */
75430diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
75431index 5864cc4..94cab18 100644
75432--- a/net/bridge/netfilter/ebtables.c
75433+++ b/net/bridge/netfilter/ebtables.c
75434@@ -1513,7 +1513,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
75435 tmp.valid_hooks = t->table->valid_hooks;
75436 }
75437 mutex_unlock(&ebt_mutex);
75438- if (copy_to_user(user, &tmp, *len) != 0){
75439+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75440 BUGPRINT("c2u Didn't work\n");
75441 ret = -EFAULT;
75442 break;
75443@@ -1781,6 +1781,8 @@ static int compat_copy_everything_to_user(struct ebt_table *t,
75444 int ret;
75445 void __user *pos;
75446
75447+ pax_track_stack();
75448+
75449 memset(&tinfo, 0, sizeof(tinfo));
75450
75451 if (cmd == EBT_SO_GET_ENTRIES) {
75452diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
75453index a986280..13444a1 100644
75454--- a/net/caif/caif_socket.c
75455+++ b/net/caif/caif_socket.c
75456@@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
75457 #ifdef CONFIG_DEBUG_FS
75458 struct debug_fs_counter {
75459 atomic_t caif_nr_socks;
75460- atomic_t caif_sock_create;
75461- atomic_t num_connect_req;
75462- atomic_t num_connect_resp;
75463- atomic_t num_connect_fail_resp;
75464- atomic_t num_disconnect;
75465- atomic_t num_remote_shutdown_ind;
75466- atomic_t num_tx_flow_off_ind;
75467- atomic_t num_tx_flow_on_ind;
75468- atomic_t num_rx_flow_off;
75469- atomic_t num_rx_flow_on;
75470+ atomic_unchecked_t caif_sock_create;
75471+ atomic_unchecked_t num_connect_req;
75472+ atomic_unchecked_t num_connect_resp;
75473+ atomic_unchecked_t num_connect_fail_resp;
75474+ atomic_unchecked_t num_disconnect;
75475+ atomic_unchecked_t num_remote_shutdown_ind;
75476+ atomic_unchecked_t num_tx_flow_off_ind;
75477+ atomic_unchecked_t num_tx_flow_on_ind;
75478+ atomic_unchecked_t num_rx_flow_off;
75479+ atomic_unchecked_t num_rx_flow_on;
75480 };
75481 static struct debug_fs_counter cnt;
75482 #define dbfs_atomic_inc(v) atomic_inc_return(v)
75483+#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
75484 #define dbfs_atomic_dec(v) atomic_dec_return(v)
75485 #else
75486 #define dbfs_atomic_inc(v) 0
75487@@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75488 atomic_read(&cf_sk->sk.sk_rmem_alloc),
75489 sk_rcvbuf_lowwater(cf_sk));
75490 set_rx_flow_off(cf_sk);
75491- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75492+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75493 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75494 }
75495
75496@@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75497 set_rx_flow_off(cf_sk);
75498 if (net_ratelimit())
75499 pr_debug("sending flow OFF due to rmem_schedule\n");
75500- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75501+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75502 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75503 }
75504 skb->dev = NULL;
75505@@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer *layr,
75506 switch (flow) {
75507 case CAIF_CTRLCMD_FLOW_ON_IND:
75508 /* OK from modem to start sending again */
75509- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
75510+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
75511 set_tx_flow_on(cf_sk);
75512 cf_sk->sk.sk_state_change(&cf_sk->sk);
75513 break;
75514
75515 case CAIF_CTRLCMD_FLOW_OFF_IND:
75516 /* Modem asks us to shut up */
75517- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
75518+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
75519 set_tx_flow_off(cf_sk);
75520 cf_sk->sk.sk_state_change(&cf_sk->sk);
75521 break;
75522@@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
75523 /* We're now connected */
75524 caif_client_register_refcnt(&cf_sk->layer,
75525 cfsk_hold, cfsk_put);
75526- dbfs_atomic_inc(&cnt.num_connect_resp);
75527+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
75528 cf_sk->sk.sk_state = CAIF_CONNECTED;
75529 set_tx_flow_on(cf_sk);
75530 cf_sk->sk.sk_state_change(&cf_sk->sk);
75531@@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
75532
75533 case CAIF_CTRLCMD_INIT_FAIL_RSP:
75534 /* Connect request failed */
75535- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
75536+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
75537 cf_sk->sk.sk_err = ECONNREFUSED;
75538 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
75539 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75540@@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
75541
75542 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
75543 /* Modem has closed this connection, or device is down. */
75544- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
75545+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
75546 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75547 cf_sk->sk.sk_err = ECONNRESET;
75548 set_rx_flow_on(cf_sk);
75549@@ -297,7 +298,7 @@ static void caif_check_flow_release(struct sock *sk)
75550 return;
75551
75552 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
75553- dbfs_atomic_inc(&cnt.num_rx_flow_on);
75554+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
75555 set_rx_flow_on(cf_sk);
75556 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
75557 }
75558@@ -854,7 +855,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
75559 /*ifindex = id of the interface.*/
75560 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
75561
75562- dbfs_atomic_inc(&cnt.num_connect_req);
75563+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
75564 cf_sk->layer.receive = caif_sktrecv_cb;
75565
75566 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
75567@@ -943,7 +944,7 @@ static int caif_release(struct socket *sock)
75568 spin_unlock_bh(&sk->sk_receive_queue.lock);
75569 sock->sk = NULL;
75570
75571- dbfs_atomic_inc(&cnt.num_disconnect);
75572+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
75573
75574 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
75575 if (cf_sk->debugfs_socket_dir != NULL)
75576@@ -1122,7 +1123,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
75577 cf_sk->conn_req.protocol = protocol;
75578 /* Increase the number of sockets created. */
75579 dbfs_atomic_inc(&cnt.caif_nr_socks);
75580- num = dbfs_atomic_inc(&cnt.caif_sock_create);
75581+ num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
75582 #ifdef CONFIG_DEBUG_FS
75583 if (!IS_ERR(debugfsdir)) {
75584
75585diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
75586index e22671b..6598ea0 100644
75587--- a/net/caif/cfctrl.c
75588+++ b/net/caif/cfctrl.c
75589@@ -9,6 +9,7 @@
75590 #include <linux/stddef.h>
75591 #include <linux/spinlock.h>
75592 #include <linux/slab.h>
75593+#include <linux/sched.h>
75594 #include <net/caif/caif_layer.h>
75595 #include <net/caif/cfpkt.h>
75596 #include <net/caif/cfctrl.h>
75597@@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
75598 dev_info.id = 0xff;
75599 memset(this, 0, sizeof(*this));
75600 cfsrvl_init(&this->serv, 0, &dev_info, false);
75601- atomic_set(&this->req_seq_no, 1);
75602- atomic_set(&this->rsp_seq_no, 1);
75603+ atomic_set_unchecked(&this->req_seq_no, 1);
75604+ atomic_set_unchecked(&this->rsp_seq_no, 1);
75605 this->serv.layer.receive = cfctrl_recv;
75606 sprintf(this->serv.layer.name, "ctrl");
75607 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
75608@@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
75609 struct cfctrl_request_info *req)
75610 {
75611 spin_lock_bh(&ctrl->info_list_lock);
75612- atomic_inc(&ctrl->req_seq_no);
75613- req->sequence_no = atomic_read(&ctrl->req_seq_no);
75614+ atomic_inc_unchecked(&ctrl->req_seq_no);
75615+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
75616 list_add_tail(&req->list, &ctrl->list);
75617 spin_unlock_bh(&ctrl->info_list_lock);
75618 }
75619@@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
75620 if (p != first)
75621 pr_warn("Requests are not received in order\n");
75622
75623- atomic_set(&ctrl->rsp_seq_no,
75624+ atomic_set_unchecked(&ctrl->rsp_seq_no,
75625 p->sequence_no);
75626 list_del(&p->list);
75627 goto out;
75628@@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
75629 struct cfctrl *cfctrl = container_obj(layer);
75630 struct cfctrl_request_info rsp, *req;
75631
75632+ pax_track_stack();
75633
75634 cfpkt_extr_head(pkt, &cmdrsp, 1);
75635 cmd = cmdrsp & CFCTRL_CMD_MASK;
75636diff --git a/net/compat.c b/net/compat.c
75637index c578d93..257fab7 100644
75638--- a/net/compat.c
75639+++ b/net/compat.c
75640@@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
75641 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
75642 __get_user(kmsg->msg_flags, &umsg->msg_flags))
75643 return -EFAULT;
75644- kmsg->msg_name = compat_ptr(tmp1);
75645- kmsg->msg_iov = compat_ptr(tmp2);
75646- kmsg->msg_control = compat_ptr(tmp3);
75647+ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
75648+ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
75649+ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
75650 return 0;
75651 }
75652
75653@@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75654
75655 if (kern_msg->msg_namelen) {
75656 if (mode == VERIFY_READ) {
75657- int err = move_addr_to_kernel(kern_msg->msg_name,
75658+ int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
75659 kern_msg->msg_namelen,
75660 kern_address);
75661 if (err < 0)
75662@@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75663 kern_msg->msg_name = NULL;
75664
75665 tot_len = iov_from_user_compat_to_kern(kern_iov,
75666- (struct compat_iovec __user *)kern_msg->msg_iov,
75667+ (struct compat_iovec __force_user *)kern_msg->msg_iov,
75668 kern_msg->msg_iovlen);
75669 if (tot_len >= 0)
75670 kern_msg->msg_iov = kern_iov;
75671@@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75672
75673 #define CMSG_COMPAT_FIRSTHDR(msg) \
75674 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
75675- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
75676+ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
75677 (struct compat_cmsghdr __user *)NULL)
75678
75679 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
75680 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
75681 (ucmlen) <= (unsigned long) \
75682 ((mhdr)->msg_controllen - \
75683- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
75684+ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
75685
75686 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
75687 struct compat_cmsghdr __user *cmsg, int cmsg_len)
75688 {
75689 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
75690- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
75691+ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
75692 msg->msg_controllen)
75693 return NULL;
75694 return (struct compat_cmsghdr __user *)ptr;
75695@@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
75696 {
75697 struct compat_timeval ctv;
75698 struct compat_timespec cts[3];
75699- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75700+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75701 struct compat_cmsghdr cmhdr;
75702 int cmlen;
75703
75704@@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
75705
75706 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
75707 {
75708- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75709+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75710 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
75711 int fdnum = scm->fp->count;
75712 struct file **fp = scm->fp->fp;
75713@@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
75714 return -EFAULT;
75715 old_fs = get_fs();
75716 set_fs(KERNEL_DS);
75717- err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
75718+ err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
75719 set_fs(old_fs);
75720
75721 return err;
75722@@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
75723 len = sizeof(ktime);
75724 old_fs = get_fs();
75725 set_fs(KERNEL_DS);
75726- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
75727+ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
75728 set_fs(old_fs);
75729
75730 if (!err) {
75731@@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75732 case MCAST_JOIN_GROUP:
75733 case MCAST_LEAVE_GROUP:
75734 {
75735- struct compat_group_req __user *gr32 = (void *)optval;
75736+ struct compat_group_req __user *gr32 = (void __user *)optval;
75737 struct group_req __user *kgr =
75738 compat_alloc_user_space(sizeof(struct group_req));
75739 u32 interface;
75740@@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75741 case MCAST_BLOCK_SOURCE:
75742 case MCAST_UNBLOCK_SOURCE:
75743 {
75744- struct compat_group_source_req __user *gsr32 = (void *)optval;
75745+ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
75746 struct group_source_req __user *kgsr = compat_alloc_user_space(
75747 sizeof(struct group_source_req));
75748 u32 interface;
75749@@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75750 }
75751 case MCAST_MSFILTER:
75752 {
75753- struct compat_group_filter __user *gf32 = (void *)optval;
75754+ struct compat_group_filter __user *gf32 = (void __user *)optval;
75755 struct group_filter __user *kgf;
75756 u32 interface, fmode, numsrc;
75757
75758@@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
75759 char __user *optval, int __user *optlen,
75760 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
75761 {
75762- struct compat_group_filter __user *gf32 = (void *)optval;
75763+ struct compat_group_filter __user *gf32 = (void __user *)optval;
75764 struct group_filter __user *kgf;
75765 int __user *koptlen;
75766 u32 interface, fmode, numsrc;
75767diff --git a/net/core/datagram.c b/net/core/datagram.c
75768index 18ac112..fe95ed9 100644
75769--- a/net/core/datagram.c
75770+++ b/net/core/datagram.c
75771@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
75772 }
75773
75774 kfree_skb(skb);
75775- atomic_inc(&sk->sk_drops);
75776+ atomic_inc_unchecked(&sk->sk_drops);
75777 sk_mem_reclaim_partial(sk);
75778
75779 return err;
75780diff --git a/net/core/dev.c b/net/core/dev.c
75781index ae5cf2d..2c950a1 100644
75782--- a/net/core/dev.c
75783+++ b/net/core/dev.c
75784@@ -1135,10 +1135,14 @@ void dev_load(struct net *net, const char *name)
75785 if (no_module && capable(CAP_NET_ADMIN))
75786 no_module = request_module("netdev-%s", name);
75787 if (no_module && capable(CAP_SYS_MODULE)) {
75788+#ifdef CONFIG_GRKERNSEC_MODHARDEN
75789+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
75790+#else
75791 if (!request_module("%s", name))
75792 pr_err("Loading kernel module for a network device "
75793 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
75794 "instead\n", name);
75795+#endif
75796 }
75797 }
75798 EXPORT_SYMBOL(dev_load);
75799@@ -1977,7 +1981,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
75800
75801 struct dev_gso_cb {
75802 void (*destructor)(struct sk_buff *skb);
75803-};
75804+} __no_const;
75805
75806 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
75807
75808@@ -2930,7 +2934,7 @@ int netif_rx_ni(struct sk_buff *skb)
75809 }
75810 EXPORT_SYMBOL(netif_rx_ni);
75811
75812-static void net_tx_action(struct softirq_action *h)
75813+static void net_tx_action(void)
75814 {
75815 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75816
75817@@ -3779,7 +3783,7 @@ void netif_napi_del(struct napi_struct *napi)
75818 }
75819 EXPORT_SYMBOL(netif_napi_del);
75820
75821-static void net_rx_action(struct softirq_action *h)
75822+static void net_rx_action(void)
75823 {
75824 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75825 unsigned long time_limit = jiffies + 2;
75826diff --git a/net/core/flow.c b/net/core/flow.c
75827index d6968e5..1690d9d 100644
75828--- a/net/core/flow.c
75829+++ b/net/core/flow.c
75830@@ -61,7 +61,7 @@ struct flow_cache {
75831 struct timer_list rnd_timer;
75832 };
75833
75834-atomic_t flow_cache_genid = ATOMIC_INIT(0);
75835+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
75836 EXPORT_SYMBOL(flow_cache_genid);
75837 static struct flow_cache flow_cache_global;
75838 static struct kmem_cache *flow_cachep __read_mostly;
75839@@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
75840
75841 static int flow_entry_valid(struct flow_cache_entry *fle)
75842 {
75843- if (atomic_read(&flow_cache_genid) != fle->genid)
75844+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
75845 return 0;
75846 if (fle->object && !fle->object->ops->check(fle->object))
75847 return 0;
75848@@ -259,7 +259,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
75849 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
75850 fcp->hash_count++;
75851 }
75852- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75853+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75854 flo = fle->object;
75855 if (!flo)
75856 goto ret_object;
75857@@ -280,7 +280,7 @@ nocache:
75858 }
75859 flo = resolver(net, key, family, dir, flo, ctx);
75860 if (fle) {
75861- fle->genid = atomic_read(&flow_cache_genid);
75862+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
75863 if (!IS_ERR(flo))
75864 fle->object = flo;
75865 else
75866diff --git a/net/core/iovec.c b/net/core/iovec.c
75867index c40f27e..7f49254 100644
75868--- a/net/core/iovec.c
75869+++ b/net/core/iovec.c
75870@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75871 if (m->msg_namelen) {
75872 if (mode == VERIFY_READ) {
75873 void __user *namep;
75874- namep = (void __user __force *) m->msg_name;
75875+ namep = (void __force_user *) m->msg_name;
75876 err = move_addr_to_kernel(namep, m->msg_namelen,
75877 address);
75878 if (err < 0)
75879@@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75880 }
75881
75882 size = m->msg_iovlen * sizeof(struct iovec);
75883- if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
75884+ if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
75885 return -EFAULT;
75886
75887 m->msg_iov = iov;
75888diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
75889index 1683e5d..f3621f6 100644
75890--- a/net/core/net-sysfs.c
75891+++ b/net/core/net-sysfs.c
75892@@ -664,11 +664,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
75893 if (count) {
75894 int i;
75895
75896- if (count > 1<<30) {
75897- /* Enforce a limit to prevent overflow */
75898+ if (count > INT_MAX)
75899 return -EINVAL;
75900- }
75901 count = roundup_pow_of_two(count);
75902+ if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table))
75903+ / sizeof(struct rps_dev_flow)) {
75904+ /* Enforce a limit to prevent overflow */
75905+ return -EINVAL;
75906+ }
75907 table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
75908 if (!table)
75909 return -ENOMEM;
75910diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
75911index 99d9e95..209bae2 100644
75912--- a/net/core/rtnetlink.c
75913+++ b/net/core/rtnetlink.c
75914@@ -57,7 +57,7 @@ struct rtnl_link {
75915 rtnl_doit_func doit;
75916 rtnl_dumpit_func dumpit;
75917 rtnl_calcit_func calcit;
75918-};
75919+} __no_const;
75920
75921 static DEFINE_MUTEX(rtnl_mutex);
75922 static u16 min_ifinfo_dump_size;
75923diff --git a/net/core/scm.c b/net/core/scm.c
75924index 811b53f..5d6c343 100644
75925--- a/net/core/scm.c
75926+++ b/net/core/scm.c
75927@@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
75928 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75929 {
75930 struct cmsghdr __user *cm
75931- = (__force struct cmsghdr __user *)msg->msg_control;
75932+ = (struct cmsghdr __force_user *)msg->msg_control;
75933 struct cmsghdr cmhdr;
75934 int cmlen = CMSG_LEN(len);
75935 int err;
75936@@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75937 err = -EFAULT;
75938 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
75939 goto out;
75940- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
75941+ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
75942 goto out;
75943 cmlen = CMSG_SPACE(len);
75944 if (msg->msg_controllen < cmlen)
75945@@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
75946 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75947 {
75948 struct cmsghdr __user *cm
75949- = (__force struct cmsghdr __user*)msg->msg_control;
75950+ = (struct cmsghdr __force_user *)msg->msg_control;
75951
75952 int fdmax = 0;
75953 int fdnum = scm->fp->count;
75954@@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75955 if (fdnum < fdmax)
75956 fdmax = fdnum;
75957
75958- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
75959+ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
75960 i++, cmfptr++)
75961 {
75962 int new_fd;
75963diff --git a/net/core/skbuff.c b/net/core/skbuff.c
75964index 387703f..035abcf 100644
75965--- a/net/core/skbuff.c
75966+++ b/net/core/skbuff.c
75967@@ -1650,6 +1650,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
75968 struct sock *sk = skb->sk;
75969 int ret = 0;
75970
75971+ pax_track_stack();
75972+
75973 if (splice_grow_spd(pipe, &spd))
75974 return -ENOMEM;
75975
75976diff --git a/net/core/sock.c b/net/core/sock.c
75977index 11d67b3..df26d4b 100644
75978--- a/net/core/sock.c
75979+++ b/net/core/sock.c
75980@@ -293,7 +293,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75981 */
75982 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
75983 (unsigned)sk->sk_rcvbuf) {
75984- atomic_inc(&sk->sk_drops);
75985+ atomic_inc_unchecked(&sk->sk_drops);
75986 trace_sock_rcvqueue_full(sk, skb);
75987 return -ENOMEM;
75988 }
75989@@ -303,7 +303,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75990 return err;
75991
75992 if (!sk_rmem_schedule(sk, skb->truesize)) {
75993- atomic_inc(&sk->sk_drops);
75994+ atomic_inc_unchecked(&sk->sk_drops);
75995 return -ENOBUFS;
75996 }
75997
75998@@ -323,7 +323,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75999 skb_dst_force(skb);
76000
76001 spin_lock_irqsave(&list->lock, flags);
76002- skb->dropcount = atomic_read(&sk->sk_drops);
76003+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
76004 __skb_queue_tail(list, skb);
76005 spin_unlock_irqrestore(&list->lock, flags);
76006
76007@@ -343,7 +343,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
76008 skb->dev = NULL;
76009
76010 if (sk_rcvqueues_full(sk, skb)) {
76011- atomic_inc(&sk->sk_drops);
76012+ atomic_inc_unchecked(&sk->sk_drops);
76013 goto discard_and_relse;
76014 }
76015 if (nested)
76016@@ -361,7 +361,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
76017 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
76018 } else if (sk_add_backlog(sk, skb)) {
76019 bh_unlock_sock(sk);
76020- atomic_inc(&sk->sk_drops);
76021+ atomic_inc_unchecked(&sk->sk_drops);
76022 goto discard_and_relse;
76023 }
76024
76025@@ -924,7 +924,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76026 if (len > sizeof(peercred))
76027 len = sizeof(peercred);
76028 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
76029- if (copy_to_user(optval, &peercred, len))
76030+ if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
76031 return -EFAULT;
76032 goto lenout;
76033 }
76034@@ -937,7 +937,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76035 return -ENOTCONN;
76036 if (lv < len)
76037 return -EINVAL;
76038- if (copy_to_user(optval, address, len))
76039+ if (len > sizeof(address) || copy_to_user(optval, address, len))
76040 return -EFAULT;
76041 goto lenout;
76042 }
76043@@ -970,7 +970,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76044
76045 if (len > lv)
76046 len = lv;
76047- if (copy_to_user(optval, &v, len))
76048+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
76049 return -EFAULT;
76050 lenout:
76051 if (put_user(len, optlen))
76052@@ -2029,7 +2029,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
76053 */
76054 smp_wmb();
76055 atomic_set(&sk->sk_refcnt, 1);
76056- atomic_set(&sk->sk_drops, 0);
76057+ atomic_set_unchecked(&sk->sk_drops, 0);
76058 }
76059 EXPORT_SYMBOL(sock_init_data);
76060
76061diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
76062index 02e75d1..9a57a7c 100644
76063--- a/net/decnet/sysctl_net_decnet.c
76064+++ b/net/decnet/sysctl_net_decnet.c
76065@@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
76066
76067 if (len > *lenp) len = *lenp;
76068
76069- if (copy_to_user(buffer, addr, len))
76070+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
76071 return -EFAULT;
76072
76073 *lenp = len;
76074@@ -237,7 +237,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
76075
76076 if (len > *lenp) len = *lenp;
76077
76078- if (copy_to_user(buffer, devname, len))
76079+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
76080 return -EFAULT;
76081
76082 *lenp = len;
76083diff --git a/net/econet/Kconfig b/net/econet/Kconfig
76084index 39a2d29..f39c0fe 100644
76085--- a/net/econet/Kconfig
76086+++ b/net/econet/Kconfig
76087@@ -4,7 +4,7 @@
76088
76089 config ECONET
76090 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
76091- depends on EXPERIMENTAL && INET
76092+ depends on EXPERIMENTAL && INET && BROKEN
76093 ---help---
76094 Econet is a fairly old and slow networking protocol mainly used by
76095 Acorn computers to access file and print servers. It uses native
76096diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
76097index 92fc5f6..b790d91 100644
76098--- a/net/ipv4/fib_frontend.c
76099+++ b/net/ipv4/fib_frontend.c
76100@@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
76101 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76102 fib_sync_up(dev);
76103 #endif
76104- atomic_inc(&net->ipv4.dev_addr_genid);
76105+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76106 rt_cache_flush(dev_net(dev), -1);
76107 break;
76108 case NETDEV_DOWN:
76109 fib_del_ifaddr(ifa, NULL);
76110- atomic_inc(&net->ipv4.dev_addr_genid);
76111+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76112 if (ifa->ifa_dev->ifa_list == NULL) {
76113 /* Last address was deleted from this interface.
76114 * Disable IP.
76115@@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
76116 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76117 fib_sync_up(dev);
76118 #endif
76119- atomic_inc(&net->ipv4.dev_addr_genid);
76120+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76121 rt_cache_flush(dev_net(dev), -1);
76122 break;
76123 case NETDEV_DOWN:
76124diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
76125index 80106d8..232e898 100644
76126--- a/net/ipv4/fib_semantics.c
76127+++ b/net/ipv4/fib_semantics.c
76128@@ -699,7 +699,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
76129 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76130 nh->nh_gw,
76131 nh->nh_parent->fib_scope);
76132- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76133+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76134
76135 return nh->nh_saddr;
76136 }
76137diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
76138index 389a2e6..ac1c1de 100644
76139--- a/net/ipv4/inet_diag.c
76140+++ b/net/ipv4/inet_diag.c
76141@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct sock *sk,
76142 r->idiag_retrans = 0;
76143
76144 r->id.idiag_if = sk->sk_bound_dev_if;
76145+
76146+#ifdef CONFIG_GRKERNSEC_HIDESYM
76147+ r->id.idiag_cookie[0] = 0;
76148+ r->id.idiag_cookie[1] = 0;
76149+#else
76150 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76151 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76152+#endif
76153
76154 r->id.idiag_sport = inet->inet_sport;
76155 r->id.idiag_dport = inet->inet_dport;
76156@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
76157 r->idiag_family = tw->tw_family;
76158 r->idiag_retrans = 0;
76159 r->id.idiag_if = tw->tw_bound_dev_if;
76160+
76161+#ifdef CONFIG_GRKERNSEC_HIDESYM
76162+ r->id.idiag_cookie[0] = 0;
76163+ r->id.idiag_cookie[1] = 0;
76164+#else
76165 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76166 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76167+#endif
76168+
76169 r->id.idiag_sport = tw->tw_sport;
76170 r->id.idiag_dport = tw->tw_dport;
76171 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76172@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
76173 if (sk == NULL)
76174 goto unlock;
76175
76176+#ifndef CONFIG_GRKERNSEC_HIDESYM
76177 err = -ESTALE;
76178 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76179 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76180 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76181 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76182 goto out;
76183+#endif
76184
76185 err = -ENOMEM;
76186 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76187@@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
76188 r->idiag_retrans = req->retrans;
76189
76190 r->id.idiag_if = sk->sk_bound_dev_if;
76191+
76192+#ifdef CONFIG_GRKERNSEC_HIDESYM
76193+ r->id.idiag_cookie[0] = 0;
76194+ r->id.idiag_cookie[1] = 0;
76195+#else
76196 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76197 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76198+#endif
76199
76200 tmo = req->expires - jiffies;
76201 if (tmo < 0)
76202diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
76203index 984ec65..97ac518 100644
76204--- a/net/ipv4/inet_hashtables.c
76205+++ b/net/ipv4/inet_hashtables.c
76206@@ -18,12 +18,15 @@
76207 #include <linux/sched.h>
76208 #include <linux/slab.h>
76209 #include <linux/wait.h>
76210+#include <linux/security.h>
76211
76212 #include <net/inet_connection_sock.h>
76213 #include <net/inet_hashtables.h>
76214 #include <net/secure_seq.h>
76215 #include <net/ip.h>
76216
76217+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76218+
76219 /*
76220 * Allocate and initialize a new local port bind bucket.
76221 * The bindhash mutex for snum's hash chain must be held here.
76222@@ -530,6 +533,8 @@ ok:
76223 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76224 spin_unlock(&head->lock);
76225
76226+ gr_update_task_in_ip_table(current, inet_sk(sk));
76227+
76228 if (tw) {
76229 inet_twsk_deschedule(tw, death_row);
76230 while (twrefcnt) {
76231diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
76232index 86f13c67..0bce60f 100644
76233--- a/net/ipv4/inetpeer.c
76234+++ b/net/ipv4/inetpeer.c
76235@@ -400,6 +400,8 @@ struct inet_peer *inet_getpeer(const struct inetpeer_addr *daddr, int create)
76236 unsigned int sequence;
76237 int invalidated, gccnt = 0;
76238
76239+ pax_track_stack();
76240+
76241 /* Attempt a lockless lookup first.
76242 * Because of a concurrent writer, we might not find an existing entry.
76243 */
76244@@ -436,8 +438,8 @@ relookup:
76245 if (p) {
76246 p->daddr = *daddr;
76247 atomic_set(&p->refcnt, 1);
76248- atomic_set(&p->rid, 0);
76249- atomic_set(&p->ip_id_count,
76250+ atomic_set_unchecked(&p->rid, 0);
76251+ atomic_set_unchecked(&p->ip_id_count,
76252 (daddr->family == AF_INET) ?
76253 secure_ip_id(daddr->addr.a4) :
76254 secure_ipv6_id(daddr->addr.a6));
76255diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
76256index 0e0ab98..2ed7dd5 100644
76257--- a/net/ipv4/ip_fragment.c
76258+++ b/net/ipv4/ip_fragment.c
76259@@ -316,7 +316,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
76260 return 0;
76261
76262 start = qp->rid;
76263- end = atomic_inc_return(&peer->rid);
76264+ end = atomic_inc_return_unchecked(&peer->rid);
76265 qp->rid = end;
76266
76267 rc = qp->q.fragments && (end - start) > max;
76268diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
76269index 8905e92..0b179fb 100644
76270--- a/net/ipv4/ip_sockglue.c
76271+++ b/net/ipv4/ip_sockglue.c
76272@@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
76273 int val;
76274 int len;
76275
76276+ pax_track_stack();
76277+
76278 if (level != SOL_IP)
76279 return -EOPNOTSUPP;
76280
76281@@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
76282 len = min_t(unsigned int, len, opt->optlen);
76283 if (put_user(len, optlen))
76284 return -EFAULT;
76285- if (copy_to_user(optval, opt->__data, len))
76286+ if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
76287+ copy_to_user(optval, opt->__data, len))
76288 return -EFAULT;
76289 return 0;
76290 }
76291@@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
76292 if (sk->sk_type != SOCK_STREAM)
76293 return -ENOPROTOOPT;
76294
76295- msg.msg_control = optval;
76296+ msg.msg_control = (void __force_kernel *)optval;
76297 msg.msg_controllen = len;
76298 msg.msg_flags = flags;
76299
76300diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
76301index 004bb74..8d4a58c 100644
76302--- a/net/ipv4/ipconfig.c
76303+++ b/net/ipv4/ipconfig.c
76304@@ -317,7 +317,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
76305
76306 mm_segment_t oldfs = get_fs();
76307 set_fs(get_ds());
76308- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76309+ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76310 set_fs(oldfs);
76311 return res;
76312 }
76313@@ -328,7 +328,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
76314
76315 mm_segment_t oldfs = get_fs();
76316 set_fs(get_ds());
76317- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76318+ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76319 set_fs(oldfs);
76320 return res;
76321 }
76322@@ -339,7 +339,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
76323
76324 mm_segment_t oldfs = get_fs();
76325 set_fs(get_ds());
76326- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
76327+ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
76328 set_fs(oldfs);
76329 return res;
76330 }
76331diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
76332index 076b7c8..9c8d038 100644
76333--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
76334+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
76335@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
76336
76337 *len = 0;
76338
76339- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76340+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76341 if (*octets == NULL) {
76342 if (net_ratelimit())
76343 pr_notice("OOM in bsalg (%d)\n", __LINE__);
76344diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
76345index 39b403f..8e6a0a8 100644
76346--- a/net/ipv4/ping.c
76347+++ b/net/ipv4/ping.c
76348@@ -837,7 +837,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
76349 sk_rmem_alloc_get(sp),
76350 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76351 atomic_read(&sp->sk_refcnt), sp,
76352- atomic_read(&sp->sk_drops), len);
76353+ atomic_read_unchecked(&sp->sk_drops), len);
76354 }
76355
76356 static int ping_seq_show(struct seq_file *seq, void *v)
76357diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
76358index 61714bd..c9cee6d 100644
76359--- a/net/ipv4/raw.c
76360+++ b/net/ipv4/raw.c
76361@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
76362 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76363 {
76364 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76365- atomic_inc(&sk->sk_drops);
76366+ atomic_inc_unchecked(&sk->sk_drops);
76367 kfree_skb(skb);
76368 return NET_RX_DROP;
76369 }
76370@@ -737,16 +737,20 @@ static int raw_init(struct sock *sk)
76371
76372 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76373 {
76374+ struct icmp_filter filter;
76375+
76376 if (optlen > sizeof(struct icmp_filter))
76377 optlen = sizeof(struct icmp_filter);
76378- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76379+ if (copy_from_user(&filter, optval, optlen))
76380 return -EFAULT;
76381+ raw_sk(sk)->filter = filter;
76382 return 0;
76383 }
76384
76385 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76386 {
76387 int len, ret = -EFAULT;
76388+ struct icmp_filter filter;
76389
76390 if (get_user(len, optlen))
76391 goto out;
76392@@ -756,8 +760,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
76393 if (len > sizeof(struct icmp_filter))
76394 len = sizeof(struct icmp_filter);
76395 ret = -EFAULT;
76396- if (put_user(len, optlen) ||
76397- copy_to_user(optval, &raw_sk(sk)->filter, len))
76398+ filter = raw_sk(sk)->filter;
76399+ if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
76400 goto out;
76401 ret = 0;
76402 out: return ret;
76403@@ -985,7 +989,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
76404 sk_wmem_alloc_get(sp),
76405 sk_rmem_alloc_get(sp),
76406 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76407- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76408+ atomic_read(&sp->sk_refcnt),
76409+#ifdef CONFIG_GRKERNSEC_HIDESYM
76410+ NULL,
76411+#else
76412+ sp,
76413+#endif
76414+ atomic_read_unchecked(&sp->sk_drops));
76415 }
76416
76417 static int raw_seq_show(struct seq_file *seq, void *v)
76418diff --git a/net/ipv4/route.c b/net/ipv4/route.c
76419index b563854..e03f8a6 100644
76420--- a/net/ipv4/route.c
76421+++ b/net/ipv4/route.c
76422@@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
76423
76424 static inline int rt_genid(struct net *net)
76425 {
76426- return atomic_read(&net->ipv4.rt_genid);
76427+ return atomic_read_unchecked(&net->ipv4.rt_genid);
76428 }
76429
76430 #ifdef CONFIG_PROC_FS
76431@@ -937,7 +937,7 @@ static void rt_cache_invalidate(struct net *net)
76432 unsigned char shuffle;
76433
76434 get_random_bytes(&shuffle, sizeof(shuffle));
76435- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76436+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76437 redirect_genid++;
76438 }
76439
76440@@ -3015,7 +3015,7 @@ static int rt_fill_info(struct net *net,
76441 error = rt->dst.error;
76442 if (peer) {
76443 inet_peer_refcheck(rt->peer);
76444- id = atomic_read(&peer->ip_id_count) & 0xffff;
76445+ id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
76446 if (peer->tcp_ts_stamp) {
76447 ts = peer->tcp_ts;
76448 tsage = get_seconds() - peer->tcp_ts_stamp;
76449diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
76450index 46febca..98b73a4 100644
76451--- a/net/ipv4/tcp.c
76452+++ b/net/ipv4/tcp.c
76453@@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
76454 int val;
76455 int err = 0;
76456
76457+ pax_track_stack();
76458+
76459 /* These are data/string values, all the others are ints */
76460 switch (optname) {
76461 case TCP_CONGESTION: {
76462@@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
76463 struct tcp_sock *tp = tcp_sk(sk);
76464 int val, len;
76465
76466+ pax_track_stack();
76467+
76468 if (get_user(len, optlen))
76469 return -EFAULT;
76470
76471diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
76472index 7963e03..c44f5d0 100644
76473--- a/net/ipv4/tcp_ipv4.c
76474+++ b/net/ipv4/tcp_ipv4.c
76475@@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
76476 int sysctl_tcp_low_latency __read_mostly;
76477 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76478
76479+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76480+extern int grsec_enable_blackhole;
76481+#endif
76482
76483 #ifdef CONFIG_TCP_MD5SIG
76484 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76485@@ -1622,6 +1625,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
76486 return 0;
76487
76488 reset:
76489+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76490+ if (!grsec_enable_blackhole)
76491+#endif
76492 tcp_v4_send_reset(rsk, skb);
76493 discard:
76494 kfree_skb(skb);
76495@@ -1684,12 +1690,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76496 TCP_SKB_CB(skb)->sacked = 0;
76497
76498 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76499- if (!sk)
76500+ if (!sk) {
76501+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76502+ ret = 1;
76503+#endif
76504 goto no_tcp_socket;
76505-
76506+ }
76507 process:
76508- if (sk->sk_state == TCP_TIME_WAIT)
76509+ if (sk->sk_state == TCP_TIME_WAIT) {
76510+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76511+ ret = 2;
76512+#endif
76513 goto do_time_wait;
76514+ }
76515
76516 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76517 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76518@@ -1739,6 +1752,10 @@ no_tcp_socket:
76519 bad_packet:
76520 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76521 } else {
76522+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76523+ if (!grsec_enable_blackhole || (ret == 1 &&
76524+ (skb->dev->flags & IFF_LOOPBACK)))
76525+#endif
76526 tcp_v4_send_reset(NULL, skb);
76527 }
76528
76529@@ -2403,7 +2420,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
76530 0, /* non standard timer */
76531 0, /* open_requests have no inode */
76532 atomic_read(&sk->sk_refcnt),
76533+#ifdef CONFIG_GRKERNSEC_HIDESYM
76534+ NULL,
76535+#else
76536 req,
76537+#endif
76538 len);
76539 }
76540
76541@@ -2453,7 +2474,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
76542 sock_i_uid(sk),
76543 icsk->icsk_probes_out,
76544 sock_i_ino(sk),
76545- atomic_read(&sk->sk_refcnt), sk,
76546+ atomic_read(&sk->sk_refcnt),
76547+#ifdef CONFIG_GRKERNSEC_HIDESYM
76548+ NULL,
76549+#else
76550+ sk,
76551+#endif
76552 jiffies_to_clock_t(icsk->icsk_rto),
76553 jiffies_to_clock_t(icsk->icsk_ack.ato),
76554 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76555@@ -2481,7 +2507,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
76556 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
76557 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76558 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76559- atomic_read(&tw->tw_refcnt), tw, len);
76560+ atomic_read(&tw->tw_refcnt),
76561+#ifdef CONFIG_GRKERNSEC_HIDESYM
76562+ NULL,
76563+#else
76564+ tw,
76565+#endif
76566+ len);
76567 }
76568
76569 #define TMPSZ 150
76570diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
76571index 0ce3d06..e182e59 100644
76572--- a/net/ipv4/tcp_minisocks.c
76573+++ b/net/ipv4/tcp_minisocks.c
76574@@ -27,6 +27,10 @@
76575 #include <net/inet_common.h>
76576 #include <net/xfrm.h>
76577
76578+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76579+extern int grsec_enable_blackhole;
76580+#endif
76581+
76582 int sysctl_tcp_syncookies __read_mostly = 1;
76583 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76584
76585@@ -750,6 +754,10 @@ listen_overflow:
76586
76587 embryonic_reset:
76588 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76589+
76590+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76591+ if (!grsec_enable_blackhole)
76592+#endif
76593 if (!(flg & TCP_FLAG_RST))
76594 req->rsk_ops->send_reset(sk, skb);
76595
76596diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
76597index 882e0b0..2eba47f 100644
76598--- a/net/ipv4/tcp_output.c
76599+++ b/net/ipv4/tcp_output.c
76600@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
76601 int mss;
76602 int s_data_desired = 0;
76603
76604+ pax_track_stack();
76605+
76606 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76607 s_data_desired = cvp->s_data_desired;
76608 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76609diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
76610index 85ee7eb..53277ab 100644
76611--- a/net/ipv4/tcp_probe.c
76612+++ b/net/ipv4/tcp_probe.c
76613@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
76614 if (cnt + width >= len)
76615 break;
76616
76617- if (copy_to_user(buf + cnt, tbuf, width))
76618+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76619 return -EFAULT;
76620 cnt += width;
76621 }
76622diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
76623index ecd44b0..b32fba6 100644
76624--- a/net/ipv4/tcp_timer.c
76625+++ b/net/ipv4/tcp_timer.c
76626@@ -22,6 +22,10 @@
76627 #include <linux/gfp.h>
76628 #include <net/tcp.h>
76629
76630+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76631+extern int grsec_lastack_retries;
76632+#endif
76633+
76634 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76635 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76636 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76637@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock *sk)
76638 }
76639 }
76640
76641+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76642+ if ((sk->sk_state == TCP_LAST_ACK) &&
76643+ (grsec_lastack_retries > 0) &&
76644+ (grsec_lastack_retries < retry_until))
76645+ retry_until = grsec_lastack_retries;
76646+#endif
76647+
76648 if (retransmits_timed_out(sk, retry_until,
76649 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76650 /* Has it gone just too far? */
76651diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
76652index 1b5a193..bd354b0 100644
76653--- a/net/ipv4/udp.c
76654+++ b/net/ipv4/udp.c
76655@@ -86,6 +86,7 @@
76656 #include <linux/types.h>
76657 #include <linux/fcntl.h>
76658 #include <linux/module.h>
76659+#include <linux/security.h>
76660 #include <linux/socket.h>
76661 #include <linux/sockios.h>
76662 #include <linux/igmp.h>
76663@@ -108,6 +109,10 @@
76664 #include <trace/events/udp.h>
76665 #include "udp_impl.h"
76666
76667+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76668+extern int grsec_enable_blackhole;
76669+#endif
76670+
76671 struct udp_table udp_table __read_mostly;
76672 EXPORT_SYMBOL(udp_table);
76673
76674@@ -565,6 +570,9 @@ found:
76675 return s;
76676 }
76677
76678+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76679+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76680+
76681 /*
76682 * This routine is called by the ICMP module when it gets some
76683 * sort of error condition. If err < 0 then the socket should
76684@@ -856,9 +864,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
76685 dport = usin->sin_port;
76686 if (dport == 0)
76687 return -EINVAL;
76688+
76689+ err = gr_search_udp_sendmsg(sk, usin);
76690+ if (err)
76691+ return err;
76692 } else {
76693 if (sk->sk_state != TCP_ESTABLISHED)
76694 return -EDESTADDRREQ;
76695+
76696+ err = gr_search_udp_sendmsg(sk, NULL);
76697+ if (err)
76698+ return err;
76699+
76700 daddr = inet->inet_daddr;
76701 dport = inet->inet_dport;
76702 /* Open fast path for connected socket.
76703@@ -1099,7 +1116,7 @@ static unsigned int first_packet_length(struct sock *sk)
76704 udp_lib_checksum_complete(skb)) {
76705 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76706 IS_UDPLITE(sk));
76707- atomic_inc(&sk->sk_drops);
76708+ atomic_inc_unchecked(&sk->sk_drops);
76709 __skb_unlink(skb, rcvq);
76710 __skb_queue_tail(&list_kill, skb);
76711 }
76712@@ -1185,6 +1202,10 @@ try_again:
76713 if (!skb)
76714 goto out;
76715
76716+ err = gr_search_udp_recvmsg(sk, skb);
76717+ if (err)
76718+ goto out_free;
76719+
76720 ulen = skb->len - sizeof(struct udphdr);
76721 if (len > ulen)
76722 len = ulen;
76723@@ -1485,7 +1506,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
76724
76725 drop:
76726 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76727- atomic_inc(&sk->sk_drops);
76728+ atomic_inc_unchecked(&sk->sk_drops);
76729 kfree_skb(skb);
76730 return -1;
76731 }
76732@@ -1504,7 +1525,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
76733 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76734
76735 if (!skb1) {
76736- atomic_inc(&sk->sk_drops);
76737+ atomic_inc_unchecked(&sk->sk_drops);
76738 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76739 IS_UDPLITE(sk));
76740 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76741@@ -1673,6 +1694,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76742 goto csum_error;
76743
76744 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76745+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76746+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76747+#endif
76748 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76749
76750 /*
76751@@ -2100,8 +2124,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
76752 sk_wmem_alloc_get(sp),
76753 sk_rmem_alloc_get(sp),
76754 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76755- atomic_read(&sp->sk_refcnt), sp,
76756- atomic_read(&sp->sk_drops), len);
76757+ atomic_read(&sp->sk_refcnt),
76758+#ifdef CONFIG_GRKERNSEC_HIDESYM
76759+ NULL,
76760+#else
76761+ sp,
76762+#endif
76763+ atomic_read_unchecked(&sp->sk_drops), len);
76764 }
76765
76766 int udp4_seq_show(struct seq_file *seq, void *v)
76767diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
76768index 12368c5..fbf899f 100644
76769--- a/net/ipv6/addrconf.c
76770+++ b/net/ipv6/addrconf.c
76771@@ -2083,7 +2083,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
76772 p.iph.ihl = 5;
76773 p.iph.protocol = IPPROTO_IPV6;
76774 p.iph.ttl = 64;
76775- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
76776+ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
76777
76778 if (ops->ndo_do_ioctl) {
76779 mm_segment_t oldfs = get_fs();
76780diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
76781index 8a58e8c..8b5e631 100644
76782--- a/net/ipv6/inet6_connection_sock.c
76783+++ b/net/ipv6/inet6_connection_sock.c
76784@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
76785 #ifdef CONFIG_XFRM
76786 {
76787 struct rt6_info *rt = (struct rt6_info *)dst;
76788- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76789+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76790 }
76791 #endif
76792 }
76793@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
76794 #ifdef CONFIG_XFRM
76795 if (dst) {
76796 struct rt6_info *rt = (struct rt6_info *)dst;
76797- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76798+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76799 __sk_dst_reset(sk);
76800 dst = NULL;
76801 }
76802diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
76803index 2fbda5f..26ed683 100644
76804--- a/net/ipv6/ipv6_sockglue.c
76805+++ b/net/ipv6/ipv6_sockglue.c
76806@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
76807 int val, valbool;
76808 int retv = -ENOPROTOOPT;
76809
76810+ pax_track_stack();
76811+
76812 if (optval == NULL)
76813 val=0;
76814 else {
76815@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
76816 int len;
76817 int val;
76818
76819+ pax_track_stack();
76820+
76821 if (ip6_mroute_opt(optname))
76822 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76823
76824@@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
76825 if (sk->sk_type != SOCK_STREAM)
76826 return -ENOPROTOOPT;
76827
76828- msg.msg_control = optval;
76829+ msg.msg_control = (void __force_kernel *)optval;
76830 msg.msg_controllen = len;
76831 msg.msg_flags = flags;
76832
76833diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
76834index 343852e..c92bd15 100644
76835--- a/net/ipv6/raw.c
76836+++ b/net/ipv6/raw.c
76837@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
76838 {
76839 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
76840 skb_checksum_complete(skb)) {
76841- atomic_inc(&sk->sk_drops);
76842+ atomic_inc_unchecked(&sk->sk_drops);
76843 kfree_skb(skb);
76844 return NET_RX_DROP;
76845 }
76846@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76847 struct raw6_sock *rp = raw6_sk(sk);
76848
76849 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76850- atomic_inc(&sk->sk_drops);
76851+ atomic_inc_unchecked(&sk->sk_drops);
76852 kfree_skb(skb);
76853 return NET_RX_DROP;
76854 }
76855@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76856
76857 if (inet->hdrincl) {
76858 if (skb_checksum_complete(skb)) {
76859- atomic_inc(&sk->sk_drops);
76860+ atomic_inc_unchecked(&sk->sk_drops);
76861 kfree_skb(skb);
76862 return NET_RX_DROP;
76863 }
76864@@ -601,7 +601,7 @@ out:
76865 return err;
76866 }
76867
76868-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76869+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76870 struct flowi6 *fl6, struct dst_entry **dstp,
76871 unsigned int flags)
76872 {
76873@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
76874 u16 proto;
76875 int err;
76876
76877+ pax_track_stack();
76878+
76879 /* Rough check on arithmetic overflow,
76880 better check is made in ip6_append_data().
76881 */
76882@@ -909,12 +911,15 @@ do_confirm:
76883 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76884 char __user *optval, int optlen)
76885 {
76886+ struct icmp6_filter filter;
76887+
76888 switch (optname) {
76889 case ICMPV6_FILTER:
76890 if (optlen > sizeof(struct icmp6_filter))
76891 optlen = sizeof(struct icmp6_filter);
76892- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76893+ if (copy_from_user(&filter, optval, optlen))
76894 return -EFAULT;
76895+ raw6_sk(sk)->filter = filter;
76896 return 0;
76897 default:
76898 return -ENOPROTOOPT;
76899@@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76900 char __user *optval, int __user *optlen)
76901 {
76902 int len;
76903+ struct icmp6_filter filter;
76904
76905 switch (optname) {
76906 case ICMPV6_FILTER:
76907@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76908 len = sizeof(struct icmp6_filter);
76909 if (put_user(len, optlen))
76910 return -EFAULT;
76911- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76912+ filter = raw6_sk(sk)->filter;
76913+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
76914 return -EFAULT;
76915 return 0;
76916 default:
76917@@ -1245,7 +1252,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
76918 0, 0L, 0,
76919 sock_i_uid(sp), 0,
76920 sock_i_ino(sp),
76921- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76922+ atomic_read(&sp->sk_refcnt),
76923+#ifdef CONFIG_GRKERNSEC_HIDESYM
76924+ NULL,
76925+#else
76926+ sp,
76927+#endif
76928+ atomic_read_unchecked(&sp->sk_drops));
76929 }
76930
76931 static int raw6_seq_show(struct seq_file *seq, void *v)
76932diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
76933index 7b8fc57..c6185da 100644
76934--- a/net/ipv6/tcp_ipv6.c
76935+++ b/net/ipv6/tcp_ipv6.c
76936@@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
76937 }
76938 #endif
76939
76940+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76941+extern int grsec_enable_blackhole;
76942+#endif
76943+
76944 static void tcp_v6_hash(struct sock *sk)
76945 {
76946 if (sk->sk_state != TCP_CLOSE) {
76947@@ -1647,6 +1651,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
76948 return 0;
76949
76950 reset:
76951+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76952+ if (!grsec_enable_blackhole)
76953+#endif
76954 tcp_v6_send_reset(sk, skb);
76955 discard:
76956 if (opt_skb)
76957@@ -1726,12 +1733,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
76958 TCP_SKB_CB(skb)->sacked = 0;
76959
76960 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76961- if (!sk)
76962+ if (!sk) {
76963+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76964+ ret = 1;
76965+#endif
76966 goto no_tcp_socket;
76967+ }
76968
76969 process:
76970- if (sk->sk_state == TCP_TIME_WAIT)
76971+ if (sk->sk_state == TCP_TIME_WAIT) {
76972+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76973+ ret = 2;
76974+#endif
76975 goto do_time_wait;
76976+ }
76977
76978 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76979 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76980@@ -1779,6 +1794,10 @@ no_tcp_socket:
76981 bad_packet:
76982 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76983 } else {
76984+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76985+ if (!grsec_enable_blackhole || (ret == 1 &&
76986+ (skb->dev->flags & IFF_LOOPBACK)))
76987+#endif
76988 tcp_v6_send_reset(NULL, skb);
76989 }
76990
76991@@ -2039,7 +2058,13 @@ static void get_openreq6(struct seq_file *seq,
76992 uid,
76993 0, /* non standard timer */
76994 0, /* open_requests have no inode */
76995- 0, req);
76996+ 0,
76997+#ifdef CONFIG_GRKERNSEC_HIDESYM
76998+ NULL
76999+#else
77000+ req
77001+#endif
77002+ );
77003 }
77004
77005 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77006@@ -2089,7 +2114,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77007 sock_i_uid(sp),
77008 icsk->icsk_probes_out,
77009 sock_i_ino(sp),
77010- atomic_read(&sp->sk_refcnt), sp,
77011+ atomic_read(&sp->sk_refcnt),
77012+#ifdef CONFIG_GRKERNSEC_HIDESYM
77013+ NULL,
77014+#else
77015+ sp,
77016+#endif
77017 jiffies_to_clock_t(icsk->icsk_rto),
77018 jiffies_to_clock_t(icsk->icsk_ack.ato),
77019 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
77020@@ -2124,7 +2154,13 @@ static void get_timewait6_sock(struct seq_file *seq,
77021 dest->s6_addr32[2], dest->s6_addr32[3], destp,
77022 tw->tw_substate, 0, 0,
77023 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
77024- atomic_read(&tw->tw_refcnt), tw);
77025+ atomic_read(&tw->tw_refcnt),
77026+#ifdef CONFIG_GRKERNSEC_HIDESYM
77027+ NULL
77028+#else
77029+ tw
77030+#endif
77031+ );
77032 }
77033
77034 static int tcp6_seq_show(struct seq_file *seq, void *v)
77035diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
77036index bb95e8e..ae0ee80 100644
77037--- a/net/ipv6/udp.c
77038+++ b/net/ipv6/udp.c
77039@@ -50,6 +50,10 @@
77040 #include <linux/seq_file.h>
77041 #include "udp_impl.h"
77042
77043+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77044+extern int grsec_enable_blackhole;
77045+#endif
77046+
77047 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
77048 {
77049 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
77050@@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
77051
77052 return 0;
77053 drop:
77054- atomic_inc(&sk->sk_drops);
77055+ atomic_inc_unchecked(&sk->sk_drops);
77056 drop_no_sk_drops_inc:
77057 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
77058 kfree_skb(skb);
77059@@ -624,7 +628,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
77060 continue;
77061 }
77062 drop:
77063- atomic_inc(&sk->sk_drops);
77064+ atomic_inc_unchecked(&sk->sk_drops);
77065 UDP6_INC_STATS_BH(sock_net(sk),
77066 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
77067 UDP6_INC_STATS_BH(sock_net(sk),
77068@@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
77069 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
77070 proto == IPPROTO_UDPLITE);
77071
77072+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77073+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
77074+#endif
77075 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
77076
77077 kfree_skb(skb);
77078@@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
77079 if (!sock_owned_by_user(sk))
77080 udpv6_queue_rcv_skb(sk, skb);
77081 else if (sk_add_backlog(sk, skb)) {
77082- atomic_inc(&sk->sk_drops);
77083+ atomic_inc_unchecked(&sk->sk_drops);
77084 bh_unlock_sock(sk);
77085 sock_put(sk);
77086 goto discard;
77087@@ -1406,8 +1413,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
77088 0, 0L, 0,
77089 sock_i_uid(sp), 0,
77090 sock_i_ino(sp),
77091- atomic_read(&sp->sk_refcnt), sp,
77092- atomic_read(&sp->sk_drops));
77093+ atomic_read(&sp->sk_refcnt),
77094+#ifdef CONFIG_GRKERNSEC_HIDESYM
77095+ NULL,
77096+#else
77097+ sp,
77098+#endif
77099+ atomic_read_unchecked(&sp->sk_drops));
77100 }
77101
77102 int udp6_seq_show(struct seq_file *seq, void *v)
77103diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
77104index b3cc8b3..baa02d0 100644
77105--- a/net/irda/ircomm/ircomm_tty.c
77106+++ b/net/irda/ircomm/ircomm_tty.c
77107@@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77108 add_wait_queue(&self->open_wait, &wait);
77109
77110 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
77111- __FILE__,__LINE__, tty->driver->name, self->open_count );
77112+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77113
77114 /* As far as I can see, we protect open_count - Jean II */
77115 spin_lock_irqsave(&self->spinlock, flags);
77116 if (!tty_hung_up_p(filp)) {
77117 extra_count = 1;
77118- self->open_count--;
77119+ local_dec(&self->open_count);
77120 }
77121 spin_unlock_irqrestore(&self->spinlock, flags);
77122- self->blocked_open++;
77123+ local_inc(&self->blocked_open);
77124
77125 while (1) {
77126 if (tty->termios->c_cflag & CBAUD) {
77127@@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77128 }
77129
77130 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77131- __FILE__,__LINE__, tty->driver->name, self->open_count );
77132+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77133
77134 schedule();
77135 }
77136@@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77137 if (extra_count) {
77138 /* ++ is not atomic, so this should be protected - Jean II */
77139 spin_lock_irqsave(&self->spinlock, flags);
77140- self->open_count++;
77141+ local_inc(&self->open_count);
77142 spin_unlock_irqrestore(&self->spinlock, flags);
77143 }
77144- self->blocked_open--;
77145+ local_dec(&self->blocked_open);
77146
77147 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77148- __FILE__,__LINE__, tty->driver->name, self->open_count);
77149+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77150
77151 if (!retval)
77152 self->flags |= ASYNC_NORMAL_ACTIVE;
77153@@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
77154 }
77155 /* ++ is not atomic, so this should be protected - Jean II */
77156 spin_lock_irqsave(&self->spinlock, flags);
77157- self->open_count++;
77158+ local_inc(&self->open_count);
77159
77160 tty->driver_data = self;
77161 self->tty = tty;
77162 spin_unlock_irqrestore(&self->spinlock, flags);
77163
77164 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77165- self->line, self->open_count);
77166+ self->line, local_read(&self->open_count));
77167
77168 /* Not really used by us, but lets do it anyway */
77169 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77170@@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77171 return;
77172 }
77173
77174- if ((tty->count == 1) && (self->open_count != 1)) {
77175+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77176 /*
77177 * Uh, oh. tty->count is 1, which means that the tty
77178 * structure will be freed. state->count should always
77179@@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77180 */
77181 IRDA_DEBUG(0, "%s(), bad serial port count; "
77182 "tty->count is 1, state->count is %d\n", __func__ ,
77183- self->open_count);
77184- self->open_count = 1;
77185+ local_read(&self->open_count));
77186+ local_set(&self->open_count, 1);
77187 }
77188
77189- if (--self->open_count < 0) {
77190+ if (local_dec_return(&self->open_count) < 0) {
77191 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77192- __func__, self->line, self->open_count);
77193- self->open_count = 0;
77194+ __func__, self->line, local_read(&self->open_count));
77195+ local_set(&self->open_count, 0);
77196 }
77197- if (self->open_count) {
77198+ if (local_read(&self->open_count)) {
77199 spin_unlock_irqrestore(&self->spinlock, flags);
77200
77201 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77202@@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77203 tty->closing = 0;
77204 self->tty = NULL;
77205
77206- if (self->blocked_open) {
77207+ if (local_read(&self->blocked_open)) {
77208 if (self->close_delay)
77209 schedule_timeout_interruptible(self->close_delay);
77210 wake_up_interruptible(&self->open_wait);
77211@@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
77212 spin_lock_irqsave(&self->spinlock, flags);
77213 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77214 self->tty = NULL;
77215- self->open_count = 0;
77216+ local_set(&self->open_count, 0);
77217 spin_unlock_irqrestore(&self->spinlock, flags);
77218
77219 wake_up_interruptible(&self->open_wait);
77220@@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
77221 seq_putc(m, '\n');
77222
77223 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77224- seq_printf(m, "Open count: %d\n", self->open_count);
77225+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77226 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77227 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77228
77229diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
77230index e2013e4..edfc1e3 100644
77231--- a/net/iucv/af_iucv.c
77232+++ b/net/iucv/af_iucv.c
77233@@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct sock *sk)
77234
77235 write_lock_bh(&iucv_sk_list.lock);
77236
77237- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77238+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77239 while (__iucv_get_sock_by_name(name)) {
77240 sprintf(name, "%08x",
77241- atomic_inc_return(&iucv_sk_list.autobind_name));
77242+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77243 }
77244
77245 write_unlock_bh(&iucv_sk_list.lock);
77246diff --git a/net/key/af_key.c b/net/key/af_key.c
77247index 1e733e9..c84de2f 100644
77248--- a/net/key/af_key.c
77249+++ b/net/key/af_key.c
77250@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
77251 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77252 struct xfrm_kmaddress k;
77253
77254+ pax_track_stack();
77255+
77256 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77257 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77258 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77259@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
77260 static u32 get_acqseq(void)
77261 {
77262 u32 res;
77263- static atomic_t acqseq;
77264+ static atomic_unchecked_t acqseq;
77265
77266 do {
77267- res = atomic_inc_return(&acqseq);
77268+ res = atomic_inc_return_unchecked(&acqseq);
77269 } while (!res);
77270 return res;
77271 }
77272diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
77273index 956b7e4..f01d328 100644
77274--- a/net/lapb/lapb_iface.c
77275+++ b/net/lapb/lapb_iface.c
77276@@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
77277 goto out;
77278
77279 lapb->dev = dev;
77280- lapb->callbacks = *callbacks;
77281+ lapb->callbacks = callbacks;
77282
77283 __lapb_insert_cb(lapb);
77284
77285@@ -380,32 +380,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
77286
77287 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
77288 {
77289- if (lapb->callbacks.connect_confirmation)
77290- lapb->callbacks.connect_confirmation(lapb->dev, reason);
77291+ if (lapb->callbacks->connect_confirmation)
77292+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
77293 }
77294
77295 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
77296 {
77297- if (lapb->callbacks.connect_indication)
77298- lapb->callbacks.connect_indication(lapb->dev, reason);
77299+ if (lapb->callbacks->connect_indication)
77300+ lapb->callbacks->connect_indication(lapb->dev, reason);
77301 }
77302
77303 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
77304 {
77305- if (lapb->callbacks.disconnect_confirmation)
77306- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
77307+ if (lapb->callbacks->disconnect_confirmation)
77308+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
77309 }
77310
77311 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
77312 {
77313- if (lapb->callbacks.disconnect_indication)
77314- lapb->callbacks.disconnect_indication(lapb->dev, reason);
77315+ if (lapb->callbacks->disconnect_indication)
77316+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
77317 }
77318
77319 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
77320 {
77321- if (lapb->callbacks.data_indication)
77322- return lapb->callbacks.data_indication(lapb->dev, skb);
77323+ if (lapb->callbacks->data_indication)
77324+ return lapb->callbacks->data_indication(lapb->dev, skb);
77325
77326 kfree_skb(skb);
77327 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
77328@@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
77329 {
77330 int used = 0;
77331
77332- if (lapb->callbacks.data_transmit) {
77333- lapb->callbacks.data_transmit(lapb->dev, skb);
77334+ if (lapb->callbacks->data_transmit) {
77335+ lapb->callbacks->data_transmit(lapb->dev, skb);
77336 used = 1;
77337 }
77338
77339diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
77340index a01d213..6a1f1ab 100644
77341--- a/net/mac80211/debugfs_sta.c
77342+++ b/net/mac80211/debugfs_sta.c
77343@@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
77344 struct tid_ampdu_rx *tid_rx;
77345 struct tid_ampdu_tx *tid_tx;
77346
77347+ pax_track_stack();
77348+
77349 rcu_read_lock();
77350
77351 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77352@@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
77353 struct sta_info *sta = file->private_data;
77354 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77355
77356+ pax_track_stack();
77357+
77358 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77359 htc->ht_supported ? "" : "not ");
77360 if (htc->ht_supported) {
77361diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
77362index 9fab144..7f0fc14 100644
77363--- a/net/mac80211/ieee80211_i.h
77364+++ b/net/mac80211/ieee80211_i.h
77365@@ -27,6 +27,7 @@
77366 #include <net/ieee80211_radiotap.h>
77367 #include <net/cfg80211.h>
77368 #include <net/mac80211.h>
77369+#include <asm/local.h>
77370 #include "key.h"
77371 #include "sta_info.h"
77372
77373@@ -754,7 +755,7 @@ struct ieee80211_local {
77374 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77375 spinlock_t queue_stop_reason_lock;
77376
77377- int open_count;
77378+ local_t open_count;
77379 int monitors, cooked_mntrs;
77380 /* number of interfaces with corresponding FIF_ flags */
77381 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77382diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
77383index 556e7e6..120dcaf 100644
77384--- a/net/mac80211/iface.c
77385+++ b/net/mac80211/iface.c
77386@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77387 break;
77388 }
77389
77390- if (local->open_count == 0) {
77391+ if (local_read(&local->open_count) == 0) {
77392 res = drv_start(local);
77393 if (res)
77394 goto err_del_bss;
77395@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77396 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77397
77398 if (!is_valid_ether_addr(dev->dev_addr)) {
77399- if (!local->open_count)
77400+ if (!local_read(&local->open_count))
77401 drv_stop(local);
77402 return -EADDRNOTAVAIL;
77403 }
77404@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77405 mutex_unlock(&local->mtx);
77406
77407 if (coming_up)
77408- local->open_count++;
77409+ local_inc(&local->open_count);
77410
77411 if (hw_reconf_flags) {
77412 ieee80211_hw_config(local, hw_reconf_flags);
77413@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77414 err_del_interface:
77415 drv_remove_interface(local, &sdata->vif);
77416 err_stop:
77417- if (!local->open_count)
77418+ if (!local_read(&local->open_count))
77419 drv_stop(local);
77420 err_del_bss:
77421 sdata->bss = NULL;
77422@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
77423 }
77424
77425 if (going_down)
77426- local->open_count--;
77427+ local_dec(&local->open_count);
77428
77429 switch (sdata->vif.type) {
77430 case NL80211_IFTYPE_AP_VLAN:
77431@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
77432
77433 ieee80211_recalc_ps(local, -1);
77434
77435- if (local->open_count == 0) {
77436+ if (local_read(&local->open_count) == 0) {
77437 if (local->ops->napi_poll)
77438 napi_disable(&local->napi);
77439 ieee80211_clear_tx_pending(local);
77440diff --git a/net/mac80211/main.c b/net/mac80211/main.c
77441index 3d90dad..36884d5 100644
77442--- a/net/mac80211/main.c
77443+++ b/net/mac80211/main.c
77444@@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
77445 local->hw.conf.power_level = power;
77446 }
77447
77448- if (changed && local->open_count) {
77449+ if (changed && local_read(&local->open_count)) {
77450 ret = drv_config(local, changed);
77451 /*
77452 * Goal:
77453diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
77454index 0f48368..d48e688 100644
77455--- a/net/mac80211/mlme.c
77456+++ b/net/mac80211/mlme.c
77457@@ -1464,6 +1464,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
77458 bool have_higher_than_11mbit = false;
77459 u16 ap_ht_cap_flags;
77460
77461+ pax_track_stack();
77462+
77463 /* AssocResp and ReassocResp have identical structure */
77464
77465 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77466diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
77467index 6326d34..7225f61 100644
77468--- a/net/mac80211/pm.c
77469+++ b/net/mac80211/pm.c
77470@@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77471 struct ieee80211_sub_if_data *sdata;
77472 struct sta_info *sta;
77473
77474- if (!local->open_count)
77475+ if (!local_read(&local->open_count))
77476 goto suspend;
77477
77478 ieee80211_scan_cancel(local);
77479@@ -72,7 +72,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77480 cancel_work_sync(&local->dynamic_ps_enable_work);
77481 del_timer_sync(&local->dynamic_ps_timer);
77482
77483- local->wowlan = wowlan && local->open_count;
77484+ local->wowlan = wowlan && local_read(&local->open_count);
77485 if (local->wowlan) {
77486 int err = drv_suspend(local, wowlan);
77487 if (err < 0) {
77488@@ -129,7 +129,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77489 }
77490
77491 /* stop hardware - this must stop RX */
77492- if (local->open_count)
77493+ if (local_read(&local->open_count))
77494 ieee80211_stop_device(local);
77495
77496 suspend:
77497diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
77498index 3d5a2cb..b17ad48 100644
77499--- a/net/mac80211/rate.c
77500+++ b/net/mac80211/rate.c
77501@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
77502
77503 ASSERT_RTNL();
77504
77505- if (local->open_count)
77506+ if (local_read(&local->open_count))
77507 return -EBUSY;
77508
77509 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77510diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
77511index 4851e9e..d860e05 100644
77512--- a/net/mac80211/rc80211_pid_debugfs.c
77513+++ b/net/mac80211/rc80211_pid_debugfs.c
77514@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
77515
77516 spin_unlock_irqrestore(&events->lock, status);
77517
77518- if (copy_to_user(buf, pb, p))
77519+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77520 return -EFAULT;
77521
77522 return p;
77523diff --git a/net/mac80211/util.c b/net/mac80211/util.c
77524index fd031e8..84fbfcf 100644
77525--- a/net/mac80211/util.c
77526+++ b/net/mac80211/util.c
77527@@ -1170,7 +1170,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
77528 drv_set_coverage_class(local, hw->wiphy->coverage_class);
77529
77530 /* everything else happens only if HW was up & running */
77531- if (!local->open_count)
77532+ if (!local_read(&local->open_count))
77533 goto wake_up;
77534
77535 /*
77536diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
77537index 32bff6d..d0cf986 100644
77538--- a/net/netfilter/Kconfig
77539+++ b/net/netfilter/Kconfig
77540@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
77541
77542 To compile it as a module, choose M here. If unsure, say N.
77543
77544+config NETFILTER_XT_MATCH_GRADM
77545+ tristate '"gradm" match support'
77546+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77547+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77548+ ---help---
77549+ The gradm match allows to match on grsecurity RBAC being enabled.
77550+ It is useful when iptables rules are applied early on bootup to
77551+ prevent connections to the machine (except from a trusted host)
77552+ while the RBAC system is disabled.
77553+
77554 config NETFILTER_XT_MATCH_HASHLIMIT
77555 tristate '"hashlimit" match support'
77556 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77557diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
77558index 1a02853..5d8c22e 100644
77559--- a/net/netfilter/Makefile
77560+++ b/net/netfilter/Makefile
77561@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
77562 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77563 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77564 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77565+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77566 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77567 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77568 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77569diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
77570index 12571fb..fb73976 100644
77571--- a/net/netfilter/ipvs/ip_vs_conn.c
77572+++ b/net/netfilter/ipvs/ip_vs_conn.c
77573@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
77574 /* Increase the refcnt counter of the dest */
77575 atomic_inc(&dest->refcnt);
77576
77577- conn_flags = atomic_read(&dest->conn_flags);
77578+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
77579 if (cp->protocol != IPPROTO_UDP)
77580 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77581 /* Bind with the destination and its corresponding transmitter */
77582@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
77583 atomic_set(&cp->refcnt, 1);
77584
77585 atomic_set(&cp->n_control, 0);
77586- atomic_set(&cp->in_pkts, 0);
77587+ atomic_set_unchecked(&cp->in_pkts, 0);
77588
77589 atomic_inc(&ipvs->conn_count);
77590 if (flags & IP_VS_CONN_F_NO_CPORT)
77591@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
77592
77593 /* Don't drop the entry if its number of incoming packets is not
77594 located in [0, 8] */
77595- i = atomic_read(&cp->in_pkts);
77596+ i = atomic_read_unchecked(&cp->in_pkts);
77597 if (i > 8 || i < 0) return 0;
77598
77599 if (!todrop_rate[i]) return 0;
77600diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
77601index 4f77bb1..5d0bc26 100644
77602--- a/net/netfilter/ipvs/ip_vs_core.c
77603+++ b/net/netfilter/ipvs/ip_vs_core.c
77604@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
77605 ret = cp->packet_xmit(skb, cp, pd->pp);
77606 /* do not touch skb anymore */
77607
77608- atomic_inc(&cp->in_pkts);
77609+ atomic_inc_unchecked(&cp->in_pkts);
77610 ip_vs_conn_put(cp);
77611 return ret;
77612 }
77613@@ -1612,7 +1612,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
77614 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77615 pkts = sysctl_sync_threshold(ipvs);
77616 else
77617- pkts = atomic_add_return(1, &cp->in_pkts);
77618+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77619
77620 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
77621 cp->protocol == IPPROTO_SCTP) {
77622diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
77623index e3be48b..d658c8c 100644
77624--- a/net/netfilter/ipvs/ip_vs_ctl.c
77625+++ b/net/netfilter/ipvs/ip_vs_ctl.c
77626@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
77627 ip_vs_rs_hash(ipvs, dest);
77628 write_unlock_bh(&ipvs->rs_lock);
77629 }
77630- atomic_set(&dest->conn_flags, conn_flags);
77631+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
77632
77633 /* bind the service */
77634 if (!dest->svc) {
77635@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
77636 " %-7s %-6d %-10d %-10d\n",
77637 &dest->addr.in6,
77638 ntohs(dest->port),
77639- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77640+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77641 atomic_read(&dest->weight),
77642 atomic_read(&dest->activeconns),
77643 atomic_read(&dest->inactconns));
77644@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
77645 "%-7s %-6d %-10d %-10d\n",
77646 ntohl(dest->addr.ip),
77647 ntohs(dest->port),
77648- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77649+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77650 atomic_read(&dest->weight),
77651 atomic_read(&dest->activeconns),
77652 atomic_read(&dest->inactconns));
77653@@ -2285,6 +2285,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
77654 struct ip_vs_dest_user_kern udest;
77655 struct netns_ipvs *ipvs = net_ipvs(net);
77656
77657+ pax_track_stack();
77658+
77659 if (!capable(CAP_NET_ADMIN))
77660 return -EPERM;
77661
77662@@ -2508,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
77663
77664 entry.addr = dest->addr.ip;
77665 entry.port = dest->port;
77666- entry.conn_flags = atomic_read(&dest->conn_flags);
77667+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77668 entry.weight = atomic_read(&dest->weight);
77669 entry.u_threshold = dest->u_threshold;
77670 entry.l_threshold = dest->l_threshold;
77671@@ -3041,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
77672 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77673
77674 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77675- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77676+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77677 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77678 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77679 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77680diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
77681index 3cdd479..116afa8 100644
77682--- a/net/netfilter/ipvs/ip_vs_sync.c
77683+++ b/net/netfilter/ipvs/ip_vs_sync.c
77684@@ -649,7 +649,7 @@ control:
77685 * i.e only increment in_pkts for Templates.
77686 */
77687 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77688- int pkts = atomic_add_return(1, &cp->in_pkts);
77689+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77690
77691 if (pkts % sysctl_sync_period(ipvs) != 1)
77692 return;
77693@@ -795,7 +795,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
77694
77695 if (opt)
77696 memcpy(&cp->in_seq, opt, sizeof(*opt));
77697- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77698+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77699 cp->state = state;
77700 cp->old_state = cp->state;
77701 /*
77702diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
77703index ee319a4..8a285ee 100644
77704--- a/net/netfilter/ipvs/ip_vs_xmit.c
77705+++ b/net/netfilter/ipvs/ip_vs_xmit.c
77706@@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
77707 else
77708 rc = NF_ACCEPT;
77709 /* do not touch skb anymore */
77710- atomic_inc(&cp->in_pkts);
77711+ atomic_inc_unchecked(&cp->in_pkts);
77712 goto out;
77713 }
77714
77715@@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
77716 else
77717 rc = NF_ACCEPT;
77718 /* do not touch skb anymore */
77719- atomic_inc(&cp->in_pkts);
77720+ atomic_inc_unchecked(&cp->in_pkts);
77721 goto out;
77722 }
77723
77724diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
77725index 7dec88a..0996ce3 100644
77726--- a/net/netfilter/nf_conntrack_netlink.c
77727+++ b/net/netfilter/nf_conntrack_netlink.c
77728@@ -135,7 +135,7 @@ nla_put_failure:
77729 static inline int
77730 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
77731 {
77732- long timeout = (ct->timeout.expires - jiffies) / HZ;
77733+ long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
77734
77735 if (timeout < 0)
77736 timeout = 0;
77737@@ -1638,7 +1638,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
77738 const struct nf_conntrack_expect *exp)
77739 {
77740 struct nf_conn *master = exp->master;
77741- long timeout = (exp->timeout.expires - jiffies) / HZ;
77742+ long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
77743 struct nf_conn_help *help;
77744
77745 if (timeout < 0)
77746diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
77747index 2d8158a..5dca296 100644
77748--- a/net/netfilter/nfnetlink_log.c
77749+++ b/net/netfilter/nfnetlink_log.c
77750@@ -70,7 +70,7 @@ struct nfulnl_instance {
77751 };
77752
77753 static DEFINE_SPINLOCK(instances_lock);
77754-static atomic_t global_seq;
77755+static atomic_unchecked_t global_seq;
77756
77757 #define INSTANCE_BUCKETS 16
77758 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77759@@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_instance *inst,
77760 /* global sequence number */
77761 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77762 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77763- htonl(atomic_inc_return(&global_seq)));
77764+ htonl(atomic_inc_return_unchecked(&global_seq)));
77765
77766 if (data_len) {
77767 struct nlattr *nla;
77768diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
77769new file mode 100644
77770index 0000000..6905327
77771--- /dev/null
77772+++ b/net/netfilter/xt_gradm.c
77773@@ -0,0 +1,51 @@
77774+/*
77775+ * gradm match for netfilter
77776